Privacy policy
VISITORS AND VOLUNTEERS PRIVACY NOTICE (GDPR COMPLIANT)
The Japanese Garden at Cowden SCIO is committed to protecting your privacy and ensuring that your personal data is handled securely and lawfully in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Purpose of this Statement
This Privacy Notice explains what data we collect from visitors, how we use it, and the lawful basis for processing it.
Please read this Privacy Notice carefully. This Privacy Notice is not intended to override the terms of any contract that you have with us (for example annual (season) pass terms) or any rights you might have available under applicable data protection laws.
We may make changes to this Privacy Notice from time to time, for example to keep it up to date or to comply with legal requirements or changes in the way we operate our business. We will strive to make sure that you are aware of any material changes by sending an email message to the email address you most recently provided to us or by posting a notice on our website so that you are aware of the impact to the data processing activities before you continue to engage. We encourage you to regularly check back and review this so that you will always know what information we collect and how we use it.
When do we collect your data?
We collect information directly from you when you:
● purchase admission online
● purchase season passes online
● book events online either directly through our website or a partner event ticketing website
● complete group booking forms on our website
● complete surveys on our website
● opt-in to receiving marketing communications
● login to the wi-fi at our attractions
● book accommodation with us
● make a complaint or provide feedback
● or request further information
We may receive some personal information from third parties, such as:
● family members or legal guardians
● promotional partners
● payment providers
We never knowingly collect personal information from children under 13 for marketing purposes without parental consent, as required by law.
What personal information /data do we collect? We may collect contact information to communicate with you about our services and your bookings. This may include your name, postal address, telephone number, email address, date of birth or social media profile name.
A) Payment Information When you submit payment details for purchasing admission, season pass or any other of our services we may receive financial information about you. This transaction data may include: bank name, bank address, account number, sort code, security code, card expiration date.
B) Purchasing & Marketing Information We collect data regarding your admission to us. This includes the collection of contact details such as your name, address, date of birth, telephone number and email address, engagement details including your purchase history and visit history, your marketing preferences, record of permissions or marketing objections.
C) Children's Personal Information We recognise our responsibility to provide suitable privacy protection to personal information we collect from children under 13. Some of the services we offer are not aimed at children and for those we do not knowingly collect personal information from children under 13. When we do intend to collect personal information about children under 13, we put in place a number of measures to protect that child’s privacy such as:
● notifying parents and/or guardians about the processing and obtaining consent where necessary
● ensuring any data collected is kept to a minimum
● where permitted by law, allowing parents/legal guardians the right to request the personal information collected about their child and ask for such to be amended or deleted.
Why do we collect it? What do we use your personal information for? We may collect, use and store your personal information for the following reasons:
● managing admissions, season passes, and communications
● to apply for gift aid
● sending newsletters, news and updates and other marketing communications, including providing you with information about upcoming events at The Japanese Garden at Cowden, based on your preferences
● security and operational purposes
● provide you with news about the charity and its work.
● for related purposes such as delivering customer service, handling queries and complaints, establishing and maintaining contractual relations, complying with industry and regulatory standards
● to operate electronic payment processes
● support our everyday business purposes, such as for account management, quality control, website administration, business continuity and disaster recovery, security and fraud prevention
● business forecasting, reporting, and analysis, including business development
● business management to include accounting, auditing, insurance, governance, reporting and legal compliance
● understand how you engage with our communications and services, to create business intelligence
● establishing, exercising or defending our legal rights; and otherwise, for the lawful operation of our business
● ensuring adequate insurance coverage for our business
Lawful Basis We need to have a legal basis for collecting and processing your personal information. This is set out below:
1. Our use of your personal information is necessary for the performance of our obligations under our contract with you, or
2. Our use of your personal information is necessary for complying with our legal obligations, or
3. Our use of your personal information is necessary to protect an individual’s vital interests (for example if there is a danger to life), or
4. Where it is necessary for the purposes of our legitimate interests or the legitimate interests of a third party (for example, to ensure a safe working environment for our employees, workers and contractors or to maintain adequate personnel records), or
5. Where the processing is necessary to protect your vital interests in an emergency situation. We will also collect information about you indirectly from other sources where we believe this is necessary to help ensure the security of site, staff, volunteers or visitors. These other sources may include public registers and social media platforms.
6. Where you have given your explicit consent, for example for gift aid, newsletters and photography. Where we require explicit opt-in consent for direct marketing in accordance with the Privacy and Electronic Communications Regulations we will ask for your consent. We take photographs for promotional purposes only with permission forms or through clearly displayed notices. Visitors who wish not to appear in any photos may inform a member of staff.
7. Where we have a legal obligation, such as to HMRC, payroll, or health and safety requirements
8. Where we have a legitimate interest, for example in visitor engagement and charity operations. The Japanese Garden at Cowden relies on the soft opt-in exemption under the specific exception within the Privacy and Electronic Communications Regulations (PECR) to retain and use the email collected during a purchase, for future marketing for similar events or news about The Japanese Garden at Cowden. You have the right to opt-out of this marketing at any time. This information will not be shared with any third parties. Where we can rely on the ‘Soft Opt-in’ exemption under the Privacy and Electronic Communications Regulations, we will be relying on our Legitimate Interests for the purposes of GDPR.
9. You have a right to stop receiving direct marketing at any time - you can do this by following the opt-out links in electronic communications (such as emails), or by exercising your rights under GDPR.
Disclosure of Personal Information Your personal data may be made available to employees, or vetted volunteers in the course of providing our services. Access to your personal information is limited to those employees who need to know the personal data and there are no international data transfers.
We may share your personal information with the following categories of third parties:
● legal and regulatory authorities, accountants, auditors, lawyers and other outside professional advisors.
● information technology systems suppliers and support, including email archiving, telecommunication suppliers, back-up and disaster recovery and cyber security services, such as off-site storage providers and cloud services providers.
We will also disclose your personal information to third parties:
● if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, any lawful request from government or law enforcement officials and as may be required to meet national security or law enforcement requirements or prevent illegal activity;
● to enforce our contract with you, to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person or to prevent any illegal activity; or ● to protect the rights, property or safety of The Japanese Garden at Cowden SCIO, our employees, visitors, volunteers, workers and contractors, customers, suppliers or other persons.
You will always have the option to unsubscribe from communications or refuse the transfer of your personal data. We will ensure that mechanisms are in place to exercise these rights easily and promptly. Any third parties with whom we share your personal information are limited (by law and by contract) in their ability to use your personal information for the
specific purposes identified by us. We will always ensure that any third parties with whom we share your personal information are subject to privacy and security obligations consistent with this privacy notice and applicable laws.
Data Retention and Security Personal data is retained only for as long as necessary for its purpose or legal obligation, and is then securely deleted or anonymised. We retain your personal data for as long as needed, or permitted, based on the reason we obtained it (consistent with applicable law and to support legitimate business purposes). When deciding how long to keep your personal data, we consider whether we are subject to any legal obligations (e.g., any laws that require us to keep records for a certain period before we can delete them) or whether we have taken any legal positions (e.g., issued any legal holds or otherwise need to preserve the information). Rather than delete your data, we may also deidentify it by removing identifying details. If we deidentify the data, we will not attempt to reidentify it.
The Japanese Garden at Cowden SCIO have implemented safeguards that are intended to protect the confidentiality of your personal information and we are fully compliant with all necessary security requirements for payment card security. Data is stored securely in protected systems.
You may, from time to time, access links to or other websites operated by third parties (e.g. online event ticket suppliers). Please note that this privacy notice only applies to the personal information that we collect from or about you and we cannot be responsible for personal information collected and stored by third parties. Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites. We do not endorse or otherwise accept any responsibility or liability for the content of such third-party websites or third-party terms and conditions or policies.
Your Rights You have the right to access, correct, or delete your data, to object to processing, and to lodge a complaint with the ICO. Your rights are outlined below:
A. Access You can ask us to confirm whether we are processing your personal data, give you a copy of that data, provide you with other information about your personal data such as what data we have, what we use it for, who we disclose it to, how long we keep it for, what rights you have, how you can make a complaint, where we got your data from and whether we have carried out automated decision making or profiling, to the extent that information has not already been provided to you in this notice.
B. Rectification You can ask us to rectify inaccurate personal data. We may seek to verify the accuracy of the data before rectifying it.
C. Erasure/Right to be forgotten You can ask us to erase your personal data, but only where: ● it is no longer needed for the purposes for which it was collected; or ● you have withdrawn your consent (where the data processing was based on consent); or ● it follows a successful right to object (see 'Objection' below); or ● it has been processed unlawfully; or ● it is necessary to comply with a legal obligation which The Japanese Garden at SCIO is subject to.
We are not required to comply with your request to erase your personal data if the processing of your personal data is necessary: for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims, in relation to the freedom of expression or for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. In the context of marketing, please note that we will maintain a suppression list if you have opted out from receiving marketing content to ensure that you do not receive any further communications.
D. Restriction You can ask us to restrict (i.e. keep but not use) your personal data, but only where:
● its accuracy is contested (see 'Rectification' above), to allow us to verify its accuracy; or
● the processing is unlawful, but you do not want it erased; or
● it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
● you have exercised the right to object, and verification of overriding grounds is pending.
We can continue to use your personal data following a request for restriction, where:
● we have your consent; or
● to establish, exercise or defend legal claims; or
● to protect the rights of another natural or legal person.
E. Portability You can ask us to provide your personal data to you in a structured, commonly used, machine-readable format, or you can ask to have it 'ported' directly to another Data Controller, but in each case only where: the processing is based on your consent or the performance of a contract with you; and the processing is carried out by automated means.
F. Objection You can object to any processing of your personal data which has our 'Legitimate Interests' as its legal basis, if you believe your fundamental rights and freedoms outweigh our Legitimate Interests.
Once you have objected, we have an opportunity to demonstrate that we have compelling Legitimate Interests which override your rights, however this does not apply as far as the objections refers to the use of personal data for direct marketing purposes.
To exercise your data subject rights, including Subject Access Requests, please contact the Data Protection Officer, (details below).
Please note the following if you do wish to exercise these rights: We take the confidentiality of all records containing personal data seriously and reserve the right to ask you for proof of your identity if you make a request.
We will not ask for a fee to exercise any of your rights in relation to your personal data, unless your request for access to information is unfounded or excessive, in which case we will charge a reasonable amount in the circumstances.
We aim to respond to any valid requests within one month unless it is particularly complicated or you have made several requests, in which case we aim to respond within three months. We will let you know if we are going to take longer than one month. We might ask you if you can help by telling us what exactly you want to receive or are concerned about. This will help us to action your request more quickly.
Contacts and complaints If you have any queries or complaints about our collection, use or storage of your personal information, or if you wish to exercise any of your rights, please contact us: Data Protection Officer: Rachael McGaffney info@cowdengarden.com or write to us at: The Japanese Garden at Cowden SCIO, Upper Hillfoot Road, Dollar, FK14 7PL. We will investigate and attempt to resolve any such complaint or dispute regarding the use or disclosure of your personal information. You have the right to complain to the Information Commissioners Office (https://ico.org.uk). We do ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time. For any other queries or complaints not relating to data protection, please contact us at info@cowdengarden.com
Reviewed Aug 2026