Data and Privacy Policy

Last updated: 29 November 2025.

Your Moth Records

1. Introduction and Contact Details

Who we are	Surrey Moth Group (referred to as "we," "us," or "the Project").
Data Controller	Les Evans-Hill, Data Manager, Surrey Moth Group.
Contact Details	Contact us
Purpose	This policy explains how we collect, use, and protect your personal data in connection with the submission and processing of moth records.

2. Personal Data We Collect

We collect the following personal data from our recorders:

Your Name: Used to credit the recorder for the submitted moth records, which is essential for the scientific and historical value of the data.
Your Email Address: Used for verification of records, communication regarding your submissions, and, if you consent, for occasional project updates.
Location and Date of Records: This is part of the biological record itself, and while the moth observation is not personal data, the record linked to your name makes your data identifiable.

3. Our Lawful Basis For Processing Your Data

Under UK GDPR, we must have a lawful basis for processing personal data. For a citizen science project, the most likely bases are:

A. Scientific Records (Name & Record Data): Legitimate Interests

Our Legitimate Interest: To collect, verify, archive, and share biological records for scientific research, conservation, and education purposes. Crediting the recorder (your name) ensures data integrity, quality, and historical value.
Impact on You: Your name will be permanently stored and shared as the recorder of the moth sighting, as is standard practice in biological recording schemes. This is balanced against your expectation that your record contributes to public interest conservation work.

B. Communication and Updates (Email Address): Consent or Legitimate Interests

Verification: Legitimate Interests - to ensure data accuracy, which is part of the core scientific purpose.
Project News/Updates: Consent - we must get a clear, opt-in consent for any marketing or non-essential communication.

4. How We Use Your Personal Data

Your personal data is used for the following specific purposes:

Data Collected	Purpose of Use	Lawful Basis
Name	To identify and credit the official recorder of the moth record.	Legitimate Interests
Name	Inclusion in publicly shared datasets (e.g., Surrey Biological Information Centre (SBIC), Butterfly Conservation (BC), National Biodiversity Network (NBN)).	Legitimate Interests
Email Address	To contact you regarding the verification or querying of a record you have submitted.	Legitimate Interests
Email Address	To send you Project newsletters and updates (only if you explicitly opt in).	Consent

5. Sharing Your Data (Recipients)

We are transparent about who receives your data:

Your Name and Moth Record Data: This information is considered part of the scientific data and will be shared with recognised conservation and research organisations for public benefit. Recipients may include:

Surrey Biological Information Centre (SBIC).
National Moth Recording Scheme (NMRS).
The National Biodiversity Network (NBN) Atlas, where it is made publicly available.

Your Email Address: Your email address is never shared or published openly in public datasets. It is only shared on a need-to-know basis with:

Volunteer verifiers/experts working directly for the Project, under strict data protection agreements, to query a record.

6. Data Retention

Moth Records (including your Name): We retain this data indefinitely as it forms part of a permanent scientific archive necessary for long-term research, historical analysis, and conservation planning.
Email Address and Correspondence: Will be kept for as long as you are actively submitting records or as required for the verification and archival process. If you request to stop recording or withdraw consent, we will delete your email address and any non-record-related correspondence, while your name remains tied to the historical records.

7. Your Rights Under UK GDPR

As a data subject, you have the following rights, which you can exercise:

Right	Explanation Relevant to Moth Records
Right to be Informed	You have the right to know how your data is used (this policy achieves this).
Right of Access	You can request a copy of the personal data we hold about you.
Right to Rectification	You can ask us to correct any inaccurate personal data (e.g., a misspelt name).
Right to Object	You have the right to object to processing based on Legitimate Interests. Note: If you object to your name being linked to your records, we may have to stop accepting future records from you as verifiability and scientific integrity rely on the recorder's identity. We will still retain your name on historical records for scientific archiving purposes.
Right to Erasure ('Right to be Forgotten')	You can ask us to delete your personal data (e.g., your email address). Note: We are exempt from deleting your name from the historical scientific records under the scientific research exemption of UK GDPR, as this is necessary for the integrity of the long-term data set.
Right to Withdraw Consent	You can withdraw consent for receiving marketing/newsletters at any time.

8. Data Security and Storage

We use appropriate technical measures to keep your data secure.
Data is stored on a password and biometric-protected personal computer (PC).
Access to email addresses is strictly limited to the Data Controller and authorised volunteer verifiers/administrators.

9. How to Complain

If you have a concern about how we have handled your personal data:

If you remain dissatisfied, you have the right to lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO)

This Website

1. Introduction

This Privacy Policy explains how we handle information when you use our website.

We are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable privacy laws.

We do not collect, store, or process personal data from visitors.

2. Information We Do Not Collect

We do not collect any information that can identify you as an individual, including but not limited to:

Names
Email addresses
IP addresses (unless anonymised)
Location data
Cookies used for tracking or profiling
Any other personal identifiers

We do not operate user accounts, contact forms, mailing lists, or any functionality requiring you to submit personal information.

3. Cookies and Tracking Technologies

Our website does not use cookies or similar tracking technologies for analytics, advertising, or user identification.

If any essential cookies are required for basic site functionality, they will not collect personal data and will not be used for tracking.

4. Third-party Services

We do not use third-party analytics tools, embedded services, advertising networks, or social media plugins that would collect personal data.

If external links are provided, we are not responsible for the privacy practices of those websites.

5. Data Security

Although we do not collect personal data, we implement standard technical measures to protect our website from unauthorised access, misuse, or disruption.

6. Your Rights

As we do not process personal data, the rights afforded under UK GDPR (such as access, rectification, erasure, or objection) do not apply in this context.

If this changes in the future, we will update this Privacy Policy accordingly.

7. Changes To This Policy

If we introduce features that involve the collection or processing of personal data, we will update this Privacy Policy to reflect how your data is handled and inform you of your rights.

8. Contact Information

If you have any questions about this Privacy Policy, please contact us.