Privacy Policy

New Lanark Privacy Policy

PRIVACY POLICY

1. General

This notice describes how New Lanark Trust, New Lanark Hotels Ltd, New Lanark Trading Ltd and New Lanark Homes process your personal data, as a Controller. You have the right to object to some of the processing which the New Lanark group carries out. More information about your rights and how to exercise these is set out in the section headed “Your rights” below.

This notice applies to:

 Anyone making a booking;

 Guests;

 Members;

 Visitors;

 Callers; and

 Other customers.

And anyone contacting, visiting or using our:

 Websites;

 Hotel, Waterhouses, Hostel;

 Leisure Suite;

 Visitor Centre; and

 Village

2. Summary of the purposes for processing your personal data and the legal basis for doing so:

 We process personal data to make, amend and administer bookings, provide hotel, leisure and visitor attraction services, process and store payment details and provide other products and services (such as meals). We also deal with enquires, gather customer feedback, undertake market research and direct marketing, in our legitimate interests to promote our business and improve our service and delivery.

 When booking with us, we don’t ask for accessibility, dietary, health or other sensitive personal data. If you (or someone on your behalf) do provide such information to us, please be aware we may need to ask for your explicit consent. In some cases, it may be permissible for us to have such data as it is in your vital interests that we do so.

 On our websites we use third party marketing and analytical cookies plus similar technologies are included in our marketing emails, as explained in our Cookie Notice below. You can reject and block cookies in your browser settings.

 When you post on social media about our business, we may use your contact details to respond to any complaints or comments, on the legal basis of our legitimate interests.

 In our legitimate interests, we also seek to prevent and detect crime as well as protect our business and premises.

 In order to fulfil the above purposes:

 We disclose your personal data to payment providers, technology providers, insurers, and other specialist professional and technical service providers and advisers, to manage your bookings, arrange payments, and provide services.

 We may transfer your personal data outside the European Economic Area (the EU Member States plus Iceland, Lichtenstein and Norway) and, where we do this, we will use safeguards to protect your data.

 We keep your data to enable us to fulfil our contract with you or to provide services, where required by law, to respond to a question or complaint, to obey rules about keeping records, to uphold or protect contractual or legal rights or where it is in your or another party’s vital interests or our legitimate interests. Where we process personal data on the basis of your consent, we will retain it for as long as required for the specified purpose. We also keep your data in line with any statutory limitation periods and for tax, legal or regulatory purposes.

3. Your rights

 Any consent(s) you give us may be withdrawn by you at any time.

 You have an absolute right to object to direct marketing at any time.

 You also have the qualified right to:

 request access, rectify, and erase your personal data, object to processing for any purpose where we rely on our legitimate interests as the legal basis;

 restrict processing; and

 supply or transfer your personal data in a portable format.

Where you exercise any of your rights, we will process your personal data to comply with your request in accordance with our legal obligations.

You have the right to lodge a complaint with a data protection supervisory authority of the EU Member State in which you are resident, work or in which your complaint arises. In the UK, the supervisory authority is the Information Commissioner.

If you wish to exercise your rights, please email trust@newlanark.org with details of your request. If you require further details of our Privacy Notice please read more below.

4. Personal information we collect

We collect personal information when you book with us or use our services. This includes hotel, restaurant and visitor centre visits, using our websites, or corresponding with us. We may also receive personal data about you from another source. This includes:

 Personal Identifiers - title, name, marital status, postal and email addresses, postcode, IP addresses and contact telephone numbers. We may also collect the names of those who are part of a group booking where necessary, and the age of children to meet your needs (e.g. to provide a cot or high chair) and enable us to confirm any restrictions that may apply to a booking;

 Business-to-Business Information - for corporate customers and corporate business leads and contacts: job title, business address and business email address;

 Transaction Information - payment, reservation and booking details, including meals, beverages & retail purchases;

 Customer special requests and feedback including complaints - via emails, surveys and online free text fields.

Third parties that we receive personal data from may include:

 Travel agents, booking agents, other agents, tour operators and schools;

 Corporate customers and public information sources such as Companies House;  Comparison and review websites;

 Social networks;

 Business Account management operators;

 Market researchers;

 Marketing service providers and advertising technology providers;

 Government and law enforcement agencies;

 Other licensees in accordance with licensing requirements; and

 Other hotel providers and other organisations as part of their contingency plans

5. How do we use your information, and what is the legal basis for this use?

 To fulfil a contract, or take steps linked to a contract. This is relevant when you want to make a reservation or booking with us; or receive other products and services from us such as meals or retail products and includes:

 making, amending or administering your booking and orders;

 providing products and services requested by you;

 verifying your identity;

 processing payments;

 communicating with you;

 providing customer services, including managing complaints; and

 alerting you by text, email or phone in the event of an unplanned , as a result of which we have to make alternative arrangements under our contract (or where we believe it is in your vital interests).

If the information we request is not provided, we may not be able to enter into or comply with a contract or our legal obligations.

In our legitimate interests regarding the conduct of our business, in particular:

Ensuring customer satisfaction, maintaining goodwill and dispute resolution

 we provide technical support and investigate and process any complaints about our website or our products or services, and to maintain appropriate records for internal administrative purposes. We reserve the right to request evidence to support any claims or complaints.

To protect our business and prevent fraud

 monitor, test and control the performance and security of our systems, networks, processes and premises to prevent and detect fraud and protect our business; and

 if you provide a credit or debit card as payment, we use third parties to check the validity of your bank account or card details in order to prevent fraud.

For business performance and improvement

 monitor and record CCTV for staff training, quality improvement purposes and establishing facts; and

 analyse transactions to enable us to improve our services and products and plan for our business.

Safety & Security of our Guests, Visitors and Employees

 to protect premises and for security purposes including information recorded from CCTV;

 to monitor food safety and hygiene;

 to obtain statements from witnesses to accidents and other incidents; and

 for the detection and prevention of crime.

Developing and Marketing Products and Services

 for raising brand awareness;

 to understand you better as a customer by analysing your transactions and other information you provide to us or which we learn through your interactions with us;

 for marketing, competitions and promotions by post and email where permitted to do so by law;

 we may use your data to provide personalised promotional offers to you; New Lanark Trust;

 we may also use your data to provide you with personalised promotional offers on selected partner websites (for example, you might see an advertisement for our products on a partner site such as Facebook and Google);

 we also share some of your information with marketing service and ad technology providers and digital marketing networks, such as Facebook and Google to present advertisements that might interest you.

 For example we may transfer information about you to such providers so that they may recognize your devices and deliver interest-based content and advertisements to you. The information may include your name, email, device ID, or other identifier in encrypted form. The providers may process the information in hashed form. These providers may collect additional information from you, such as your IP address and information about your browser or operating system; may combine information about you with information from other companies in data sharing cooperatives in which we participate; and may place or recognize their own unique cookie on your browser. These cookies may contain demographic or other data in de-identified form;

 for monitoring the use of our websites and apps in order to improve their performance and optimise our media spend;

 we use personal data of some individuals to invite them to provide feedback or take part in market research; and

 for developing corporate business and applying rates.

 responding to a rights request under data protection legislation.

Legal and Regulatory purposes

 in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with claims, legal process or litigation);

 to comply with health and safety legislation, including accounting for the number of individuals on our premises and logging accidents;

 to prevent, investigate and/or report suspected fraud, terrorism, security incidents or other crime, in accordance with applicable law; and

 to anonymise personal data when we no longer need to process it.

Where you give us consent:

 we will send you emails (including newsletters) in relation to products and services provided by us;

 when you use our websites, we place cookies and use similar technologies on your computer, mobile or other device and we use such technologies such as pixel tags and web beacons in marketing emails and communications (also see our Cookie Notice below);

 we may use credit checks if you apply for a Business Account;

 to participate in competitions we run and, if you win, to use your information for promotional purposes;

 we will process health information, such as dietary, accessibility, and allergy information you or a party on your behalf provides to us (we may also be able to do this where it is in your vital interests); and

 on other occasions where we ask you for consent, we will use the personal data for the purpose which we explain at that time. You have the right to withdraw consent at any time.

For purposes which are required by law:

 to record details of guests not resident in the UK;

 in response to requests by government, law enforcement authorities, or intelligence services and court orders;

 if required to comply with health and safety legislation to which we are subject;

 we may be required to share information with other licensees in accordance with local licensing requirements; and

 responding to a rights request under data protection legislation.

To protect your vital interests or those of another person:

 disclosing your personal data to the emergency services where we believe it is necessary to protect your vital interests or the vital interest of another person; and

 where you (or a person acting on your behalf) provide us with dietary or other personal health data such as allergies.

6. Other recipients that we disclose, transfer or share your personal data with.

Partner companies

When you book accommodation with us in some limited circumstances it may be provided by one of our partner Hotels/ B&Bs; in these cases, we will pass your booking details to the relevant company to fulfil your booking. Each of these companies use your details to provide the services and products requested with your booking and for the other purposes set out in this notice.

Service Providers

For some activities New Lanark Trust, Hotels, Trading and Homes use third party service providers. Your personal data will be disclosed to such organisations where this is necessary to provide a service to you, or where it is in our legitimate interests. For example, we use third parties to:

 administer bookings;

 provide Wifi;

 undertake customer feedback surveys;

 provide analytics;

send promotional offers;

 provide personalised advertisements;

 provide insurance;

 provide IT development, support, maintenance and hosting, including the provision of applications and website hosting;

 process payments to enable you to pay by credit or debit card; and

 provide credit checks and fraud checks.

Other parties

Personal data may be shared with regulators, government authorities and/or law enforcement officials for the prevention or detection of crime, if required by law or if required for a legal or contractual claim or regulatory purposes.

We disclose your personal data to payment providers, technology providers, insurers, and other specialist professional and technical advisers, to manage your bookings, arrange payments, and provide services.

International transfers

Sometimes we may need to send or store your data outside of the European Economic Area (the EU plus Iceland, Lichtenstein and Norway) (‘EEA’). For example, to follow your instructions, comply with a legal duty or to work with or receive services from our service providers who we use to help run your accounts and our services.

If we do transfer information outside of the EEA, we will make sure that it is protected by using one of these safeguards:

 Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA. Some countries have been deemed adequate by the EU.

 Put in place a contract with the recipient that means they must protect it to the same standards as the EEA or use other mechanisms and measures to achieve adequate protection. We also may use the Standard Contractual Clauses published by the EU.

 Transfer it to organisations that are part of Privacy Shield. This is a framework that sets privacy standards for data sent between EU countries and the US. It makes sure those standards are similar to what is used within the EEA.

 Binding corporate rules. These are internal rules adopted by group companies to allow international transfers of personal data to entities within the same corporate group located in countries which do not provide an adequate level of protection.

7. What rights do I have?

Withdrawing consent or otherwise objecting to direct marketing

Wherever we rely on your consent, you will always be able to withdraw that consent. We will continue to process your personal data for other purposes on a different lawful basis (other than consent) where that applies.

In some cases, we are able to send you direct marketing without your consent, where we rely on our legitimate interests. You have an absolute right to opt-out of direct marketing at any time. You can do this by clicking on the 'unsubscribe' link located in the footer of every marketing email or text.

Where you have a relationship with another organisation, such as a social media platform like Facebook, we may ask them to send marketing to you. If you object to receiving marketing from us we will stop marketing to you. However, please contact the organisation directly if you want to withdraw your consent to such organisation marketing to you.

Other qualified rights

 You have the right to know whether or not we process information about you and to access that information.

 You have the right to update, correct and complete any information we hold about you which is inaccurate or incomplete.

 You have the right to obtain the personal data you provide to us for a contract or with your consent in a commonly used, structured, and machine-readable format, and to ask us to share this personal data with another controller.

 You have the right to ask that we erase or restrict (stop active) processing of your personal data.

 In addition, you can object to the processing where the lawful basis is our legitimate interests.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person or you ask us to erase information which we are required by law to keep. Where you object to us processing personal information we may have a compelling justification for processing it. Relevant exemptions are also included within the data protection laws that apply in the UK. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, you can get in touch with us using the details set out below. If you have concerns, you have the right to complain to the data protection supervisory authority of the EU Member State in which you are resident, work or in which your complaint arises. In the UK, the supervisory authority is the Information Commissioner.

8. How long will you retain my personal data?

We keep your data to enable us to fulfil our contract with you or to provide services, where required by law, to respond to a question or complaint, to obey rules about keeping records, to uphold or protect contractual or legal rights or where it is in your or another party’s vital interests or our legitimate interests. Where we process personal data on the basis of your consent, we will retain it only for as long as required for the specified purpose. We also keep your data in line with any statutory limitation periods and for tax, legal or regulatory purposes.

The period for which we will retain your personal data depends on the purposes for which we are processing it and where the same personal data is processed for two or more purposes, we will retain it for the longest period; For example, we retain:

 CCTV recording for up to 31 days;

 until a period of 3 years has elapsed since your last interaction with us, personal data we process for marketing (including profiling) purposes, unless you ask us to stop sending electronic direct marketing, in which case we will act on your request, and then keep a record of your request indefinitely;

 accident report information for 40 years; and

 financial information for a period of 7 years, for accounting, business reporting, analysis and audit purposes.

In any of the cases mentioned above, we may retain the personal data for longer, if it is required for the purposes of any internal or external investigation or litigation; in these cases, it may be retained until the matter is resolved. We may keep your data for longer in line with any limitation periods, or if we cannot delete it, e.g. for tax, legal or regulatory reasons.

You have the qualified right to request deletion of your personal data at any time, or we may choose or be obliged to erase your personal data earlier, for example, if we no longer need to process it.

9. Cookies and other similar technologies we use.

Like many websites we use cookies to store and then retrieve small bits of information on your computer when you visit. This information is used to make the site work as you expect it to. It is not personally identifiable to you, but it can be used to give you a more personalised web experience.

Some of the information stored is put there by other companies whose software we have added to the site, and this can also impact your experience of other websites you may visit after leaving ours.

If you continue to use this site without taking action to prevent the storage of this information, you are effectively agreeing to this use.

If you want to learn more about the general uses of cookies, including how to stop them being stored by your computer, please visit Cookiepedia - all about cookies.

10. How do I get in touch with you?

General data protection queries If you have any queries about the way we process your personal data or want to exercise any of your rights, you can get in touch at trust@newlanark.org

This Privacy Notice was last updated on 24th May 2018. Any changes to this Privacy Notice will be communicated on our website.

DigiTickets Privacy Policy

Policy Owner

This policy is owned and distributed by IT and Compliance manager of Digital Ticketing Systems Limited

Who we are

In this Privacy Policy, references to "we", "us", and "our"" are to Digital Ticketing Systems Limited (Company number 07044584). References to "our Website" or "the Website" are to *.digitickets.co.uk.

Digital Ticketing Systems Limited is the data controller responsible for the personal information collected through this Website.

Information We Collect

We may collect and process the following categories of personal information:

Information You Provide Directly

When you contact us, make a purchase, register for services, or complete forms on our Website, we may collect information such as:

Name
Postal address
Email address
Telephone number
Purchase and booking information
Any other information voluntarily provided by you

Payment Information

Payments made through our Website are processed by authorised payment service providers. We do not store your full credit or debit card details on our systems.

Our payment providers may process payment information and carry out fraud prevention and verification checks. Where international transfers are required, appropriate safeguards will be applied in accordance with applicable data protection laws.

Digital Ticketing Systems is PCI DSS v4.0.1 compliant and are annually assessed/certified.

Website Usage Information

When you visit our Website, we may automatically collect:

IP address
Browser type and version
Device information
Screen resolution
Operating system
Referral source
Pages visited and actions taken on the Website
Date and time of access

Marketing Preferences

If you choose to receive marketing communications, we will record your preferences and any interactions with our emails, including whether emails are opened or links are clicked.

Cookies and Similar Technologies

We use cookies and similar technologies to operate our Website, remember your preferences, analyse usage, and improve user experience. Further information is provided in our Cookie Policy below.

How We Use Your Information

We process personal information for the following purposes:

To provide products and services you request
To process transactions and fulfil orders
To provide customer support and after-sales services
To manage bookings and accounts
To improve our Website, products, and services
To ensure Website security and prevent fraud
To comply with legal and regulatory obligations
To send marketing communications where we have your consent or another lawful basis to do so

Lawful Basis for Processing

Under UK GDPR, we rely on one or more of the following lawful bases:

Performance of a contract: to provide goods or services you have requested.
Legal obligation: where processing is necessary to comply with legal requirements.
Legitimate interests: to manage and improve our business, Website security, and customer experience.
Consent: where required, including for certain cookies and marketing communications.

Where we rely on consent, you may withdraw it at any time.

Sharing Your Information

We may share your personal information with:

Payment processors
Hosting and IT service providers
Delivery and fulfilment partners
Marketing and communications providers
Analytics and Website performance providers
Professional advisers and auditors
Regulatory authorities, law enforcement agencies, or courts where required by law

All third-party service providers are required to process personal information only on our instructions and in accordance with applicable data protection laws.

We do not sell personal information to third parties.

International Transfers

Where personal information is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place, such as:

Transfers to countries deemed to provide an adequate level of protection; or
Approved contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanisms.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, regulatory, and reporting requirements.

Retention periods vary depending on the type of information and the purpose for which it is processed.

Cookie Policy

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function properly, remember preferences, improve performance, and provide analytics information.

How We Use Cookies

We use the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the operation of the Website and cannot be disabled through our cookie management tools.

Cookie	Purpose	Duration
PHPSESSID	Maintains user session and shopping basket functionality	Session / 24 minutes
dtAnalyticsConsent	Records cookie consent preferences	1 year

Analytics Cookies

These cookies help us understand how visitors interact with the Website so that we can improve performance and usability.

These cookies are only placed with your consent.

DigiTickets

Examples include:

dtAnonymousID

Used to distinguish individual visitors and record their activity on the Website (pages viewed, events, approximate location, device and referral source) so we can analyse and report on how the Website is used. This data is collected against a randomly generated identifier stored in the cookie.

Google Analytics

Examples include:

_ga
_ga<container-id>
_gid
_gat_<tracker-name>

Google Privacy Information:

https://support.google.com/analytics/answer/6004245

Microsoft Clarity

Examples include:

_clck
_clsk
CLID
ANONCHK
MR
MUID
SM

Used to analyse user interactions and improve Website usability.

Microsoft Clarity Information:

Performance Monitoring Cookies

Performance monitoring tools help us identify technical issues and improve Website reliability.

Examples may include cookies used by services such as New Relic.

Managing Cookies

When you first visit our Website, you will be presented with a cookie banner allowing you to:

Accept all cookies
Reject non-essential cookies
Choose your cookie preferences

You may change your preferences at any time through our cookie settings tool.

You can also manage cookies through your browser settings. Disabling certain cookies may affect Website functionality.

Your Data Protection Rights

Under UK GDPR, you may have the right to:

Access your personal information
Correct inaccurate information
Request deletion of your information
Restrict processing
Object to processing
Request portability of your data
Withdraw consent where processing is based on consent
Lodge a complaint with the Information Commissioner's Office (ICO)

For more information about your rights, visit:

https://ico.org.uk/

Automated Decision-Making

We do not generally make decisions producing legal or similarly significant effects using solely automated processing.

Where automated tools are used for fraud prevention, security monitoring, or service administration, appropriate safeguards will be applied in accordance with applicable data protection legislation.

Childrens Data

Our Website is not intended to knowingly collect personal information from children unless necessary to provide services requested by a parent, guardian, school, attraction, venue, or authorised organisation.

Where we process children's personal information, we take additional care to ensure appropriate protections are in place.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:

Digital Ticketing Systems (t/a DigiTickets)

Sentio House, Pynes Hill, Exeter, Devon, EX2 5AZ

www.digitickets.co.uk/compliance-request

If you have concerns about how we use your personal information, you may submit a privacy complaint to us using the contact details above.

We will acknowledge your complaint and investigate it in accordance with applicable data protection legislation. We aim to respond without undue delay and within the timescales required by law.

If you remain dissatisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).

Other Websites

This Privacy Policy applies only to this Website. Links to third-party websites are provided for convenience only. We are not responsible for the privacy practices of those websites, and we encourage you to review their privacy policies before providing any personal information.

Last Updated: 25 August 2026