1. Who is responsible
CastleScotland is the data controller for this independent project operated in Scotland. Use the Contact page for privacy enquiries.
CastleScotland
2. Information handled
The website does not require an account. If you join the Castle Journal newsletter, we process your email address, consent and confirmation status, and technical form data. You can unsubscribe through a link in every email. Standard technical data helps deliver and secure the site. The contact form processes your email address, message and technical form data.
3. Why information is used
Contact messages are used to answer questions, handle corrections, consider castle suggestions and discuss collaboration. We send the newsletter only when you tick the consent box and confirm your email address. Consent is the basis for newsletter emails and you can withdraw it at any time. Other processing relies on steps at your request or our legitimate interest in operating and protecting the project.
4. Local preferences
Your chosen language, colour theme and light or dark mode may be stored in your browser's local storage. These preferences remain on your device and are not used to identify you.
5. External services
Sender.net provides the newsletter form and email delivery. Its script may receive technical browser data when a page with the form loads, and signup data is sent to Sender.net. Cloudflare Turnstile protects the contact form and a private Cloudflare Worker delivers its messages. Links to Buy Me a Coffee, PDF files and external maps lead to independent services. Personal data is not sold.
6. Cookies and analytics
With your consent, CastleScotland’s own analytics measure page views, visits, countries, referrals, UTM campaigns, searches, PDF clicks, hotel recommendations and PWA use. IP addresses and browser headers are processed briefly to create a daily rotating identifier; they are not stored in the analytics database. Country and visitor counts are estimates. We store paths without URL parameters, referring domains and limited UTM fields. Search terms resembling email addresses, phone numbers or URLs are dropped; do not enter personal information in search. Detailed events are accessible only to DG. Events older than 365 days are gradually deleted on subsequent activity. Collection and storage run on Cloudflare infrastructure through Sites. Consent is stored locally; current visit attribution is kept in browser session storage. Decline or withdraw consent using “Change analytics consent” at the bottom of the privacy policy page. Declining does not limit features; withdrawal stops future collection. We respect DNT and GPC. Offline activity is not uploaded later.
7. Retention and security
Newsletter data is kept until you withdraw consent or the service ends. After unsubscribing, we may retain the minimum needed to prevent further emails and document consent. Contact messages are kept as long as needed for correspondence, corrections, abuse prevention or legal obligations. Reasonable safeguards are used.
8. Your rights
Depending on the circumstances, you may request access, correction, erasure or restriction of processing, or object to processing. You may also complain to the UK Information Commissioner's Office.
9. Updates
This notice is reviewed when site features or data practices change. Last reviewed: 3 October 2026.
Explore Scotland
Find Scottish castles by region, landscape or the stories that bring them to life.