Privacy Policy for Supporters

What information do we hold about you and why?

Becoming a member

When you become a member, we will collect the following information about you:

  • Your full name – to set up your membership account with us
  • Your date of birth – if you wish to apply for an under 25 or senior membership. Otherwise, providing your date of birth is optional.
  • Your full address – to contact you about your membership and set up membership payments
  • Your email address (if you provide one) – to contact you about your membership
  • Your bank/card details – to process your membership payment
  • Your contact telephone number – to contact you about your membership

It is necessary to process this information to fulfil our membership terms and conditions to you. Our legal grounds in relation to this processing is contract, in that the processing is necessary for the performance of a contract (your membership) to which you are party.

We will also use your address to send you other postal communications about the Trust (including our membership magazine and ways that you can support our cause) because we consider it to be of interest to you and that you would reasonably expect to hear from us about these activities. If you would prefer not to receive these communications, you can let us know at any time. Our legal grounds in relation to this processing is legitimate interests.

If you have provided us with an email address, we will also send you other communications about the Trust if you have told us that you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

Donating to the Trust

When you donate to the Trust, we will collect the following information about you:

  • Your name – to say thank you, retain a record of your donation and, if eligible, to reclaim gift aid
  • Your address – to say thank you, retain a record of your donation and let you know what your donation enables
  • Confirmation that you are a UK taxpayer (if claiming gift aid) – to reclaim gift aid
  • Your bank details/card/cheque details – to process your donation
  • Your telephone number (optional) – to say thank you and to let you know how you might be able to support us in other ways

We collect this information from you if you directly donate to us and through third party fundraising platforms. For information about how these third parties process your personal data in compliance with data protection laws, please refer to the privacy policies on their websites. We may use public telephone directories to contact you. We will always check the Telephone Preference Service (TPS) before doing so and will tell you when we call you if we have obtained your telephone number from a public directory. You can opt out of receiving these calls from us at any time.

When we process your information for the purposes of retaining accurate records or reclaiming gift aid, we do so in line with the Charities and Trustee Investment (Scotland) Act 2005 and the Finance Acts of 2005 and 2010. Our legal grounds in relation to this processing is legal obligation in that it is necessary for evidencing compliance with the legislation. This information will be retained for 6 years from the end of the financial year in which the last donation payment was made.

When we process your information for the purposes of contacting you to say thank you, let you know what difference you make to our work, what we are working on and how you can support us to achieve even more, our legal grounds are legitimate interests, because we think you would expect to hear from us about this and it is of interest to you. If you would prefer we did not contact you, you can let us know at any time. We will contact you for up to 2 years after your last donation. After this time, you will no longer hear from us unless you have provided your consent.

If you have provided us with a contact telephone number or email address, we will also contact you with other communications about the Trust if you have told us that you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

Registering for a My Trust account

When you register for a My Trust account on our website, we will collect the following information from you:

  • Your full name – to set up your online account with us
  • Your email address – to enable you to log in to your account online
  • Your chosen account password – to enable you to log in to your account online
  • Your postcode – to enable us to link your account to your record

Our legal grounds in relation to this processing are our legitimate interests, in that we consider it necessary to process your information to provide you with an online account and to ensure that we can link your account to your record.

When we use your email address to send you other communications about the Trust we do so because you have told us that you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

Purchasing a product from our gift shops or online

When you purchase a product from one of our gift shops or online we will collect the following information from you:

  • Your payment card details (if paying by credit or debit card) - to pay for the products or services ordered
  • Your email address (for online purchases only) – to send you a copy of your order confirmation
  • Your telephone number (for online purchases only) – to contact you regarding your order

Our legal grounds in relation to this processing is contract, in that the processing is necessary for the performance of a contract (the provision of the product or service).

If you have a My Trust account and are logged in when you purchase a product, we will retain a record of the transaction on your record. Our legal grounds in relation to this processing is our legitimate interests because we think you would expect us to retain this information in order to better understand and support your relationship with us.

If you are a member, when you purchase a product at one of our properties, we will also ask for your membership number to record the purchases you have made. Our legal grounds in relation to this processing is our legitimate interests in that the information is necessary for statistical analysis to monitor general usage and benefits of your membership.

If we use your personal information to tailor our communications to you, for example, by letting you know that we have certain offers available on similar products or services, we will only do so because you have told us you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

Visiting our properties and places

If you are a member, when you visit a Trust property or place, we will collect the following information from you:

  • Your unique barcode or membership number and the date of your visit – for the purposes of facilitating entry to a property or place

Our legal grounds in relation to this processing is contract, in that the processing is necessary for the performance of a contract (the provision of your membership) and to validate your membership at the point of entry.

When you visit a property or place, we will also use this information for statistical analysis to monitor general usage and benefits of your membership. Our legal grounds in relation to this processing is our legitimate interests in that the information is necessary to understand general usage of the membership.

If we use this data to tailor our communications to you, for example, by letting you know about similar properties or places that you might like to visit, we will only do so because you have told us you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

We may also invite you to complete a feedback survey. Completion of surveys will be entirely optional, and we will tell you every time what the purpose of the survey is and how we will process your data. Our legal grounds for this processing are our legitimate interests so we can understand how we are performing and where we can improve.

We operate CCTV/video surveillance cameras at some of our properties. CCTV is used for maintaining the security of property and premises; for preventing and investigating crime; and for detecting, apprehending and prosecuting offenders.

If CCTV is in operation, appropriate signage will be in place and the operating procedures will be regularly audited by the property manager to ensure compliance with relevant standards and legislation.

Where we host a CCTV system for which another organisation is responsible, there will an agreement in place to cover:

  • agreed responsibilities for compliance with data protection law
  • named contacts responsible for the operation of the CCTV system in each organisation
  • a procedure for handling requests for access to CCTV footage

Photography and filming

If we plan to take photographs or film individuals or small groups at an event you have booked, we will ask for your consent to take and use these images, before doing so. You have a right to withdraw your consent at any time, but you should note that it might be difficult to remove images if they have been published.

If we plan to take photographs or film large events, we will inform you that photography or filming is due to take place at the point of booking and will ensure there is clear signage on the day. If you would prefer not to be included in any images, or do not want your image to be published, please contact us and we will find ways to manage this carefully on the day.

Contacting us with enquiries

When you contact us with an enquiry, we will collect the following information from you:

  • Your name – to effectively process your enquiry
  • Your preferred contact details - to respond to your enquiry
  • The details of your enquiry – to respond to your enquiry
  • Your membership number (if applicable) – to retain a record of queries you have raised with us
  • We may also ask for your email address and postcode if you do not know or have a membership number, to help identify you, but this is optional.

When we process information about you to respond to comments, questions and queries you have raised with us, our legal grounds for processing are our legitimate interests in that it is necessary to process your information to effectively respond to your enquiry and manage any additional enquiries in future.

If you call us with a general enquiry, other than renewing a membership, we will use a third party to handle your call. They will collect the same categories of data as highlighted above and will record all calls to verify our quality of customer service. This is for the purposes of improving our customer service and enabling us to follow up when problems arise.

Who will have access to your data and who will we share it with?

Access to your personal data will be restricted to Trust employees and volunteers on a need-to-know basis only. Access will be provided for the purposes of supporting you as a member or donor, understanding your interests and relationship with us and making sure we keep you informed about the things important to you.

We will never sell your data to third parties.

We will only ever share your information with third parties in relation to servicing your relationship with us and auditing our practice. To make your interactions with us as efficient as possible we will share your information with:

  • Our call handling company – for the purposes of handling telephone enquiries regarding membership and donations
  • Our website host – for the purposes of managing your My Trust account, facilitating donation payments and enquiries submitted through our website
  • Our magazine auditors – for the purposes of verifying aggregated statistics about circulation and usage of our magazine or review our policies, processes and procedures for compliance with relevant advertising standards. Please refer to their Privacy Policy for further information.
  • Our affiliate marketing partner - for the purposes of recording, validating and reporting on successful transactions after clicking on a Trust advertisement on another website. Please refer to their Privacy Policy for further information.
  • Our payments processors – for the purposes of processing secure card payments at tills, contactless points and online. Please refer to the Privacy Policies of Sage Pay, Worldpay, and Verifone for further information.
  • Our electronic newsletter provider – for the purposes of delivering our newsletter and gathering statistics around email opening and clicks to help us monitor and improve content
  • Our core systems provider – for the purposes of maintaining accurate supporter records
  • Our survey provider – for the purposes of collating and reporting on any feedback you provide

Where these third parties are acting as data controllers, they are required to handle your personal data in accordance with all applicable data protection laws. For further information about how they do this, please refer to their privacy policies.

Where the third parties are acting as data processors, processing personal data on behalf of the Trust, we have contracts in place with these third parties which require them to process your personal data on our instructions only. They will not process your personal data for any other purpose and they will retain it securely.

If you are a member of our Patron’s Club, we will also share your information with the National Trust for Scotland Foundation USA. Our legal grounds in relation to this processing is our legitimate interests in that it is necessary to build and maintain an international collective of supporters.

In some cases, your data will be processed outside of the UK. Where this is the case, we will ensure that there are adequate safeguards in place (for example, the use of Standard Contractual Clauses) for the protection of your personal data.

How long will we keep your personal data?

  • Information held on your record (including contact details, donations made, enquiries): 6 years from the end of our financial year
  • Recorded calls: 3 months
  • Email address and password for My Trust account: held for as long as the account exists
  • Credit/Debit Card payments: held until the transaction is successfully completed
  • Bank details (account number and sort code) where a regular Direct Debit is arranged: 6 years from the end of our financial year during which the Direct Debit came to an end
  • CCTV images: one calendar month, unless a crime or incident has been reported and the images are to be retained in line with the investigation. Also, if we receive a request for access to CCTV images, a copy of the images provided will be retained for 2 years.
  • Photographs/video footage: permanently unless you ask us to delete your information