1. Who is responsible
CastleScotland is the data controller for this independent project operated in Scotland. Use the Contact page for privacy enquiries.
Beta2. Information handled
The website does not currently require an account or operate a newsletter. Standard technical data may be processed to deliver and secure the site. When you submit the contact form, your email address, message and technical form data are processed.
3. Why information is used
Messages are used only to reply to questions, handle corrections, consider castle suggestions or discuss collaboration. The lawful basis is taking steps at your request and the legitimate interest in operating and protecting the project.
4. Local preferences
Your chosen language, colour theme and light or dark mode may be stored in your browser's local storage. These preferences remain on your device and are not used to identify you.
5. External services
The contact form uses Formspree. Links to Buy Me a Coffee, PDF files and external map services lead to independent services with their own privacy policies. Personal data is not sold.
6. Cookies and analytics
With your consent, CastleScotland’s own analytics measure page views, visits, countries, referrals, UTM campaigns, searches, PDF clicks, hotel recommendations and PWA use. Separately, after consent that explicitly includes Google, we use Google Analytics 4 (G-7KRCGETPDJ) to measure page views. Google receives technical connection data and may process it outside the UK/EEA. GA4 uses _ga cookies; we configure a 180-day lifetime. Our code disables Google signals and advertising personalisation. We do not send typed search terms or URL parameters to Google. Google explains its processing at https://policies.google.com/privacy. Previous consent to our own analytics does not enable Google. Withdraw consent using the button below; this stops future measurement and removes accessible GA cookies, but does not delete data already sent. IP addresses and browser headers are processed briefly to create a daily rotating identifier; they are not stored in the analytics database. Country and visitor counts are estimates. We store paths without URL parameters, referring domains and limited UTM fields. Search terms resembling email addresses, phone numbers or URLs are dropped; do not enter personal information in search. Detailed events are accessible only to DG. Events older than 365 days are gradually deleted on subsequent activity. Collection and storage run on Cloudflare infrastructure through Sites. Consent is stored locally; current visit attribution is kept in browser session storage. Decline or withdraw consent using “Change analytics consent” at the bottom of the privacy policy page. Declining does not limit features; withdrawal stops future collection. We respect DNT and GPC. Offline activity is not uploaded later.
7. Retention and security
Messages are kept only for as long as needed to manage correspondence, handle a correction, prevent abuse or meet a legal obligation. Reasonable technical and organisational safeguards are used.
8. Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction or object to processing. You may also complain to the UK Information Commissioner's Office.
9. Updates
This notice is reviewed when site features or data practices change. Last reviewed: 9 September 2026.
Explore Scotland
Find Scottish castles by region, landscape or the stories that bring them to life.