Hoghton Tower Preservation Trust Privacy Policy

Hoghton Tower Privacy Policy

Hoghton Tower is a hilltop fortified Elizabethan Manor House situated between Blackburn and Preston. It is the ancestral home of the de Hoghton family and was built in 1565. It is open to the public as a historic house and gardens. Access to the house is by guided tour and numerous events are held during the year. There is also a tearoom and gift shop on site.    The Hoghton Tower Preservation Trust is a registered charity (charity number 508357) and Hoghton Tower Limited (company number 02637777) is an associated company handling the commercial business.  Under this policy, ‘we’ and ‘Hoghton Tower’ refers to both Hoghton Tower Preservation Trust and Hoghton Tower Limited. 
 
Hoghton Tower is the ‘data controller’ of your personal data and is subject to the Data Protection Act 1998 (‘DPA’) and (from 25th May 2018) the General Data Protection Regulation (the ‘GDPR’). Hoghton Tower Preservation Trust and Hoghton Tower Limited are both registered with the UK Information Commissioner’s Office with the registration numbers ZA320369 and ZA320375 respectively.
 
This Privacy Policy sets out the basis upon which information about you is collected and processed by us through the use of the Hoghton Tower website (www.hoghtontower.co.uk) and any other electronic communication networks by Hoghton Tower and the use of the personal information you provide to us in person or online, via email, phone, in writing or other correspondence.  
 
We are committed to protecting your privacy and ensuring the confidentiality of the personal information we collect and have created this Privacy Policy to ensure that you are aware of how we use the data you provide to us. We will keep this policy updated and will refer to it when we ask for your consent so that you can be confident we will only use your information in the way set out here. 
 
How we collect personal information 
 
We collect information about you in the following ways:  When you purchase a ticket for an event / tour;  When you volunteer with us or are employed by us;  When you make a booking for a tour / stay in the Irishman’s Tower / wedding / private event / corporate event / afternoon tea  When you make a donation including Gift Aid (either online, in person, or by filling out a form);  When you sign up to Hoghton Tower email updates, either via the website or by filling in a form on site;  When you visit Hoghton Tower;  When you provide visitor feedback.

 
What types of information we collect
We may collect the following types of personal data:
 Name, contact and communications information, including your contact details (including email address(es), telephone number and postal address(es) and records of communications and interactions we have had with you;  Financial information (payment information such as credit or debit card details); bank details and other financial information, e.g. to make or collect payments;  Sensitive personal data for Equal Opportunities monitoring; this will only be analysed at an aggregated level;  If you are a volunteer with us will may collect extra information about you (e.g. references, details of emergency contacts, medical conditions etc.) This information will be retained for legal or contractual reasons, to protect us and for safeguarding reasons.   If you access our teacher resources, we may collect information about your role and place of work.  For guests staying in the Irishman’s Tower, we record your nationality and, if you are not British, Irish or from a Commonwealth country, are required by law to record your passport number and place of issue along with details of your next destination.  Car details (about those who use our car parking facilities);  Dietary requirements (collected on behalf of our catering function);  Where appropriate, information about individuals' health and welfare, and contact details for their next of kin;  Professional memberships, qualifications, DBS clearance and references given or relevant information provided by service providers; and  Correspondence with and concerning past and future events and weddings including venue hire contracts.  Historic House membership numbers  CCTV images  Photographs and video images
We may also, in limited circumstances where you have volunteered this, collect data about your health or medical conditions to enable us to cater for your needs.
How we use the information we collect
Bookings / Events Management
 We process customer data in order to fulfil bookings for tours/ events / catering / venue hire and accommodation and voucher purchases. We use the data to communicate with customers with regard to their bookings and purchases. The data also provides a record of the relationship between the customer and Hoghton Tower. 
 We are legally obliged to collect customer data from guests staying in the Irishman’s Tower.  We process supplier / trader data to enable us to successfully manage events. We may hold dietary requirements to enable us to cater appropriately for our customers.   We, and those authorised by us, may take photographs and video images during events as a record of the event and to use for marketing and promotional purposes. These images may be used in perpetuity on both printed and electronic media including the internet and social media. 
CCTV  Our site is protected by circuit television (CCTV) systems throughout its premises as deemed necessary. Employees, volunteers, visitors and other site users should expect all areas (other than those where use would contravene common decency) to be visible on a television monitoring system. Any information obtained from systems will be used with strict adherence to the GDPR. Information will be used for the prevention and detection of crime and to ensure compliance with our policies and procedures and our legal obligations. This may include using recorded images as evidence in legal or disciplinary proceedings.
Marketing
 Where we have consent, we process personal data (name and email address) for marketing purposes using a third-party processor who also comply with relevant legislation.  We will not share personal information for marketing purposes.  There is an option to unsubscribe or change your preferences at the end of each marketing email.
Volunteer Management
 We need to use volunteer data from the initial enquiry to the time you cease volunteering with us. Examples of this include but are not limited to contact about potential or current roles, the rota, expense claims, the volunteer newsletter, social events and to recognise your contribution.  If you choose to participate in the Time Credits Scheme we will ask for separate consent to process and share your data in this way.
Access Teacher Resources
 The data you provide will be used to create a WordPress account to enable you to access the resources. We also analyse the data to measure the interest in and reach of our resources. We will not use the data for any other purpose. 
Research
 If you choose to take part in any optional research, we will make it clear what data will be collected, the purpose for collection and how it will be used.  
Consent on how personal information is used

NHS Track and Trace (New 24/6/2020)

• Please note that the opening up of the economy following the COVID-19 outbreak is being supported by NHS Test and Trace. Organisations such as Hoghton Tower are required  under the guidance set out on the 24th June 2020, to assist this service by keeping a temporary record of all customers and visitors for 21 days. Your booking data will be kept securely and only shared with NHS Test and Trace if requested by them. 

 
We will only use the data you provide on relevant lawful grounds as permitted by the EU General Data Protection Regulation. 
We will give a clear explanation of the purpose for which personal information is collected and processed. Where necessary, we will also ask for consent to be given by a positive opt in choice. Sufficient information will be provided for an informed choice to be made. The personal data will not be used for any extra purpose without additional consent being obtained. It will also be made clear how consent can be withdrawn or preferences changed.  
The exception this would be if we were asked by the police, or other regulatory or government authority investigating suspected illegal activity.
Data Security 
 
We have in place physical, electronic and managerial procedures to safeguard and secure the personal information we collect.  
 
We do use external ‘data processors’ to manage ticket purchases, online donations, hold donation information and email mailing lists as well as to enable us fulfil our contractual, statutory and management responsibilities.  All of our data processors have provided statements on how they keep your personal data safe and secure in compliance with the General Data Protection Regulation (GDPR) 2018. Where you are providing the data directly to the third party you should read the terms and conditions and privacy policy of any third party to ensure that you are happy with them. 
 
All our employees, volunteers and data processors, who have access to, and are associated with the processing of personal data, are legally obliged to respect the confidentiality of our visitors’ and supporters’ personal data.
 
No sharing of personal information 
 
We do not share personal information with any third parties for marketing purposes.   
 
Some of our third-party data processors store information on remote servers across the world, and we are confident that they are compliant with the GDPR.
 
No indirect collection of personal information
 
We do not collect personal data indirectly, for instance by tracking people individually when they have used our social media accounts.   
 
Retention of data
 
We will only retain personal data for as long as necessary or in line with statutory requirements. Further details are contained within our record retention documentation We will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason.  
 
Rights to access, remove or correct personal information
 
You have the right to request a copy of the information that we hold about you.  Our contact details can be found at the end of this policy.
 
If we receive a request from someone for their personal data to be removed from our current record systems, this will be done within ten working days of the request being received. In certain circumstances, including but not limited to legal reasons and statutory retention periods, this may not be possible. The same timescale will apply when we are notified that personal information needs to be corrected or updated. 
 
A limited and reasonable amount of information will be kept for archiving purposes, for example; and even where you have requested we no longer keep in touch with you, we will need to keep a record of the fact in order to fulfil your wishes (called a "suppression record").
 
You can also opt out of email correspondence immediately by following the links to unsubscribe.
 
Issues and complaints
We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
This notice was drafted with clarity in mind. It does not provide exhaustive detail of all aspects of our collection and use of personal information. However, we are happy to provide any additional information or explanation needed. 
If you want to make a complaint about the way we have processed your personal information, you can contact the Information Commissioner’s Office in their capacity as the statutory body which oversees data protection law – www.ico.org.uk/concerns.
 
Cookies
 
Please see our Cookies Policy on our website (www.hoghtontower.co.uk)
 
Other websites
 
On our website we occasionally provide links to other websites for your convenience and information. Please be aware that these sites will have different security and privacy policies than our own; we have no control over and take no responsibility for any information submitted to these sites.
 
Changes to our privacy policy
 
This policy will be amended in the light of any relevant changes in legislation or related good practice.  Any changes will be made to this document which can be viewed on our website. 
 
This privacy policy was last updated on 23 May 2018.
 
How to contact us
 
Please contact us if you have any questions about our privacy policy.  Our contact details are as follows:
 
 By email: mail@hoghtontower.co.uk   Or write to us: Hoghton Tower, Hoghton, Preston, Lancashire, PR5 0SH
 
 

DigiTickets Privacy Policy

Policy Owner

This policy is owned and distributed by IT and Compliance manager of Digital Ticketing Systems Limited

Who we are

In this Privacy Policy, references to "we", "us", and "our"" are to Digital Ticketing Systems Limited (Company number 07044584). References to "our Website" or "the Website" are to *.digitickets.co.uk.

Digital Ticketing Systems Limited is the data controller responsible for the personal information collected through this Website.

Information We Collect

We may collect and process the following categories of personal information:

Information You Provide Directly

When you contact us, make a purchase, register for services, or complete forms on our Website, we may collect information such as:

• Name
• Postal address
• Email address
• Telephone number
• Purchase and booking information
• Any other information voluntarily provided by you

Payment Information

Payments made through our Website are processed by authorised payment service providers. We do not store your full credit or debit card details on our systems.

Our payment providers may process payment information and carry out fraud prevention and verification checks. Where international transfers are required, appropriate safeguards will be applied in accordance with applicable data protection laws.

Digital Ticketing Systems is PCI DSS v4.0.1 compliant and are annually assessed/certified.

Website Usage Information

When you visit our Website, we may automatically collect:

• IP address
• Browser type and version
• Device information
• Screen resolution
• Operating system
• Referral source
• Pages visited and actions taken on the Website
• Date and time of access

Marketing Preferences

If you choose to receive marketing communications, we will record your preferences and any interactions with our emails, including whether emails are opened or links are clicked.

Cookies and Similar Technologies

We use cookies and similar technologies to operate our Website, remember your preferences, analyse usage, and improve user experience. Further information is provided in our Cookie Policy below.

How We Use Your Information

We process personal information for the following purposes:

• To provide products and services you request
• To process transactions and fulfil orders
• To provide customer support and after-sales services
• To manage bookings and accounts
• To improve our Website, products, and services
• To ensure Website security and prevent fraud
• To comply with legal and regulatory obligations
• To send marketing communications where we have your consent or another lawful basis to do so

Lawful Basis for Processing

Under UK GDPR, we rely on one or more of the following lawful bases:

• Performance of a contract: to provide goods or services you have requested.
• Legal obligation: where processing is necessary to comply with legal requirements.
• Legitimate interests: to manage and improve our business, Website security, and customer experience.
• Consent: where required, including for certain cookies and marketing communications.

Where we rely on consent, you may withdraw it at any time.

Sharing Your Information

We may share your personal information with:

• Payment processors
• Hosting and IT service providers
• Delivery and fulfilment partners
• Marketing and communications providers
• Analytics and Website performance providers
• Professional advisers and auditors
• Regulatory authorities, law enforcement agencies, or courts where required by law

All third-party service providers are required to process personal information only on our instructions and in accordance with applicable data protection laws.

We do not sell personal information to third parties.

International Transfers

Where personal information is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place, such as:

• Transfers to countries deemed to provide an adequate level of protection; or
• Approved contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanisms.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, regulatory, and reporting requirements.

Retention periods vary depending on the type of information and the purpose for which it is processed.

Cookie Policy

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function properly, remember preferences, improve performance, and provide analytics information.

How We Use Cookies

We use the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the operation of the Website and cannot be disabled through our cookie management tools.

Cookie	Purpose	Duration
PHPSESSID	Maintains user session and shopping basket functionality	Session / 24 minutes
dtAnalyticsConsent	Records cookie consent preferences	1 year

Analytics Cookies

These cookies help us understand how visitors interact with the Website so that we can improve performance and usability.

These cookies are only placed with your consent.

Google Analytics

Examples include:

• _ga
• _ga<container-id>
• _gid
• _gat_<tracker-name>

Used to collect aggregated statistical information about Website usage.

Google Privacy Information:

https://support.google.com/analytics/answer/6004245

Microsoft Clarity

Examples include:

• _clck
• _clsk
• CLID
• ANONCHK
• MR
• MUID
• SM

Used to analyse user interactions and improve Website usability.

Microsoft Clarity Information:

• https://clarity.microsoft.com/blog/cookies-in-clarity/
• https://learn.microsoft.com/en-us/clarity/

Performance Monitoring Cookies

Performance monitoring tools help us identify technical issues and improve Website reliability.

Examples may include cookies used by services such as New Relic.

Managing Cookies

When you first visit our Website, you will be presented with a cookie banner allowing you to:

• Accept all cookies
• Reject non-essential cookies
• Choose your cookie preferences

You may change your preferences at any time through our cookie settings tool.

You can also manage cookies through your browser settings. Disabling certain cookies may affect Website functionality.

Your Data Protection Rights

Under UK GDPR, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Restrict processing
• Object to processing
• Request portability of your data
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO)

For more information about your rights, visit:

https://ico.org.uk/

Automated Decision-Making

We do not generally make decisions producing legal or similarly significant effects using solely automated processing.

Where automated tools are used for fraud prevention, security monitoring, or service administration, appropriate safeguards will be applied in accordance with applicable data protection legislation.

Childrens Data

Our Website is not intended to knowingly collect personal information from children unless necessary to provide services requested by a parent, guardian, school, attraction, venue, or authorised organisation.

Where we process children's personal information, we take additional care to ensure appropriate protections are in place.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:

Digital Ticketing Systems (t/a DigiTickets)

Sentio House, Pynes Hill, Exeter, Devon, EX2 5AZ

www.digitickets.co.uk/compliance-request

If you have concerns about how we use your personal information, you may submit a privacy complaint to us using the contact details above.

We will acknowledge your complaint and investigate it in accordance with applicable data protection legislation. We aim to respond without undue delay and within the timescales required by law.

If you remain dissatisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).

Other Websites

This Privacy Policy applies only to this Website. Links to third-party websites are provided for convenience only. We are not responsible for the privacy practices of those websites, and we encourage you to review their privacy policies before providing any personal information.

Last Updated: 5 August 2026