Who this notice covers
Discover Scottish Borders is the independent heritage project created and hosted by Mark Nicol. This notice explains how personal information is used in running this heritage website and responding to people who contact the project. Discover Scottish Borders is responsible for that use of information.
For a privacy question, request or complaint, use the contact page and tell us it concerns privacy. If online enquiries are unavailable, that page provides the project’s Facebook contact link. Please send a private message rather than posting personal details publicly.
Tour bookings and websites reached through external links have their own privacy information. This notice covers the heritage website, including its stories and film archive.
Comments and memories
When you submit a comment, we store your name, email address, text, submission time and moderation status privately on SiteGround. Only approved names, comments and any reply from the site owner appear publicly. Your email address is never displayed and is not added to the newsletter.
We use a necessary session cookie, a spam-prevention question and short-lived hashed network identifiers to help prevent abuse. The site owner alone reviews submissions. Notification and sign-in emails are sent only to the site owner. No advertising profiles or website links are created for commenters.
Unpublished submissions are removed after 90 days during routine use of the system. Approved comments remain until removed; their email addresses are cleared after 90 days. A hash of a blocked sender’s address is retained until unblocked to prevent repeat abuse. Contact us if you want your comment removed.
Email newsletter
If you sign up, we use your email address to send one weekly Discover Scottish Borders email with all new posts from the week and a clearly labelled archive feature. We send a confirmation link first. We rely on your consent, which you can withdraw using the unsubscribe link in every email.
We store the address, confirmation status, sign-up time and an unsubscribe token in a private file outside the public website on SiteGround. Unconfirmed requests expire after 14 days and are removed during routine maintenance. Confirmed addresses are removed when you unsubscribe. Short delivery records help prevent duplicate emails and are kept for about a month. SiteGround handles delivery through the existing domain email service.
Information from using the website
Hosting and security services receive technical information needed to deliver pages and protect the website. This can include your IP address, browser information, the page requested, request time and error details. Such information may be recorded in service or security logs.
The heritage website does not currently include visitor analytics, advertising pixels or a visitor profiling system. Archive filters and related-story selections do not create a personal browsing profile or save your reading history in browser storage. The RSS feed does not require you to register with us; your chosen feed reader handles its own account and usage information.
Why we use personal information
Under UK data protection law, we need a lawful reason to use personal information. The reason depends on what we are doing:
- Answering messages and considering contributions: our legitimate interests in running the heritage project, responding to enquiries and keeping useful correspondence, balanced against your privacy and reasonable expectations.
- Discussing a service you have requested: taking steps at your request before entering into a contract, where that applies. Actual tour bookings are handled through the tours website.
- Keeping the site secure and working: our legitimate interests in preventing abuse, diagnosing faults and maintaining access.
- Optional embedded services: consent, given by your choice to load a film player or, when available, the Google security check after seeing the information about that service.
- Meeting legal duties: complying with applicable obligations, including handling data-protection requests.
Sending an enquiry does not sign you up for marketing. We do not sell your enquiry details or make decisions about you with legal or similarly significant effects solely through automated processing. Spam checks can reject a submission; another contact route is provided if you need help.
Who may receive your information
Enquiries are handled by the people helping run Discover Scottish Borders who need the information to respond. Once the contact form is activated, Google services will check submissions for spam and deliver messages to the project’s chosen private email recipients. Recipient addresses are kept out of public pages and form responses.
The website uses Sites hosting with Cloudflare infrastructure. Hosting providers process connection and security information to operate their services. If a hosting sign-in is required, that provider also handles access under its own privacy information. See OpenAI’s privacy policy and Cloudflare’s privacy policy.
Information may also be shared where required by law or where necessary and lawful to deal with a legal claim. We do not publish private enquiries as visitor comments.
Films hosted by Facebook
A small number of archive films are hosted by Facebook. These players load only when you choose Load film. Loading a player allows Facebook to receive connection and device information and use cookies or similar storage. You can leave it unloaded and read the accompanying story, or use Unload film to remove the player.
See Facebook’s privacy policy for its handling of that information.
The contact form’s security check
When online enquiries are enabled, the form uses Google reCAPTCHA to help distinguish visitors from automated spam. It loads only when you choose Load security check. Google receives connection, device and interaction information and may set its _GRECAPTCHA security cookie or use other storage described in its policies.
You can use the alternative contact route instead. Once loaded, the form provides a link to turn the check off by reloading the contact page; this also clears unsent form text. Google’s privacy policy and terms of service apply to its service.
Submitting the form sends its fields for verification and email delivery. The website does not create a separate contact database or spreadsheet. A short-lived reference is used to reduce duplicate delivery after a retry; the prepared delivery service keeps that reference for up to ten minutes.
Where information is processed
Hosting, Google and social services operate internationally, so information may be processed outside the United Kingdom, including in the United States. The location depends on the service and account being used; we do not promise that all processing stays in the UK.
Cloudflare’s published policy describes reliance on the UK Extension to the EU–US Data Privacy Framework for covered US transfers, with contractual safeguards for other relevant transfers. OpenAI’s policy describes adequacy arrangements and standard contractual clauses with the UK addendum. Google explains its international transfer arrangements in its privacy information.
These are the providers’ stated arrangements, rather than a claim that every service uses the same safeguard. Contact us for information about the arrangements relevant to your enquiry or to request details of applicable safeguards.
How long information is kept
Enquiry correspondence is kept for as long as needed to answer the message, deal with reasonable follow-up and resolve the matter. Once those purposes have ended, we delete it unless a continuing legal or practical reason justifies keeping it. The nature of the enquiry, an ongoing collaboration, an unresolved complaint or a legal requirement may affect that decision.
If you agree to contribute material to the archive, permission and credit records may need to be kept while that material is used, and afterwards where needed to demonstrate the agreed rights. Published historical material can remain in the archive for longer than the correspondence accompanying it.
Hosting logs and provider-held records follow the relevant service’s retention arrangements. Email and backup settings also affect when deleted correspondence is fully removed. You can ask us about the information relating to you; we will explain any reason it needs to be retained.
Contributions and living people
The archive may include credited contributors, public historical sources and memories you have agreed to share. A private message is not automatically permission to publish it. We will discuss intended use and attribution before publishing a contribution from an enquiry.
Although much of the archive concerns people from the past, material can also affect living people. If an article, image or film raises a concern about your own personal information, contact us with the page link and explanation so we can review accuracy, context and the appropriate response.
Your privacy rights
Depending on the circumstances, you may ask for access to your personal information, correction, deletion, restriction of its use or a portable copy where that right applies. Where we rely on consent, you may withdraw it without affecting the lawfulness of earlier use.
Your right to object
You can object to our use of your information based on legitimate interests. Tell us about your circumstances and we will consider your request and explain the outcome.
Use the contact page to make a request. We may need proportionate information to confirm your identity before disclosing personal data. We normally respond to rights requests within one month, subject to the extensions and other provisions allowed by law, and will explain any applicable exception.
Privacy questions and complaints
If you are concerned about how we have handled your information, contact the project with the subject “Privacy complaint”, a description of the concern and a way to reply. You do not have to use those exact words or complete a particular form for us to consider a complaint.
We will acknowledge a privacy complaint within 30 days, investigate it without undue delay and keep you informed of the outcome. You can also complain to the UK Information Commissioner’s Office through its complaints service. You do not need our permission to do so.
Keeping this notice up to date
We will update this notice when the website’s services or information practices change, including when online enquiries are activated or any analytics are introduced. The date at the top shows the latest revision. You can also read our website terms for information about content, contributions and visiting featured places.

Social channels and other websites
Our social buttons are links, rather than embedded social feeds. Following a link to Facebook, Instagram, YouTube or another service takes you to that service, which applies its own privacy and cookie rules. If you message us there, the platform also processes that conversation. External archives and visitor websites are responsible for the information they collect on their own pages.