Privacy Policy
Cumbria Biodiversity Data Centre (CBDC) Privacy Policy
Policy last updated: 31 January 2025
Introduction
This privacy policy explains how and why Cumbria Biodiversity Data Centre collects, uses, and shares your personal data. We are committed to protecting your privacy and will only collect and use your data in ways that are lawful, necessary, and transparent. We appreciate that people using our services place their trust in us to manage their information safely and with respect.
Who we are
We are Cumbria Biodiversity Data Centre and are a local environment records centre hosted by Tullie House Museum and Art Gallery in Carlisle, Cumbria.
Who do we collect data from?
- People who use our website or contact us (by email or through the website).
- People who work with us such as biodiversity data suppliers (including individual recorders) and biodiversity data users (our partners, data search service users and others who request data from us).
- Job applicants and volunteers.
- Subscribers to our newsletter.
What personal data do we collect?
We collect a variety of personal data from you, including:
- Contact information, such as your name, organisation name, email address, job title, employer and/or phone number.
- Information about your use of our website, such as the pages you visit and the links you click. This will largely be non-personal identification information such as the browser name, the type of computer and technical information about means of connection to our website, such as the operating system, internet service provider and other similar information.
- We may also create information about you that becomes your personal data, such as CBDC events you have attended and the records you have submitted to us.
- We take photographs and make video and audio recordings at our events for the purpose of awareness raising, promotion and publicity.
Why do we need that data?
We use your data to provide the best service that we possibly can to biodiversity data suppliers, biodiversity data users and other people with whom we work. We do this in accordance with applicable laws and regulations as well as your reasonable expectations. We update our policy regularly to make sure that it fulfils its purpose in serving us and protecting everyone who gives us their data.
We only use your data if we have a legal basis for doing so. You can find out more about this and how to protect your data online here: Information Commissioner’s Office.
When you submit records to us, we will ask you if we can share your contact details with the relevant County Recorders for your data so they can contact you directly if they have any questions about the records you have submitted.
Any biodiversity records that you submit to us will always be your records: you do not transfer ownership of the records to us but do allow us to use your records to better inform decision making across Cumbria. Your personal data (name and contact) will allow us to contact you if there are any questions about your biodiversity records.
How do we collect your personal data?
We collect your personal data in a variety of ways, including:
- When you provide it to us directly, such as when you contact us via email or a contact form, sign up for our newsletter, sign up for an event or send us your biodiversity records.
- When you use our website, such as when you browse our pages or interact with our content.
- From third parties, such as when you interact with our digital channels including social media, when you submit records to a recording app such as iNaturalist or iRecord, or attend a collaborative event.
How do we use your personal data?
We use your personal data for a variety of purposes, including:
- To provide you with the services you have requested, such as the newsletter or events.
- To improve our website and services.
- To notify you of important information relating to the records you have submitted such as to contact you for more information about rare or unusual observations.
- To invite you to take part in our events.
- To comply with our legal obligations.
Our general mailing list includes an unsubscribe option so you can remove yourself from future contact.
How long do we keep your personal data?
We will only use and store your information for as long as it is required, for the purposes it was collected. How long it will be stored depends on the information in question, what it is being used for and, sometimes, statutory legal requirements.
Who do we share your personal data with?
We may share your personal data with third parties, such as:
- Analytics providers, who help us to track and measure the use of our website.
- Government agencies, if we are required to do so by law.
- With County Recorders who help us to verify the biodiversity records we receive but only with your prior consent.
- Our partners such as local authorities and protected landscape authorities but only with your prior consent.
We do not sell your data.
How do we protect your personal data?
We take the security of your personal data very seriously. We use a variety of security measures to protect your data, including:
- Secure data storage.
- Secure data transmission.
- Access controls.
- Anonymisation of data when biodiversity records are shared with data users.
- Regular security audits.
What do we do if there is a data breach?
If we think that there is a risk of a personal data breach, we follow the procedures laid down by the Information Commissioner’s Office (ICO):
- We would first collate information about the source of the breach, and the practical options for containment and mitigation.
- We would then assess the risk of harm to those impacted.
- We would then take action to protect those affected by the breach.
- Finally, we would prepare a report to submit to the ICO within 72 hours of discovery.
Your rights
You have a number of rights in relation to your personal data, including:
- The right to withdraw your consent to the processing of your personal data;
- The right to request a copy of your personal data;
- The right to request information about how your personal data is processed;
- The right to request correction of your personal data;
- The right to request deletion of your personal data;
- The right to request restriction of the processing of your personal data in certain circumstances;
Access to your personal data
You can find out if Cumbria Biodiversity Data Centre holds any personal information about you by making a Subject Access Request to:
Cumbria Biodiversity Data Centre, Tullie, Castle Street, Carlisle CA3 8TP.
manager@cbdc.org.uk
If Cumbria Biodiversity Data Centre does hold information about your personal data, we may ask you to provide the following details:
- the personal information you want to access.
- where it is likely to be held.
- the date range of the information you wish to access.
We will need you to confirm your identity.
If we hold personal information about you, we will give you a copy of the information in an understandable format, and with an explanation of why we hold and use it. We will aim to respond to any requests for information promptly, and in any event within the legally required time limits (30 days). This timeframe may be extended by up to two months if your request is particularly complex.
How to contact us
If you have any questions about this privacy policy or your rights, please contact us at:
Web browser cookies
Our Site may use “cookies” to enhance User experience. User’s web browser places cookies on their hard drive for record-keeping purposes and sometimes to track information about them. In general, cookies are used to retain user preferences, store information for things like shopping carts, and provide anonymised tracking data to third party applications like Google Analytics. Users may choose to set their web browser to refuse cookies, or to alert you when cookies are being sent (consult the Help section of your browser or taking a look at the About Cookies website which offers guidance for all modern browsers). Please note that some parts of the Site may not function properly with cookies disabled.
Changes to this privacy policy
We may update this privacy policy from time to time.
Sharing your information as part of a Biological Record
The name of the recorder is an important part of a biological record. For information about the circumstances when CBDC will share a recorder’s name visit our page Record Ownership.
