Legal

Privacy & cookies

Last updated: 13 October 2026

The short version: ScottishLocal shows no adverts and has nothing to sell about you. Google Analytics runs on every page so we can see which pages people read. It sets no cookies unless you press “Allow cookies”, and its advertising features are switched off. Apart from that, the only cookie set while you browse is a security cookie from our host. If you are a visitor, the only personal data we receive directly is what you type into the contact form. Businesses using the portal to update their own listing are the one exception, and that section says exactly what is kept.

Who we are

ScottishLocal is an independent guide to local businesses in Scotland, operated from Scotland, United Kingdom. For the purposes of UK GDPR and the Data Protection Act 2018, ScottishLocal is the data controller for any personal data described on this page.

If you want to reach us about anything here, use the contact form.

What we collect, and why

1. The contact form

When you send us a message we receive your name, email address, the business name you enter (if any), the reason you selected and your message.

Why: to reply to you, and to set up or amend a listing if that's what you're asking for.
Lawful basis: legitimate interests — responding to someone who has deliberately contacted us. Where the message is about listing a business, it is also necessary to take steps at your request prior to entering a contract.
How long: we keep correspondence for up to 24 months, then delete it. Listing-related correspondence is kept for as long as the listing is live, plus 12 months.

We do not add you to a mailing list, and we do not send marketing email. If you ask us not to contact you again, we won't.

2. Business listing information

If you list a business with us, the details you supply — business name, description, town, photographs, opening hours, contact details and social links — are published on this site and are intended to be public. Please don't send us anything you don't want the world (and search engines) to see.

Lawful basis: performance of a contract, or legitimate interests where the listing is free. You can have a listing removed at any time by asking; we action removals within two working days.

3. Server logs

Our hosting provider records standard technical information when a page is requested — IP address, browser type, the page requested and the time. This is generated automatically by the web server, is used only for security and diagnosing faults, and is not used to build any profile of you.

Lawful basis: legitimate interests — keeping the site available and secure.

4. Google Analytics

Google Analytics runs on every page, from your first visit. It tells us which towns and pages people read and which business websites they click through to, so we know where to add listings next. What it collects depends on your answer to the cookie banner.

Before you answer, or if you say no: no cookies, and nothing stored on your device. Each page view sends Google the page's address and title (the address includes any search you typed on the site), the page you came from, the time, your screen size, your browser's language and type, and the fact that you haven't allowed cookies. It carries a throwaway number that is never saved, so it does not link one page view to the next.
If you press “Allow cookies”: the same, plus two cookies that let Google Analytics recognise your browser from page to page and on later visits. They are described under Cookies below.
Either way: Google sees your IP address, uses it to estimate your country and town, and does not store it. Google signals and ad personalisation are switched off.

Lawful basis: legitimate interests for the cookieless page counts, because we need to know which parts of the guide are used. Your consent for the cookies, which you can withdraw at any time.
How long: Google keeps the detailed records for 14 months at most. Totals in our reports have no fixed end date.
Opting out entirely: if you would rather Google Analytics didn't count your visits at all, Google's opt-out browser add-on or any content blocker stops it.

Cookies

Browsing this website sets no tracking cookies unless you allow them. On your first visit a banner asks whether Google Analytics may use cookies. “No thanks” sits right beside “Allow cookies”, works just as well, and changes nothing else about the site.

If you allow them, Google Analytics sets two cookies: _ga, a random number that lets it tell one visitor from another, and _ga_…, which keeps track of the current visit. Both expire two years after your last visit. Lawful basis: your consent.

We remember your answer in your browser's local storage so the banner doesn't ask on every page. It holds only your yes or no, and it never leaves your device.

You can change your answer at any time. If you switch cookies off, we delete the Google Analytics cookies straight away, and Google Analytics goes back to counting page views without them.

One security cookie. Our host, Cloudflare, checks each visit for automated traffic and keeps the result in a cookie called cf_clearance. It holds nothing we can read, is not used for analytics or advertising, and expires after a year. We treat it as strictly necessary, the kind of cookie UK rules exempt from consent, because it exists only to protect the site.

Apart from the Google Analytics cookies and that security cookie, two areas of the site set a cookie, and neither is reachable by browsing:

The private admin area used to manage listings, which is excluded from search engines.
The business portal at /portal, where a listed business can update its own opening hours and post short updates. Signing in sets one cookie so the site knows who is signed in. It expires after 30 days, holds nothing but a random session reference, is sent only to /portal, and is deleted when you sign out.

That portal cookie is strictly necessary — it exists only to deliver something the business explicitly asked for by signing in. Under the Privacy and Electronic Communications Regulations that kind of cookie needs no consent banner, and we do not use it for anything else.

If you are a business using the portal

When a business signs in and makes a change, we record what changed, when, and the IP address the change came from. We keep it because the portal lets a business publish text onto a public website, and if anyone later asks who published something and when, "we don't know" is not an acceptable answer. It is also how we spot a link that has fallen into the wrong hands.

The lawful basis is our legitimate interest in running the site safely and being able to account for what it publishes. We keep these records for 12 months, then delete them. They are never used for marketing, never combined with anything else, and never shared except where the law requires it.

Anything you post through the portal is published on your page in your name. Treat it as public the moment you press the button. If you want a post and its record removed entirely rather than just taken down, ask us and we will delete it.

Third parties who may receive data

We have deliberately kept these to a minimum. Google is the only one with an advertising business. It receives page-view data from every visit, as described above, but its advertising features are switched off on this site.

Who	What reaches them	When
Formspree Formspree Inc., USA	Everything you type into the contact form, plus your IP address	Only when you press “Send message”. They pass it to our inbox and act as a processor on our behalf. Transfers to the USA rely on the provider's standard contractual clauses.
OpenStreetMap Foundation United Kingdom	Your IP address and which map tiles you requested	Only on pages showing a map, and only once the map loads. No account or identifier is involved.
Our hosting provider Cloudflare	Standard server log data, as above, and the result of its automated-traffic check, kept in the `cf_clearance` security cookie	Every page request, as with any website.
Cloudflare D1 Cloudflare, EU (Western Europe)	For businesses using the portal only: opening hours, the updates they post, and a record of each change with its time and IP address	Only when a listed business signs in to update its own page. Visitors reading the site never touch it. Nothing about visitors is stored there.
Google Analytics Google, USA	The page's address and title (including any search you typed on the site), the page you came from, the time, your screen size, browser language and type, which business websites you click through to, and your IP address, which Google uses to estimate your location and does not store. If you allow cookies, also the random number in the `_ga` cookie.	Every page view, from your first visit, with or without cookies. Google signals and ad personalisation are switched off. Google may process the data in the USA.

Fonts and all of our own scripts are served from this site's own domain, so no font or CDN provider sees your visit. The only outside scripts are Google Analytics, on every page, and Cloudflare's security check. We do not use Google Fonts, Meta Pixel, or any advertising or cross-site tracker.

Photographs

Landmark and scenery photographs on this site are openly licensed images from Wikimedia Commons, credited in full on our photo credits page. If you believe a photograph has been used incorrectly, tell us and we will take it down while we check.

Your rights

Under UK data protection law you have the right to:

ask what personal data we hold about you, and get a copy;
have inaccurate data corrected;
have your data deleted;
object to, or ask us to restrict, our processing;
ask for your data in a portable format;
withdraw consent, where we relied on consent.

Ask via the contact form and we will respond within one month, free of charge.

If you think we've handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first.

Children

This site is aimed at adults and we do not knowingly collect data from children. If you believe a child has sent us personal data, contact us and we will delete it.

Changes to this policy

If we change how we handle data, we will update this page and change the date at the top before the change takes effect.