East Lammermuir Community Council | Version 2.94 | Updated 29 October 2026
Who we are and what this policy covers
East Lammermuir Community Council (ELCC) is a voluntary local body established under the East Lothian Community Council Scheme to represent the interests of the community.
This policy covers enquiries, newsletter subscriptions, energy-development issue reports and our website, together with legacy grant information still held by ELCC. We protect personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended. We will never sell your personal data.
We are responsible for deciding why and how your personal information is used: we are the data controller. We handle information ourselves and use service providers, including Mailchimp, to process information on our behalf. This does not transfer our responsibility to them.
Information we use
We use your name, contact details and the information you provide to respond to enquiries and deal with follow-up. For reported energy-development issues, we use the details supplied about the issue and contact information where provided.
For newsletters, we use your email address, newsletter choices and interests to manage your subscription. Name and postcode are optional; leaving them blank does not prevent subscription. We use your name to personalise communications. If you provide a postcode, we link it with your selected interests to understand which areas subscribers live in and the topics they are interested in, helping us provide more relevant local information. We retain subscription status and preference records and use delivery and readership information as explained below.
Our reasons for using personal information
Newsletters: we rely on consent under Article 6(1)(a) of the UK GDPR to send the newsletters you choose and manage your requested subscription. You can withdraw consent at any time without affecting the lawfulness of earlier use. Optional opening and click tracking is used only where permitted and subject to any required consent, as explained below.
Enquiries, reported problems and community representation: we rely on public task under Article 6(1)(e) to use the information necessary to respond to residents, follow up community concerns and represent those concerns to appropriate organisations. Our underlying community representation function is established by section 51(2) of the Local Government (Scotland) Act 1973. This includes keeping proportionate correspondence and follow-up records. We do not disclose a resident’s identity where the matter can reasonably be handled without doing so.
Historical grant copies: our proposed basis is legitimate interests under Article 6(1)(f) for the limited retention and secure disposal of copies received under the former arrangement, to maintain an appropriate record of ELCC’s past involvement and deal with related enquiries or disputes. This does not authorise ELCC to administer East Lammermuir Community Benefit Fund (ELCBF) applications or retain unnecessary information. The retention period below is ELCC’s retention rule, not a claim that the law requires every application copy to be kept for that period.
Privacy requests, compliance and incidents: we rely on legal obligation under Article 6(1)(c) where processing is necessary to comply with our data-protection duties. This includes responding to rights requests, respecting withdrawals, keeping necessary compliance records, securing personal information and recording, investigating and reporting personal-data breaches as required by the UK GDPR and Data Protection Act 2018.
Website operation: we rely on public task for technical processing necessary to provide community information and receive enquiries as part of our representative role. We also rely on legal obligation where processing is necessary to protect personal information under data-protection security requirements. These bases do not automatically cover optional analytics, tracking or a provider’s separate uses of information.
External maps and optional technologies: we rely on consent under Article 6(1)(a) for the optional ArcGIS energy-map loading and associated sharing enabled by your choice. We obtain permission for optional storage or access to information on your device where required by the applicable rules. The Local Place Plan maps and their providers are described separately below; the energy-map choice does not control those services. Providers’ processing for their own purposes is subject to their own responsibilities and privacy information.
Legacy grant applications
East Lammermuir Community Benefit Fund (ELCBF) handles grant applications, including Crystal Rig funding. ELCC does not administer these applications. ELCC may still hold application copies received under an earlier arrangement. The retention rule below applies to those ELCC-held copies.
Email subscriptions and readership reports
ELCC is responsible for subscriber information. We use Mailchimp to host sign-up, manage preferences and send newsletters on our behalf. You can choose East Lammermuir Community News, Energy Projects News, or both. Community News includes Local Place Plan updates. Where an interest-based edition is offered, your choices determine which articles you receive. We will not restart newsletters to an unsubscribed contact without a valid new subscription.
We use Mailchimp delivery information to understand whether newsletters reach subscribers. We use optional opening and link-click tracking only where permitted and subject to any required consent. When enabled, open tracking uses a small image and HTML click tracking uses tracked links; Mailchimp can associate this activity with a subscriber. An opening does not establish that an article was read, and privacy tools and automated activity can affect the figures. Reports supplied to the community council use aggregate totals, including readership by area, without identifying individuals; small groups are combined or omitted where necessary. Access to identifiable records is restricted to authorised administrators.
You can change your details and newsletter choices using the Update your preferences link in our emails, or contact Secretary@elcc.scot. You can use Unsubscribe to stop newsletters from ELCC’s active list. Removing one newsletter choice lets you keep another. We retain the minimum unsubscribe information needed to respect your choice; unsubscribing does not automatically remove all earlier campaign records.
Website and bulletin service providers
We use OurLocality to host the website, Google Workspace for correspondence and administration, Mailchimp for subscriptions and newsletter delivery, and Make.com to prepare draft bulletins from website articles for editorial review. Where an interest-filtered edition is produced, Make may also process subscriber addresses, subscription status and selected interests to prepare recipient groups in Mailchimp. Its execution records may contain this information. Access is limited to authorised users, and editors review drafts before sending.
Our Local Place Plan maps are provided through uMap, hosted by OpenStreetMap France. Map backgrounds and optional reference layers load from external providers, including Esri ArcGIS. These connections share technical information, such as your IP address, browser information and the map resources requested. The maps also load a Sentry script associated with the map provider’s diagnostic service.
Interactive energy map: Our energy map is provided by Esri ArcGIS. You can choose whether to load it and can continue using the rest of the website without doing so. Loading the map allows browser storage and sends technical and usage information to Esri and its service providers, including browser and session identifiers and information about interactions with the map. Esri describes its usage-data programme as helping improve its products and user experience. These identifiers do not mean that the information is necessarily anonymous.
The energy map displays a short explanation and a button to allow it to load. Your browser remembers your choice. You can withdraw permission through Manage consent by selecting Deny; this also withdraws other optional permissions. The general consent controls can also allow the map to load. Our Cookie Policy explains the website’s cookies and controls. The Local Place Plan maps use a separate service and are not covered by this energy-map control.
International processing
Mailchimp processes information in the United States and may use other international service providers. Its Data Processing Addendum describes the applicable contractual transfer safeguards for UK personal information. Other website and bulletin providers may also process information outside the UK. You can ask ELCC at Secretary@elcc.scot for details of the safeguards that apply; we will obtain the relevant information from our provider records.
Who may receive information
Access is limited to relevant community council members and authorised support roles or agents who need information for the purposes described here, subject to confidentiality. External providers may process information to deliver our services. We do not give ELCC’s newsletter subscriber list to ELCBT or ELCBF for their own use.
Information about a reported energy-development issue may be shared with relevant project contacts to help resolve it. We limit disclosure to what is needed. We may also disclose relevant information to statutory or regulatory authorities where required, including for safeguarding.
How long we keep information
We keep personal information only for as long as it is needed for its purpose.
Enquiries: we keep routine correspondence for two complete calendar years following the end of the year in which the matter was closed. We review closed correspondence annually. Where records are still needed for an ongoing matter, a legal requirement or an appropriate record of ELCC’s work, we document the reason for longer retention and review it again.
Newsletter information: we keep subscription details while needed to manage your subscription and choices. After an unsubscribe, we retain the minimum information needed to respect that choice and avoid adding you back inadvertently. We keep consent evidence and identifiable open and click history only for as long as needed for their respective purposes. We review these records quarterly and remove or anonymise information that is no longer needed. Anonymous aggregate reports may be retained for longer where needed to understand trends.
Reporting portal: we keep issue reports only for as long as needed to handle the report and any necessary follow-up, subject to applicable record-keeping requirements.
ELCC retains copies of some grant applications received under earlier arrangements. Copies of successful and unsuccessful applications are kept for seven complete calendar years following the calendar year in which the application was submitted. ELCC securely destroys its copies at the end of that period unless an ongoing matter or documented legal requirement justifies longer retention. We review retained information and remove personal details that are no longer necessary. This seven-year period does not apply to newsletter subscribers.
Keeping information secure
We keep electronic and paper records securely and restrict access to people who need them for the purposes described here. ELCC account holders use organisational Google Workspace email accounts, not private email forwarding. Community council members, authorised support roles and agents must handle information confidentially. We use appropriate technical and organisational safeguards and require appropriate protection from providers processing information for us.
Your rights
You can ask to access your personal information, correct inaccurate information, erase information or restrict its use. You may object to processing where the law provides this right. You can withdraw consent at any time. Where applicable, you can receive information you supplied in a portable format and ask for it to be transferred to another controller.
These rights have conditions and exceptions. For example, some records may need to be retained for a lawful compliance purpose, and portability does not apply to every kind of processing. An objection to direct marketing must be respected. If necessary information is erased, we may be unable to resolve your enquiry.
To exercise your rights, contact Secretary@elcc.scot. This mailbox is monitored by ELCC’s authorised email-list administrator, who handles subscription changes and passes other privacy requests promptly to the appropriate community council office bearer or service administrator. We respond without undue delay, normally within one calendar month. Where permitted, complex or multiple requests can require up to two additional months; we will explain an extension within the initial month. We may need proportionate identity checks. Any lawful adjustment for identity information or clarification will follow the rules applying to that request; it is not a routine reason to delay.
You can raise concerns with us or complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/. You do not have to wait for our agreement to complain.
Data breaches
We record and investigate personal-data breaches, assess the risks to individuals and take appropriate action. Where a breach must be notified to the ICO, we do so without undue delay and, where feasible, within 72 hours of becoming aware of it. Notification is not required where the breach is unlikely to result in a risk to people’s rights and freedoms. We inform affected individuals without undue delay where the breach is likely to result in a high risk, subject to the applicable legal exceptions. We document our assessment and decisions.
Contact and policy updates
ELCC is responsible for this privacy policy. We review it when our activities or the way we handle personal information changes. The latest approved version is available on our website. For questions about your information or this policy, contact Secretary@elcc.scot.
We explain material changes and provide any notice or obtain any fresh consent required by law. A revised policy does not itself expand the purposes for which your information may be used.