Privacy & data protection

The Privacy Policy sets out how the National Trust for Scotland may collect, use, disclose and retain (for specified periods) personal data. The Policy gives both general undertakings, and provisions applying to specific interactions.

How we use your personal information

We set out below the ways the National Trust for Scotland and its group processes personal information:

  • collected via our website www.nts.org.uk (“our site”);
  • when you contact us; and
  • in connection with our functions such as memberships, marketing and newsletters, fundraising, clubs and school visits as well as goods, services, accommodation, events and activities we provide to our visitors, members, donors and customers.

Paragraphs 1 to 9 apply to the use and processing of all personal information by us and the use of our site and when you contact us by phone, e-mail or through our site. We recommend that you read these.

When we talk about “we,” “our,” or “us” in this Policy, we are referring to The National Trust for Scotland or (for paragraph 11 below) National Trust for Scotland Enterprises Ltd. Our contact details are: The National Trust for Scotland, 5 Cultins Road, Hermiston Quay, EH11 4DF (please address all correspondence for the attention of the Data Protection Officer) or e-mail dataprotection@nts.org.uk.

We are the data controller for the purposes of data protection legislation.

1. Your rights under data protection legislation

You have the following rights in respect of the personal information we process about you:

  • the right to access information held about you;
  • the right to request us to rectify personal information concerning you which is inaccurate;
  • the right to request us to erase personal information concerning you (in certain conditions);
  • the right to object to the processing of your information by us as well as the right to request us to restrict the extent to which we process your personal information (both in certain conditions);
  • the right to data portability (in certain conditions);
  • the right to ask us not to process your personal information for marketing purposes. We will usually inform you (at the time of collecting information) if we intend to use your information for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your information or at any time by contacting us;
  • right to know about and automated decision-making or profiling;
  • where you have provided your consent to us for us to process your personal information, you have the right to withdraw your consent by informing us; and
  • the right to lodge a complaint with the Information Commissioner’s Office in the UK.

The above rights may be exercised in accordance with data protection law.

2. International transfer

We do not presently transfer personal information outside the European Economic Area and will not do so without appropriate safeguards being in place and with your consent.

3. Our legal grounds for processing personal information

Our legal grounds for our processing of your personal information are:

  • your consent, where you have agreed to us using personal information; or
  • the processing is necessary for the performance of a contract with us to which you are party or in order to take steps at your request prior to entering into a contract with us; or
  • the processing is necessary for compliance with a legal obligation to which we are subject; or
  • the processing is necessary for the purposes of our legitimate interests or those of a third party, such as financial interests, preserving historical heritage, operational and administrative interests, ensuring security, health and safety, maintaining our relationship with you, marketing, optimising and understanding the use of our site, research and statistical analysis.

We outline in paragraphs 9 to 14 the specific legal grounds we use in connection with each activity. In connection with certain activities, we may also process special categories personal data (i.e. sensitive personal data), such as information relating to health and convictions on the basis of consent.

We will disclose personal information to third parties if we are under a duty to disclose or share personal information in order to comply with any legal obligation, or in order to enforce or apply our terms of use, our membership terms and conditions and other agreements or to protect our rights, property, or safety and the rights, property or safety of our customers and others.

4. Retention of your personal information

Your information will be held in accordance with our Records Management and Retention Policy. The retention period depends on the activities in relation to which you engage is and the specific retention period in connection with each of our activities is outlined below. You may have a legal right to ask us to delete or destroy your information. Please contact us for further information.

5. Cookies

Our site uses cookies. Cookies enable our system to recognise your computer and allow us to see how you use our site. Cookies enhance website performance in several ways, including provision of a secure way to measure website usage. This helps us to determine what is popular and can influence future content and development of our site.  For further information on cookies on our site, please refer to our Cookies Policy, available on our site.

6. Links to third party websites

To provide increased value to our users, we may provide links to other websites or resources for you to access at your sole discretion. This document applies solely to the personal information collected by us and does not apply to any third-party websites. We are not responsible for the privacy policies, content or the use by others of these websites and advise users to read the privacy policies and terms of use of any third party websites before providing any personal information.

7. Security on our site

Unfortunately, the transmission of information over the internet cannot be guaranteed to be 100% secure. We cannot ensure, guarantee or warrant the security of any information you transmit to us over the internet. Transmitting information over the internet is done at your own risk and you should bear this in mind when using our site, products and services online.

In order to protect key account and financial information you provide us with online, we use a security measure known as Secure Server Layer (SSL). When you submit financial information to our site it is encrypted to provide protection. 

8. Notification of changes

We keep this document under regular review and we will place an updated version on our site and, where appropriate, notify you by e-mail, or place a notification on our site. Regularly reviewing this page ensures you are always aware of what personal information we collect, how we use it and under what circumstances, if any, we will share it with other parties.

9. Information collected through our site or when you contact us (by phone, e-mail or through our site)

What information do we collect through our site or when you contact us?

We collect two kinds of personal information:

Swipe to view table

Information given to us We collect information you give us when you register or log in on our site, fill in forms and searches, report problems or contact us by phone, e-mail or otherwise. The information you give us may include your name, date of birth, e-mail address, postal address, membership details, fundraising response, telephone number, credit card or other payment information and a password.
Information we collect about you With regard to each of your visits to our site (regardless of whether you register or log in during your visit) we will automatically collect the following information:

- technical information, including your Internet Protocol (IP) address, login information, browser type and version, time zone and setting, browser plug-in types and versions, operating system and platform;

- information about your visit, including the full URL and the pages and products you viewed during your visit, any search terms entered on our site, length of time spent on each page and page interaction information, the URL you came from and your browsing history, the city and country you accessed our site from, page response times, download errors, page interaction information, any phone number used to call our customer service number.

How we use your personal information?

On the basis of the legal grounds outlined at paragraph 3, we use your personal information in the following ways:

Swipe to view table

Information you give to usWe will use this information:

- to administer user accounts (legal basis: performance of our contract with you and our legitimate interests);

- to provide you with information about goods or services we feel may interest you (legal basis: consent where we contact you by electronic means (SMS, e-mail) and our legitimate interests for non-electronic forms of communication);

- to respond to comments, questions, and queries you have raised with us (legal basis: legitimate interest);

- ensuring security of our site and reporting incidents (legal basis: where we are required to comply with a legal obligation, our legitimate interests);

- responding to requests by relevant authorities (legal basis: where we are required to comply with a legal obligation and our legitimate interests);

- research and statistical analysis and improving our offering (legal basis: our legitimate interests);

- to ensure that content from our site is presented in the most effective manner for you and for your device (legal basis: our legitimate interests). payment card details in order to pay for products or services ordered (legal basis: consent)
Information we collect about youWe will use this information on the basis of consent:

- to administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

- to improve our site to ensure that content is presented in the most effective manner for you and for your device;

- to allow you to participate in interactive features of our site, when you choose to do so;

- as part of our efforts to keep our site safe and secure;

- to measure or understand the effectiveness of advertising we serve to you and others;

Disclosure of your information

We may share your personal information with the following parties:

  • analytics and search engine providers that assist us in the improvement and optimisation of our site and our providers of web and hosting services;
  • Affiliate Window for the purposes of recording, validating and reporting on successful transactions (new members or donations) after clicking on a Trust advertisement on another website. Affiliate Window are a joint data controller for the personal data processed and the Trust has a contract in place with Affiliate Window to govern the lawful handling of this data. Please also refer to the Affiliate Window Privacy Policy for information.
  • our suppliers and sub-contractors, advisors and consultants and service providers for the performance of any contract we enter into with you or where you have separately consented to this; and
  • National Trust for Scotland (Enterprises) Limited and any member of its group which means its subsidiaries, ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

Retention of your personal information

We retain personal information for the following time periods:

Information you provide when you contact us:  6 Years

Information we collect through our site:

Our online account registration information: Data sent directly to Customer Relationship Management System held for 6 years from the end of our financial year during which the membership came to an end.

Account Name and Password held for the duration of your My Trust account.

Credit/Debit Card payments: Duration of the transaction.



The following paragraphs deal with various types of personal information you provide to us or which we collect:

·       when you sign up as a member, please see paragraph 10;

·       when you purchase goods (such as products from our online store) or services (such as function services) sign up for an event, or book a holiday (including working holiday) or accommodation (including holiday and tenant accommodation), please see paragraph 11;

·       when you sign up to receive newsletters and other communications from us, please see paragraph 12;

·       when you make a donation, or leave us a legacy, please see paragraph 13;

·       when you or your child attend school visits or clubs, please see paragraph 14.

10. Information collected through membership registration and use of your membership

We collect two kinds of personal information

Swipe to view table

Information given to usWe collect information you give us when you sign up for a membership, contact us about your membership or administer your membership through your online account. The information you give us may include your name, date of birth, e-mail address, postal address, membership details, fundraising response, telephone number, credit card or other payment information and a password.
Information about our use of your membership cardWe use barcodes on our membership cards to collect information about your visits and purchases made through our site. This information includes the attractions you have visited, the date of your visit and your membership number, as well as any transactions and purchases. In addition, CCTV cameras operate at our attractions.

How we use your personal information

On the basis of the legal grounds outlined at paragraph 3, we use your personal information in the following ways:

  • to perform any contracts entered into between you and us and to provide you with information, products and services (legal basis: performance of our contract with you and our legitimate interests);
  • to administer memberships and user accounts (legal basis: performance of our contract with you and our legitimate interests);
  • ensuring security and reporting incidents and accidents (legal basis: where we are required to comply with a legal obligation and our legitimate interests);
  • responding to requests by relevant authorities (legal basis: where we are required to comply with a legal obligation and our legitimate interests);
  • to notify you about changes to our offering (legal basis: our legitimate interests);
  • research and statistical analysis and improving our offering (legal basis: our legitimate interests);
  • Administration of Membership Cards, we will use the data gathered through the scanning of membership cards in two ways. Firstly, from a statistical analysis point of view to understand general trends. Secondly, to increase the personalisation and relevance of communications to you thereby enhancing the value of your membership (legal basis: consent);
  • to provide you with our Service message only enewsletter (legal basis: contractual);
  • payment card details in order to pay for products or services ordered (legal basis: consent)

Disclosure of personal information

We may share personal information with the following parties:

  • our suppliers and sub-contractors, advisors and consultants and service providers for the performance of any contract we enter into with you, or where you have separately consented to this;
  • National Trust for Scotland (Enterprises) Limited and any member of its group which means its subsidiaries, ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006; and
  • analytics and search engine providers that assist us in the improvement and optimisation of our site and our providers of web and hosting services.

Retention of your personal information

We retain personal information collected in connection with your membership for: 6 years from the end of the financial year during which the membership comes to an end.

Credit/Debit Card payments: Duration of the transaction.

11. Information collected when we provide events, holidays, goods, services or accommodation

What information do we collect?

We collect information when you sign up for an event, order good or services or book accommodation and contact us in connection your bookings or purchases. The information you give us may include your name, date of birth, e-mail address, postal address, membership details, telephone number, credit card or other payment information and a password.

How we use your personal information

On the basis of the legal grounds outlined at paragraph 3, we use your personal information in the following ways:

  • to determine whether we wish to enter into a contract with you and to carry out credit checks (legal basis: our legitimate interests);
  • to perform any contracts entered into between you and us and to provide you with information, products and services (legal basis: performance of our contract with you and our legitimate interests);
  • to contact you about your order, purchase or booking (legal basis: performance of a contract);
  • to administer user accounts, orders and bookings (legal basis: performance of our contract with you and our legitimate interests);
  • to manage events, our provision of goods and services, accommodation and holidays (legal basis: performance of our contract with you and our legitimate interests);;
  • ensuring security and reporting incidents and accidents (legal basis: where we are required to comply with a legal obligation and our legitimate interests);
  • responding to requests by relevant authorities (legal basis: where we are required to comply with a legal obligation and our legitimate interests);
  • research and statistical analysis and improving our offering (legal basis: our legitimate interests); and
  • to provide you with information about goods or services we feel may interest you (legal basis: consent where we contact you by electronic means (SMS, e-mail) and our legitimate interests for non-electronic forms of communication).
  • payment card details in order to pay for products or services ordered (legal basis: consent)

Disclosure of personal information

We may share your personal information with the following parties:

  • our suppliers and sub-contractors, advisors and consultants, delivery agents and service providers for the performance of any contract we enter into with you, or where you have separately consented to this;
  • The National Trust for Scotland and any member of its group which means its subsidiaries, ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006]; and
  • analytics and search engine providers that assist us in the improvement and optimisation of our site and our providers of web and hosting services.

Retention of your personal information

We retain personal information for: 6 years form the end of our financial year during which the transaction is completed or delivered.

Credit/Debit Card payments: Duration of the transaction.

12. Information collected when you sign up to receive newsletters and information from us

What information do we collect?

We collect information you give us when you sign up to receive newsletters or correspondence from us. The information you give us may include your name, date of birth, e-mail address, postal address, membership details and telephone number.

How we use your personal information

On the basis of the legal grounds outlined at paragraph 3, we use your personal information in the following ways:

We will use this information:

  • to provide you with information about goods, services, events and activities (legal basis: consent where we contact you by electronic means (SMS, e-mail) and our legitimate interests for non-electronic forms of communication);
  • to send you newsletters and to notify you about changes to our offering (legal basis: consent and our legitimate interests);
  • research and statistical analysis and improving our offering (legal basis: our legitimate interests);
  • to administer your account preferences (legal basis: our legitimate interests);
  • responding to requests by relevant authorities (legal basis: where we are required to comply with a legal obligation and our legitimate interests); and
  • to implement your instructions not to send you any direct marketing (legal basis; legal obligation).

Disclosure of personal information

We may share your personal information with the following parties:

  • our suppliers and sub-contractors, advisors and consultants, delivery agents and service providers for the purposes of providing you with information you have requested, or where you have separately consented to this;
  • National Trust for Scotland (Enterprises) Limited and any member of its group which means its subsidiaries, ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006]; and
  • analytics and search engine providers that assist us in the improvement and optimisation of our site and our providers of web and hosting services.

Retention of your personal information

We will hold your personal information: Until you remove your consent and instruct us you no longer wish to receive newsletters or information from us. You have a right at any time to stop us from contacting you for marketing purposes.

13. Information collected in connection with donations and legacies

What information do we collect?

We collect information you give us when you make a donation, respond to our fundraising communications or grant us a pledge to leave us a legacy. The information you give us may include your name, date of birth, e-mail address, postal address, membership details, fundraising response, telephone number, credit card or other payment information and whether or not you are a UK tax payer.

How we use your personal information

On the basis of the legal grounds outlined at paragraph 3, we use your personal information in the following ways:

  • administering donations, pledges and legacies and managing Gift Aid (legal basis: performance of our contract with you, our legitimate interests and where we are required to comply with a legal obligation);
  • contacting you about your donation or legacy pledge (legal basis: our legitimate interests);
  • administering your membership and account in connection with donations and legacy pledges (legal basis: performance of our contract with you and our legitimate interests);
  • responding to requests by relevant authorities (legal basis: where we are required to comply with a legal obligation and our legitimate interests); and
  • research and statistical analysis and improving our offering (legal basis: our legitimate interests).
  • payment card details in order to pay for products or services ordered (legal basis: consent)

Disclosure of personal information

We may share your personal information with the following parties:

  • our suppliers and sub-contractors, advisors and consultants, delivery agents and service providers for the purposes of providing you with information you have requested, or where you have separately consented to this;
  • National Trust for Scotland (Enterprises) Limited and any member of its group which means its subsidiaries, ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006]; and
  • analytics and search engine providers that assist us in the improvement and optimisation of our site and our providers of web and hosting services.

Retention of your personal information


We will hold your personal information: Until you remove your consent and instruct us you no longer wish to receive newsletters or information from us. You have a right at any time to stop us from contacting you for marketing purposes

14. Information collected in connection with donations and legacies

What information do we collect?

We collect information you give us when you make a donation, respond to our fundraising communications or grant us a pledge to leave us a legacy. The information you give us may include your name, date of birth, e-mail address, postal address, membership details, fundraising response, telephone number, credit card or other payment information and whether or not you are a UK tax payer.

How we use your personal information

On the basis of the legal grounds outlined at paragraph 3, we use your personal information in the following ways:

  • administering donations, pledges and legacies and managing Gift Aid (legal basis: performance of our contract with you, our legitimate interests and where we are required to comply with a legal obligation);
  • contacting you about your donation or legacy pledge (legal basis: our legitimate interests);
  • administering your membership and account in connection with donations and legacy pledges (legal basis: performance of our contract with you and our legitimate interests);
  • responding to requests by relevant authorities (legal basis: where we are required to comply with a legal obligation and our legitimate interests); and
  • research and statistical analysis and improving our offering (legal basis: our legitimate interests).
  • payment card details in order to pay for products or services ordered (legal basis: consent)

Disclosure of personal information

We may share your personal information with the following parties:

  • our suppliers and sub-contractors, advisors and consultants, delivery agents and service providers for the purposes of providing you with information you have requested, or where you have separately consented to this;

Retention of your personal information

Donations: 6 years from the end of the financial year during which the donation is made.

Legacy Pledges: Will be held until we receive an instruction from you that you no longer wish to continue.

Gift Aid Declarations: 6 years from the end of the financial year during which the Gift Aid claim is made.

Credit/Debit Card payments: Duration of the transaction.

15. Information collected in connection with clubs and school visits

What information do we collect?

We collect information given us when you / your child attends activities we arrange, such as the Young Naturalist Club. For school visits, statistics only are gathered. The personal information may include your and the child’s name, date of birth, e-mail address, postal address, telephone number and health information.

Children’s personal information

Where collecting and processing personal information of a child we may provide this Privacy Policy and any relevant privacy notice to a person with parental authority over that child, if required by data protection law.

How we use personal information

  • managing Learning Visits and clubs and contacting you in connection with these (legal basis: consent of a child or a parent/guardian as appropriate);
  • School visits; statistics only (legal basis: legitimate interest)
  • ensuring security and reporting incidents and accidents (legal basis: where we are required to comply with a legal obligation, our legitimate interests); and
  • research and statistical analysis and improving our offering (legal basis: our legitimate interests).

Disclosure of personal information

We do not share personal information with the any other parties

Retention of your personal information

We will hold personal information for: Child’s 16th birthday plus 3 years.