Privacy Policy

Last updated: April 2026

1. Introduction

This Privacy Policy explains how Edinburgh Castle Tickets ("we", "us", or "our") collects, uses, and protects your personal information when you use our website and booking services. We are committed to ensuring that your privacy is protected in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We may collect the following types of personal information:

• Identity Data: First name, last name
• Contact Data: Email address, telephone number
• Transaction Data: Details about payments and ticket purchases
• Technical Data: IP address, browser type, time zone, operating system
• Usage Data: Information about how you use our website

3. How We Use Your Information

We use your personal information for the following purposes:

• To process and fulfil your ticket bookings
• To send booking confirmations and e-tickets via email
• To process payments through our secure payment gateway
• To communicate with you about your booking
• To improve our website and services
• To comply with legal obligations

4. Payment Processing

All payment transactions are processed through PayGlobal, our third-party payment processor. We do not store your full credit card details on our servers. Payment processing is secured with 256-bit SSL encryption. PayGlobal processes your payment data in accordance with PCI DSS standards.

5. Data Sharing

We may share your personal information with:

• Payment processors: To process your ticket purchases
• Email service providers: To deliver booking confirmations
• Analytics providers: To help us understand website usage (anonymised data)
• Legal authorities: When required by law

We will never sell your personal information to third parties for marketing purposes.

6. Cookies

Our website uses cookies to enhance your browsing experience. These include essential cookies for website functionality, performance cookies for analytics, and preference cookies to remember your language settings. You can manage your cookie preferences through your browser settings.

7. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, typically for a period of 24 months after your last transaction. Transaction records may be retained longer to comply with legal and accounting requirements.

8. Your Rights

Under UK GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. All data transmitted between your browser and our servers is encrypted using SSL/TLS technology.

10. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at: privacy@edinburghcastletickets.com