8. Confidentiality, Freedom of Information and Data Protection
8.1 For the purposes of this clause 8, Confidential Information means all information of a confidential nature disclosed (whether verbally or in writing) by either party to the other whether before or after the Effective Date, relating to such party's business, customers, personnel, suppliers, products, operations, methodologies, processes, developments, know-how and/or business affairs.
8.2 Each party may disclose the other party's Confidential Information:
(a) to its employees, officers, representatives, contractors, subcontractors or advisers who need to know such information for the purposes of exercising the party's rights or carrying out its obligations under or in connection with this agreement. Each party shall ensure that its employees, officers, representatives, contractors, subcontractors or advisers to whom it discloses the other party's Confidential Information comply with this clause 8; and
(b) as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.
8.3 No party shall use any other party's Confidential Information for any purpose other than to exercise its rights and perform its obligations under or in connection with this agreement.
8.4 The Content Creator acknowledges that VisitScotland, as a public sector body in Scotland, is subject to the requirements of certain access to information legislation, including the Freedom of Information (Scotland) Act 2002, the Access to Environmental Information (Scotland) Regulations 2004 and the Public Services Reform (Scotland) Act 2010 (the “Information Laws”). The Content Creator acknowledges that VisitScotland may be obliged under the Information Laws to disclose information relating to the Content Creator. The Content Creator acknowledges that VisitScotland will be responsible for determining in VisitScotland’s absolute discretion whether any information requires to be disclosed in accordance with the provisions of the Information Laws, and that nothing in this agreement shall prevent VisitScotland from disclosing (and VisitScotland shall not have any liability to the Content Creator in connection with the disclosure of) any information pursuant to the Information Laws.
8.5 Each party shall, at its own expense, ensure that it complies with and assists the other party to comply with the requirements of all legislation and regulatory requirements in force from time to time relating to the use of personal data, including (without limitation) any data protection legislation from time to time in force in the UK including the Data Protection Act 2018 and UK General Data Protection Regulation (“Data Protection Law”). This clause is in addition to, and does not reduce, remove or replace, a party's obligations arising from such requirements.
8.6
(a) Under the terms of this agreement the Content Creator will provide personal data to VisitScotland in order to provide the Deliverables. VisitScotland is the controller as defined by the Data Protection Law.
(b) The duration of processing is for the duration of the copyright in the Deliverables, and the Deliverables will be retained by VisitScotland in perpetuity.
(c) The processing is carried out for:
(i) VisitScotland’s use of the Deliverables which may contain personal data,
(ii) contract management, including intellectual property rights administration, making payments, and contacting the Content Creator or their agent regarding Services and Deliverables.
(iii) compliance with statutory, regulatory, and audit obligations (including HMRC reporting), and
(iv) sharing personal data with the Content Creator’s agent or representative to facilitate agreement management and payments.
The lawful basis for processing is contract, and where applicable, explicit consent (see clause 8.6 (d) below) or other lawful grounds under Data Protection Law.
(d) No Special Category or Criminal Offence data will be processed unless explicit consent has been obtained or where it is otherwise permitted by law (e.g., where the personal data is manifestly made public by the Content Creator).
(e) The Content Creator's personal data types may include:
- Name,
- Email address,
- Address,
- Mobile phone number,
- Nationality,
- Financial details including bank account information,
- Image, voice, photographs and other identifiable information contained in the Deliverables, and
- Information collected by VisitScotland from public sources (eg social media).
(f) Content Creator personal data will be processed in the UK in accordance with the Data Protection Law. Data subjects have rights regarding how their personal data is used, including the right to complain to the regulator (the ICO in the UK). For full information about rights and how to complain, visit our privacy centre.