Invincible Scotland Trust Privacy Notice

1. Introduction

This Privacy and Cookie Policy explains how we collect, use, store and protect your personal data when you use our website and booking services. It applies to all visitors to our Squarespace-hosted website and anyone who books appointments, classes or retreats through our Acuity Scheduling system.

We are committed to protecting your privacy and handling your data in a transparent, lawful manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who we are

TM Glasgow is operated by Invincible Scotland Trust (IST), a registered educational charity (Registered with the Charity Commission in England & Wales (number 270157), Northern Ireland (XR20456), and Scotland (SC013238)). Our registered office is 6 Gardenia Close, Rendlesham, Suffolk IP12 2GX.

Invincible Scotland Trust is the data controller for the purposes of data protection law. This means we decide how your personal data is processed and for what purposes.

For data protection queries, please contact us at: glasgow.uk@tm.org

3. What personal data we collect

We may collect the following categories of personal data:

3.1 Information you provide directly

  • Name and contact details (email address, phone number, postal address)

  • Booking and appointment details

  • Payment information (processed securely via Acuity Scheduling’s integrated payment providers such as Stripe or PayPal – we do not store card details ourselves)

  • Responses to intake forms completed during the booking process

  • Health-related information where necessary for the provision of Transcendental Meditation instruction (collected only with your explicit consent)

  • Communication preferences and marketing consent

  • Any information you provide when contacting us with an enquiry

3.2 Information collected automatically

  • Technical data such as IP address, browser type and version, device type, operating system

  • Usage data including pages visited, time spent on pages, navigation paths and referral sources

  • Cookie data (see Section 9 below for full details)

4. How we use your personal data

We use your personal data for the following purposes:

  • To process and confirm event bookings and appointments you make through Acuity Scheduling

  • To respond to your enquiries

  • To send appointment confirmations, reminders and follow-up communications via Acuity Scheduling’s automated notifications

  • To ensure our accredited instructors can deliver Transcendental Meditation programmes to you as effectively and appropriately as possible

  • To maintain a record of your course credentials, which qualify you for further courses

  • To inform you of news, events, activities and services offered by Invincible Scotland Trust (until and unless you unsubscribe)

  • To manage our employees and maintain our accounts and records

  • To analyse website usage and improve our services (using anonymised and aggregated data where possible)

5. Legal basis for processing

Under the UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

  • Legitimate interest: when you make an enquiry or an event booking, and to keep you informed about closely related services.

  • Contract: where processing is necessary to fulfil a booking you have made with us.

  • Consent: for marketing communications and for processing health-related special category data necessary for the provision of Transcendental Meditation instruction (GDPR Article 9(2)(d)).

  • Legal obligation: for complying with employment, health and safety, social security or social protection law as it applies to our employees and consultants.

You can adjust your communication preferences or opt out of marketing communications at any time by contacting us or using the unsubscribe link in any marketing email.

6. Sharing your personal data

Your personal data will be treated as strictly confidential. We will not sell, trade or lease your personal information to third parties for their marketing purposes.

We may share your data with the following categories of service provider, all of whom are required to process your data securely and only in accordance with our instructions:

  • Squarespace Inc. – as our website hosting platform and provider of Acuity Scheduling. Squarespace acts as a data processor on our behalf. Their privacy policy is available at squarespace.com/privacy.

  • Payment processors – such as Stripe or PayPal, integrated through Acuity Scheduling, to securely process payments.

  • Google – for calendar synchronisation (Google Calendar) and website analytics (Google Analytics).

  • Email service providers – to deliver transactional emails and, where you have opted in, marketing communications.

Where any service provider is located outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

7. How long we keep your personal data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements.

  • Booking and transaction records: retained for 6 years from the date of the transaction (in line with HMRC requirements).

  • Course credentials: held for as long as necessary to verify eligibility for further courses, and may be retained indefinitely with your consent.

  • Marketing preferences: retained until you withdraw consent.

  • Website analytics data: retained in anonymised/aggregated form only.

8. Your rights

Under the UK GDPR, you have the following rights in respect of your personal data:

  • Right of access – to request a copy of the personal data we hold about you (free of charge).

  • Right to rectification – to request correction of inaccurate or incomplete data.

  • Right to erasure – to request deletion of your data where it is no longer necessary for us to retain it.

  • Right to restrict processing – to request a restriction on further processing where there is a dispute about accuracy or processing.

  • Right to data portability – to request that we provide your personal data in a structured, commonly used format.

  • Right to object – to object to the processing of your personal data in certain circumstances.

  • Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at glasgow.uk@tm.org.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) on 0303 123 1113, via email at https://ico.org.uk/global/contact-us/email, or at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

9. Cookies and tracking technologies

Cookies are small text files placed on your device when you visit a website. They help websites function properly, remember your preferences and understand how visitors use the site.

Our Squarespace-hosted website uses two categories of cookies:

9.1 Necessary cookies

These are essential for the website to function and cannot be switched off. They are typically set in response to actions you take, such as logging in, completing forms or setting your cookie preferences.

Cookie Name

Set By

Purpose

crumb

Squarespace

CSRF (Cross-Site Request Forgery) protection token. Prevents unauthorised form submissions.

ss_cid

Squarespace

Identifies unique visitors for analytics purposes. Necessary for core site functionality.

ss_cpvisit

Squarespace

Identifies unique visits for analytics purposes.

ss_cvr

Squarespace

Tracks unique visitors and visits for analytics.

ss_cvt

Squarespace

Tracks total visits for a visitor.

SS_MATTR

Squarespace

Tracks the referring URL for a visitor.

SS_MID

Squarespace

Identifies unique site visitors to enable visitor counting.

9.2 Non-essential cookies (analytics and performance)

These cookies collect information about how visitors use our website, helping us improve the site and your experience. They are only set with your consent, which you can manage via the cookie banner displayed when you first visit the site.

Cookie Name

Set By

Purpose

_ga

Google Analytics

Distinguishes unique visitors by assigning a randomly generated number. Used to calculate visitor, session and campaign data for site analytics reports. Expires after 2 years.

ga[ID]

Google Analytics

Used by Google Analytics to persist session state. Expires after 2 years.

_gid

Google Analytics

Stores and counts pageviews. Expires after 24 hours.

_gat

Google Analytics

Used to throttle request rate to Google Analytics. Expires after 1 minute.

9.3 Third-party cookies (Acuity Scheduling)

When you use our embedded Acuity Scheduling booking system, Acuity (a Squarespace product) may set cookies to manage your booking session and preferences. These cookies are governed by Squarespace’s privacy and cookie policies. If you proceed to make a payment, additional cookies may be set by the payment processor (e.g. Stripe or PayPal) to facilitate the secure transaction.

9.4 Social media cookies

If our website includes social media features (such as sharing buttons), these may set cookies to enable functionality. These are governed by the privacy policies of the respective social media platforms (e.g. Facebook, Instagram).

9.5 Managing cookies

When you first visit our website, you will see a cookie banner allowing you to accept or decline non-essential cookies. You can change your preferences at any time through the cookie settings on our website.

You can also control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling cookies may affect the functionality of our website. For more information about cookies, visit www.aboutcookies.org or www.allaboutcookies.org.

10. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include:

  • Our website is hosted on Squarespace, which uses industry-standard SSL/TLS encryption (HTTPS) to protect data in transit.

  • Payment processing is handled by PCI DSS-compliant providers (Stripe, PayPal) through Acuity Scheduling. We do not store, process or have access to your full payment card details.

  • Access to personal data is limited to authorised personnel only.

  • Our booking data is stored securely within the Squarespace/Acuity infrastructure.

11. Links to other websites

Our website may contain links to third-party websites. This privacy policy applies only to our website and services. When you follow a link to another website, you should read their own privacy policy. We are not responsible for the privacy practices of other sites.

12. Changes to this policy

We keep this privacy and cookie policy under regular review. Any updates will be published on our website with the revised date shown at the top of this page. We encourage you to check back periodically.

13. Contact us

If you have any questions about this policy, or wish to exercise any of your data protection rights, please contact us:

Email: glasgow.uk@tm.org

Post: TM Glasgow, c/o Invincible Scotland Trust, 6 Gardenia Close, Rendlesham, Suffolk IP12 2GX