Privacy Information Notice
The National Wallace Monument (Stirling) is managed and operated as a heritage attraction by Stirling District Tourism Ltd. (SDT).
SDT recognises the importance of respecting and protecting the privacy of visitors, customers, suppliers, and of the other different organisations with which it interacts.
This Privacy Information Notice is applicable to all visitors to The National Wallace Monument website, and it is designed to provide essential information regarding the procedures which SDT has put in place for the processing of personal data.
If you have any queries regarding the use of personal information by SDT, these should be sent to firstname.lastname@example.org, or you can call (01786) 472140.
This Privacy Information Notice covers:
- Who We Are
- How We Collect or Receive Information
- Access to Personal Information
- Your Options
- The ‘Right to Erasure’
- Accessing and Updating Personal Information
- Security Precautions In Place to Protect The Loss, Misuse or Alteration of Personal Information
- Links to Other Websites
- Persons Aged Under 16
- The Transfer of Data Outside the EU
Who We Are
Stirling District Tourism Limited is a registered Scottish charity (No. SC023597), and a company limited by guarantee (No. 156924). SDT is responsible for the management and operation of The National Wallace Monument as a visitor attraction, under a Lease Agreement with the owners of the building (Stirling Council).
The Information Access Manager for SDT is Ken Thomson, Stirling District Tourism Ltd., Room 38, Enterprise House, Stirling FK7 7UF.
How We Collect or Receive Information
There are a number of different bases on which Personal Information can be collected, and these are summarised here.
|User Group||Collection Method||Content||Information Use||Processing Base(s)||Retention Period|
|Website Visitors||Advance ticket purchase; subscriptions and donations; enquiries; responses to surveys, competitions, etc.||Personal and Company Contact Details, Payment Details, etc.||Process orders, reservations or donations, process competition entries, respond to communications and enquiries, capture data for analysis and statistical purposes. (Information may be processed through 3rd parties. Information will not be used for remarketing).||Contract; Legal Obligation; Legitimate Interest||Transactional information (including financial data) will be retained for up to 8 years. All other information will be retained for up to 14 months from last interaction.|
|Attraction Visitors||Competition Entries; Feedback forms; etc.||Personal contact details, photographs and film footage, and CCTV images.||Processing competition entries; obtaining visitor feedback; marketing activities; visitor safety and security.||Consent; Legitimate interest||Whilst information remains valid. CCTV images are retained for up to 18 days.|
|Members||Completion of Membership Application Form||Name, Address
|Process Gift Aid claims with HMRC; Carry out our obligations to members.||Legal Obligation; Contract; Legitimate Interest.||Up to 8 Years from Expiry of Membership.|
|Visiting Groups and Tour Guides||Direct enquiries (via E-mail, Telephone, or Post)||Personal and Company Contact Details.||Carry out obligations under applicable contracts.||Consent; Contract; Legitimate Interest.||Up to 3 Years from last visit. Data archived for up to 8 years and then destroyed.|
|Corporate and Social Event Customers||Direct enquiries (via E-mail, Telephone, or Post)||Personal and Company Contact Details.||Carry out obligations under applicable contracts.||Contract; Legitimate Interest.||Up to 3 Years from date of enquiry or event.|
|Wi-Fi Service Users||Wi-Fi in Legends Coffee House.||Device type and Operating System.||Retained in system only.||Legitimate Interest.||Up to 8 days from date of use.|
|Subscribers||Online data collection (including opt-in facilities).||Name, and E-mail Address.||Newsletters and other information.||Consent.||Up to 12 months from last interaction, as of May 2018.|
|Donors||Various||Personal Contact Details||Record and acknowledge donation||Contract; Legitimate Interest; Legal Obligation||8 Years (Archived thereafter).|
|Other||General enquiries and communications received via e-mail, telephone, social media channels, etc.||Personal contact details.||Respond to communication(s) and requests||Legitimate Interest||Whilst the business issue remains valid. Thereafter data will be destroyed or archived.|
Access to Personal Information
Personal information will be accessible and available internally for use by SDT in carrying out relevant processes and activities. SDT will take all reasonable steps to ensure that personal data is safe and secure. Information will only be shared with external organisations and 3rd parties for SDT’s operational and marketing purposes. Data provided will never be shared with external companies or 3rd parties for other marketing purposes unless it is specified at the point of data collection.
Personal information may be provided to service providers, sub-contractors and to other organisations for the purpose of completing tasks and providing services such as processing orders and sending communications. Where external service providers are used by SDT, only the information which is required for delivery of the service is disclosed. SDT will only use service providers that have adequate measures in place to ensure the protection of personal information.
SDT recognises your entitlement to privacy, and accepts that you will always be able to choose whether or not to receive information from the organisation. This does not affect the service provided to customers and visitors, and you may still receive communications which are required for SDT to complete orders and transactions, respond to enquiries, etc.
You will always be able to unsubscribe from communications which you have previously consented to receive, and you can also contact SDT via email@example.com to request a change in your contact settings.
The Right to Erasure
You have the right to request the deletion or removal of personal data, and this must be carried out where:
- The data is no longer necessary in relation to the purpose for which it was originally collected or processed.
- You withdraw consent for the data to be used, or you object to the processing of data and there is no overriding justification for it being processed.
- Your personal data was unlawfully processed based on its collection method.
- The time period for the use of data on legal or contractual grounds has expired.
The right to erasure may not be available in circumstances where (e.g.) personal information is needed to meet legal requirements. In such circumstances the data will be used for no purpose other than compliance with legal obligations, and it shall not be retained thereafter.
Accessing and Updating Personal Information
You have the right to request details of your personal information as it is held by SDT. This can be requested by completing the form which is available here. Requests should be forwarded to firstname.lastname@example.org, or addressed to:
Stirling District Tourism Ltd., Enterprise House, Springkerse Business Park, STIRLING FK7 7UF.
Every effort will be made to provide the information in the form requested. Information can also be provided to a third party, where this is requested, and where the necessary information is provided.
The accuracy of personal information is important, and any errors in the data should be notified to SDT as soon as is practically possible. (SDT will carry out identity verification checks before releasing or amending personal information).
Security Precautions In Place to Protect The Loss, Misuse or Alteration of Personal Information
SDT will take the necessary precautions to ensure that any personal information is treated securely, and in line with the policies in this Notice. The company uses approved and recognised systems to protect sensitive information such as credit card or debit card details.
SDT will take reasonable measures to protect information transmitted via the internet, but the security of data distributed by this means is not guaranteed.
SDT has procedures in place to protect documents and records held by the company, either in printed form or in computerised databases. Access to such information is restricted to those employees who need to use this data to carry out their duties.
Links to Other Websites
Persons Aged Under 16
SDT does not knowingly send any marketing communications to persons aged under 16 years. In subscribing to the National Wallace Monument Mailing List you are acknowledging that you are over the age of 16 years. Persons aged under 16 should seek the consent of a parent or guardian before entering into any online transaction(s).
The Transfer of Data Outside the EU
SDT aims to store and maintain personal information within the UK or the EU. However this may not be possible on every occasion, and it is possible that data may be stored in a server in a country outside the UK or the EU. In such circumstances SDT will carry out the necessary checks to ensure that data is adequately protected, and that the privacy rights outlined in this policy are protected.
Complaints regarding the use of personal information, or any part of this policy, should be addressed to email@example.com
If you are not satisfied with the response to your complaint you can contact the Information Commissioner’s Office at the following address:
Information Commissioner’s Office
45 Melville Street
Edinburgh EH3 7HL
Tel: 0303 123 1115
You can also contact the ICO at:
Stirling District Tourism Privacy Information Notice
23 May 2018