Last updated 17 September 2026
This notice explains how Our Paisley Community Interest Company collects, uses, shares and protects personal information when you visit our website, contact us or arrange a tour or experience. It also explains your data protection rights and how to contact us about them.
Who we are
Our Paisley Community Interest Company is the data controller for the personal information described in this notice. This means we decide why and how that information is used.
Legal name: Our Paisley Community Interest Company
Company number: SC890926
Registered office: 116 Stewarton Drive, Cambuslang, Glasgow, Scotland, G72 8DJ
Privacy contact: info@ourpaisley.co.uk
The information we collect
Depending on how you interact with us, we may collect:
• Contact information, including your name and email address.
• Enquiry and tour information, including the experience you are interested in, possible dates, party size and anything you include in your message or later correspondence.
• Booking and service information, including attendance details, agreed arrangements, amounts paid and records needed to manage the booking or resolve a query.
• Technical and usage information, such as your internet protocol address, approximate location, device and browser type, pages viewed, interactions, referral source and the date and time of visits, where permitted.
• Limited information supplied by a group organiser about other participants when it is needed to arrange or deliver an experience.
We do not routinely ask for health or other sensitive information through the website. If you voluntarily tell us about an accessibility or health need so that we can make appropriate arrangements, we will use only what is necessary and, where required, ask for your explicit consent. Please do not send more sensitive information than we need.
How we use personal information
The following table explains our main purposes and lawful bases under UK data protection law.
| Purpose | Information used | Lawful basis |
| Respond to general enquiries | Contact details and the contents of your enquiry | Our legitimate interests in communicating with people and operating the CIC |
| Provide information or take steps towards a booking | Contact, tour, date, party and correspondence details | Steps taken at your request before entering into a contract |
| Administer and deliver a confirmed tour or experience | Contact, booking, attendance and agreed service details | Performance of our contract with you |
| Meet accessibility or health-related needs you choose to disclose | Only the relevant information you provide | Explicit consent for special-category information, where required |
| Maintain accounts and comply with legal duties | Booking, payment, invoice and accounting records | Legal obligation |
| Operate, secure and troubleshoot the website and email service | Technical, security and communication records | Our legitimate interests in maintaining secure and reliable services |
| Understand and improve website use through Google Analytics | Cookie identifiers and technical and usage information | Consent |
We do not sell personal information. We do not currently use enquiry details for email newsletters or other direct marketing. We do not make decisions about people that have legal or similarly significant effects using solely automated processing.
Contact form and email enquiries
Our contact form asks for your name and email address so that we can reply. You can also select an experience and provide a party size and message. The name and email fields are required; without them, we may be unable to respond. The other fields are optional, although some information may be necessary if you ask us to arrange a booking.
Form submissions are sent to our email inbox and are not intentionally stored as enquiry records in the WordPress database. Our website, email and backup providers may process or temporarily retain technical copies as part of providing and securing their services.
Cookies analytics and Google services
We use Google Tag Manager to manage website tags and Google Analytics 4 to understand how visitors use the website. If you consent to analytics, Google Analytics may receive cookie identifiers and technical and usage information such as your device, browser, approximate location, pages viewed, interactions, referral source and visit times. We do not intentionally send your name, email address or the contents of your enquiry to Google Analytics.
Analytics is optional. Our cookie controls allow you to accept or reject analytics without losing access to the website and to change your choice later. Analytics tags must remain inactive unless you consent. Strictly necessary storage may still be used where it is required for the website or your privacy choices to work.
Google’s privacy information is available at policies.google.com/privacy.
We also use Google Search Console to understand how the website appears in Google Search. Search Console provides site-level search and performance information and does not require us to place an additional tracking tag in your browser.
At the date of this notice, we do not use Google Ads, Microsoft Advertising or Meta advertising or remarketing tags. We will update this notice and our cookie information before introducing advertising technology.
Who we share information with
We may share limited personal information with:
• website, hosting, email, backup and technical-support providers that help us operate our services;
• Google, when you consent to Google Analytics;
• venues, experience providers and tour partners where sharing is necessary to arrange or deliver the experience you selected;
• payment, banking, accounting and professional-adviser services where relevant to a booking or our legal obligations; and
• courts, regulators, law-enforcement bodies or other authorities where disclosure is required or permitted by law.
We require service providers acting on our behalf to protect personal information and use it only for the agreed purpose. Some recipients, such as banks or professional advisers, may act as separate controllers under their own privacy notices.
International transfers
Some technology providers may process personal information outside the United Kingdom. Where this happens, we take steps intended to ensure that an appropriate level of protection applies, such as relying on UK adequacy regulations or approved contractual safeguards. You may contact us for more information about the safeguards relevant to your information.
How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected:
• General enquiries that do not become bookings are normally retained for up to 12 months after the last meaningful correspondence.
• Booking and service correspondence is normally retained for up to three years after the relevant experience, unless it is needed for longer to deal with a complaint, legal claim or safeguarding matter.
• Accounting and transaction records required for company and tax purposes are generally retained for six years from the end of the relevant financial year.
• Google Analytics event-level data is retained for up to 14 months, subject to the settings applied to our Analytics property.
• Technical and security records are retained for the period reasonably required to operate and protect the service or investigate an incident.
When information is no longer required, we delete it or anonymise it where reasonably practicable.
Security
We use reasonable technical and organisational measures to protect personal information and restrict access to people who need it for their work. No internet or email system can be guaranteed to be completely secure, so please avoid sending unnecessary sensitive information through the contact form or ordinary email.
Children and group bookings
Bookings and enquiries should normally be made by an adult. We do not knowingly ask children to submit their contact details through the website. A parent, guardian or group organiser may provide limited information about children in a party where it is necessary to plan or safely deliver an experience. We ask organisers not to provide more information than is needed.
Your data protection rights
Depending on the circumstances and the lawful basis we use, you may have the right to:
• ask for a copy of the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete personal information in certain circumstances;
• ask us to restrict how information is used in certain circumstances;
• object to processing based on legitimate interests;
• receive information you provided in a portable format where the right applies; and
• withdraw consent at any time where we rely on consent, without affecting earlier lawful use.
To exercise a right, email info@ourpaisley.co.uk. We may need to verify your identity before acting on a request. Data protection rights are not absolute, and we will explain if an exemption or other legal reason means that we cannot fully comply.
Complaints
If you are concerned about how we have used your personal information, please contact us first at info@ourpaisley.co.uk. We will acknowledge a data protection complaint within 30 days and investigate and respond without undue delay.
You can also complain to the Information Commissioner’s Office. Guidance and contact options are available at ico.org.uk/make-a-complaint.
Changes to this notice
We will review this notice and update it when our services or use of personal information changes. We will publish the current version on our website and change the date at the top. Where a change materially affects how we use information already collected, we will take reasonable steps to bring it to the attention of the people concerned before the new use begins.
Contact us
Email: info@ourpaisley.co.uk
Registered office: 116 Stewarton Drive, Cambuslang, Glasgow, Scotland, G72 8DJ