1. NLB Privacy Notice
As the General Lighthouse Authority for Scotland and the Isle of Man, NLB has responsibility, subject to certain provisions, for the superintendence and management of “all lighthouses, buoys and beacons” throughout Scotland and the Isle of Man including “the adjacent seas and islands.” within and beyond territorial waters. Our head office is at 84 George Street, Edinburgh EH2 3DA.
Throughout this document we refer to Data Protection Legislation which means the Data Protection Act 2018 (DPA2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003, all the foregoing as amended from time to time, and any legislation implemented in connection with the aforementioned legislation.
NLB is the controller for the personal information we process, unless otherwise stated.
We are registered with the Information Commissioner with registration number Z5564485.
Contact details
84 George Street,
Edinburgh EH2 3DA
Tel: +44(0) 131 473 3100
E: enquiries@nlb.org.uk
We take seriously our responsibilities in respect of the protection of your privacy and confidentiality, and hope that you will reciprocate. This Privacy Policy sets out the conditions under which we may process any personal information that we collect from you, about you, or that you provide to us. It covers both information that could identify you (“personal information”) and information that could not. In the context of the law and this notice, “process” means collect, store, transfer, use or otherwise act on information. It also covers what we ask of you, to help us keep information up to date.
We use personal information for a wide range of purposes, to enable us to carry out our functions as a government department. These include:
- verifying your identity for security purposes
- maintaining our accounts and records
- selling of products to you through our website
- consideration and investigation of complaints
- answering queries, Freedom of Information Act 2000 and Environmental Information Regulations 2004 requests
- undertaking research
- provision of education or training
- provision of The Journal or online articles through social media
- property management
- corporate administration
- support and management of our staff
- licensing, enforcement, and regulatory duties
- crime prevention and prosecution of offenders
2. What is personal data?
Personal data is any information relating to an identified or identifiable natural living person, otherwise known as a ‘data subject.’ A data subject is someone who can be recognised, directly or indirectly, by information such as a name, an identification number, location data, an online identifier, or data relating to their physical, physiological, genetic, mental, economic, cultural, or social identity. These types of identifying information are known as ‘personal data’. Data protection law applies to the processing of personal data, including its collection, use and storage.
3. Your privacy
We know how important it is to protect your privacy and comply with data protection law. If we need to collect, store or otherwise use your personal information, we will:
- have a lawful basis for doing so and only ask for what we need
- do so in a fair and transparent way, letting you know why we need your information and how we will use it
- use it in the way we said we would and not in any way you wouldn’t expect without consulting you
- ensure that we do not keep personal information for more than we need, or longer than we need
- make sure it is accurate and up to date where appropriate
- make sure nobody has access to it who shouldn’t
- ensure that it is kept safe and secure
4. What allows NLB to process your personal data
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. To process personal data, we need to meet one of the following conditions (or lawful bases):
- Consent – freely given consent where it is explicit, as to what you are consenting to and clear how you can withdraw your consent. Sometimes however you might give your consent implicitly, such as when you send us a message by e-mail to which you would expect us to reply. All of your data protection rights may apply, except the right to object. You do have the right to withdraw your consent at any time.
- Contract – processing is necessary for a contract you have entered or intend to enter into. All of your data protection rights may apply except the right to object.
- Legal obligation – processing is necessary to meet a Legal obligation (such as collecting income tax). All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
- Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. All of your data protection rights may apply, except the right to object and the right to portability.
- Public task – processing is necessary in respect of the exercise of our official authority Under Section 193 of the Merchant Shipping Act 1995 or to exercise powers set out in law. All of your data protection rights may apply, except the right to erasure and the right to portability.
- Legitimate interests – The processing of other data not directly associated with the functions of the NLB but needed to enable to function within its obligations under wider legislation and its’ Duty of Care’ responsibilities. It also applies within NLB for such areas as managing the subscription list for the Journal. All of your data protection rights may apply, except the right to portability.
- Recognised legitimate interests – NLB may rely on RLI where processing is necessary for purpose such as prevention, investigation, detection of crime, safeguarding or public security.
There are further requirements for processing more sensitive, or ‘special category’, personal data.
The lawful basis that we rely on to process your personal data will determine which rights are available to you. Much of the processing we do in NLB will be necessary to perform our duties under our public task or to meet our legal obligations. If we hold personal data about for different purposes, then the legal basis we rely on in each case may not be the same.
5. Your rights over your information
The UK General Data Protection Regulation (UK GDPR) sets out a number of rights which individuals have over their personal data, allowing you to request copies of your personal data or, in certain circumstances, to have it deleted or modified. NLB will ensure that we uphold your rights to the extent that they apply to the way in which we process your personal data. Below we have explained those rights that are most likely to be relevant to the ways in which NLB, as a public authority, process personal data.
You have the right to be informed about the collection and use of your personal data. We ensure we do this by providing you with this Privacy Notice. This Notice is regularly reviewed and updated to ensure it accurately reflects our data processing activities.
Please note, NLB does not undertake any Automated Decision Making (ADM) that requires disclosure in line with UK Algorithmic Transparency Recording Standard (ATRS) requirements as required by the UK Cabinet Office.
You can request copies of the personal data that we hold about you in many circumstances, by making a written subject access request (SAR). Before we can act on your request, you may need to supply proof of your identity. Please be as specific as you can about the information you want and, if it isn’t obvious, explain why you expect us to hold your personal data.
If we agree that we are obliged to provide personal information to you (or someone else on your behalf), we will provide it to you or them free of charge and we will respond without delay and within one calendar month of receipt of your request; but may take up to 2 months in the case of complex and/or numerous requests. We will let you know when you can expect to receive a response, or if we will be unable to provide you with one. We will advise you of your right to complain to the Information Commission or to seek a judicial remedy.
We may ask for proof of identity and sufficient information about your interactions with us so that we can locate your personal information. Please note that the time limit for fulfilling your request does not start until we have been able to verify your identity.
If you would like to exercise this right, please email enquiries@nlb.org.uk
Staff or former staff should email HRConfidential@nlb.org.uk
You have the right to object to us processing your personal information for particular purposes, to have your information deleted if we are keeping it too long, or have its processing restricted in certain circumstances.
If you would like to exercise this right, please contact us as set out below.
Your personal data will not be shared with organisations other than Police and /or Security Services where the information is required by law, and with National Records Scotland where much of our archive material is stored. In such circumstances, the appropriate lawful basis under Article 6 of the UK GDPR will be defined.
Other rights you may have are a right to rectification if your personal data is inaccurate, a right to erasure, a right to restrict processing, a right to data portability, and rights in relation to automated decision making.
Whilst these rights are unlikely to apply to the kind of processing that NLB routinely carries out. Any request you make to us to exercise these rights will receive appropriate consideration, within the timescales required by data protection law.
The Information Commission (IC) regulates data protection and privacy matters in the UK. They make a lot of information accessible to consumers on their website, and they ensure that the registered details of all data controllers such as us are available publicly. You can access them here https://ico.org.uk/for-the-public.
6. Children’s information
In the normal course of our work, we do not routinely process data in respect of children. We don’t provide or plan to provide services directly to children, or to proactively collect their personal information.
Children may visit NLB premises under the control of parents, guardians or teachers for special events such as Open Doors, Carol Services and Christmas Parties, or for educational purposes through work experience programmes or our outreach Programme. NLB staff may also visit schools under the outreach programme. Photographs are often taken at these events and subsequently used on the lawful basis of legitimate interests.
For outreach events, a Privacy Statement will be provided to the school. As long as the school has agreed, and the children and/or their guardians are made aware by the schools that photographs of those attending the events may appear in one of our publications, this will not breach current UK legislation. Where a school raises any objections, photographs are not taken.
Where data is collected in relation to a schools competition, the Terms & Conditions will make clear that photos and videos may be taken of some or all of the children involved and explain the context in which the images will be used. The schools involved are required to ensure that parents are also made aware.
Images recorded at special events may be used for journalistic purposes within NLB publications such as the Journal, on our website or our social media platforms fairly and lawfully without causing unwarranted harm or intrusion to the data subjects. When we publish images of children as part of an article, we won’t include personal details such as names unless explicit Consent has been given by a parent or a guardian. These images are processed under our legitimate interest of providing information and education on the role of the NLB.
Personal Data and Risk Assessment documentation in relation to work experience activities are stored within HR and governed by normal HR rules. Privacy Statements are provided to the school or parent/guardian depending on the circumstances of set up of the work experience.
The policy is designed to ensure that the responsible adults are aware that photos and videos are being taken and the context in which the images may be used.
7. Visitors
We only collect personal information that we know will genuinely use and in accordance with the Data Protection Legislation. The type of personal information that we will collect and process about you, may include the following:
- names
- contact details provided
- host name
- visitor’s organisation
- visits (date & time)
- static photographic images
- moving imagery via CCTV or other video devices
- vehicle details (if applicable
8. How do we use your data
We use personal information for a wide range of purposes, to enable us to carry out our functions as a government Arm’s Length Body (ALB) of a department. These include:
- verifying your identity for security purposes
- maintaining our accounts and records
- selling of products to you through our website
- consideration and investigation of complaints
- answering queries, including Freedom of Information Act 2000 and Environmental Information Regulations 2004 requests
- undertaking research
- provision of education or training
- provision of The Journal or on-line articles through social media
- property management
- corporate administration
- support and management of our staff
- licensing, enforcement and regulatory duties
- crime prevention and prosecution of offenders
9. When we share information
We may share your personal data within our organisation or with other bodies where we are permitted to do so by law. There are some cases where we can pass on your data without telling you – for example, to prevent or detect crime, or in order to produce anonymised statistics. In all cases, whether data is shared internally or externally, we will be governed by data protection law.
We use data processors who are third parties to provide elements of services for us. We have Data Processing Agreements in place with our data processors. This means that they are only able to process your personal information under our strict instructions. They may only share your personal information with other organisations apart from us if we have provided them with prior written consent for this sharing. In addition, these other organisations must comply with our Data Processing Agreement. They will hold your personal data securely and retain it for the period we instruct.
A small proportion of our records are transferred to The National Records Scotland, in line with legal obligations for the collection, disposal and preservation of records in the public interest.
10. International Transfers
Most of our data is stored on servers within the UK. Where necessary, we will transfer personal information outside of the UK, either directly or through certain data processors. Every time we arrange for restricted (international) transfers of personal data outside of the UK we will ensure that appropriate safeguards are in place.
11. Distribution lists
NLB maintains a number of distribution lists to communicate with its stakeholders. In most cases this is to enable us to function efficiently as an ALB of a government department. In some cases, where the use of a distribution list does not relate to the performance of our tasks, we may use it as necessary for our legitimate interests. In such cases, we have had regard to the rights and freedoms of those whose names are included on the list. Each list will be used only for the purpose that the individuals on the list were informed about at the time their information was collected by us.
12. CCTV
Closed-circuit television (CCTV) operates outside the building for security purposes of ensuring the integrity and safety of staff, visitors, and of buildings, contents and the facilities within them.
Please see our CCTV Policy 2026
13. Filming and Photography
Video and photographic records may be made, particularly at special events and used for journalistic purposes within NLB publications such as The Journal, and on our website fairly and lawfully without causing unwarranted harm or intrusion to the data subjects. These are processed under our legitimate interest of providing information and education on the role of the NLB.
NLB uses film and photographs to illustrate the work that we do, to support and promote policy in the public interest. We film individuals in non-intrusive ways where possible. If you have any concerns about appearing in any footage, please speak to a member of the film crew at the time or contact enquiries@nlb.org.uk.
We also take photographs to illustrate our work in our official publications and on our social media channels. We aim to avoid using images which could identify members of the public. If you are concerned about an image of you that we have used in one of our publications, contact us at enquiries@nlb.org.uk.
14. Privacy by design
Where we introduce new technologies, policies or processes, we will ensure that your privacy is considered from the outset, and where beneficial will carry out a Data Protection Impact Assessment (DPIA).
We will always carry out a DPIA where we use new technologies or consider there is a high risk to your rights and freedoms. Where an assessment identifies risks that cannot be satisfactorily reduced or avoided, our Data Protection Officer will seek advice from the Information Commissioner to help us find the best solution.
15. The steps we take to keep your data secure
We take information security seriously and will protect your personal data from unauthorised access, accidental loss, destruction and damage. We carry out regular reviews and audits to ensure that our methods of collecting, holding and processing personal data meet the government’s security standards and industry good practice. We will only transfer your personal data overseas where appropriate safeguards are in place to protect it. The cross-government security policy framework sets out the government’s approach to protective security.
16. The training and guidance we give to our staff
All of our staff are trained in the importance of protecting personal and other sensitive information. In line with government policy all those who routinely access personal data as part of their jobs are expected to undertake more in-depth training.
Managers who have formal responsibilities for large datasets, for example as information asset owners, will also receive additional training so that they have a clear understanding of what they need to do to keep the data under their control safe and secure.
17. Data breach notification
NLB does everything it can to keep your personal data secure. But if, despite this, a breach occurs which creates a risk to your rights and freedoms (for example, financial loss, breach of confidentiality, discrimination, reputational damage, or other significant social or economic damage), we will ensure that the Information Commission is informed without delay, and in any event within 72 hours after we have become aware of it.
Where we assess that there is a high risk to you, we will ensure that you are notified without undue delay.
18. How to make a complaint
If you are unhappy with the content of this notice, have any concerns about our use of your personal data, you can make a complaint to NLB using the contact details:
Director of Business Services
Northern Lighthouse Board
84 George Street
Edinburgh EH2 3DA
E: enquiries@nlb.org.uk
If your complaint means we need to contact another person, we may decide to give some of the information in your complaint to that other person. We do this as infrequently as possible, but it is ultimately our decision as to whether we give the information, and if we do, what that information is.
We aim to respond to complaints within NLB Corporate response times wherever possible, as listed in Complaints section of this website. If it is not possible to give you a full reply within this time (for example, if your complaint requires more detailed investigation), we will tell you what is being done and when you can expect a full response.
If following the complaint resolution by NLB you remain unhappy with how we have used your data after raising complaint with us, you can also complain to the IC.
The IC’s address:
Information Commission
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
19. How to contact us
If you would like to exercise any of your rights as set out above, or have a question or a complaint about this policy, the way your personal information is processed, please contact us by one of the following means:
Data Protection Officer
Northern Lighthouse Board
84 George Street,
Edinburgh EH2 3DA
Tel: +44(0) 131 473 3100
E: enquiries@nlb.org.uk
20. Changes to this privacy notice
We may change this Privacy Notice from time to time (for example if the law changes).