Biodiversity Audit Project and Farm Biodiversity Scotland App - Privacy Statement
The Farm Biodiversity Scotland tool (mobile app and web platform) ("FarmBioScot") is owned by NatureScot. It has been developed under the Biodiversity Audit project (“the Project”) to test how a digital tool could encourage and help farmers and crofters to manage and monitor their contributions to biodiversity on their farms and crofts, and align with and signpost to appropriate management measures under the future rural support framework being taken forward through the Scottish Government Agricultural Reform Programme. NatureScot contracts a company called Lumoscript for support and maintenance of FarmBioScot. There is a Data Processing Agreement between NatureScot and Lumoscript that ensures personal and private data is subject to UK General Data Protection Regulation (UK GDPR) rules and only used for the purposes of the Biodiversity Audit project. NatureScot piloted FarmBioScot in 2024 and are carrying out a second phase of testing of this Beta product in 2025.
1. What information do we collect about you, and why?
Information | Why? |
|---|---|
| Your name and email address | To communicate with you and create an account in the app |
| Farm name and Business Reference Number (BRN) / Location Codes (LCs) | For NatureScot to retrieve your land parcel boundaries from Rural Payments & Inspections Division (RPID) from LPIS (Land Parcel Identification System) for FarmBioScot |
| Name and email of Responsible Person or Business Representative in Rural Payments and Services (RP&S) | For NatureScot to check in RP&S that you have a mandate to act for the business by either being the Responsible Person named within RP&S or that the Responsible Person agrees to you acting on their behalf |
| Land Parcel Identification (LPID) numbers and polygons | To create your farm map in FarmBioScot |
| IP address | For Lumoscript to maintain system security and to troubleshoot technical issues |
| Questionnaires and survey data | To receive and analyse feedback to help future design and development |
Farmer/crofter and farm information (farmer/crofter; owner/tenant; farm type) | For NatureScot to be able to analyse the range of users during the 2025 testing phase |
2. What do we do with that information, and why?
Note: Information may also be shared with Scottish Government, with whom NatureScot are working on the Project.
Information | Sharing? | Why shared? |
|---|---|---|
| Your name and email address | NatureScot shares with Lumoscript | To create an account in FarmBioScot |
| Farm name and Business Reference Number (BRN) / Location Codes (LCs) | NatureScot shares with Lumoscript | For NatureScot to retrieve your land parcel boundaries from Rural Payments & Inspections Division (RPID) from LPIS (Land Parcel Identification System) for FarmBioScot |
| Name and email of Responsible Person or Business Representative in Rural Payments and Services (RP&S) | Not shared | - |
| Land Parcel Identification (LPID) numbers and polygons | Rural Payments & Inspections Division (RPID) shares with NatureScot | - |
| IP address | Not shared | - |
| Questionnaires and survey data | NatureScot can share anonymised results with third parties | To demonstrate how the aims of the Project are being delivered |
| Farmer/crofter and farm information (farmer/crofter; owner/tenant; farm type) | NatureScot can share anonymised aggregated results with third parties | To report on engagement |
3. How long may we keep your personal information for?
NatureScot will retain your personal information and the data collected for as long as the Biodiversity Audit Project is operational.
4. How are we keeping the data secure?
NatureScot aims to protect your personal information through a system of organisational and technical security measures. Lumoscript will ensure that:
- all Land Parcel Identification, Farm, and Business data provided is transferred in a secure manner, encrypted in transit and only used for the purposes of FarmBioScot.
- all personal individual contact data is only used for the purposes of FarmBioScot.
- data is stored securely within the platform which has been penetration tested and meets the criteria specified within the National Cyber Security Centre 14 Cloud Security Principles assessment.
- the data supporting the platform is stored in a secure manner with the required safety tests carried out and is processed and stored in an accurate and reliable manner. This means that data will be recorded as provided by users, without alteration, ensuring the integrity of habitat details, biodiversity conditions, and field boundaries. Once entered into the system, safeguards will be in place to prevent loss, corruption, or unauthorised modification of data. Regular backups will be maintained to ensure data can be restored in the event of system failure or data loss. Data accuracy is maintained through secure storage practices, periodic system reviews, and compliance with relevant data protection and environmental monitoring standards.
- all NatureScot laptops are managed via MS Intune and are encrypted on successful enrolment. Users require a Corporate account and a valid username and password to access the laptop and network resources.
- Role-based access control are implemented to ensure staff have the correct levels of access to the data.
Dedicated user accounts are created for each participant with their email. Farmers/crofters can only access their own farm/croft details and cannot view any other farm or croft unless they have been added as a Farm Team member to another farm or croft. Farmers/crofters have the ability to add additional Farm Team members to their account.
The database that houses the results of assessments, user data and user authentication is currently hosted in Google Firebase in the UK.
5. What other information do we collect and share?
Information | Sharing? | Why shared? |
|---|---|---|
| Habitats and features | NatureScot can share with Scottish Government who will upload the data into the LPIS Habitat Layers once the farmer/crofter has confirmed completion. | For you to be able to view your habitat data alongside the other data for your farm within LPIS, and to count towards your Whole Farm Plan requirements |
| Habitats and features, and habitat condition assessments | NatureScot can share anonymised data with third parties | Analysis of anonymised results may be shared with interested third parties to inform biodiversity and agricultural policy development |
| Photos of habitats | NatureScot can share selected photos with third parties. | Selected photos may be used e.g. through social media or Project reports, in order to promote or demonstrate how the aims of the project are being delivered and the lessons being learned or for illustrations within FarmBioScot |
| Photos of farmers and crofters | NatureScot can share photos of farmers and crofters using FarmBioScot or attending associated events, only with their specific permission | Selected photos may be used e.g. through social media or Project reports, in order to promote or demonstrate how the aims of the Project are being delivered |
6. My privacy and technology?
Please see Appendix for further information on Application data and information collected if you use the Farm Biodiversity Scotland mobile app or website.
7. What are your rights?
You have the right to know what information we hold about you and you have the right to ask us for copies of this information. You also have the right to ask us to rectify inaccurate data about you. You also have the right to ask us to stop processing your data until corrections are made or when you have concerns about our use of your data. You have the right to appeal to the UK Information Commissioner (https://ico.org.uk/) if you are not happy with our response following a request to access your information or for rectification of inaccuracies. For further details see your personal data rights.
NatureScot is a Scottish Public Authority and is subject to the provisions of the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004. We are therefore obliged to consider the release of any information held by us in response to a request. In providing any response to a request, we will fully consider our obligations under data protection legislation.
8. How can you contact us?
Please contact NatureScot’s Data Protection Officer (DPO) if you want to discuss any data related issues. The DPO can be contacted at: DPO@nature.scot Battleby, Redgorton, Perth, PH1 3EW, 01738 444177.
For any other Project related query, please email biodiversity.audit@nature.scot.
Appendix - Further information on your privacy in relation to the mobile app and the website
Mobile Application Data
If you use our mobile application, we also may collect the following information if you choose to provide us with access or permission:
- Geolocation Information. We may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services. If you wish to change our access or permissions, you may do so in your device's settings.
- Mobile Device Access. We may request access or permission to certain features from your mobile device, including your mobile device's calendar, camera, reminders, and other features. If you wish to change our access or permissions, you may do so in your device's settings.
- Mobile Device Data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model, Internet service provider and/or mobile carrier, and Internet Protocol (IP) address (or proxy server). If you are using our application(s), we may also collect information about the phone network associated with your mobile device, your mobile device’s operating system or platform, the type of mobile device you use, your mobile device’s unique device ID, and information about the features of our application(s) you accessed.
- Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.
- This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes and not shared with third parties.
Information automatically collected
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit FarmBioScot.
We automatically collect certain information when you visit, use, or navigate FarmBioScot. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use FarmBioScot, and other technical information. This information is primarily needed to maintain the security and operation of FarmBioScot, and for our internal analytics and reporting purposes.
We also collect information through cookies and similar technologies for analytical purposes only.
The information we collect includes:
- Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use FarmBioScot and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in FarmBioScot (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).
- Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access FarmBioScot. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
- Location Data. We collect location data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access FarmBioScot. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of FarmBioScot.
Last updated:
