The Treasure Trove – Privacy Notice

This policy applies to you, as a user of the website: https://www.treasuretrove-edinburgh.com/ (the “Website”). This policy also applies to The Treasure Trove which is a trading name of The Royal Edinburgh Repository and Self Aid Society, a Scottish registered charity (registered charity number SC006702) having its principal office at 23a Castle Street, Edinburgh EH2 3DN (“we”/“us”/“our”) as the owner and provider of the Website and sets out the basis on which any and all personal data we collect from you, or that you provide to us, will be processed by us. 

We are committed to protecting your privacy and being open and clear about how we use the information you intrust us with. We may update this privacy notice from time to time and we’ll post the changes on this page. Please check back frequently to ensure you are aware of any updates. 

If you have any questions about this notice please contact [email protected] or write to us at: Data Protection, The Royal Edinburgh Repository and Self Aid Society, 23a Castle Street, Edinburgh EH2 3DN. 

Our commitment to you

We process your personal data in accordance with the overarching principles and requirements set out in the in the General Data Protection Regulation and the Data Protection Act 2018 (“Data Protection Law”). What this means is that we process your data in a way that is: 

• Lawful, fair and transparent;
• Compatible with the purposes that we have told you about;
• Adequate and necessary, we only use the data we need to use for the reason we told you;
• Accurate and up to date;
• Not excessive, we only keep your data for as long as we need it; and 
• Secure and protected.  

Data we may collect from you

We may collect and process the following personal data about you: 

• Name
• Contact Information
• Address
• Email
• Telephone Numbers
• Date of Birth
• Gender
• IP Address 
• Web Browser Type 
• Operating System 
• Financial Information relating to banking and payment information
• Your activity on the Website
• Cookie information

How and why we collect your personal data

We collect personal data from when you complete forms on the Website or when you correspond with us in other ways such as by email or over the phone. Personal data is information that can be used to directly or indirectly identify you, such as your name, an ID number or an online identifier. Our lawful basis for processing this data under data protection law will be one of the following: 

• Contract – e.g. it is necessary for us to process the data to fulfil the terms and conditions of our agreement with you;
• Consent – e.g. where you have given us your consent to send you promotional materials (remember you can withdraw this consent at any time); or 
• Legitimate interest – e.g. where we process your personal data for direct marketing purposes or to ensure network and information security. Where we use legitimate interest as our lawful basis to process your personal data we will ensure that our legitimate interests are proportional and do not compromise your personal data rights. 

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We will only keep your data for as long as we need to for the reason we have collected it. 

Payment information

Where you make a purchase using the Website payment can be made using Visa, Mastercard or American Express credit/debit cards. Your payment will be processed by Stripe, our third party payment processor, who collect, use and process your information, including payment information, in accordance with their privacy policies – which can be viewed here: https://stripe.com/gb/privacy.

We will not retain or process your credit/debit card details and this information will never be shared or viewed by us.  

Cookies

We use cookies on the Website to distinguish you from other users. This helps us to provide you with a good experience when you use the Website and also allows us to improve the Website. A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.

We use the following cookies: 

• Strictly necessary cookies – these are cookies which are required for the operation of the Website. They include, for example, cookies which enable you to use the shopping cart function of the Website. 

• Analytical or performance cookies – these allow us to recognise and count the number of visitors to the Website and see how those visitors move around the Website when they are using it. These cookies help us to improve the way the Website works – for example by ensuring that visitors are able to find the information they are looking for easily. 

• Functionality cookies – these are used to allow us to recognise you when you return to the Website. This enables us to do things like remember your preferences (such as your choice of language or region). 

You may refuse to accept cookies by activating a setting within your web browser. Disabling or refusing to accept cookies may affect various services offered by us or the functionality of the Website. 

Third Parties

We may disclose your personal data to third parties in the following circumstances:

• Where we are obliged to or permitted by law; 
• In order to enforce or apply our terms and other agreements with you; 
• To protect the rights, property, or safety of our customers or others (including exchanging information with other companies or organisations for the purposes of fraud prevention and credit risk reduction). 

We also employ a third party technology company based in the UK, to assist us with the development, maintenance and management of the website. This company may have access to your personal information in the course of providing us with their services. Where third parties process data on our behalf, they won’t use your personal information for their own purposes and we only permit them to use it in accordance with our instructions and the law. We have appropriate safeguards in place to protect personal data transferred outside the EEA. 

How do we keep your data safe? 

We have put in place appropriate security measures to protect your personal information and prevent it from being lost, destroyed, damaged, used, altered or disclosed. The data is hosted on cloud servers by UK Web.Solutions Direct Ltd which are located in the UK. 

Third Party Links

The Website may contain links to other websites. If you follow a link to another website, please note that these sites have their own privacy notices and that we do not accept any responsibility or liability for these notices. We encourage you to check the privacy notices of these other sites when visiting.

Your legal rights

You have a number of rights under data protection law in relation to your personal information and if you want to exercise any of these rights, please contact us at [email protected] and we’ll be happy to help. These rights are as follows: 

• right to request access to your personal information – you can request a copy of the personal information we hold on you;
• right to request correction of your personal information – if any personal information we hold on you is incorrect, you can request to have it corrected;
• right to request erasure of your personal information – you can ask us to delete your personal information in certain circumstances;
• right to object to processing or restrict processing of your personal information – you may object to our processing of your personal data in certain circumstances;
• right to request the transfer of your personal information – to provide you, or a third party you have chosen, with your personal information; and
• right to withdraw consent – where we process your data on the basis of consent, you can notify us that you want to withdraw consent any time. 

If you have any data protection complaints, you may contact the Information Commissioner’s Office (ICO) by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Email: [email protected] Telephone: 0303 123 1113.

We would like to try and help with any concerns you may have before you contact the ICO, so please get in touch with [email protected] in the first instance.