How your information is handled

Who is responsible

Ian Barrs is the data controller for muirkirk.info. The service is independent: it is not operated by East Ayrshire Council, an emergency service, MEG or the Community Council.

Public intake must remain disabled until Ian has recorded the legal capacity in which he will operate, completed the ICO fee assessment and published a valid correspondence address.

How to contact the controller

privacy@muirkirk.info is the intended privacy contact. It must be tested before public intake opens. A correspondence address will be published before the service accepts personal information.

Information the service may use

• Contact details you provide, such as your name and email address.
• Your question, support request or organisation application and the choices you make on the form.
• For a permitted community report: category, official route shown, description, location, an existing official reference, sharing choices and one optional photograph.
• Age-range acknowledgement, service acknowledgement and account or ticket-following details.
• Messages, actions, status history and minimal disclosure records needed to manage the request.
• Limited technical request and security data processed by the hosting and service providers, such as an IP address, date, browser information and requested page.

Information not requested

Do not use muirkirk.info for immediate danger, crime or safeguarding details, health information, gas leaks, fallen electrical equipment, active flooding or sewage emergencies. The report guide sends these matters straight to the appropriate official route without opening a muirkirk.info form.

Do not send passwords, recovery codes, MFA seeds, payment-card information or other people's confidential records. If information outside the service scope arrives accidentally, access will be restricted while Ian decides how to delete it safely and signpost the sender.

Why information is used

The intended purposes are to receive and answer requests, triage permitted reports, provide organisation support, maintain a private ticket history, prevent misuse, keep the service secure, honour people's information rights and meet legal duties.

The service does not use submitted information for advertising, profiling or automated decisions. Anonymous totals may be kept to understand demand after the underlying tickets are deleted.

Proposed lawful bases

Legitimate interests is the proposed basis for receiving and managing a request and protecting the service. Those interests are providing a useful community service and operating it safely. This basis cannot be used until the recorded legitimate-interests assessment has passed its purpose, necessity and balancing tests.

Consent is the proposed basis for optional onward sharing. Consent to share issue details, location or a photograph is separate from consent to share contact details. You can withdraw consent for future sharing, although that cannot undo a disclosure already made lawfully. Legal obligation may apply where records must be used to meet a legal duty.

Who may receive information

Odoo is the intended ticket-system processor and Cloudflare is the intended static-site and security provider. Their current contracts, subprocessors, data locations, transfer safeguards, logs and deletion behavior must be recorded and approved before intake opens.

For a permitted report, necessary issue details may be sent to the responsible service only if you agreed. Your contact details are included only if you separately agreed and sharing them is necessary. Ian may also disclose information where the law requires it or to obtain confidential legal or security advice.

External official routes

Following an official link or calling an official number does not submit a form to muirkirk.info. The receiving organisation handles that contact under its own privacy notice. Your browser will still make the normal technical request needed to open an external website.

muirkirk.info does not sell resident information, share it with community organisations for marketing or publish reports and photographs on a public map.

How long records are kept

The intended rule is to delete the complete Odoo ticket, chatter, messages and attachments 12 months after the ticket is closed. A monthly review will record deletion without copying the ticket's contents into the deletion log.

Associated contact or portal records will be removed when no continuing request, legal requirement or other documented reason remains. Anonymous aggregate service counts may be retained.

Backups and deletion limits

Deleting a live record may not remove it immediately from protected provider backups. Backup frequency, retention, locations, restore access and expiry must be confirmed against the live Odoo contract before launch and reflected in the final notice.

A backup will not be searched or restored simply to recover a deleted ticket. If a backup is restored for service recovery, the deletion list must be reapplied before normal use. No promise of instant or absolute erasure is made.

Your choices and rights

Depending on the circumstances and lawful basis, you may ask for access, correction, deletion or restriction of your information, or object to its use. You may withdraw an optional sharing consent at any time. Data portability applies only in particular circumstances.

Your right to object: you may object to processing based on legitimate interests. Ian must stop unless there are compelling legitimate reasons to continue or the information is needed for legal claims.

Questions and complaints

Once the privacy contact is live, write to privacy@muirkirk.info or the published correspondence address. Identity checks will be proportionate and the normal response deadline is one calendar month.

You can also complain to the Information Commissioner's Office. It is helpful, but not required, to raise the matter with Ian first.