Privacy Notice

Test and Protect Privacy Notice

During the COVID-19 (Coronavirus) pandemic, we are supporting NHS Scotland’s Test and Protect strategy by recording details of customers making an online bookings in line with GDPR.

To support NHS Scotland’s Test and Protect strategy and for the health and safety of our customers visiting our staffed sites, we are recording the name and contact details of customers making an online bookings.

Where a customer is making a booking on behalf of a group, only the person making the booking will have their personal data recorded. 

This information will be used to enable NHS Scotland to contact you should you have been in the premises around the same time as someone who has tested positive for COVID-19 (Coronavirus). Contacting people who might have been exposed to the virus is an important step in stopping the spread.  

We believe you should always know what data we collect from you, why we need it and how we look after it. Find out more about how we manage your data when you interact with our websites, contact us by email and more in our privacy notice.

For specific information on how we manage your data when you book a ticket online, please read our ticketing privacy notice.

Reasons for data collection 

The personal data collected by Historic Environment Scotland (HES) as part of the normal ticketing process includes sufficient data to allow us to meet the requirements of NHS Scotlands Test and Protect Strategy. 

In order to assist in the containment of the virus, we will only share your data for this purpose when it is requested directly by NHS Scotland. This will only be in the unlikely event there is a cluster of coronavirus cases linked to the venue. Information will be transferred securely to NHS National Services Scotland who will use the data to contact trace those who were in the establishment at the same time as the positive case, and will provide guidance and support to those who may be advised to self-isolate.  

Read further information on the NHS Scotland Test and Protect strategy.

Type of data collected

Along with the date and time of your arrival, we will use the following personal data if applicable:

  • your name; and
  • contact telephone number

If you do not have a telephone number, you have the option to provide:

  • a postal address; or
  • an email address

Customer health information will not be requested or stored.

Lawful basis for collecting this data

Under data protection law, GDPR Article 6(1), we have a number of lawful bases that allow us to collect and process personal information. In this case, the lawful basis for processing your data is 'legitimate interests'.

Broadly speaking 'legitimate interests' means that we can process your personal information if we have a genuine and legitimate reason and we are not harming any of your rights and interests.

Our legitimate reason for processing your data is to assist with NHS Scotland’s Test and Protect strategy in relation to the COVID-19 (Coronavirus) public health epidemic.

Before sharing any information, we will carefully consider and balance any potential impact on you and your rights.

Data retention period  

Your personal data will be retained as part of the booking process. However, for the purposes of the NHS Test and Protect Strategy, we will not share your data with NHS Scotland after a 3 week (21 days) period 

All personal data will be held and disposed of in a safe and secure manner.  

Your rights  

As defined in the data protection law, GDPR Article(s) 12-23, you have the following rights:  

  • the right to be informed about the collection and use of your personal data. This is outlined above.  
  • the right to erasure. If at any point within the 21 days after your visit you decide you do not wish us to hold your data for the purpose of the NHS Test and Protect Strategy you can opt out by contacting us on the email address below.  
  • the right to object to us processing your personal data.  
  • the right to rectificationIf the information held is in any way incorrect, you can contact us and request that the information be rectified.  

In certain circumstances exemptions to these rights may apply. Further information is available on the Information Commissioner’s Office website.

Complaint procedure  

If you consider that your personal data has been misused or mishandled by us, you can raise this with the data controller. In this instance, the data controller is Historic Environment Scotland 

If you have any questions about this privacy notice or our data protection policies generally, please contact us:    
By email: 

By phone:0131 668 8600 

If you remain dissatisfied you can make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:  

Information Commissioner’s Office
Wycliffe House
Water Lane
SK9 5AF 

Telephone: 0303 123 1113


Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.