Privacy Policy for Supporters

What information do we hold about you and why?

Becoming a member

When you become a member, we will collect the following information about you:

• Your full name – to set up your membership account with us
• Your date of birth – if you wish to apply for an under 25 or senior membership. Otherwise, providing your date of birth is optional.
• Your full address – to contact you about your membership and set up membership payments
• Your email address (if you provide one) – to contact you about your membership
• Your bank/card details – to process your membership payment
• Your contact telephone number – to contact you about your membership

It is necessary to process this information to fulfil our membership terms and conditions to you. Our legal grounds in relation to this processing is contract, in that the processing is necessary for the performance of a contract (your membership) to which you are party.

We will also use your address to send you other postal communications about the Trust (including our membership magazine and ways that you can support our cause) because we consider it to be of interest to you and that you would reasonably expect to hear from us about these activities. If you would prefer not to receive these communications, you can let us know at any time. Our legal grounds in relation to this processing is legitimate interests.

If you have provided us with an email address, we will also send you other communications about the Trust if you have told us that you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

Donating to the Trust

When you donate to the Trust, we will collect the following information about you:

• Your name – to say thank you, retain a record of your donation and, if eligible, to reclaim gift aid
• Your address – to say thank you, retain a record of your donation and let you know what your donation enables
• Confirmation that you are a UK taxpayer (if claiming gift aid) – to reclaim gift aid
• Your bank details/card/cheque details – to process your donation
• Your telephone number (optional) – to say thank you and to let you know how you might be able to support us in other ways

We collect this information from you if you directly donate to us and through third party fundraising platforms. For information about how these third parties process your personal data in compliance with data protection laws, please refer to the privacy policies on their websites.

We may use public telephone directories to contact you. We will always check the Telephone Preference Service (TPS) before doing so and will tell you when we call you if we have obtained your telephone number from a public directory. You can opt out of receiving these calls from us at any time.

In line with our Donation Acceptance and Refusal Policy, where required, we will carry out due diligence on donations pledged or received. These due diligence checks will include looking at professional biographies, giving information on the source of the wealth, what sectors/industries a donation has come from, and a general assessment of publicly available news media to check there are no reputational issues we should be aware of that may cause our Trustees to turn down a proposed gift.

When we process your information for the purposes of retaining accurate records or reclaiming gift aid, we do so in line with the Charities and Trustee Investment (Scotland) Act 2005 and the Finance Acts of 2005 and 2010. Our legal grounds in relation to this processing is legal obligation in that it is necessary for evidencing compliance with the legislation. This information will be retained for 6 years from the end of the financial year in which the last donation payment was made.

When we process your information for the purposes of contacting you to say thank you, let you know what difference you make to our work, what we are working on and how you can support us to achieve even more, our legal grounds are legitimate interests because we think you would expect to hear from us about this and it is of interest to you. If you would prefer we did not contact you, you can let us know at any time. We will contact you for up to 6 years after your last donation. After this time, you will no longer hear from us unless you have provided your consent.

If you have provided us with an email address, we will also contact you with other communications about the Trust if you have told us that you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

Letting us know you are interested in supporting us with a gift in your Will or have already included a gift to the Trust in your Will

When you let us know of your plans regarding a gift in your Will to the Trust, we will process the personal data and information shared for the purposes of saying thank you and letting you know what difference your support makes to our work, what we are working on through general news and updates, communicating with you about gifts in Wills, and other ways you can support us. Our legal grounds for this are legitimate interests, because we think you would expect to hear from us about this and it is of interest to you. If you would prefer we did not contact you, you can let us know at any time.

Registering for a My Trust account

When you register for a My Trust account on our website, we will collect the following information from you:

• Your full name – to set up your online account with us
• Your email address – to enable you to log in to your account online
• Your chosen account password – to enable you to log in to your account online
• Your postcode – to enable us to link your account to your record

Our legal grounds in relation to this processing are our legitimate interests, in that we consider it necessary to process your information to provide you with an online account and to ensure that we can link your account to your record.

When we use your email address to send you other communications about the Trust we do so because you have told us that you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

Purchasing a product from our gift shops or online

When you purchase a product from one of our gift shops or online we will collect the following information from you:

• Your payment card details (if paying by credit or debit card) - to pay for the products or services ordered
• Your email address (for online purchases only) – to send you a copy of your order confirmation and, if you have provided consent, to send you information about other National Trust for Scotland products or services, or other ways you can support us
• Your telephone number (for online purchases only) – to contact you regarding your order
• Your address (for online purchases only) – to deliver your order

Our legal grounds in relation to this processing is contract, in that the processing is necessary for the performance of a contract (the provision of the product or service).

If you have a My Trust account and are logged in when you purchase a product, we will retain a record of the transaction on your record. Our legal grounds in relation to this processing is our legitimate interests because we think you would expect us to retain this information in order to better understand and support your relationship with us.

If you are a member, when you purchase a product at one of our properties, we will also ask for your membership number to record the purchases you have made. Our legal grounds in relation to this processing is our legitimate interests in that the information is necessary for statistical analysis to monitor general usage and benefits of your membership.

If we use your personal information to tailor our communications to you, for example by letting you know that we have certain offers available on similar products or services, we will only do so because you have told us you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

If we use your address details to send you information about other products or services we have available, or other ways you can support us, our legal grounds in relation to this processing is our legitimate interests because we think you would reasonably expect to hear from us and it is of interest to you. If you would prefer we did not contact you in this way, you can let us know at any time.

Visiting our properties and places

If you are a member, when you visit a Trust property or place we will collect the following information from you:

• Your unique barcode or membership number and the date of your visit – for the purposes of facilitating entry to a property or place

Our legal grounds in relation to this processing is contract, in that the processing is necessary for the performance of a contract (the provision of your membership) and to validate your membership at the point of entry.

When you visit a property or place, we will also use this information for statistical analysis to monitor general usage and benefits of your membership. Our legal grounds in relation to this processing is our legitimate interests in that the information is necessary to understand general usage of the membership.

If we use this data to tailor our communications to you, for example by letting you know about similar properties or places that you might like to visit, we will only do so because you have told us you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

We may also invite you to complete a feedback survey. Completion of surveys will be entirely optional, and we will tell you every time what the purpose of the survey is and how we will process your data. Our legal grounds for this processing are our legitimate interests so we can understand how we are performing and where we can improve.

We operate CCTV/video surveillance cameras at some of our properties. CCTV is used for maintaining the security of property and premises; for preventing and investigating crime; and for detecting, apprehending and prosecuting offenders.

If CCTV is in operation, appropriate signage will be in place and the operating procedures will be regularly audited by the property manager to ensure compliance with relevant standards and legislation.

Where we host a CCTV system for which another organisation is responsible, there will be an agreement in place to cover:

• agreed responsibilities for compliance with data protection law
• named contacts responsible for the operation of the CCTV system in each organisation
• a procedure for handling requests for access to CCTV footage

Photography and filming

If we plan to take photographs or film individuals or small groups during a visit or at an event you have booked, we will ask for your consent to take and use these images, before doing so. You have a right to withdraw your consent at any time, but you should note that it might be difficult to remove images if they have been published.

If we plan to take photographs or film large events, we will inform you that photography or filming is due to take place at the point of booking and will ensure there is clear signage on the day. If you would prefer not to be included in any images, or do not want your image to be published, please contact us and we will find ways to manage this carefully on the day.

Contacting us with enquiries

When you contact us with an enquiry, we will collect the following information from you:

• Your name – to effectively process your enquiry
• Your preferred contact details – to respond to your enquiry
• The details of your enquiry – to respond to your enquiry
• Your membership number (if applicable) – to retain a record of queries you have raised with us
• We may also ask for your email address and postcode if you do not know or have a membership number, to help identify you, but this is optional.

When we process information about you to respond to comments, questions and queries you have raised with us, our legal grounds for processing are our legitimate interests in that it is necessary to process your information to effectively respond to your enquiry and manage any additional enquiries in future.

If you call us with a general enquiry, other than renewing a membership, we will use a third party to handle your call. They will collect the same categories of data as highlighted above and will record all calls to verify our quality of customer service. This is for the purposes of improving our customer service and enabling us to follow up when problems arise.

Surveys and feedback

When we conduct research and surveys with you that involve the processing of your personal data, we will collect the following information from you:

• Your name – to record your feedback and respond to any feedback and comments raised
• Your comments, opinions and views – in support of the survey aims and to improve our communications, experiences and operations, ensuring they continue to meet your expectations
• Your email address – to communicate with you regarding your feedback or to send newsletters (if you have provided consent)

When we process the above information about you, our legal grounds for processing are our legitimate interests in that it is necessary to respond to feedback and improve our communications and experiences. If we ask for special category data (eg your ethnic origin) we will inform you of the purposes at the time of data collection and we will only process this data with your consent.

Research and profiling

The work of our charity is only possible thanks to the generosity of our supporters and the work of our volunteers, employees and Trustees – so it’s vital that our fundraising, marketing and communications efforts are as effective as they can be. By developing a better understanding of our supporters through analysis of information provided to us, surveys and interviews carried out with individuals directly, and research using publicly available sources, we can build a profile to help us tailor and target our activities and communications, allowing us to be more efficient and cost-effective with our resources, encouraging new supporters to get involved and providing more relevant digital content.

When we use data which you have provided to us and combine this with information from publicly available sources, we do so to create a fuller understanding of your interests and support of our charity and other organisations. We avoid any data that we believe has not been lawfully or ethically obtained, and we do not use information sources which have not been made public. When we estimate your gift capacity, based on your visible assets, history of charitable giving, we do so to understand how connected you are to us and to ensure that we present you with options to make a difference, or request that you become engaged with our charity in the most appropriate way.

We know it’s important to you that we use our resources in a responsible and cost-effective way. Therefore, we use profiling and targeting to help us ensure that:

• our communications (for example emails) and services (for example our website) are relevant, personalised and interesting to you
• our services and activities meet your needs, likes and interests, and help us reach new audiences
• we understand what matters most to you and where we should focus our strategic and corporate planning
• we only ask for further support and help if it’s appropriate
• we use our resources responsibly and keep our costs down

To do this, we’ll analyse how you interact with us (for example on our website through heatmaps and recording which parts of the site you have interacted with), donations made or at the places where you use your membership card; and use both geographic and demographic information to improve our communications, advertising, marketing and fundraising.

We will also analyse how you interact with our emails, for example analysing open and click-through rates to understand how effective our email communications are and what stories/articles are of most interest to you.

The personal information we collect for profiling purposes includes transactional information (for example, order number) for membership subscription, membership card scans, donations and fundraising products, renewals, holiday bookings and online shop purchases.

Much of the information we collect is aggregated, which means we look at it as a whole rather than at an individual level. However, we will also collect some personal data to personalise your experience, tailor our fundraising and marketing campaigns to your interests, and ensure the website is functioning as we want it to.

We use personal data to create profiles which help us target our communications to you. For example, we may use your interests to ensure you receive fundraising appeals to places/activity of interest to you, or your membership data to ensure you don’t see adverts about membership online.

We use your personal data to find online users with a similar profile to you who may also be interested in our appeals, products or services. If we collect publicly available data about individuals who do not have a relationship with the Trust, and we have not previously told them how we will process their personal data, we will inform them of this within one month of collection and we will tell them that they have the right to opt out of this data processing activity.

We won’t profile anyone under the age of 18.

When we carry out research using publicly available sources, or when combining data we hold about you with other data that is publicly available, our legal grounds are legitimate interests, in that we consider it necessary to better understand what is important to you so that we can use our resources as effectively as possible.

When we analyse how you interact with digital content, or emails we send to you, we will only do so with your consent. For further information about these activities and the use of cookies and analytics, please refer to our Cookies and Analytics Policy.

We’re committed to protecting your personal data and putting you in control of your data.

You can request a copy of any personal data held about you by contacting our Data Protection Officer. You can also opt out from profiling activities at any time.

Who will have access to your data and who will we share it with?

Access to your personal data will be restricted to Trust employees and volunteers on a need-to-know basis only. Access will be provided for the purposes of supporting you as a member or donor, understanding your interests and relationship with us and making sure we keep you informed about the things important to you.

We will never sell your data to third parties.

We will only ever share your information with third parties in relation to servicing your relationship with us and auditing our practice. To make your interactions with us as efficient as possible we will share your information with:

• Our call handling company – for the purposes of handling telephone enquiries regarding membership and donations
• Our website host – for the purposes of managing your My Trust account, facilitating donation payments and enquiries submitted through our website
• Our magazine auditors – for the purposes of verifying aggregated statistics about circulation and usage of our magazine or review our policies, processes and procedures for compliance with relevant advertising standards. Please refer to their Privacy Policy for further information.
• Our affiliate marketing partner – for the purposes of recording, validating and reporting on successful transactions after clicking on a Trust advertisement on another website. Please refer to their Privacy Policy for further information.
• Our payments processors – for the purposes of processing secure card payments at tills, contactless points and online. Please refer to the Privacy Policies of Sage Pay, Worldpay and Verifone for further information.
• Our electronic newsletter provider – for the purposes of delivering our newsletter and gathering statistics around email opening and clicks to help us monitor and improve content
• Our core systems provider – for the purposes of maintaining accurate supporter records
• Our survey provider – for the purposes of collating and reporting on any feedback you provide
• Our research partners – for the purposes of conducting research on our behalf
• International National Trust Organisations – for the purposes of confirming your active membership with the National Trust for Scotland, to enable you to access other National Trust organisations around the world. Please note that we will not disclose any other information about you other than confirm your membership, in the event that you have forgotten your National Trust for Scotland membership card when you visit another international National Trust organisation.
• Our data quality partners, including postcode lookup agencies and address verification providers – for the purposes of ensuring we collect and process accurate address data

Where these third parties are acting as data controllers, they are required to handle your personal data in accordance with all applicable data protection laws. For further information about how they do this, please refer to their privacy policies.

Where the third parties are acting as data processors, processing personal data on behalf of the Trust, we have contracts in place with these third parties which require them to process your personal data on our instructions only. They will not process your personal data for any other purpose and they will retain it securely.

If you are a member of our Patrons’ Club, we will also share your information with the NTS Foundation USA. Our legal grounds in relation to this processing is our legitimate interests, in that it is necessary to build and maintain an international collective of supporters.

In some cases, your data will be processed outside of the UK. Where this is the case, we will ensure that there are adequate safeguards in place (for example, the use of Standard Contractual Clauses and International Data Transfer Agreements) for the protection of your personal data.

Facebook Ads

Facebook Ads are used by the National Trust for Scotland to advertise the work we do and how you can help us. Each Facebook Ad may advertise different areas of work we undertake to help protect the natural and cultural heritage of Scotland.

When completing a Facebook Ad form, you will be asked for your consent for Facebook to share the personal information entered in the form with the National Trust for Scotland. This allows us to contact you to discuss your interest further. You may provide such information as:

• Your full name – to allow us to use your name when contacting you
• Your full address including postcode – to contact you about the Facebook Ad you were interested in
• Your email address – to contact you about the Facebook Ad you were interested in
• Your contact telephone number – to contact you about the Facebook Ad you were interested in

When we process your information for the purposes of contacting you to discuss the Facebook Ad further, let you know what difference you make to our work, what we are working on and how you can support us to achieve even more, our legal grounds are legitimate interests, because we think you would expect to hear from us about this as you have asked us to contact you.

The data will be retained in line with the Trust’s Records Retention Policy.

If you would prefer we do not contact you, you can let us know at any time by emailing dataprotection@nts.org.uk

Facebook will process the personal information collected on their own platform and channels via lead ad forms. Facebook are a separate controller of the data collected via National Trust for Scotland Facebook Ad lead forms. Please see their Privacy Policy for further information.

How long will we keep your personal data?

• Information held on your record (including contact details, donations made, enquiries): 6 years from the end of our financial year
• Recorded calls: 3 months
• Email address and password for My Trust account: held for as long as the account exists
• Credit/Debit Card payments: held until the transaction is successfully completed
• Bank details (account number and sort code) where a regular Direct Debit is arranged: 6 years from the end of our financial year during which the Direct Debit came to an end
• CCTV images: one calendar month, unless a crime or incident has been reported and the images are to be retained in line with the investigation. Also, if we receive a request for access to CCTV images, a copy of the images provided will be retained for 2 years.
• Photographs/video footage: permanently unless you ask us to delete your information