The General Data Protection Regulation which came into force on 25 May 2018, requires the Company to manage personal information in accordance with Data Protection Principles. Our website notice now also reflects updated ICO expectations for transparency in the use of tracking technologies, analytics services and AI-powered tools used on or integrated with our website.

Who are we

Edinburgh International Conference Centre Ltd (EICC) of 150 Morrison Street, Edinburgh, EH3 8EE is a provider of world class conference, meeting and exhibition facilities.  EICC is a data controller of your personal information.

At EICC we take your privacy seriously and are committed to protecting your personal information and to being transparent about what personal information we process.

Personal data refers to any information that tells us something about you or that we can link to you.  This may include your name, address, date of birth etc.  Processing refers to anything that we do with this data, such as: collecting; recording; storing; amending; using; disclosing or; deleting it. Personal data also includes technical information generated when you interact with our website or digital platforms, such as device identifiers, browsing activity, preferences and online behaviour patterns.

This privacy notice explains how EICC collects, uses and stores personal information about you that we obtain when you use our website or in the course of any direct contact that you have with us.  It also describes: why the Company needs that information; what the Company does with the information and; what rights individuals have in respect of their data that we hold. This notice also explains how we use certain modern technologies including artificial intelligence tools, automated processing, online analytics and cookie-based tracking where applicable.

Why we hold your personal data

Processing personal information allows us to operate our business efficiently and effectively and to provide our services to our customers.  We may keep your personal information on our system or in our archives for evidential and historical reasons, or use it for analysis and research purposes.  EICC processes your personal information for the following reasons:

• to fulfil a contract that we have with you
• to maintain our records and accounts
• to inform you of news, activities and events
• when it is in our legitimate interest
• when it is our legal duty
• when you consent to it

A legitimate interest arises when we have a business or commercial reason to use your personal information. Examples include improving the performance of our website, understanding how users interact with our online content, ensuring network and information security, and developing our services.

We may also process certain website interaction data for the purpose of analytics, service improvement, fraud prevention and the responsible use of AI-supported tools. These activities are carried out only where such processing does not override your rights and freedoms.

What type of personal data do we hold

EICC typically collects personal information about you when you: visit our website; complete an on-line form; make an enquiry; become a customer; sign a contract and; use our facilities and services.  We may also obtain information about you from third parties. 

The personal information that we hold may include the following:

• your name, address and contact information
• your e-mail address, IP address and telephone number
• your financial and credit card information
• information gathered from your use of our website
• information required to set you up as a client on our system
• information about our services that you use
• information gathered from your use of social media
• information gathered from your use of our box office/ticketing system
• information about any devices that you have used to access our services
• records of our contact or communication with you, such as – system notes, e-mails or letters
• CCTV images

We may also collect certain types of technical and behavioural information when you interact with our website or digital communications, including:

• device identifiers such as browser type, operating system and approximate location data
• interaction data including pages viewed, links clicked and time spent on pages
• information generated through cookies, tags, pixels and similar tracking technologies
• information gathered through automated tools or AI-supported systems used on our website

When do we collect personal data?

We may collect personal information about you, when you:

• enquire about our facilities and services
• register with us for the provision of services or information
• use our services or attend events within our facilities
• use our website, Wi-Fi, or box office services
• sign up with us for newsletters or publications
• telephone us, write to us, email us, contact us online or otherwise provide us with your personal information
• are involved in a health and safety incident whilst on our premises

We may collect information about you through direct means whenever you contact us.  We may also receive information about you when you liaise or interact with third parties with whom we work.

We may also collect personal data automatically when you visit our website or interact with our digital content. This includes information gathered through cookies, analytics tools, tracking pixels and AI-powered systems that help us understand user behaviour, improve our services and respond effectively to enquiries.

Legal basis for processing personal data

The Company is not allowed to process personal data unless it has valid legal grounds to do so.  We will therefore only process your personal data in the following circumstances:

• where we have your consent, where this is required
• where we need to use your information in order to fulfil our contractual obligations to you
• where we need to use your information to comply with our legal and regulatory obligations
• for preventing and detecting crime through the use of CCTV
• where the processing is necessary for the legitimate interests of the Company

Where we rely on your consent to use your personal information, you have the right to withdraw your consent at any time.

Where we rely on legitimate interests, these interests may include ensuring the security and performance of our website, analysing website and service usage to improve user experience, and ensuring effective communication with our customers and prospective customers.

If we use automated tools or AI-assisted systems to support enquiry handling, analytics or website optimisation, these tools operate under the same lawful bases set out above and do not override your rights and freedoms. Any automated processes do not involve decisions that produce legal or significant effects without human involvement.

How do we protect personal data?

The security of your information is very important to us. We protect your information through the maintenance of physical, electronic and procedural safeguards in relation to the collection, storage and disclosure of personal information to prevent unauthorised access, accidental loss, disclosure or destruction.

The following measures are designed to safeguard your personal data:

• we store your data in a secure environment
• we restrict access to your personal information to those who have a genuine need to use it
• our computer network is secured through the use of an advanced firewall and anti-virus software
• we have appropriate policies and procedures in place to protect the integrity of your personal information

We implement role-based access controls, data minimisation practices and regular system monitoring to help prevent unauthorised access to personal information.

Where we use third-party service providers, including hosting services, ticketing systems, analytics providers and AI technology providers, we require them to implement appropriate technical and organisational security measures.

Cookies and other tracking technologies

When you access our website we may gather personal information through the use of internet logs, and cookies.  Cookies enable us to distinguish you from other users of the website although this information is anonymised.  They record what you look at, what links you click etc and gather user behaviour information that is used to track and monitor traffic on our website.  This enables us to tailor the content of our website to meet our client’ and delegates preferences and interest. 

We may also use tracking pixels, tags, analytics tools and session monitoring technologies to understand how visitors engage with our website, identify technical issues, and assess the effectiveness of our content and communications.

You can manage your cookie and tracking preferences through the cookie consent banner on our website or through your browser settings. Non-essential cookies will only be used where you have provided your consent.

How we share your information

We may need to send personal information to, receive personal information from or exchange personal information with relevant third parties.  This will only be done where we have your consent to do so or where the information is disclosed to or received from:

• our principal sub-contractors in order to enable us to deliver our services to you
• other third parties so that we can manage our business appropriately
• other third parties for marketing purposes, where you have given us permission to do so
• analytics and search engine providers that help us to optimise the use of our web site
• regulators, public authorities or the courts
• the emergency services, in the event of an accident or emergency

Where personal data is shared with third parties for marketing or analytics purposes, we will only do so where permitted by law and where you have provided any necessary consent. We do not sell your personal information to third parties.

Your rights

Under the new regulations you have a number of rights, over the personal information that we hold and, which include the following:

• right to fair processing of information and how we use your personal information
• right to request a copy of your information that we hold
• right to require us to correct any mistakes in your information that we hold
• right to request that a restriction is placed on further processing
• right to ask us to delete your personal data from our systems where it is no longer necessary to retain such data
• right to withdraw your consent to the processing at any time, where consent was our lawful basis for processing the data
• right to object to the processing of your personal data
• right to know who your data is shared with

You also have the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal effects or similarly significant impacts. EICC does not carry out such automated decision making.

You can action any of the above by contacting us using the details provided, below.

Access to information

You have the right to access your personal information that we hold. You may however need to supply us with appropriate evidence of your identity.

You can action any of the above by contacting us using the details provided, below.

How long do we keep your personal information for?

We will normally retain your personal data for as long as you use our services and for up to ten years after your last use of our services or your last interaction with us. However, we will not keep your personal information for any longer than is necessary for the purposes we need to use it for.

Transfer of data

We will not transfer your information to countries outwith the European Economic Area (EEA) unless it is unavoidable in allowing us to deliver our products and services.  If you are based outside the EEA data may be transferred between the UK/EAA and the country in which you are based.

Your personal data will not be transferred to countries outwith the European Economic Area.

Changes to this privacy notice

This privacy notice was published on 25 May 2018 and last amended on 19 Dec 2025. We keep our privacy policy under regular review, and we may amend this privacy notice from time to time.  Any such changes will be posted on this page so that we can keep you informed about how we process your personal data.  We therefore recommend that you consult this page periodically so that you are aware of any changes to our privacy notice.  Your continued use of our services shall constitute your acceptance of any revised privacy notice.

How to make a complaint

We aim to meet the highest standards whenever we collect or use your personal information.  We therefore take any complaints very seriously and if you wish to make a complaint, you should in the first instance contact our Data Protection Officer using the contact details provided below.

If you are not satisfied with our use of your personal information; our response to an exercise of your rights or; if you believe that we are in breach of our data protection obligations, you should in the first instance contact our Data Protection Officer using the contact details provided below.

If this does not resolve your complaint to your satisfaction you have the right to lodge a complaint with the Information Commissioners Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

How to contact us

If you have any queries, requests or complaints relating to your personal information that we hold or if you would like to opt in or out of any contact or communications, please contact our Data Protection Officer at the address below:

Data Protection Officer
Edinburgh International Conference Centre Ltd
150 Morrison Street
Edinburgh 
EH3 8EE

E-mail: gdpr@eicc.co.uk