Privacy & cookies
Last updated: 11 August 2026
The short version: browsing ScottishLocal sets no cookies and shows no adverts. We don't track you across the web, we don't build a profile of you, and we have nothing to sell about you. We use one cookieless analytics tool that counts page views and nothing else. If you are a visitor, the only personal data we ever receive is what you type into the contact form. Businesses using the portal to update their own listing are the one exception, and that section says exactly what is kept.
Who we are
ScottishLocal is an independent guide to local businesses in Scotland, operated from Scotland, United Kingdom. For the purposes of UK GDPR and the Data Protection Act 2018, ScottishLocal is the data controller for any personal data described on this page.
If you want to reach us about anything here, use the contact form.
What we collect, and why
1. The contact form
When you send us a message we receive your name, email address, the business name you enter (if any), the reason you selected and your message.
- Why: to reply to you, and to set up or amend a listing if that's what you're asking for.
- Lawful basis: legitimate interests — responding to someone who has deliberately contacted us. Where the message is about listing a business, it is also necessary to take steps at your request prior to entering a contract.
- How long: we keep correspondence for up to 24 months, then delete it. Listing-related correspondence is kept for as long as the listing is live, plus 12 months.
We do not add you to a mailing list, and we do not send marketing email. If you ask us not to contact you again, we won't.
2. Business listing information
If you list a business with us, the details you supply — business name, description, town, photographs, opening hours, contact details and social links — are published on this site and are intended to be public. Please don't send us anything you don't want the world (and search engines) to see.
Lawful basis: performance of a contract, or legitimate interests where the listing is free. You can have a listing removed at any time by asking; we action removals within two working days.
3. Server logs
Our hosting provider records standard technical information when a page is requested — IP address, browser type, the page requested and the time. This is generated automatically by the web server, is used only for security and diagnosing faults, and is not used to build any profile of you.
Lawful basis: legitimate interests — keeping the site available and secure.
Cookies
Browsing this website sets no cookies. There is no analytics cookie, no advertising cookie and no consent banner, because there is nothing to consent to. The site does not use local storage or any similar tracking technology on the pages visitors read.
Our analytics (see below) is deliberately a cookieless one. It counts page views without storing anything on your device and without any identifier that could follow you to another website, which is why no consent banner is required.
Two areas of the site do set a cookie, and neither is reachable by browsing:
- The private admin area used to manage listings, which is excluded from search engines.
- The business portal at
/portal, where a listed business can update its own opening hours and post short updates. Signing in sets one cookie so the site knows who is signed in. It expires after 30 days, holds nothing but a random session reference, is sent only to/portal, and is deleted when you sign out.
That portal cookie is strictly necessary — it exists only to deliver something the business explicitly asked for by signing in. Under the Privacy and Electronic Communications Regulations that kind of cookie needs no consent banner, and we do not use it for anything else.
If you are a business using the portal
When a business signs in and makes a change, we record what changed, when, and the IP address the change came from. We keep it because the portal lets a business publish text onto a public website, and if anyone later asks who published something and when, "we don't know" is not an acceptable answer. It is also how we spot a link that has fallen into the wrong hands.
The lawful basis is our legitimate interest in running the site safely and being able to account for what it publishes. We keep these records for 12 months, then delete them. They are never used for marketing, never combined with anything else, and never shared except where the law requires it.
Anything you post through the portal is published on your page in your name. Treat it as public the moment you press the button. If you want a post and its record removed entirely rather than just taken down, ask us and we will delete it.
Third parties who may receive data
We have deliberately kept these to a minimum. None of them are advertising companies.
| Who | What reaches them | When |
|---|---|---|
| Formspree Formspree Inc., USA |
Everything you type into the contact form, plus your IP address | Only when you press “Send message”. They pass it to our inbox and act as a processor on our behalf. Transfers to the USA rely on the provider's standard contractual clauses. |
| OpenStreetMap Foundation United Kingdom |
Your IP address and which map tiles you requested | Only on pages showing a map, and only once the map loads. No account or identifier is involved. |
| Our hosting provider Cloudflare |
Standard server log data, as above | Every page request, as with any website. |
| Cloudflare D1 Cloudflare, EU (Western Europe) |
For businesses using the portal only: opening hours, the updates they post, and a record of each change with its time and IP address | Only when a listed business signs in to update its own page. Visitors reading the site never touch it. Nothing about visitors is stored there. |
| Cloudflare Web Analytics Cloudflare |
The page you viewed, roughly where in the world you are, and what browser you used — but no cookie, no device identifier and nothing that follows you to another site | Every page view. We use it to see which parts of the guide people actually read, so we know where to add listings next. It cannot identify you, and we could not single you out from it even if we wanted to. |
Fonts and all of our own scripts are served from this site's own domain, so no font or CDN provider sees your visit. We do not use Google Analytics, Google Fonts, Meta Pixel, or any advertising or cross-site tracker.
Photographs
Landmark and scenery photographs on this site are openly licensed images from Wikimedia Commons, credited in full on our photo credits page. If you believe a photograph has been used incorrectly, tell us and we will take it down while we check.
Your rights
Under UK data protection law you have the right to:
- ask what personal data we hold about you, and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- object to, or ask us to restrict, our processing;
- ask for your data in a portable format;
- withdraw consent, where we relied on consent.
Ask via the contact form and we will respond within one month, free of charge.
If you think we've handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first.
Children
This site is aimed at adults and we do not knowingly collect data from children. If you believe a child has sent us personal data, contact us and we will delete it.
Changes to this policy
If we change how we handle data — for example by adding analytics — we will update this page and change the date at the top before the change takes effect.