1. About this Privacy Policy

Core Path 13 Group respects your privacy and is committed to handling personal information responsibly.

This Privacy Policy explains how personal information is collected, used, stored and shared when you visit the Core Path 13 Group website, use the contact form or otherwise contact the group.

Website: corepath13.co.uk

────────────────────────

2. Who is responsible for your information?

Core Path 13 Group is the data controller for personal information collected through this website.

Core Path 13 Group is a public non-profit community group based in Kirkcudbright.

For privacy enquiries, data requests or concerns, contact:

Email: [email protected]

No public postal address is provided through the website.

────────────────────────

3. Information we collect

The information collected depends on how you use the website.

Contact-form information

When you contact the group through the website, we collect:

your full name

your email address

the message or enquiry you submit

any additional information you choose to include

Please do not include sensitive or confidential personal information unless it is necessary for your enquiry.

Email correspondence

If you contact the group by email or reply to a message, we may retain:

your email address

the content of the correspondence

any other information you provide

Technical website information

The website platform, hosting services and security systems may process limited technical information required to operate and protect the website.

This may include:

IP address

browser and device information

operating system

date and time of access

pages or website resources requested

diagnostic, error and security information

cookie and consent preferences

Google Analytics 4 information

With your consent, Google Analytics 4 may collect information including:

pages viewed

website interactions and events

approximate geographic area

referring website or traffic source

browser and device information

operating system and screen information

session and engagement statistics

Google Analytics uses IP-address information during collection to derive approximate location information. Google states that individual IP addresses from UK visitors are discarded before the analytics data is logged or stored.

Microsoft Clarity information

With your consent, Microsoft Clarity may collect information about how you interact with the website, including:

pages visited

clicks and taps

scrolling behaviour

mouse movements

device and browser information

screen size

navigation and interaction patterns

session and usability information

Clarity uses this information to create aggregated heatmaps and reconstructed session recordings. These recordings are generated from website layout and interaction data rather than conventional video footage of the visitor.

Contact-form fields and other sensitive content will be masked or excluded from Microsoft Clarity recording.

────────────────────────

4. How we collect information

Personal information may be collected:

when you submit the website contact form

when you contact the group by email

through essential website, hosting and security systems

through Google Analytics 4 after analytics consent

through Microsoft Clarity after analytics consent

through cookies or similar technologies

The website does not use contact-form information to add visitors to an unrelated marketing list.

────────────────────────

5. How we use your information

Personal information may be used to:

receive and respond to enquiries

communicate with you about Core Path 13

provide information about project progress, access, funding or community activity

administer and maintain the website

operate the contact form and enquiry workflow

protect the website and associated systems

maintain appropriate correspondence records

understand general website use

identify website usability problems

improve website structure, content and performance

comply with legal, regulatory or official requirements

Google Analytics and Microsoft Clarity information is used to understand and improve the website. It is not used by Core Path 13 Group to identify individual visitors by name.

────────────────────────

6. Lawful basis for processing

UK data-protection law requires an appropriate lawful basis whenever personal information is processed.

Legitimate interests

Core Path 13 Group normally relies on legitimate interests to:

receive and respond to genuine enquiries

communicate about the community project

maintain appropriate correspondence records

administer and protect the website

operate the contact-management system

prevent misuse or security problems

These activities support the reasonable administration and communication needs of the group.

Consent

Consent is used for non-essential analytics technologies, including:

Google Analytics 4

Microsoft Clarity

related analytics cookies or device identifiers

These services will not be permitted to place non-essential analytics cookies until the visitor has made an appropriate consent choice.

You can refuse analytics cookies without losing access to the website’s main content and essential functions.

You can also withdraw or change your consent through the website’s cookie-preference controls.

Legal obligation

Information may be processed or retained where necessary to comply with a legal, regulatory or official requirement.

────────────────────────

7. Cookies and consent choices

The website uses a cookie-consent system to explain the available cookie categories and record visitor preferences.

Visitors will be given options to:

accept optional cookies

reject optional cookies

manage their cookie preferences

Essential cookies may operate without consent where they are strictly necessary for the website, security, form functionality or consent-management system.

Google Analytics 4 and Microsoft Clarity are treated as optional analytics services and will be controlled through the cookie-consent system.

Further information is provided in the separate Cookie Policy.

────────────────────────

8. Who may access or receive your information?

Personal information will only be accessed or shared where reasonably necessary.

Recipients may include:

authorised Core Path 13 Group committee members

DH Admin & Business Support

website hosting and infrastructure providers

email and notification providers

Google, in connection with Google Analytics 4

Microsoft, in connection with Microsoft Clarity

professional advisers where necessary

regulators, public authorities or law-enforcement organisations where disclosure is legally required

Personal information is not sold.

────────────────────────

9. DH Connect and website support

The website contact form and associated enquiry workflow operate through the DH Connect platform.

Information submitted through the website may be:

stored as a contact or enquiry record

used to operate the form and enquiry workflow

sent to authorised recipients through an internal email notification

accessed by authorised Core Path 13 Group committee members

accessed by DH Admin & Business Support where reasonably required

DH Admin & Business Support administers and supports the DH Connect sub-accounts it manages. This may require access to contact records when maintaining, testing, troubleshooting or supporting a sub-account, website, form, workflow or related system.

Access is limited to what is reasonably necessary for those support purposes.

────────────────────────

10. Google Analytics 4

Google Analytics 4 is used to measure general website activity and help Core Path 13 Group understand:

how visitors reach the website

which pages or sections are used

general visitor and session numbers

device and browser patterns

how visitors interact with the website

whether website improvements are working

Google Analytics will only operate after the required analytics consent has been given.

Core Path 13 Group will not intentionally send names, email addresses, contact-form messages or other directly identifying enquiry information to Google Analytics.

The Google Analytics property will be configured with a 14-month user and event data-retention period. Google allows standard Analytics properties to use either a two-month or 14-month retention setting for user-level and event-level data.

Aggregated statistical reports that no longer identify individual visitor activity may remain available for longer.

────────────────────────

11. Microsoft Clarity

Microsoft Clarity is used to help understand:

how visitors navigate the website

which elements receive interaction

how far visitors scroll

where visitors may experience difficulty

how the website performs across different devices

whether website layout and content can be improved

Clarity may produce heatmaps and reconstructed session recordings after consent has been given.

Form fields and sensitive information will be masked or excluded from Clarity recording.

Microsoft states that standard Clarity playback data is retained for 30 days, while labelled or favourited sessions and heatmap data may be retained for up to nine months.

────────────────────────

12. International data transfers

Some technology providers used by the website may process personal information outside the United Kingdom.

This may include providers connected with:

DH Connect

Google Analytics

Microsoft Clarity

hosting, infrastructure or email delivery

Where a restricted international transfer takes place, the relevant provider is expected to use an appropriate legal transfer mechanism, contractual safeguard or recognised adequacy arrangement.

Information about relevant safeguards may be requested by contacting:

[email protected]

────────────────────────

13. How long we keep information

Enquiries and correspondence

General website enquiries will normally be retained for up to 12 months after the last meaningful correspondence.

Information may be retained for longer where:

the enquiry relates to an ongoing project matter

further communication is reasonably expected

a complaint or dispute remains unresolved

retention is required for legal, regulatory or record-keeping purposes

Google Analytics

Google Analytics user-level and event-level data will be retained for up to 14 months.

Microsoft Clarity

Microsoft Clarity information will be retained in accordance with the applicable Clarity retention periods described above.

Technical and security information

Technical, security and platform records may be retained according to the operating, diagnostic and security requirements of the relevant provider.

Information will be deleted or anonymised when it is no longer reasonably required.

────────────────────────

14. How information is protected

Reasonable organisational and technical measures are used to protect personal information.

These may include:

restricting access to authorised people

password-protected systems

secure website and form infrastructure

controlled access by website-support providers

appropriate arrangements with technology providers

analytics-consent controls

masking or excluding sensitive form information from session-recording tools

deleting information when it is no longer required

No internet-based system can be guaranteed to be completely secure, but reasonable steps are taken to reduce the risk of unauthorised access, loss or misuse.

────────────────────────

15. Your data-protection rights

Depending on the circumstances, you may have the right to:

request access to personal information held about you

ask for inaccurate information to be corrected

ask for information to be deleted

request restriction of processing

object to processing based on legitimate interests

request data portability where applicable

withdraw consent where processing is based on consent

complain about how your information has been handled

Not every right applies in every situation. Legal or regulatory reasons may sometimes prevent a request from being fulfilled in full.

To exercise a right, contact:

[email protected]

Your right to object

You have the right to object to processing based on legitimate interests.

Where an objection is received, Core Path 13 Group will consider the circumstances and stop the processing unless there is an appropriate lawful reason to continue.

Withdrawing analytics consent

You can withdraw or change analytics consent through the website’s cookie-preference controls.

Withdrawing consent will prevent future optional analytics-cookie use on that device or browser. It does not automatically remove information lawfully collected before consent was withdrawn.

────────────────────────

16. Complaints

Please contact Core Path 13 Group first if you have concerns about how personal information has been handled:

Email: [email protected]

You also have the right to complain to the Information Commissioner’s Office, the UK regulator responsible for data protection.

────────────────────────

17. External links

The website contains links to external websites and services, including Facebook.

Core Path 13 Group is not responsible for the content, privacy practices or security of third-party websites. Visitors should review the privacy information provided by those services.

────────────────────────

18. Changes to this policy

This Privacy Policy may be updated when:

the website changes

new forms, fundraising tools or features are introduced

analytics or technology settings change

service providers change

the way personal information is used changes

legal or regulatory requirements change

The latest version will be published on this page with a revised update date.