Friday28 August 2026

ScottishNews.com

Events
News Features Food and Drink Best of Scotland Music What's On Watch
Events

Privacy Policy

(including Data Protection Complaints Policy and Procedure)

Effective from: 27th August 2026

HEAD OFFICE

Hero Media & Entertainment Ltd

5 Redwood Place

Glasgow, Scotland

G74 5PB

‍’Scottish News’ is the trading name of Hero Media & Entertainment Ltd; a company registered in Scotland with company number SC869649.

Privacy Policy

This privacy policy explains how we use, collect, and protect your personal data in compliance with the UK General Data Protection Regulation (“UK GDPR”).

We ask that you read this privacy policy carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information and on how to contact us and supervisory authorities in the event that you have a complaint.

Who We Are

This website is operated by Hero Media & Entertainment Ltd.

We collect, use and are responsible for certain personal information about you. For the purposes of data protection legislation, the controller of any personal information collected through this website is Hero Media & Entertainment Ltd (company number SC869649) 5 Redwood Place, Glasgow, Scotland, G74 5PB. Regarding information received from third parties, Hero Media & Entertainment Ltd is the processor of your data.

Please see the ICO Register for more information.

If you have any questions about our privacy policy, you may raise them with our data protection officer.

If you feel like we have mishandled your data in any way or that you were unable to enjoy the full exercise of your rights and freedoms under the UK GDPR, you can make a complaint with us. For this purpose, and in line with the Data (Use and Access) Act 2025 (DUAA), we have included our ‘Data Protection Complaints Policy and Procedure’ at the end of this Policy.

You may also always contact the Information Commissioner’s Office at https://ico.org.uk/ if you wish to do so.

This website is not intended for children under the age of 16, and we do not knowingly collect or use personal information about children.

Our Collection and Use of your Personal Information

We may collect personal information about you, which is categorised together as follows:

Personal data we collect Where does this personal data come from?
Contact data (such as email address) When you register a mailing list with us; When you contact us about any aspect of our services;
Technical and Usage data (such as IP address, user agent IDs, operating system details etc). When you use our website. We collect this information by using cookies and delivering your newsletter

How we Use your Personal Data and Legal Bases

We only use your personal data where we are allowed to do so legally. We rely on certain lawful bases for this. The most common bases we rely on are:

  • Contract, where we need to process your personal information in order to fulfil the contract we have, or are about to, enter into with you;
  • Legal, where we need to comply with a legal or regulatory obligation;
  • Consent, where we seek your agreement that you would like to receive newsletter detail from us.
  • Legitimate interests, where it is in our legitimate interests, or a third parties, that the processing takes place and your data rights do not override these legitimate interests;

Change of Purpose

We will only use the data collected for the purposes we have specified above, unless we reasonably consider we need to use if for another purpose which is compatible with the original purpose. If there is any change in purpose, we will inform you both of the purpose and the legal basis upon which such processing will take place.

Sharing your Personal Data

Scottish News may share your personal data with trusted third parties in order to carry out the purposes laid out above. When sharing your data with third parties, we will be the controller of your data.

The types of third parties that we will be sharing your data with include:

  • Email delivery services (Amazon SES)
  • Google
  • If ownership of all or part of our business changes, or we undergo reorganisation, we may transfer your personal data to the new owner of the successor company to allow them to continue to provide the Services requested by you.

When sharing your data, Scottish News will only disclose your personal information which it deems to be necessary and proportionate to the aim of the processing and where it has been assured by such third party, through Data Processing Agreements, that it will be used in compliance with data protection legislation.

Some third parties are located outside of the UK in countries such as the USA. In such cases, we have appropriate agreements which ensure that your data is processed in a way which is in line with UK standards. See the section below on Internet-based data transfers for more information.

In other cases, we may specify in an agreement with third parties with whom we share your data that they must have in place data protection safeguards which meet the standards in the UK. Such agreement is known as the International Data Transfer Agreement ("IDTA").

Internet-based data transfers

Given the global nature of the Internet, using the Internet to collect and process information necessarily involves the transmission of information on an international basis. Some of the data processors engaged to process information may be outside the European Economic Area. Therefore, by browsing our website and communicating electronically with us, you acknowledge and agree to our processing of your information in this way.

If your data is transferred to a third-party located in a jurisdiction not covered by UK adequacy agreements, we will enter into EU Standard Contractual Clauses (EU SCCs) with a UK addendum, or an International Data Transfer Agreement (IDTA). This way we can ensure that the third-party processors have in place such equivalent safeguards protecting your data as are required under the UK GDPR.

Your Data Rights

Under the UK GDPR, you, as a data subject have a number of rights which are detailed below. Some of these only apply in specific circumstances and are qualified in several respects by exemptions which are provided for in data protection legislation. We will advise you in our response to your request if we are relying on any such exemptions.

Note that generally there will be no fee attached to your exercise of any of the rights below, unless your request is complex or the related information has to be delivered to you in an unusual manner. We may require proof of identity to verify that the individual making the request is entitled to copies of any personal data.

  • Access to personal data: You have a right to request a copy of the personal information that we hold about you. Should you wish to make such a request, dpo@hme.global. You should include adequate information to identify yourself and relevant contact details that will reasonably assist us in fulfilling your request. Your request will be dealt with as soon as possible.
  • Correction of personal data: You can request us to correct any personal data that we are processing about you which is incorrect. Please remember to always ensure your data is current and updated.
  • Right to withdraw consent: Where we have relied upon your consent to process your personal data, you have the right to withdraw that consent. To change your preferences, you can email dpo@hme.global.
  • Right of erasure: You can request us to erase your personal data where there is no compelling or regulatory reason to continue processing. This right is not a guaranteed or absolute right.
  • Right to data portability: This right allows you to request that we transfer your personal data to a third party. This information will be provided in a machine-readable format such as .csv (readable on Microsoft Excel or equivalent) or .pdf (readable on Adobe Acrobat or equivalent). You have this right as is relates to data processing which you consented to, or which was necessary to fulfil a contract with you. To make a request, contact dpo@hme.global ; we will seek to acknowledge you request within three working days, and to fulfil your request within one month. More complex requests may take longer.
  • Right to restrict processing of personal data: You have the right, in certain circumstances, to request that we suspend our processing of your personal data. Where we suspend our processing of your personal data, we will still be permitted to store your personal data, but any other processing of this information will require your consent, subject to certain exemptions.
  • Right to object to processing of personal data: You have the right to object to our use of your personal data which is processed on the basis of legitimate interests. However, we may continue to process your personal data, despite your objection, where there are compelling legitimate grounds to do so, or we need to process your personal data in connection with any legal claims.
  • Right to request an explanation of the logic involved where we make decisions about you solely through automated means.
  • Right to complain to your national data protection regulator.

Raising a complaint

If you believe we have mishandled your data, or that you were unable to exercise your rights, you can make a complaint. Please follow the procedure set out at the end of this policy: ‘Data Protection Complaints Policy and Procedure’.

Retention of your Personal Data

We will retain your personal data for the period necessary to provide you with Services. Where it is no longer necessary to process your personal data, we will delete it securely. We may be subject to legal and regulatory requirements to keep personal data for a longer period, in particular pursuant to any applicable statutory limitation period.

IP Address

Your browser generates information, including which language the Website is displayed in, and your Internet Protocol address (“IP address”). An IP address is a set of numbers which is assigned to your computer during a browsing session. The IP address is generated whenever you log on to the internet via your internet service provider or your network. Your IP address is automatically logged by our servers and used to collect traffic data about visitors to our website. We also use your IP address to help diagnose problems with our server, and to administer our website.

Cookies

Cookies are small text files that record your preferences when you visit certain online pages and are stored on your computer or other connected device. We use a variety of first party and third-party cookies. We and (where relevant) our third-party service providers use cookies to:

a. track the use of the Service;

b. improve the service by making it easier for you to use;

c. obtain and pass on analytics regarding your use of the website and the service.

Online browsers can usually be set to either accept or decline cookies. However, if cookies are declined you may not be able to fully experience the interactive features of the service.

Please see our Cookie Policy to find out more information relating to cookies used on our website.

Data Protection Complaints Policy and Procedure

Scottish News understands that there are occasions when things may go wrong, and that you may feel that we have not addressed a data protection concern appropriately or that you may feel that you have not enjoyed the full exercise of your rights and freedoms under the UK General Data Protection Regulation (“UK GDPR”) or General Data Protection Regulation (“GDPR”).

We take your data protection concerns seriously and, accordingly, have in place a process for dealing with complaints about this.

How to make a data protection complaint

Should you have a complaint about the way we have handled any aspect of data protection, or feel that we have infringed data protection laws, you can make a complaint to our Data Protection Officer.

This is the best way to ensure your complaint reaches the appropriate person in a timely manner. Where other members of our team receive a complaint about data protection matters via some other mechanism, they will nonetheless pass this along as appropriate.

When we respond to a data subject access request, or other exercise of data rights, we will include details of how to complain to us within the response.

Complaints via social media

As noted above, we would ask that complaints be made to the Data Protection Officer. However, should you raise a data protection complaint via social media, the person who receives it will ask for a more secure means by which you can be contacted to address the complaint. This is because, per Information Commissioner’s Office (ICO) guidance, social media is not a secure means by which to do so.

Our pledge on data protection complaints

We will acknowledge receipt of your complaint within 30 days of receiving it. For this purpose, the 30-day period begins on the day after we receive the complaint. If the final day falls on a weekend or public holiday, we will acknowledge it by the next working day.

Where we will be able to respond to your complaint within thirty (30) days, we will simply do so rather than sending both an acknowledgement and then a final response.

We will take appropriate action to respond to your complaint, including any required investigation, and keep you informed during this process, particularly if there ae any undue delays in responding to the complaint.

We will inform you of the outcome of your complaint without undue delay.

Types of data protection complaint we can deal with

We can deal with any complaint that relates to data protection legislation and requirements, but some examples include:

  • Cases in which you are dissatisfied with our response to your data subject access request (DSAR) or another request within which you sought to exercise your data rights;
  • Instances in which you have concerns about the data security safeguards which we have in place;
  • Any concerns or complaints you may have which relate to how we collected, recorded, used, or retained your personal information.

Cases which we will not consider to be a data protection complaint

Should you be complaining about some other aspect of Scottish News’ service, for instance a transaction or general communication with customer service personnel and seek to exercise your data rights in the process, we will not treat this as a data protection complaint.

What this means is that we will not treat, for example, a data subject access request which is made alongside a more general complaint as a data protection complaint.

Should you wish to make a data protection complaint, please let us know and give us details of your complaint so that we can begin addressing in as quickly as possible.

Where we are unsure about your intent, we may ask you to clarify whether you are making a data protection complaint.

Mixed complaints

Sometimes a complaint may include both data protection issues and wider customer service, account, transaction, gambling, or operational issues. Where this happens, we will identify and handle the data protection element under this procedure. If we can provide an outcome on the data protection element sooner than the wider complaint, we will do so unless there is a justified reason not to.

Proving your identity and making a complaint on behalf of another person

On occasion, your complaint may relate to a situation where we have not met your expectations due to uncertainty on our behalf that addressing your initial effort to exercise your data rights could result in sharing personal data with a person who should not have it.

In such cases, though we will also ask for this at the time of your initial request in any case, we may request proof of identity if this is what it will take for us to be sure we would not be committing such a breach in satisfying your complaint.

If you make a request on behalf of another person, we will again have to satisfy ourselves that you have the authority to do this. Ordinarily, we will ask for such proof at the time your initial query or request. However, there may be occasions upon which the person making the data protection complaint differs from the person who made initial contact with the request or query. In such cases, we will ask you to prove that you have authority to deal with the complaint on behalf of the data subject before we fulfil the request.

Investigating your complaint

We may ask you to confirm what your complaint relates to if we are unsure.

We will consider any material held internally and any previous actions in relation to the matter you are raising, and will begin investigating it as soon as we become aware of it.

The amount of time it takes us to issue a final response to your complaint will depend on how complex it is and how much investigation is involved, but we will respond without any undue delay.

Informing you of the outcome of your complaint

We will let you know the outcome of your complaint and, in doing so, explain the steps we have taken to resolve it. If we take any actions following on from the investigation, we will inform you of these at the same time.

Where we believe that we have complied with data protection legislation, we will explain to you how we have arrived at that conclusion.

If you are still unhappy

Should you remain dissatisfied following our investigation, as always you have the right to complain to the Information Commissioner’s Office, who can be contacted at https://ico.org.uk/make-a-complaint/.

Changes to Privacy Policy

If we decide to change our privacy policy, we will post those changes on this page. If you have any questions about the security of our website, or the information we hold on you, you can send an email to dpo@hme.global.