Privacy policy

The National Trust Group is made up of different legal entities, including the National Trust for Places of Historic Interest or Natural Beauty, the National Trust (Enterprises) Limited and Historic House Hotels Ltd.

The National Trust for Places of Historic Interest or Natural Beauty is the controller responsible for our charitable and investment activity. Our Registered Charity Number is 205846. The ICO registration number is Z5945928. Our activities include membership, fundraising, estate management (including tenanted properties), holiday cottages and visits to our properties and places (including our cafes).

The National Trust (Enterprises) Limited is the controller responsible for our non-charitable activity. This includes our online shop, our retail stores, advertising sales, commercial events, and some of our campsites and hotels. The ICO registration number is ZB147964.

Personal data collected on our website and related surveys may be collected by either the National Trust for Places of Historic Interest or Natural Beauty or the National Trust (Enterprises) Limited. This privacy policy is issued on behalf of the National Trust Group; when we mention "The National Trust", "we", "us" or "our" in this privacy policy, we are referring to the relevant organisation in the National Trust Group responsible for processing your data.
There are other companies within the National Trust Group who have their own privacy policy, for example Historic House Hotels Limited.

The National Trust may also enter into specific projects (including joint venture projects) from time to time, such as the Roundhouse Birmingham and Heritage Open Days. In those circumstances there may be separate privacy policies governing the processing of personal data.

The National Trust is also closely affiliated with other organisations (including other charities). Those organisations also process personal data in accordance with their own privacy policies. One example is the Royal Oak Foundation based in the United States. If you are based in the United States but visit a National Trust property in the United Kingdom, you may be asked if you would like to become a member of the Royal Oak Foundation. In those circumstances, the National Trust may be able to process your membership on behalf of the Royal Oak Foundation. The Royal Oak Foundation processes personal data in accordance with its own privacy policy.

Our about us page has further information on our legal status, charitable and investment activities and associations with other organisations.

If you have any questions relating to this privacy policy or how we use your personal data, please email dpo@nationaltrust.org.uk or post them to:

Data Protection Officer,
National Trust,
Heelis,
Kemble Drive,
Swindon,
SN2 2NA.

Personal data or personal information means any information which identifies you or which relates to you.
We will collect and process personal data about you as part of the following interactions that you may have with us:

• When you interact with us and provide information
• When you visit our website
• Throughout our relationship with you
• Personal information that we may receive from third parties or collect from CCTV footage
• When you call us by telephone

We may collect Special Categories of Personal Data, Information about Criminal Convictions or Offences or Children’s Data in exceptional circumstances where it is necessary and where we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR) or Data Protection Act 2018.

Please note that where we need to collect personal data, for example, under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with membership). We will notify you where this is the case.

We also collect and use anonymous and aggregated data, such as statistical or demographic data.

We collect different types of personal data via different methods. We have set out further detail on this below.

• Information you give us. This is personal information that you provide as part of your relationship with us. This could include information that you provide when: purchasing a membership or visiting a property; making a donation; buying goods or holidays on our site; providing a service; becoming a tenant of a National Trust property; making an enquiry, complaint or request; creating a National Trust account on our website; or by corresponding with us by phone, email, in person or otherwise. The information you give us may include your name, postal or email address, phone number, National Trust account login details, financial information (for example, if you set up a Direct Debit with us), date of birth, gender, employment status, demographic information, personal description, photographs, attitudes, interests and opinions.
• Information we collect from your use of our website. When you visit our website, in addition to information that you give us, as well as those collected through Essential Cookies, we may collect information depending on what types of cookies or similar technologies you consent to. For more information about how we use cookies and similar technologies and the personal data processed please visit our cookie policy.
• Information we collect throughout our relationship. This information will depend on your interactions with the National Trust. It may include your supporter membership number and supporter interactions; your tenancy information (if you are a National Trust tenant); information relating to properties you visit (including those at which your membership card is scanned); details of your transactions including order numbers and transaction details relating to membership (including renewals); purchases from our online shop; holiday bookings, donations you make or feedback you provide. This also includes where you correspond with, and link to, the National Trust on social media.
• Information we receive from others (third parties). This may include information on social media, such as queries, complaints and feedback that relates to the National Trust and is publicly accessible. It may also include information you provide as part of a legacy, a donation or research conducted on our behalf. We may also receive information from our regulators, official registries, government authorities, public services, your insurers, your employers or other public sources.
• We collect personal data through CCTV, body worn cameras and trail and dash cameras used at our properties. This enables us to provide security and protect our properties, staff, volunteers and supporters. We have appropriate signage at our properties where CCTV is used.
• We may record calls made to our Service Centres. This enables us to review call details so we can resolve any query that may arise. It also permits us to provide training to call agents to improve the service provided to our supporters.
• We collect and use anonymous and aggregated data, such as statistical or demographic data, and may share this with carefully selected partners. This is not considered to be personal data by law, as it will not directly or indirectly reveal your identity. If, in the unlikely event that this data is combined or connected with your personal data so that you can be identified, we will treat the combined data as personal data in accordance with this privacy policy.

We may collect Special Categories of Personal Data in exceptional circumstances (examples of this include details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, gender identity, political opinions, trade union membership, genetic and biometric data and information about your health e.g. medical conditions, allergies, dietary/access requirements). This is only collected where necessary and where we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR) or Data Protection Act 2018. We also have an appropriate internal policy document in place, as required by data protection legislation.

In exceptional circumstances we may process information about criminal convictions and offences in collaboration with official authorities where we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR) or Data Protection Act 2018.

We process the personal data of children (persons under the age of 18) in line with UK General Data Protection Regulation (UK GDPR) or Data Protection Act 2018 legal requirements. For example: when a junior membership is purchased or where children are included on family memberships purchased from the National Trust or as part of administering a tenancy at our properties. When communicating with children, National Trust will ensure we are transparent on how we use their personal data using plain, clear language that they can understand.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.
• Where we have your consent to do so.

• We may also use your personal data where we need to protect your vital interests (or someone else’s vital interests), although such situations will be rare.

For more information about the ways we plan to use your personal data, and which lawful basis we rely on to do so, please see below. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific lawful basis we are relying on to process your personal data where more than one basis has been set out in the table below.

In certain circumstances we may also need to share your personal data.

Major gifts and donors – we will use your personal data in a number of different ways to ensure we can engage and communicate with you effectively, and in a way which is relevant to you. Additionally, we will use your personal data to ensure we can fulfil any obligations asked of us, by regulatory bodies with regards charitable fundraising. Further information included in this linked document.

Gifts in wills – if you have left a gift in your will, or are considering doing so, we will use your personal data to record details of this and any associated conversations or interactions (including those with someone who contacts us on your behalf, such as your solicitor). Further information included in this linked document.

Fundraising research – in raising funds towards its ongoing work, we utilise periodic fundraising research practises for two main primary purposes:

• For Due Diligence: We research existing supporters and donations to ensure that they appropriately align with the National Trust’s wider organisational values. We do this before any further engagement is made or any donation(s) are accepted.
• Profiling: We conduct research on new or existing supporters (over 18) that guide us in making tailored approaches (normally for financial support) toward appropriate areas of our work that would relate to each supporter’s own interests. Further information included in this linked document.

Estate administration – where a supporter has passed away, and we are in the process of receiving their legacy gift, we will process the personal data of those involved in the estate administration process.

Research and Insights – if you take part in market research, including panels or surveys, your personal data provided as part of that research activity will be processed in accordance with the privacy notice provided to you at the start of that research activity. All research undertaken is optional and you can choose not to take part.

Should you visit our website or purchase from us via an affiliate marketing company, your personal data may be processed by us and by Affiliate Window for the purposes of conversion tracking – Affiliate Window’s Privacy Policy.

Direct marketing:

To you as an individual

This includes where you are acting in an individual capacity, where you are a sole trader or part of an unincorporated partnership.

We will only process your personal data for the purposes of sending unsolicited electronic marketing communications to you where we have your consent to do so.

This could include communications relating to visiting our places, volunteering with us, membership, events, conservation work, causes, campaigns, fundraising activities or our shops and holidays. We will usually only send marketing communications by post where we have your consent to do so, however there may also be circumstances where we will send marketing communications by post on the basis that it is in our and your legitimate interests to do so.

To businesses

This includes where you are acting in a business capacity, for example, where you work for a limited company. If we are corresponding in your business capacity, we may send relevant communications to you, including to invite you to attend events or keep up to date with National Trust projects. We also keep a media contact list to allow us to issue statements and press releases. It is in our legitimate interests to do so to allow us to issue relevant and up-to-date information about our charity.

Opting out

You can opt out from receiving direct marketing communications and notifications from us at any time. There are several ways you can do this:

Update your marketing permissions by contacting us:

• write to us at National Trust, PO Box 7083, Stratford-Upon-Avon, CV37 1XE
• e-mail us at dpo@nationaltrust.org.uk with your name, address and supporter/member number (if available)
• call us on 0344 800 1895 (local call rates apply), 9.00am-5.30pm weekdays, 9.00am-4.00pm weekends and bank holidays
• online self-service portal for members and supporters.
  

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data; the potential risk of harm from unauthorised use or disclosure of your personal data. We thoroughly assess the purposes for which we process your personal data and whether we can achieve those purposes through other means which would reduce any risk to your personal data.

We take your safety and security very seriously and are committed to protecting your personal and financial information. All information kept by us is stored on our secure servers. We have a robust process for assessing, managing and protecting all of our new and existing systems to ensure they are up to date and secure.

Where we have given you (or where you have chosen) a password that enables you to access certain parts of our website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

As part of our compliance, we ensure that our IT systems do not directly collect or store your payment card information. The National Trust has an active PCI-DSS (Payment Card Industry Data Security Standard) compliance programme. This is the stringent international standard for safe card payment processes.

Sharing of your personal data

For the purposes set out in the ‘Why do we process this information?’ section above, we may share your personal information with carefully selected suppliers or partner organisations as categorised below. These may be acting as approved data processors, joint or independent controllers in their right.

• Business partners, financial service providers, subsidiaries, suppliers and sub-contractors for the performance of any contract we enter into with you;

• Database and website hosting companies and support service providers;

• Analytics and search engine providers that assist us in the improvement of the services we provide and optimisation of our website and to enable us to track the effectiveness of our site;

• Advertising partners to ensure our advertising is relevant to you;

• Social media platforms to enable us to ensure advertisements that you receive are relevant to you;

• Customer survey providers and market research agencies in order to receive and analyse feedback in order to improve our services;

• Mail fulfilment companies (both electronic and postal);

• Other entities, individuals, charities and organisations involved in a legacy, for the purpose of collecting that legacy;

• Other charities;

• Our Trustees, to the extent required to allow them to fulfil their functions and responsibilities as Trustees;

• Any member of our group of companies.

• Additionally, we may disclose your personal information to the relevant third party:

• In the event that we sell or buy any business or assets including in relation to any of our Group companies, your personal data will be disclosed to the prospective seller or buyer of such business or assets.

• If we are acquired by a third party, in which case personal data we hold about our customers will be one of the transferred assets.

• If we dispose of or acquire any assets, which may include properties, leases or visitor attractions, we may be required to share personal data with the person or organisation disposing of or acquiring those assets.

• In the event of a transfer, restructure or replacement of our assets or otherwise.

• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements.

• If we are under an obligation to protect the rights, property, or safety of our customers, our regulators (including the Charity Commission, the Information Commissioner’s Office or the Fundraising Regulator), or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and prevention of money laundering and credit risk reduction.

The National Trust’s operations are based in the United Kingdom and the majority of your personal data we hold is stored within the UK and European Economic Area (EEA). Where we transfer your data outside the UK, we will always inform you. We will only do so in compliance with the law and where we ensure a similar degree of protection is afforded to it. We will ensure that one of the following safeguards is implemented:

• Transferring to countries that have been deemed to provide an adequate level of protection for personal data by the Information Commissioner’s Office and/or the UK government;

• Binding corporate rules, where applicable;

• Specific contractual clauses approved by the Information Commissioner’s Office and/or the UK government;

• Authorised certification for transfers to any countries not covered by the safeguards listed above.

Whenever your information is stored or transferred, we will use strict procedures and security features to prevent unauthorised access or disclosure of your personal data.

In addition to this privacy policy, we may provide additional information at the point of data collection informing you of the lawful basis, the purpose, and retention periods that apply where the National Trust is processing your personal data.

You have the following rights in relation to our processing of your personal data. You can exercise these rights at any time using the contact details below.

• You can withdraw your consent at any time, where processing of your personal data is based on consent.

• You can object to the processing of your personal data where it is processed on the basis of legitimate interests provided that there are no compelling reasons for that processing.

• You can object to the processing of your personal data for direct marketing purposes.

• You can request access to copies of your personal information that we process. This is commonly known as a “subject access request”.

• You can ask for information we process about you to be corrected if it is inaccurate or incomplete, although we may need to verify the accuracy of the new data you provide to us.

• You can ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see above), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law.
  Note, however, that we may not always be able to comply with your request for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• You can ask for the processing of your personal data to be restricted in the following circumstances:

  • The accuracy of the data is contested and you want us to confirm the accuracy of the data that we hold;

  • Where the processing is unlawful, but you do not want us to erase it;

  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or

  • You have objected to our use of your data but we need to verify whether have overriding legitimate grounds to use it.

• You can ask for “data portability” (the transfer of your personal data to you or a third party in certain circumstances). We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• You have the right not to be subject to a decision based solely on automated processing, this might include the right to obtain human intervention, the right to present your point of view and the right to challenge the decision made by automated processing.

Should you wish to exercise any of the individual rights listed above please let us know by emailing us at dpo@nationaltrust.org.uk, or by writing to:

Data Protection Office,
National Trust,
Heelis,
Kemble Drive,
Swindon,
SN2 2NA.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

In the event that you are not satisfied with our processing of your personal data, you have the right to lodge a complaint with the relevant supervisory authority, which is the Information Commissioner’s Office (ICO) in the United Kingdom, at any time.

The National Trust website may include links to third-party websites, plug-ins and applications. We endeavour to indicate where a website link will connect to a third-party page. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

We’ll amend this privacy policy from time to time to ensure it remains up-to-date and accurately reflects how and why we use your personal data. The current version of our privacy policy will always be posted on our website.

This privacy policy was last updated on 1 October 2024.

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to our dedicated Data Protection Office. Please contact us via email at dpo@nationaltrust.org.uk or by post at the following addressand and we'll do all we can to assist.:

Data Protection Office,
National Trust,
Heelis,
Kemble Drive, Swindon,
SN2 2NA.