Privacy

POLICY

Introduction

We take the security and privacy of your personal information very seriously. This privacy policy will give you a clear understanding of what kinds of personal information we collect, how we use the personal information that you provide and our measures for protecting it. The policy will also outline your subject access rights and the options you have to control your personal information and protect your privacy.

General privacy POLICY

Policy Content:

1. Who We Are
2. Personal Information We May Collect About You
3. How We Collect Your Personal Information
4. How We Use Your Personal Information
5. How We Protect Your Personal Information
6. Who We May Share Your Personal Information With
7. How Long We Keep Your Personal Information
8. Information for Job Applicants
9. Information for Former Employees
10. Your Individual Rights
11. Our Cookies
12. Social Media
13. International Transfers
14. Contact Us

1. Who We Are

This privacy policy applies to Buccleuch Living Heritage Trust (“BLHT”) and its subsidiaries and affiliated entities, and are collectively referred to as Buccleuch Living Heritage Trust (“BLHT”),” “we,” “us” or “our” in this policy.

This website is operated by Buccleuch Living Heritage Trust (“BLHT”) .Certain processing activities, including customer relationship management, marketing administration, reporting and IT systems management, are undertaken jointly with or under the direction of MDS Group Investments Ltd, therefore your information may be shared with MDS Group Investment Ltd for these legitimate purposes.

Where Buccleuch Living Heritage Trust (“BLHT”)  is not the ultimate parent company, Buccleuch Living Heritage Trust (“BLHT”) and Buccleuch Estates Limited act as joint controllers of your personal information for the purposes described above. For all other processing carried out on this website, Buccleuch Living Heritage Trust (“BLHT”) is the sole data controller of your personal information.

Buccleuch Living Heritage Trust (“BLHT”) is registered with the Information Commissioner’s Office (ICO) as a data controller, registration number [ICO registration number – to be confirmed]. You can check our registration on the ICO’s public register.

Any questions in relation to this privacy policy should be sent to dataprotection@buccleuch.com or addressed to Data Protection, 27 Silvermills Court, Henderson Place Lane, Edinburgh, EH3 5DG.

2. Personal Information We May Collect About You

We will only collect the personal information that we need, and this may include:

• Information about who you are e.g. your name, date of birth and contact details
• Information in connection with specific activities such as event registration, donations, volunteering, employment etc.
• Information about your correspondence with us e.g. meetings, phone calls, emails/letters
• Information that is automatically collected e.g. via cookies when you visit one of our websites
• Information that is automatically collected via log files e.g. IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
• Information if you visit one of our sites e.g. visual images collected via (CCTV)
• Information classified as ‘sensitive’ personal information e.g. relating to your health, marital or civil partnership status. This information will only be collected and used where it is needed to provide the product or service you have requested or to comply with our legal obligations.

3. How We Collect Your Personal Information

We collect your personal information in a number of ways, and depends on how you interact with us.

• When you contact us (email, call or write to us).
• When you register for an event or sign up for one of our services.
• When you visit our website or engage with our social media channels.
• When you sign up to receive email updates or our e-newsletter subscription list.
• When you participate in any of our competitions or promotions.
• When you make a purchase from us.
• When you apply for a job or volunteer for us.

4. How We Use Your Personal Information

We take your privacy and the protection of your personal information seriously, and we will only ever collect and use personal information where it is necessary, fair and lawful to do so.  We’ll collect and use your personal information for a variety of different purposes, including:

• To respond to any correspondence including your requests, enquiries, or comments.
• To engage with you in relation to any events, promotions, services, etc., that you have signed up for.
• To send you marketing communications on the provision that you have provided consent to receive them, or where we are otherwise permitted to do so by law. You can opt out of receiving marketing from us at any time.
• To process any applications that you send us; volunteering applications, etc.

5. How We Protect Your Personal Information

We take the security of your personal information very seriously. We have adopted appropriate safeguards to ensure the data we collect, store or process, whether on paper, online or any other media, is protected in line with our data protection obligations.

We have implemented appropriate technical and organisational security measures, including on-going training, to protect your personal information against any unauthorised or unlawful processing and against any loss or damage through accident, negligence or deliberate actions.

Our security measures have been developed in line with industry standards and good practice, safeguarding against the risks to the privacy, integrity and availability of your personal information.

6. Who We May Share Your Personal Information With

We do not sell your personal information; however, we do share it with third parties when necessary. When sharing your information, we ensure to maintain control of what they can access, how long they can access and what they are permitted to do.

Where necessary, personal information collected and processed by us may be shared with the following:

• MDS Group Investments Ltd employees and volunteers.
• Third party hosting and IT infrastructure providers who host the website and provide IT support in respect of the website.
• Third party marketing communication providers.

7. How Long We Keep Your Personal Information

We will only use and store your information for as long as it is required for the purposes it was collected for. How long it will be stored for depends on the information in question, what it is being used for and, sometimes, statutory legal or regulatory requirements.

We look to find ways to reduce the amount of information we hold and the length of time that we need to keep it. For example:

• We aim to utilise a paperless approach where possible and securely destroy any paper correspondence we receive in accordance with our data retention policy, with the exception where we are required to retain it for evidential or legal purposes.

• We retain a marketing suppression list of individuals who no longer wish to be contacted by us indefinitely. We require this information to comply with their wishes not to contact them in future.

8. Information for Job Applicants

As part of our candidate application and recruitment process we will only collect, process and store personal information about you that is required to manage and progress your application, consider your suitability for employment, respond to queries, consider you for alternative roles, demonstrate a fair recruitment process or as required by law or other regulatory obligations.

Information we collect will include your name and contact details, work history, education history and professional qualifications and skills, former employer feedback, right to work information, photographs or images from onsite CCTV if you attend an interview, results of pre-employment screening checks such as criminal records checks where permitted under law, assessment results e.g. psychometric assessment results where applicable; and any other information you provide directly, via an agency or is provided by a referee on your behalf.

We may also collect, process and store personal information relating to your health or disability in order to make reasonable adjustments to enable you to apply for a role and to assess adjustments required to fulfil the requirements of the role.

We will share your information internally within the HR team and with managers or other employees who are involved in the recruitment and selection process.  In some cases we may need to share your information with third parties including:

• Companies who provide assessment services
• Organisations who carry out background checks permitted within the law, such as criminal record or fraud checks
• Academic institutions in validating information you have provided about your qualifications
• Referees that you provide in order to obtain a reference
• Our employment lawyers if we are required to demonstrate a fair recruitment and selection process
• Other third party organisations who provide services that allow us to determine the suitability of your appointment to a role.

For unsuccessful candidates, we will store your data for up to one year in order to be able to demonstrate a fair recruitment process, respond to your queries and consider your suitability for alternative roles.

For successful candidates, information collected during the recruitment process will form part of your employment record and held in accordance with an employee privacy notice that we will make available to you.

9. Information for Former Employees

When your employment ends, we will store your data gathered throughout your employment for up to 7 years, and in some cases beyond.  Your data may include some or all of:

• Your contact details
• Personal details such as marital status, sex, nationality and date of birth
• Evidence of your right to work in the UK
• Your employment history, contractual changes and information relating to your education, qualifications, professional membership and training
• Information about your performance
• Absence records
• Information relating to your beneficiaries, emergency contacts and dependent children
• Financial data, including your bank account details, pension records, payroll records, payments we have made to you, deductions (both statutory and voluntary), wages arrestment orders and national insurance and tax records
• Your image by way of photographs or captured by CCTV
• Criminal convictions (where permitted by law)
• Information about health conditions and disabilities
• Details of any disciplinary or grievance matters you were subject to or witness to
• Membership of employee benefit schemes.

This information will have been collected during your employment from you, your manager or other appropriate employee, or third party organisations such as HMRC or DVLA.

We will retain this information after your employment for up to seven years in order to communicate with you as required, provide references on your behalf, comply with our statutory or regulatory obligations, fulfil outstanding contractual obligations with you, defend a claim made against us and otherwise in the legitimate interests of our business in compliance with GDPR.

We will retain information beyond seven years if required to comply with a statutory or regulatory obligation to do so, for example, information relating to pension records, certain safety training or records of accident or injury you were involved in or witness to; and in order to provide a reference when your new employer requests one from us.

Your information is retained in order to fulfil any statutory or regulatory obligations, demonstrate compliance with statutory or regulatory obligations and to defend any action brought against the company relating to you, or a matter you were involved in or witness to, and in the legitimate interest of our business as defined by GDPR.

We may share your information with third parties after your employment where there is a statutory or regulatory obligation for us to do, when asked to provide a reference or with our legal advisors in so far as the information relates to a legal matter or claim against us.

10. Your Individual Rights

There are several rights as a customer, visitor, job applicant, former employee or any other type of data subject, you have to gain access to or amend the information that we hold on you. These rights are:

• Right to be Informed;
• Right of Access to your data;
• Rights related to automated decision making including profiling;
• Right to object;
• Right to be forgotten / erasure;
• Right to data portability;
• Right to restrict processing;
• Right for your information to be rectified

If you would like further information on your rights, or you wish to exercise the rights mentioned above then please do not hesitate to contact us at:

Data Protection,

27 Silvermills Court,

Henderson Place Lane,

Edinburgh,

EH3 5DG

Or email us at: dataprotection@buccleuch.com

11. Our Cookies

Cookies are small, often encrypted, text files, which are stored on your computer when you visit some websites. They are used to remember useful information which allows certain functionality within the website to work, for example remembering where you have reached within an order process, or if you’ve logged in to a site. Cookies can’t harm your computer.

Types of cookies we use

• Strictly necessary cookies – required for the website to function (for example, remembering items in a booking basket or keeping you logged in). These do not require your consent.
• Functional / preference cookies – remember choices you make (such as language or region) to improve your experience.
• Analytics / performance cookies – help us understand how visitors use our websites (for example, Google Analytics), so we can improve them. These require your consent.
• Targeting / advertising cookies – used to show you relevant advertising on social media and other websites (for example, the Meta/Facebook Pixel), and to measure the effectiveness of our marketing. These require your consent.

The table below sets out the main cookies currently used on our websites.

How we obtain your consent

Our websites do not currently use a cookie consent banner. Under the Privacy and Electronic Communications Regulations (PECR), we need your consent before we (or third parties on our behalf) set analytics or targeting/advertising cookies on your device – strictly necessary cookies are the only ones that do not need consent. Until a consent management tool is implemented, non-essential cookies must not be set before a visitor has given consent; we recommend this is treated as a priority action for the website team. In the meantime, you can prevent non-essential cookies being set, or delete them, using the browser controls below.

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org.

Find out how to manage cookies on popular browsers:

Google Chrome

Microsoft Edge

Mozilla Firefox

Microsoft Internet Explorer

Opera

Apple Safari

To find information relating to other browsers, visit the browser developer’s website.

To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.

You can opt out of Meta/Facebook advertising cookies through your Meta Ad Preferences, and manage many other companies’ advertising cookies in one place at Your Online Choices. For more general guidance on cookies, see the ICO’s guide to cookies and similar technologies.

12. Social Media

We maintain profiles on a number of social media platforms to share news, promote our events and engage with our visitors and customers, including Facebook, Instagram, LinkedIn, YouTube and TikTok.

When you interact with us on social media – for example, by following, liking, commenting on or sharing our content, entering a competition, or sending us a message – we may collect and use information about that interaction (such as your username, public profile information and the content of your message) to respond to you, to run our social media activity and to understand how it is performing.

Each social media platform is a separate and independent data controller of the personal information it collects about you, and processes it in accordance with its own privacy policy, not this one. We encourage you to review the privacy settings and policy of each platform you use:

• Facebook
• Instagram
• LinkedIn
• YouTube
• TikTok

Where we embed social media content on our websites (for example, an embedded YouTube video or a social media feed), the relevant platform may set its own cookies and collect information about your visit, even if you do not interact with the embedded content directly – see Section 11 (Our Cookies) for more information.

We may use social media advertising tools, such as Facebook/Meta Ads, to promote our content to people who may be interested in it, based on information provided by the platform. You can control the advertising you see, and how your data is used for this purpose, through your settings on each platform.

Links to other websites

Our websites may contain links to third-party websites, including our social media pages. We are not responsible for the privacy practices or content of third-party websites, and we encourage you to read the privacy policy of any website you visit via a link from our site.

13. International Transfers

We may use technology and cloud-based service providers that store, process or access personal data outside the United Kingdom. Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place in accordance with UK data protection law, such as transfers to countries recognised as providing an adequate level of protection or the use of approved contractual safeguards.

14. Contact Us

If you have any questions, would like to report a problem or exercise your subject access right, please contact us by email at dataprotection@buccleuch.com or in writing at:

Data Protection,

27 Silvermills Court,

Henderson Place Lane,

Edinburgh,

EH3 5DG.

If you are unhappy with how your data has been handled, we encourage you to contact us in the first instance so that we can investigate and resolve your concern.

Please contact us using the details above and provide as much information as possible about your concern. We will acknowledge your complaint and aim to respond within 30 days.  More information about our complaints policy can be found here.

If you remain dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters. Further information is available at www.ico.org.uk.

Review

This Policy will be reviewed, and if appropriate updated annually.

This Policy was last updated on 25 August 2026.