Source: https://www.heritageofscotland.com/page/privacy
Timestamp: 2019-04-19 08:26:54+00:00

Document:
When transmitting your data to us, your data will be encrypted using state-of-the-art technical safety standard, a so-called SSL 256-bit encryption (SSL = Secure Socket Layer). The safety certificate used is issued by one of the world market leaders, DigiCert Inc. (RapidSSL RSA CA 2018).
As part of the payment in our online shop, we acquire certain person-related data about you to be able to process the payment.
In addition to the purchase on account, for which we will send an invoice to the contact address provided by you, we offer additional payment method to be able to execute the purchase in our online shop as comfortable as possible.
Sage Pay uses a range of secure methods such as fraud screening, I.P address blocking, and 3D secure. Once on the Sage Pay systems, all sensitive data is secured using the same internationally recognised 256-bit encryption standards.
For more information see the Sage Pay Data Privacy regulations.
You will find how to clear Cookies for the respective browser under the following links but please pay attention that with the non-acceptance of cookies the functionality of our website may be limited.
These cookies expire within 60 days and do not contain information that can identify you personally. Please refer to the Google Advertising Privacy Notice for more information about Google Conversion Tracking and the ability to opt out.
Google uses this information to carefully display CloudApps adverts on various third-party websites across the internet. These cookies are set to expire and do not contain information that can identify you personally.
We further use the Criteo service on our site. With the help of this tool, users who have already visited our website once before and were interested in our offers are specifically offered advertisements on websites, which also use the Criteo service (re-marketing). This advertising is faded in based on information about the visit to the respective websites, which among others are stored in cookies on your computer. These text files are read out within the scope of subsequent website visits for specific product recommendations. For this purpose, an accidentally generated identification number is stored in the cookies. Neither this number nor the information about your visits to the websites can be allocated to you personally.
We further use the Go.pl service on our site. With the help of this tool, users who have already visited our website once before and were interested in our offers are specifically offered advertisements on websites, which also use the Go.pl service (re-marketing). This advertising is faded in based on information about the visit to the respective websites, which among others are stored in cookies on your computer. These text files are read out within the scope of subsequent website visits for specific product recommendations. For this purpose, an accidentally generated identification number is stored in the cookies. Neither this number nor the information about your visits to the websites can be allocated to you personally.
The cookie is, as a rule, stored for a maximum period of three months and will subsequently be deleted automatically.
• Right to withdraw consent: If you have consented to certain types of processing activities, you can withdraw your consent at any time with future effect. However, please note that this withdrawal does not affect the legitimacy of the processing activities that took place before you withdrew your consent, or if the processing can be justified on the grounds of another legal basis.
• Right to access: You have the right to request information about your data that is stored at our company according to the provisions of Art. 15 GDPR (restrictions may apply pursuant to sec. 34 BDSG).
• Right to correction: At your request, we will correct the data that is stored about you according to Art. 16 GDPR if the data is incorrect or contains errors.
• Right to erasure: At your request, we will delete your data according to the principles of Art. 17 GDPR as long as this is not opposed by other statutory provisions (e.g. statutory retention obligations or the restrictions pursuant to sec. 35 BDSG) or an overriding interest on our part (e.g. to defend our rights and claims).
• Right to restrict processing: Taking into account the requirements of Art. 18 GDPR, you can request that the processing of your data is restricted.
• Right to object: You can also object to the processing of your data in accordance with Art. 21 GDPR. This right to object exists if there are certain reasons that arise from your special situation, and only for data processing the legitimacy of which is based on a consideration of the various interests, which relates to profiling or that is carried out for the purpose of direct advertising. In this case, your data will no longer be processed unless we are legally entitled to decline your objection. We must, however, comply with an objection against direct marketing, including profiling, and we may no longer process your data for these purposes.
You must withdraw your consent if you have previously consented to direct advertising and no longer wish to receive direct advertising.
• Right to data transferability: In accordance with the regulatory requirements of Art. 20 GDPR, you also have the right to receive your data in a structured, popular and machine-readable format, or to have the same transmitted to a third party.
• Complaint submitted to the data privacy authority: You also have the right to submit a complaint to a data privacy supervisory authority in charge (Art. 77 GDPR). However, we recommend that a complaint is always first submitted to our Data Protection Officer so that we can address your concerns as quickly and customer-focused as possible.
We do not use purely automated decision-making processes pursuant to Art. 22 GDPR. If such processes are used in isolated cases in the future, you will be informed separately, if this is required by law.
You only have to provide the data that is required to initiate and implement the contractual relationship or for a pre-contractual relationship, or that we are legally required to collect. Without this data, we will normally be unable to conclude or further implement the contract. This may also relate to data that is required at a later time in the context of the contractual relationship. If we request additional data, you will be informed about the voluntary nature of this information.
Heritage of Scotland can only access your data as is required to achieve the purposes in accordance with the internal division of tasks. To this end, only those departments and employees who are required to access your data will be granted access to this data internally.
Service providers: We have involved service providers that have access to your data in their capacity as a contract processor, and who process this data for the purposes specifically defined by us. These contract processors may be marketing services providers, website hosting service providers, IT support services providers or website analysis service providers.
Other third parties: We may also be required to forward certain data to third parties in cases where this is required by law or under the legislation. Such parties may include government authorities, external advisors, business partners, courts, experts as well as internal company committees and control instances if required.
International data transmission: Even though all recipients are currently based in the EU/EEA, it is possible that in the future recipients may be based in a country outside of the EU/EEA that does not offer a standard of data privacy that is comparable to the European data privacy standard. In particular, such service providers may be located in the US in the future. In this case, Heritage of Scotland will either select service providers that have been certified under the US-EU Privacy Shield Program (Art. 45 para. 1 GDPR), or that arrange the EU standard contract clauses, such as those approved by the EU Commission, with Heritage of Scotland (Art. 46 para. 2 (c) or (d) GDPR).
This data privacy information was most recently updated on 25 May 2018. Heritage of Scotland reserves the right to update this data privacy information from time to time.

References: Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 21
 Art. 20
 Art. 22