Norfolk Biodiversity Information Service

General Privacy Notice

The purpose of this document

Norfolk Biodiversity Information Service (NBIS) and our host organisation Norfolk County Council (NCC) are committed to protecting the privacy and security of your personal information. By personal information, we mean information which, by itself or with other data available to NBIS, can be used to identify you.

This general privacy notice serves as a privacy notice:

  • Under the UK General Data Protection Regulation (GDPR) for NBIS statutory functions.

In summary, this privacy notice:

  • Sets out how we promise to look after your personal information
  • Describes how we collect, use and share your personal information, and
  • Tells you about your privacy rights and how the law protects you.

This privacy notice covers personal information we collect about:

  • Visitors to our website
  • People who use our services
  • People who complain about any aspect of a service we provide

This notice should be read in conjunction with NCC’s General Privacy notice related to all services it provides.

Who we are

NBIS is the "data controller" for the personal information held by NBIS.  This means that we are responsible for deciding how we "process" (that is, collect, hold, use and disclose) your personal information.

Our address is Norfolk Biodiversity Information Service, Norfolk County Council, Community and Environmental Services, 1st Floor, County Hall, Martineau Lane, NORWICH, NR1 2DH.

The kind of information we hold about you and who provides it

Personal information can include, but is not limited to, your name, address and telephone number, which can be found within records that NBIS holds. These may include electronic records, letters, emails, photographs, audio recordings and video recordings.  It does not include information where your identity has been removed, and you cannot be identified by this information (anonymous information).

We may collect personal information about you from yourself directly or from other individuals or organisations.

You can see in more detail the kind of information we hold about you in relation to NBIS services, and who we receive that information from below.

What we use your personal information for

As part of NBIS day-to-day functions we use your personal information to:

  • Provide NBIS services and anything we must do by law
  • Make payments, grants and benefits
  • Listen to your ideas about NBIS services
  • Deal with complaints
  • Tell you about the NBIS services.

We gather, retain and share environmental data relating to Norfolk. We use your personal information primarily for the following purposes:

  • Biological records: Our work involves collecting, collating and preserving records, managing records, validating and verifying records. We use, analyse and make records available for evidenced-based decisions regarding nature recovery within Norfolk, via better planning, wildlife conservation, education/outreach or scientific research outcomes. If we make your records available to commercial customers and other non-chargeable requests, including to the public, your identity is removed and you cannot be identified by this information (anonymous information). The only exception to this is those third parties described in the Who we share your personal data with section below.  Our data is collected by members of the public, amateur experts, ecological professionals and other interested people. This is either in the form of ad hoc casual observations or systematic or structured survey or monitoring. Records are usually collected via written notes, Excel spreadsheet or via email.
    • For the avoidance of doubt, biological records include a grid reference and/or location name. This may have been determined from a postcode or postal address, but equally from a public location. Locations are not often so precise as to distinguish between one house and another. One could argue this location information and its association with a named individual assumes personal information, but the reality is that it would be very difficult to determine that the person that recorded the species, lives at the location recorded. Furthermore, we do not provide the recorder name when sending out data requests, hence it is therefore merely a location that may happen to be next to or near a private residence.
  • To populate dataset metadata for our biological records (species data, habitat, sites and other environmental datasets). This may include data ownership, copyright and custodianship.
    • Please note the following point 19 from our Terms and Conditions: “Individual biological records cannot be copyrighted, given ownership or intellectual property. However, where these data have been collated in a way that creates or implies ownership: All data remains the intellectual property and, in the ownership, and copyright of the original recorder(s). NBIS follows best practice in treating all records in accordance with the original recorder(s)'(or their subsequent custodian - such as the County Recorder) wishes, including recognising the rights of recorder(s) to control their records. NBIS will seek permissions where necessary and acknowledge the recorder(s) where appropriate and feasible. For further details of legal rights and best practice, please see the following links: IPR of the data recorder; NBN data ownership 2019; Archive discussion on permission to share and use existing data.”
  • Promotional activities, events management and other outreach or engagement activities, this includes email updates/bulletins/newsletters.
  • Monitoring and improving our services or wildlife conservation/data management including carrying out surveys, questionnaires and evaluation forms.
    • Evaluation forms may on occasion require us (often dictated by a project funder) to include socio-economic or demographic questions, this may (but unlikely to) include information classed as “special category data” under the GDPR.
  • Administering the use of volunteers.

In some cases, you may be under a statutory or contractual obligation to provide information to NBIS/NCC.  Further detail of where this applies and the consequences of not providing it, together with information about why we use your personal data in relation to each of the NCC’s services can be found in NCC's privacy notices for council service areas.

How the law protects you and the legal basis for processing your information

The GDPR and DPA place a legal obligation on us to process your personal information in accordance with the following data protection principles in that your personal data must be:

  • Used lawfully, fairly and in a transparent way
  • Collected only for valid purposes that we have explained to you and not used in any way that is incompatible with those purposes
  • Relevant to the purposes we have told you about and limited only to those purposes
  • Accurate and kept up to date
  • Kept only as long as is necessary for the purposes we have told you about
  • Kept securely. 

There must also be a lawful basis for processing personal information - a justifiable reason for us to collect, store, use and disclose your personal information.  Our lawful basis for doing so will depend on what services we are providing to you, and what type of information we process about you, for example, an additional basis is required for 'special category' data.

The basis we process your information under GDPR/DPA may include:

  • Necessary for the performance of a task in the public interest.  There are statutory duties placed on, and statutory powers provided to NCC by various pieces of legislation. Further information on the legislation relevant to NBIS is covered in Best practice, data, and ecological standards and Data Policies and Processes. Further detail about our legal duties and powers in relation to each NCC service can be found in NCC's privacy notices for council service areas. 
  • Necessary for the performance of a contract we have with you.
  • You consent/agree to the processing. NBIS will tell you if processing some of your personal data is not necessary to comply with a public task or to fulfil a legal duty or to fulfil a contract and is therefore optional.  In these circumstances, we will ask for your consent to process it. The GDPR sets higher standards in relation to obtaining your consent to process your personal information. We have an obligation to ensure that when consent is required from you it is done so in a manner which is clear. 

Who we share your personal data with

Your personal information can be provided to a third party, for example for the following reasons:

  • To County Recorders and other wildlife experts/naturalists, whose role is to verify all biological records received by NBIS. This may involve contact with other national or international experts and may involve direct contact with yourself for further information about the biological record(s), including photographic, audio or video evidence, to confirm species identification. This role is required for scientific purposes – a biological record is not authenticated without verification by an expert and is not valid, usable or relevant without the recorders name as part of that record. NBIS has formal and informal agreements with County Recorders and other data providers, including Data Exchange Agreements. [County Recorders are associated with and are often members of the Norfolk and Norwich Naturalists' Society. The society manages these expert’s roles and keeps them to a code of conduct. Many of these experts are also key figures or county representatives for their relevant taxonomic group’s national scheme or society and data is exchanged with these organisations. All County Recorder’s contact information can be found at this website: https://norfolknaturalists.org.uk/wp/recording/county-recorders/ ].
  • These data, once verified, may also be uploaded to the NBN (National Biodiversity Network) Atlas and then passed to GBIF (Global Biodiversity Information Forum) portal. Currently NBIS does not expose personal information of the recorder's name on either of these portals and data is only available under a CC-BY-NC non-commercial licence.
  • A trusted third party contracted by NBIS to provide a service to NBIS or directly to you. 
    • NBIS currently has a contract with Cofnod, for their ORCA system. This cloud-hosted system provides NBIS with our main database for biological records, where recorder names are stored within the biological record itself. This system is also the technology that provides our Data Enquiries service through My LERC and its eMapper outputs. Recorder names are not provided as part of our Data Enquiries service for any reason. The only personal data exchanged through this service is that of the customers who request a Data Search and have therefore signed up for a My LERC customer account. More details about how your information is used in relation to this account can be found on our website privacy notice and in the My LERC Privacy Policy.

These third parties are known as data processors and have a legal obligation under GDPR and DPA and to NBIS to look after your personal information and only use it for providing the service within their naturalist role, data management role or role stated within a contract.

We are unlikely to need to share your personal data with other services within NCC, but if we do, we will gain your consent. 

We may also need to share your personal data with, and receive your personal data from, organisations and individuals outside of NBIS and NCC, but if we do, again we will gain your consent. 

If we transfer your personal information to other countries 

Your personal information may need to be transferred outside of the UK and the European Economic Area.  While some countries have adequate legal protections for personal data, in other countries steps will be necessary to ensure appropriate safeguards apply to the information.  These include imposing contractual obligations to ensure that these safeguards apply.  You can find details of what information NCC may transfer to countries outside of the European Economic Area and the safeguards that apply in NCC's privacy notices for council service areas.

How long we use your information for

We will only retain your personal information for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. 

To work out the right retention period for personal data, we consider the following matters:

  • The amount, nature, and sensitivity of the personal data
  • The potential risk of harm from unauthorised use or disclosure of your personal data
  • The purposes for which we process your personal data and whether we can achieve those purposes through other means, and
  • Any legal or regulatory requirements. 

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

We will retain and securely destroy your personal information in accordance with our data retention schedule.

For biological records the retention period of your personal information is in accordance with its scientific basis: ‘in perpetuity’, otherwise these records are not valid, usable or relevant. If you send us your records directly, we will only keep your name in our database and will only keep the details you provide in your email or online form for as long is necessary to contact you again regarding validation or verification of your record(s), and within the specified data retention schedule for this information. This information may include your email address, address and phone number.

Your responsibility to inform us of changes

It is important that the personal information we hold about you is accurate and current.

Please keep us informed if your personal information changes during your working relationship with us.  You can help us with this by:

  • Telling us when any of your details change; and
  • Telling us if any of the information we hold about you is wrong.

Your rights under the GDPR

You have the following rights (but note, these rights do not apply in all circumstances):

  • Your right to be informed about the processing of your personal information.  This is the purpose of this notice.
  • Your right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed.
  • Your right to object to the processing of your personal data.
  • Your right to restrict processing of your personal information.
  • Your right to have your personal data erased ("the right to be forgotten").  As above, please note this right is subject to several restrictions, which we will discuss further with you if you choose to exercise it.
  • Your right to move, copy or transfer your personal information ("data portability").  This only applies to personal data processed under the GDPR and only in certain limited circumstances.  This right does not apply to personal data processed under the DPA.
  • Your right to request access to your personal information and information about how NBIS processes it.
  • Your right to withdraw any consent you have given for the processing of personal data at any time.

If you want to exercise any of these rights, please contact NBIS and the NCC Information Compliance Team by:

  • Emailing NBIS on nbis@norfolk.gov.uk
  • Writing to NBIS at Norfolk Biodiversity Information Service, Norfolk County Council, Community and Environmental Services, 1st Floor, County Hall, Martineau Lane, NORWICH, NR1 2DH.
  • Emailing the Norfolk County Council Information Compliance Team on information.management@norfolk.gov.uk
  • Writing to the Norfolk County Council Information Compliance Team, Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2UA

Questions or complaints

If you have any questions about this privacy notice or how we handle your personal information, you can write to NBIS (using the details above) or the Data Protection Officer (DPO) by letter to the DPO, Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2DH or by email to dpo@norfolk.gov.uk.

You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.  The ICO can be contacted:

  • By writing to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
  • By telephoning 0303 123 1113
  • Online at ico.org.uk/global/contact-us/

Links to other websites

If you follow links to other organisations websites, even if you follow a link which we have provided, it is suggested you take the time to read the privacy notices on the websites you visit.

More information

Please see our other relevant NBIS policies and terms:

Changes to this privacy notice

We may amend this privacy notice at any time so please review it frequently.  The date below will be amended each time this notice is updated.

This notice was last updated in July 2025