PRIVACY NOTICE

Effective from: 23 August 2026
Last updated: 23 August 2026

Website: MyScotlandTrip.com
Brand: MyScotland Trip – My Scotland, My Story

1. Introduction

The purpose of this Privacy Notice is to provide visitors to our website, prospective customers and users of our services with clear and transparent information about how and why we collect and process personal data, the lawful bases on which we do so, how long we retain personal data, with whom it may be shared, and the rights individuals have in relation to their personal data.

The Data Controllers are committed to processing personal data lawfully, fairly, transparently and securely.

Personal data is processed in accordance with the data protection legislation applicable to the relevant processing activities, including, where applicable, the EU General Data Protection Regulation (EU GDPR), the UK GDPR and the Data Protection Act 2018.

2. Data Controllers

MyScotland Trip

Contracting Service Provider:
Dorottya Molnar – self-employed sole trader operating in the United Kingdom

Trading Name:
MyScotland Trip-Dorottya Molnar

Operation:
Dorottya Molnar & Péter Ács

UK & Hungarian business and service addresses:

48.West George Street,Glasgow, G2 1BP

2182.Domony,Fő út 59.

​

The address serves as our business and service address and as one of the locations from which we conduct our business activities. By prior arrangement, we use the premises for business and group meetings, project and travel planning, content creation and creative project work, as well as other behind-the-scenes business operations. We are not permanently present at the premises and therefore do not operate a permanent walk-in customer service. For enquiries and assistance, please use the contact details provided on our website.

​

Contact:
Email: scotlandtraveling@gmail.com
Telephone: +36 70 388 8739, +44 7803 492932

​

The primary contact address for any enquiries relating to privacy or personal data is:

 

scotlandtraveling@gmail.com

​

A separate Data Protection Officer (DPO) has not currently been appointed. Should the future structure or activities of the business, or applicable legislation, require the appointment of a DPO, this Privacy Notice will be updated accordingly.

​

3. What Personal Data We Process and Why

The Data Controllers only process personal data that is necessary for specified and lawful purposes.

3.1. Technical Data Relating to the Use of the Website

Certain technical information may be generated or recorded automatically when the website is used.

This may include:

• IP address;

• browser type and version;

• device type;

• operating system;

• date and time of the visit;

• pages visited;

• session and technical log data;

• information collected through cookies and similar technologies.

Purpose of processing: to ensure the proper and secure operation of the website, identify and resolve technical issues, prevent misuse and, where consent is required, for statistical and analytical purposes.

Lawful basis: depending on the particular processing activity, the legitimate interests of the Data Controllers, the necessity of providing the relevant service, or the consent of the individual where required for analytical, marketing or other non-essential technologies.

Retention period: for as long as necessary for the operation of the relevant technical function, cookie or service, or for the period determined by Wix or the relevant third-party service provider. Where processing is based on consent, processing may continue until consent is withdrawn or until the relevant technology reaches the end of its specified lifespan.

3.2. Enquiries and Contact

Where an individual contacts us through the website, by email, telephone or another communication channel used by the Data Controllers, we process the personal data provided for the purpose of responding to the enquiry and maintaining communication.

Personal data processed may include:

• name;

• email address;

• telephone number;

• the content of the message;

• any additional information voluntarily provided by the individual.

Purpose of processing: responding to enquiries, providing information, answering questions, providing quotations and communicating with prospective customers before they use our services.

Lawful basis: taking steps at the request of the individual prior to entering into a contract or, depending on the nature of the communication, the legitimate interests of the Data Controllers.

Retention period: where an enquiry does not result in a booking or contract, the information will generally be retained for no longer than 12 months following the conclusion of the enquiry, unless a legal claim or other legal requirement justifies a longer retention period.

3.3. Bookings and Provision of Services

Where a booking is made, the Data Controllers process the personal data necessary to record and administer the booking, organise and provide the tour or travel service, and communicate with the traveller.

Personal data processed may include:

• full name;

• email address;

• telephone number;

• billing information;

• booking details;

• selected tour or service;

• number of participants;

• information relating to payment status;

• other information necessary for organising the trip;

• where appropriate, the name and telephone number of an emergency contact.

Purpose of processing: administering bookings, entering into and performing the contract, organising the trip, communicating with travellers and, where necessary, helping to ensure the safety of participants.

Lawful basis: entering into and performing a contract, compliance with legal obligations and, depending on the particular information concerned, legitimate interests or consent.

Retention period: for as long as necessary to perform the contract and subsequently for any period required under applicable accounting, taxation or other legislation, or for as long as reasonably necessary for the establishment, exercise or defence of legal claims.

3.4. Additional Information Required to Organise a Trip

Certain tours or travel arrangements may require additional information.

This may include:

• traveller’s name;

• contact details;

• booking details;

• information required for accommodation arrangements;

• information required to book admission tickets or other activities;

• the name and telephone number of an emergency contact;

• any other information strictly necessary to provide the relevant service.

The Data Controllers will only disclose to third-party service providers the information that is necessary to book or provide the relevant service.

Categories of recipients may include: accommodation providers, activity and attraction providers, ticketing services, transport providers, payment and booking service providers, and other service providers genuinely involved in delivering the relevant tour.

4. Payments and Invoicing

Payment for services may be made by:

• bank transfer;

• online debit or credit card payment;

• other payment methods supported by the website from time to time.

Where an online payment is made, payment information is processed by the relevant payment service provider. The Data Controllers do not store full payment card details.

Payment provider: the payment service provider activated on the website through the Wix system.

Invoicing: invoices are issued through the invoicing system used by the website and the business from time to time.

Personal data processed may include:

• name;

• billing name;

• billing address;

• email address;

• telephone number;

• service purchased;

• amount due and amount paid;

• transaction identifiers and related transaction information;

• any further information required by law for issuing an invoice.

Retention period: payment and invoicing information will be retained for the period required under applicable accounting, taxation and other legal requirements.

5. Use of the Wix Platform

The My Scotland Trip website operates using the Wix platform.

The Wix service is provided by:

Wix.com Ltd., Yunitsman 5 St., Tel Aviv, Israel.

Certain visitor and customer data processed through the website may be processed by Wix on behalf of the Data Controllers in its capacity as a data processor.

Personal data submitted through the website or generated through its use may be processed and stored through Wix’s technical infrastructure.

Wix operates international infrastructure and uses sub-processors. According to information provided by Wix, personal data may be stored in data centres located in, among other places, the United States and Ireland.

Wix.com Ltd. is based in Israel. The European Commission has recognised Israel as providing an adequate level of protection for personal data.

Where personal data is transferred to a country for which no applicable adequacy decision is available, Wix states that it uses appropriate safeguards, including Standard Contractual Clauses (SCCs), together with additional technical, contractual and organisational measures where appropriate.

6. Other Processors and Recipients

The Data Controllers may use third-party providers where necessary to operate the service.

These may include:

• Wix – website hosting, website functionality, booking, marketing and related online services;

• Google/Gmail – electronic communications;

• the payment service provider activated on the website;

• invoicing service providers;

• accounting service providers;

• accommodation providers;

• ticketing and activity providers;

• transport and other tourism service providers;

• other providers necessary to deliver a particular tour.

As individual accommodation providers, attractions, activities and other tourism partners may vary from one tour to another, they are not necessarily listed individually in this Privacy Notice.

Personal data is disclosed to such providers only where, and to the extent that, it is necessary to book or provide the relevant service.

7. International Transfers of Personal Data

As a result of using Wix, Google and other international service providers, personal data may be processed outside the United Kingdom or the European Economic Area.

Any such international transfer will be carried out in accordance with applicable data protection law and, where required, subject to appropriate contractual, technical and organisational safeguards or an applicable adequacy decision.

According to Wix, where personal data is transferred to a third country that is not covered by an applicable adequacy decision, it uses Standard Contractual Clauses and additional data protection safeguards where appropriate.

8. Cookies and Similar Technologies

The website uses cookies and similar technologies.

Strictly necessary cookies may be used to enable the basic operation, security, sessions, booking functionality and other essential features of the website.

Depending on the website’s current configuration, the website may use:

• strictly necessary cookies;

• functional cookies;

• analytical and statistical cookies;

• marketing and advertising cookies;

• technologies associated with Wix services.

Non-essential cookies and similar technologies that require consent will only be activated after the visitor has provided the required consent.

Visitors can manage or withdraw their consent through the cookie settings provided on the website.

The current list of cookies and similar technologies actually used by the website is available through the website’s cookie management system.

9. Marketing and Newsletters

The Data Controllers may send newsletters and electronic marketing communications.

Newsletter and marketing communications may be managed through Wix and other communication tools connected to the website.

Personal data processed: primarily name, email address and information necessary to record subscription and consent.

Where processing is based on consent, consent may be withdrawn at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

10. Social Media

My Scotland Trip may use social media platforms to present its services, publish content, conduct marketing activities and communicate with prospective customers and travellers.

Platforms currently used or planned include:

• TikTok;

• YouTube.

Individual social media platforms may also process users’ personal data as independent data controllers in accordance with their own privacy policies.

11. Special Categories of Personal Data

As a general rule, the Data Controllers do not request or collect information concerning health or other special categories of personal data.

The tours are not healthcare, medical assistance or specialist care services.

Where a participant has a health condition or reduced mobility that may materially affect their ability to participate safely in a particular tour, the possibility of participation should be discussed in advance, taking into account the nature of the tour, the vehicle used and the physical requirements of the programme.

Where an individual voluntarily provides health-related information that is necessary to assess safe participation, the Data Controllers will process such information only to the extent necessary and only where an appropriate lawful basis for processing such special category data applies.

12. Personal Data Relating to Children

A child may participate in a tour only when accompanied by a parent or another adult who is lawfully responsible for the child’s participation.

Personal data relating to a child will only be processed to the extent necessary to administer the booking, organise the trip and provide the relevant service.

13. Automated Decision-Making and Profiling

The Data Controllers do not use solely automated decision-making that produces legal effects concerning an individual or similarly significantly affects them.

Statistical or marketing technologies used on the website are not used by the Data Controllers to make such significant decisions solely by automated means.

14. Data Security

The Data Controllers take appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss, deletion or destruction.

Access to personal data is limited to those individuals and service providers who require access in order to provide the services or for another lawful purpose.

15. Data Retention

Personal data is retained only for as long as necessary for the purpose for which it was collected and processed.

When determining an appropriate retention period, the Data Controllers take into account:

• the purpose of the processing;

• performance of the relevant contract;

• applicable accounting and taxation obligations;

• limitation periods relating to potential legal claims;

• whether the individual’s consent remains valid;

• retention rules applied by relevant technical service providers.

Where there is no longer a lawful purpose or legal requirement to retain personal data, it will be deleted or anonymised as appropriate.

16. Your Data Protection Rights

Depending on the applicable data protection legislation and the lawful basis for the relevant processing, individuals may have the following rights:

Right of Access

You may ask whether we process your personal data and request access to personal data held about you.

Right to Rectification

You may request the correction of inaccurate personal data and the completion of incomplete personal data.

Right to Erasure

In circumstances provided for by applicable law, you may request the deletion of your personal data.

Right to Restriction of Processing

In certain circumstances, you may request that the processing of your personal data be restricted.

Right to Data Portability

Where the legal requirements are met, you may have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit that information to another controller.

Right to Object

Where processing is based on legitimate interests you may object to processing of your personal data in accordance with applicable law.

Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

17. Exercising Your Rights

Requests relating to personal data or the exercise of data protection rights may be submitted using the following contact details:

Email:
scotlandtraveling@gmail.com

Postal address:
2182 Domony, Fő utca 59., Hungary

The Data Controllers will respond to requests within the time limits required by applicable data protection legislation.

Where reasonably necessary, the Data Controllers may request appropriate information to verify the identity of the person making the request in order to prevent personal data from being disclosed to an unauthorised person.

18. Complaints

If you believe that your personal data has been processed in breach of applicable data protection legislation, you have the right to lodge a complaint with the competent data protection supervisory authority.

The data protection supervisory authority in the United Kingdom is the:

Information Commissioner’s Office (ICO)
United Kingdom

Where another European supervisory authority has jurisdiction under the EU GDPR, you may also have the right to lodge a complaint with that competent supervisory authority.

You may also have the right to seek a judicial remedy where provided for by applicable law.

19. Providing Personal Data and the Consequences of Not Providing It

Certain personal data is necessary in order to make a booking and provide the requested service.

If you do not provide information necessary to administer a booking or perform the service, we may be unable to accept the booking or provide the relevant service.

Where possible, optional information will be distinguished from information required in order to provide the service.

20. Sources of Personal Data

We obtain personal data primarily directly from the individual concerned.

Where one person makes a booking on behalf of several participants, we may receive the personal data necessary for the other participants from the person making the booking.

Additional personal data may arise from communications initiated by an individual by email, telephone or social media, as well as from use of the website and its technical systems.

The Data Controllers do not purchase personal data from third-party databases for the purpose of building marketing databases or conducting direct marketing.

21. Personal Data Breaches

If a security incident involving personal data occurs, the Data Controllers will respond in accordance with applicable data protection legislation.

Where required by law, the breach will be reported to the competent supervisory authority and, where the breach is likely to result in a high risk to the rights and freedoms of affected individuals, those individuals will also be informed as required.

22. Changes to this Privacy Notice

The Data Controllers may amend this Privacy Notice, particularly where there is a change to:

• the operation of the services;

• the website;

• a personal data processing activity;

• a service provider used by the business;

• applicable data protection legislation.

The current version of this Privacy Notice will be made available on the MyScotland Trip website.

Where a material change is made, affected individuals will be informed in an appropriate manner where required.

Last updated: 23 August 2026

23. Contact

If you have any questions about this Privacy Notice or the processing of your personal data, please contact us using the following details:

Data Controllers:
Dorottya Molnár and Péter Ács

Email:
scotlandtraveling@gmail.com

Postal address:
2182 Domony, Fő utca 59., Hungary

48.West George Street,Glasgow,G2 1BP UK

Telephone:
+36 30 395 4623
+44 7803 492932
+36 70 388 8739

​

​

​

​

© 2026 MyScotland Trip. All rights reserved.

This Privacy Notice has been specifically prepared for the operation of MyScotland Trip. Unauthorised copying, reproduction, publication or commercial use of this document, in whole or in part, is not permitted.