Privacy Statement

 

Last reviewed: 15 August 2026

Adopted and effective from: 17 August 2026

ICO Registration Number: ZA158356

Next review: August 2027, or sooner where required following changes to applicable data protection legislation or ICO guidance.

 

1. About this Privacy Statement
Garve & District Community Council ("GDCC", "we", "us" or "our") respects your privacy and is committed to protecting your personal information.

This Privacy Statement explains how GDCC collects, uses, stores and protects personal data, why we use it, the lawful bases on which we process it, how long we retain it, who we may share it with and the rights you have in relation to your personal data.

We will regularly review this Privacy Statement and update it where necessary to reflect changes to our activities, systems or applicable data protection legislation and guidance.

2. Who is responsible for your personal data?
Garve & District Community Council is the data controller for the personal data it processes in carrying out its functions.

GDCC's nominated contact for data protection matters is:

Robert Moir
Chairperson, Garve & District Community Council
Email: chair@gdcc.scot

Robert Moir can be contacted regarding questions about the processing of personal data by GDCC or to exercise any of your data protection rights.

ICO Registration Number: ZA158356

3. What personal data do we collect?
·        your name;

·        postal address;

·        email address;

·        telephone number;

·        correspondence you send to us and our correspondence with you;

·        information you provide when expressing a view, raising a concern, making a request or otherwise contacting GDCC;

·        information contained in representations, consultations, surveys or community engagement exercises;

·        records of meetings, discussions or other interactions where you are identifiable;

·        information relating to your involvement with community matters where this constitutes personal data;

·        information provided by another person or organisation where there is a lawful basis for us to process it; and

·        other personal information that you voluntarily provide to us or which we lawfully obtain in connection with our functions.

Personal data is not limited to contact details. It can include information contained within correspondence, representations, opinions, records of interactions and other information relating to an identifiable individual.

We will only collect personal data that is relevant and necessary for the particular purpose for which it is being processed.

4. How do we obtain personal data?
·        directly from you, including by email, telephone, post, in person or through forms and surveys;

·        when you contact or correspond with GDCC;

·        when you participate in consultations or community engagement;

·        from publicly available sources where this is lawful and necessary;

·        from other individuals or organisations where there is a lawful basis for doing so;

·        through our website, including our website contact form;

·        through our email communications;

·        through our Facebook page and other digital communication channels used by GDCC; and

·        through online meetings and other community engagement activities.

Where we obtain personal data from a source other than the individual concerned, we will comply with the applicable transparency requirements, including providing information about the source where required.

5. Why do we use personal data?
·        communicating with residents and other members of the community;

·        informing residents about Community Council matters, meetings, consultations and community issues;

·        seeking and recording residents' views on matters affecting the community;

·        representing and communicating community views to Highland Council, Scottish Government, elected representatives, public bodies, utilities, agencies and other relevant organisations;

·        responding to enquiries, complaints, requests and correspondence;

·        administering Community Council meetings and activities;

·        maintaining appropriate records of Community Council business;

·        carrying out consultations and community engagement;

·        supporting community projects and initiatives;

·        maintaining historical records of Community Council business;

·        complying with legal and regulatory obligations;

·        establishing, exercising or defending legal claims where necessary;

·        maintaining the security and integrity of our records and systems;

·        managing our community email list where an individual has expressly opted in to receive such communications; and

·        other purposes which are compatible with the functions and activities of GDCC and which are lawful under applicable data protection legislation.

We will not use personal data for a new purpose which is incompatible with the purpose for which it was originally collected unless there is a lawful basis for doing so and any additional transparency requirements have been met.

6. What is our lawful basis for processing your personal data?
GDCC will only process personal data where there is a lawful basis under Article 6 of the UK General Data Protection Regulation ("UK GDPR").

Public task
Where processing is necessary for GDCC to carry out a task in the public interest or in the exercise of official authority, GDCC may rely on the public task lawful basis where the necessary legal basis exists.

Legal obligation
Where processing is necessary for GDCC to comply with a legal obligation, we may rely on the legal obligation lawful basis.

Legitimate interests
Where appropriate, GDCC may rely on legitimate interests where processing is necessary for a legitimate interest pursued by GDCC or a third party, provided that the individual's interests, rights and freedoms do not override those interests.

Consent
Where consent is the appropriate lawful basis, GDCC will request consent in a manner that is specific, informed and freely given.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Consent will not be treated as the lawful basis where another lawful basis is more appropriate.

For the GDCC community email list, individuals are asked to actively opt in to receive email communications through the GDCC website contact form. We will not add a person to this mailing list where they have not opted in.

The lawful basis used will depend on the particular purpose and circumstances of the processing.

7. Sharing personal data
GDCC does not sell personal data.

We may share personal data where this is necessary, lawful and proportionate for the purpose for which it was collected or for another lawful purpose.

·        Highland Council;

·        Scottish Government;

·        elected representatives;

·        public authorities and statutory bodies;

·        emergency services or other organisations where necessary to protect individuals or respond to an emergency;

·        utilities and infrastructure providers;

·        professional advisers or service providers acting on our behalf; and

·        other organisations where there is a lawful basis for sharing the information.

We will only share personal data that is necessary and relevant for the particular purpose.

Where disclosure requires consent, we will seek that consent where appropriate. However, consent is not required where another lawful basis permits or requires the disclosure.

8. Special category data
Some personal information is subject to additional protection under the UK GDPR. This includes information concerning health, racial or ethnic origin, religious beliefs, political opinions and certain other categories of personal information.

GDCC will only process special category data where there is both a lawful basis under Article 6 and an applicable condition under Article 9 of the UK GDPR.

We will take particular care with any sensitive information that residents provide to us and will only use or disclose it where this is lawful and necessary.

9. Community Council meetings and recordings
GDCC may record online Community Council meetings, including meetings conducted using Zoom or another online meeting platform.

Where a meeting is to be recorded, attendees will be informed at the beginning of the meeting that recording is taking place, the purpose of the recording and how the recording will be used.

Where consent is relied upon as the lawful basis for recording, attendees will be asked to provide that consent before participating in the recorded meeting.

Meeting recordings are normally made available for public viewing for 12 months.

GDCC may retain meeting recordings beyond this period where this is necessary for legitimate archival, historical, legal or Community Council record-keeping purposes.

Meeting recordings may contain personal data, including the names, voices, images, statements and opinions of individuals participating in the meeting.

Anyone who participates in a recorded meeting should therefore be aware that information they provide or statements they make may form part of the recording and may be made publicly available.

10. Community Council minutes and historical records
GDCC maintains records of its meetings and business as part of its historical and administrative record.

Community Council minutes are retained indefinitely.

Historic minutes dating back to the 1990s are retained as part of GDCC's Community Council records and are made available for public inspection.

Current and historic minutes are made available through GDCC's website in the relevant Documents/Minutes section.

Because minutes form part of the historical record of Community Council business, personal data contained within them may continue to be retained and publicly available where there is a lawful basis for doing so.

11. Correspondence and other records
GDCC retains emails, letters and other correspondence for as long as is reasonably necessary for the purpose for which the information is held.

This may include retaining correspondence for longer where it is necessary to:

·        maintain an appropriate record of Community Council business;

·        deal with an ongoing matter;

·        demonstrate what information was provided or what action was taken;

·        meet a legal or regulatory requirement;

·        establish, exercise or defend legal claims; or

·        preserve information of historical or continuing community significance.

When personal data is no longer required for a lawful purpose, GDCC will securely delete or dispose of it where appropriate.

12. Contact details
GDCC may retain residents' and other community contacts' names and contact details where there is an ongoing and lawful purpose for maintaining contact.

Contact details will normally be retained unless the individual asks GDCC to remove them, subject to any information which GDCC is required or otherwise permitted to retain for another lawful purpose.

A request to remove contact details does not require GDCC to erase other personal data where there is a continuing lawful reason to retain that information.

13. Website contact form and email list
GDCC operates a contact form on its website through which individuals may contact the Community Council.

The contact form may provide an option to join the GDCC community email list.

Individuals must actively opt in to the email list by selecting the relevant option on the contact form.

Choosing not to join the email list does not prevent an individual from contacting GDCC or receiving a response to an enquiry.

Individuals may withdraw from the email list at any time.

14. Facebook and social media
GDCC operates a Facebook page to communicate with the community, publicise Community Council activities, share information and engage with residents and others.

Information provided to GDCC through social media may be processed where this is necessary and lawful for Community Council purposes.

Social media platforms operate their own privacy policies and terms of service. GDCC does not control how those platforms process personal data within their own systems.

GDCC will not request or encourage individuals to provide sensitive personal information through social media where doing so would be inappropriate or insecure.

15. Third-party service providers
GDCC uses third-party service providers to provide certain technical and administrative services, including email, website and online meeting services.

Where a service provider processes personal data on behalf of GDCC, GDCC will ensure that appropriate data protection arrangements are in place in accordance with applicable data protection legislation.

Service providers may have limited technical access to personal data where this is necessary to provide, maintain or support the relevant service. GDCC does not permit such providers to use personal data for their own purposes where they are acting as a processor on behalf of GDCC.

16. How do we protect your personal data?
GDCC takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal data will be limited to Community Councillors or other persons who need access to carry out legitimate GDCC functions.

Where digital systems are used, appropriate security measures such as password protection, access controls and other appropriate safeguards will be used.

Paper records containing personal data will be stored securely and access will be restricted appropriately.

Where GDCC uses third-party service providers to process personal data on its behalf, we will take appropriate steps to ensure that the processing is carried out lawfully and securely.

Councillor and office-bearer changes
When a Community Councillor or office-bearer leaves GDCC or ceases to hold their role, access to GDCC systems and accounts will be removed or amended as appropriate.

GDCC email accounts are Community Council accounts and remain under the control of GDCC. Where an account is to be transferred to a new Councillor or office-bearer, its contents may be reviewed and cleared before the account is reassigned, provided that any records required for the continuing administration, legal, historical or other legitimate purposes of GDCC have already been appropriately retained within GDCC's records or otherwise made available to the Community Council.

Relevant Community Council information should not depend on the continued possession or access of an individual Councillor. Records forming part of GDCC's official business will be retained by GDCC in accordance with this Privacy Statement and the Data Retention Schedule.

GDCC will take appropriate steps to ensure that access to its systems, accounts and records is appropriately transferred, removed or amended when Councillors or office-bearers change.

17. How long do we keep your personal data?
GDCC does not apply a single retention period to all personal data. Retention depends on the nature of the information and the purpose for which it is held.

Our principal retention arrangements are:

Community Council minutes: retained indefinitely as part of the permanent historical record of GDCC and made available for public inspection.

Online meeting recordings: normally made available for public viewing for 12 months. GDCC may retain recordings beyond this period where there is a lawful and appropriate archival, historical, legal or Community Council record-keeping purpose.

Emails, letters and other correspondence: retained for as long as reasonably necessary for the relevant Community Council purpose, including where necessary to maintain an appropriate record of Community Council business or to deal with an ongoing matter.

Contact details: retained while there is an ongoing and lawful purpose for maintaining contact, unless the individual asks GDCC to remove them, subject to any information that must or may lawfully be retained for another purpose.

Community email list: retained while the individual remains opted in, subject to retention of limited records where necessary to demonstrate consent, manage unsubscribing or comply with legal requirements.

GDCC will periodically review personal data and securely delete or dispose of information when there is no longer a lawful reason to retain it.

18. Your data protection rights
·        the right to be informed about how your personal data is used;

·        the right of access to your personal data;

·        the right to have inaccurate personal data corrected;

·        the right to request erasure of your personal data in certain circumstances;

·        the right to request restriction of processing in certain circumstances;

·        the right to object to certain processing, including processing based on legitimate interests or public task;

·        the right to data portability in certain circumstances; and

·        the right to withdraw consent where consent is the lawful basis for processing.

These rights are not absolute and some are subject to specific conditions and exemptions under data protection legislation.

The rights available to you will depend on the circumstances and the lawful basis on which your personal data is being processed.

19. Subject Access Requests
You have the right to ask GDCC whether we process personal data relating to you and, where applicable, to request access to that personal data.

Such a request is commonly known as a Subject Access Request (SAR).

You do not normally have to use a particular form or wording to make a Subject Access Request.

Requests should be sent to:

Robert Moir
Email: chair@gdcc.scot

or by post to:

Garve & District Community Council
2 Stirling Drive, Garve, IV23 2PP

GDCC will handle Subject Access Requests in accordance with the UK GDPR and Data Protection Act 2018, including the applicable statutory timescales and exemptions.

20. International transfers
GDCC will not intentionally transfer personal data outside the United Kingdom unless there is a lawful basis for doing so and the requirements of UK data protection law relating to international transfers are satisfied.

Where a service provider used by GDCC involves an international transfer of personal data, GDCC will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place where required.

21. Automated decision-making and profiling
GDCC does not currently use personal data for solely automated decision-making that produces legal or similarly significant effects on individuals, nor does it carry out profiling for such purposes.

If this changes, this Privacy Statement will be reviewed and updated and the applicable legal requirements will be followed.

22. Right to complain
If you are concerned about how GDCC has collected, used or otherwise processed your personal data, please contact us in the first instance so that we have an opportunity to address your concern.

You also have the right to complain directly to the UK's data protection supervisory authority:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk/
Telephone: 0303 123 1113

The ICO is the UK's independent supervisory authority for data protection and information rights.

23. Changes to this Privacy Statement
GDCC will review this Privacy Statement periodically and whenever there is a significant change to the way we process personal data or to applicable data protection legislation or guidance.

The current version will be made available to residents and other individuals whose personal data we process.

ICO Registration Number: ZA158356
Last reviewed: 15 August 2026
Adopted and effective from: 17 August 2026
Next review: August 2027, or sooner where required following changes to applicable data protection legislation or ICO guidance.

 

 

Proposed: 15 August 2026
Adopted and Effective from: 17 August 2026

This schedule should be read alongside the Garve & District Community Council Privacy Statement.

Purpose:
This schedule sets out GDCC's principal retention arrangements for personal data and other records. It is intended to provide a practical record of how long different categories of information are retained and the reason for retention.

GDCC does not apply a single retention period to all information. Retention depends on the nature of the record, its purpose, legal requirements and the need to maintain an appropriate record of Community Council business.

1. Community Council minutes
Retention: Indefinite.

Reason: Minutes form part of the permanent historical and administrative record of Garve & District Community Council.

Historic minutes dating back to the 1990s are retained. Minutes are made available for public inspection through GDCC's website.

Personal data contained in minutes may therefore be retained and publicly accessible indefinitely where there is a lawful basis for doing so.

2. Online Community Council meeting recordings
Normal public availability: 12 months.

Longer retention: Recordings may be retained beyond 12 months where GDCC considers this necessary and lawful for archival, historical, legal or Community Council record-keeping purposes.

At the beginning of a meeting which is being recorded, attendees will be informed that recording is taking place and how the recording will be used.

3. Emails and electronic correspondence
Retention: For as long as reasonably necessary for the relevant Community Council purpose.

This may include longer retention where an email forms part of an ongoing matter, records a decision or representation, is required for legal or regulatory purposes, may be required to establish or defend a legal claim, or has continuing historical or community significance.

When there is no longer a lawful reason to retain an email or other electronic correspondence, it should be deleted or securely disposed of where appropriate.

4. Letters and paper correspondence
Retention: For as long as reasonably necessary for the relevant Community Council purpose.

Paper records may be retained longer where they form part of an ongoing matter, record a decision or representation, are required for legal or regulatory purposes, may be required to establish or defend a legal claim, or have continuing historical or community significance.

When there is no longer a lawful reason to retain the record, it should be securely destroyed where appropriate.

5. Contact details
Retention: While there is an ongoing and lawful purpose for maintaining contact.

Individuals may ask GDCC to remove their contact details. Where there is no other lawful reason to retain the information, GDCC will remove it within a reasonable period.

Removal of contact details does not necessarily require deletion of other personal data that GDCC has a lawful reason to retain, including information contained in minutes or records of Community Council business.

6. Community email list
Retention: While the individual remains opted in.

GDCC will retain only the information reasonably necessary to administer the email list and demonstrate consent where required.

Individuals may withdraw from the list at any time.

Where an individual withdraws, their active subscription details will be removed or suppressed as appropriate. Limited information may be retained where necessary to demonstrate that consent was withdrawn or to ensure that the individual is not inadvertently re-added.

7. Website contact form submissions
Retention: For as long as reasonably necessary to deal with the enquiry and maintain an appropriate record of Community Council business.

Where a submission forms part of an ongoing matter, complaint, consultation, representation or other Community Council business, it may be retained with the associated records for as long as reasonably necessary.

8. Facebook and social media correspondence
Retention: For as long as reasonably necessary for the relevant Community Council purpose.

Where a social media interaction forms part of an ongoing matter or significant Community Council correspondence, relevant information may be retained in GDCC's records where necessary and lawful.

GDCC does not control the retention of information by Facebook or other social media platforms within their own systems.

9. Security, access and disposal
GDCC will take appropriate technical and organisational measures to protect records containing personal data.

When information is no longer required for a lawful purpose, GDCC will securely delete, destroy or otherwise dispose of it as appropriate.

Records subject to an ongoing legal matter, complaint, investigation, Subject Access Request or other formal process should not be deleted where retention is necessary to deal with that matter or where deletion would otherwise be inappropriate.

10. Councillor and office-bearer email accounts
GDCC email accounts are Community Council accounts and remain under the control of GDCC.

When a Councillor or office-bearer leaves GDCC, the relevant account may be cleared and reassigned to a successor once GDCC has ensured that information required for the continuing administration, legal, historical or other legitimate purposes of the Community Council has been appropriately retained or otherwise made available to GDCC.

The clearing of an individual account does not require GDCC to delete records which it has retained elsewhere because they form part of its official, historical, legal or administrative records.

GDCC will ensure that access to accounts is appropriately transferred, removed or amended when Councillors or office-bearers change.

11. Review of this schedule
This schedule will be reviewed periodically and whenever there is a significant change to GDCC's processing activities, record-keeping arrangements or applicable data protection requirements.

Any changes should be approved and recorded by GDCC.

Proposed: 15 August 2026
Adopted and effective from: 17 August 2026
Next review: August 2027, or sooner where required following changes to applicable data protection legislation or ICO guidance.