Privacy policy for venue hire customers and guests

What information do we hold about you and why?

Hiring one of our venues for events (including corporate events and weddings)*

*For accommodation bookings, please see our separate Privacy Policy for Property Occupiers

When you hire one of our venues for an event, we will receive and collect the following information from you:

Your name – to manage the booking
Your contact details – to send you a copy of your booking and to contact you in relation to your booking
Your payment card details (if paying by credit or debit card) – to pay for the booking
Details of any external suppliers which you may use to support your event (provided that we have consented to the use of such suppliers in accordance with our contract with you)
Details of your event, including the nature of the event, the duration, the number of guests, etc

Our legal grounds in relation to this processing is contract, in that the processing is necessary for the performance of a contract (the provision of the service/activity being hire of our venue[s]) or to take steps to enter into a contract (when you enquire about booking a venue).

We will retain a record of the transaction on your record. Our legal grounds in relation to this processing is our legitimate interests because we think you would expect us to retain this information in order to better understand and support your relationship with us.

If we use your personal information to tailor our communications to you, for example by letting you know that we have certain offers available on similar products or services, we will only do so because you have told us you would like to receive these communications. Our legal grounds in relation to this processing is your consent, and you have the right to withdraw your consent at any time by notifying us of this.

When we use your email address to send you other communications about services offered by NTSE or more widely in the Trust, we do so because you have told us that you would like to receive these communications. Our legal grounds in relation to this processing is your consent, and you have the right to withdraw your consent at any time.

When we process information about you to respond to comments, questions and queries you have raised with us, our legal grounds for processing are our legitimate interests in that it is necessary to process your information to effectively respond to your enquiry and manage any additional enquiries in future.

If you call us with a general enquiry, we will use a third party to handle your call. They will collect the information on our behalf and will record all calls to verify our quality of customer service. This is for the purposes of improving our customer service and enabling us to follow up when problems arise.

Attending one of our venues for an event as a guest of the hirer

When you attend one of our venues, as a guest of the host of an event (hirer), we will collect the following information from you directly or indirectly via your host:

Your full name if required
Dietary requirements where we are providing catering facilities
Your age – when this is relevant to the event or any catering we are providing.

Our legal grounds in relation to this processing is our legitimate interests because we require this information to support our venue hire booking process as well as the security of our properties.

Feedback surveys

When you hire one of our venues for an event, we may invite you to complete a feedback survey. Completion of surveys will be entirely optional, and we will tell you every time what the purpose of the survey is and how we will process your data. Our legal grounds for this processing are our legitimate interests so we can understand how we are performing and where we can improve.

CCTV (Closed Circuit Television)

We operate CCTV/video surveillance cameras at some of our properties. CCTV is used for maintaining the security of property and premises; for preventing and investigating crime; and for detecting, apprehending and prosecuting offenders.

If CCTV is in operation, appropriate signage will be in place and the operating procedures will be regularly audited by the property manager to ensure compliance with relevant standards and legislation.

Where we host a CCTV system for which another organisation is responsible, there will be an agreement in place to cover:

agreed responsibilities for compliance with data protection law
named contacts responsible for the operation of the CCTV system in each organisation
a procedure for handling requests for access to CCTV footage

Photography and filming

If you ask us to undertake or organise photography or filming in connection with your hire of one of our venues, you are consenting to us (or our appointed suppliers) taking and using these images in connection with your venue hire booking and proving them to you.

You will be responsible for obtaining the consent of any guests to such photography or filming and notifying us or our appointed supplier(s) in advance or on the day of the hire in the event that any individuals do not wish to be included in any images, or do not wish their images to be published and we will find ways to manage this carefully, where possible.

Who will have access to your data and who will we share it with?

National Trust for Scotland (Enterprises) Ltd (NTSE) being a subsidiary of the National Trust for Scotland (the Trust) will act as the data controller in respect of the personal data obtained by us to facilitate the hire of our properties as set out in this privacy policy. Access to your personal data will be restricted to employees and volunteers of NTSE and the Trust on a need-to-know basis only. Access will be provided for the purposes of supporting your customer experience with us. Access to CCTV images is restricted to authorised members of staff for the purposes of ensuring the equipment is in good working order and images are being recorded accurately.

We will never sell your data to third parties.

Where necessary or required, CCTV images may be shared with CCTV service providers, security organisations, and individuals or organisations making an enquiry under the appropriate sections of the Data Protection Act 2018. We will only provide access when we consider there to be a lawful basis for doing so and we have documented this.

We will share your information with third parties to perform our contract with you and support your customer experience and relationship with us. To make your interactions with us as efficient as possible we will share your information with:

Our call handling company – for the purposes of handling telephone enquiries
Our website host – for the purposes of managing enquiries submitted through our website
Our affiliate marketing partner – for the purposes of recording, validating and reporting on successful transactions after clicking on a Trust advertisement on another website; please refer to their Privacy Policy for further information.
Our payments processors – for the purposes of processing secure card payments online; please refer to the Privacy Policies of Sage Pay and Worldpay for further information.
Our core systems provider – for the purposes of maintaining accurate customer records
Our survey provider – for the purposes of collating and reporting on any feedback you provide
Our events booking providers – for the purposes of facilitating bookings and informing you of any changes to bookings
Our data quality partners, including postcode look-up agencies and address verification providers – for the purposes of ensuring we collect and process accurate address data
Our third-party suppliers, such as caterers, entertainers or photographers – for the purposes of performing our contract with you and supporting the venue hire booking process

Where these third parties are acting as data controllers, they are required to handle your personal data in accordance with all applicable data protection laws. For further information about how they do this, please refer to their privacy policies.

Where the third parties are acting as data processors, processing personal data on behalf of the Trust, we have contracts in place with these third parties which require them to process your personal data on our instructions only. They will not process your personal data for any other purpose and they will retain it securely.

In some cases, your data will be processed outside of the UK. Where this is the case, we will ensure that there are adequate safeguards in place (for example, the use of Standard Contractual Clauses and International Data Transfer Agreements) for the protection of your personal data.

How long will we keep your personal data?

Information held on your record (including contact details and enquiries): 6 years from the end of our financial year
Recorded calls: 3 months
Credit/Debit card payments: held until the transaction is successfully completed
Bank details (account number and sort code) where a regular Direct Debit is arranged: 6 years from the end of our financial year during which the Direct Debit came to an end
CCTV images: one calendar month, unless a crime or incident has been reported and the images are to be retained in line with the investigation. Also, if we receive a request for access to CCTV images, a copy of the images provided will be retained for 2 years.
Photographs/video footage: permanently unless you ask us to delete your information