Privacy and security

Your privacy is extremely important to us. Our Privacy Notice outlines the way in which we gather and use information relating to you.  Any personal information we gather from you will be used in accordance with the Data Protection Act 2018 and in accordance with the policy of the Royal Household.

You can at any time change or withdraw your consent from Cookies using the Cookie Declaration on our website.

PRIVACY NOTICE

This privacy notice tells you what to expect when Royal Collection Trust (RCT) collects personal information.

Royal Collection Trust incorporates a registered charity, The Royal Collection Trust, and its wholly owned trading company, Royal Collection Enterprises Ltd. The charity and the trading company are registered as data controllers with the Information Commissioner’s Office (registration numbers Z580764X and Z5807653 respectively).

This privacy notice applies to information we collect if you: 

• Purchase a ticket from us  
• Provide feedback  
• Appear in a photograph we take with your permission 
• Have an accident  
• Are captured on CCTV  
• Purchase our merchandise  
• Subscribe to be contacted by us  
• Enter our competitions  
• Access our free guest WiFi service  
• E-mail us via the retail help desk  
• Browse our websites  
• Contact us via RCT websites  
• Make an enquiry about the Royal Collection  
• Request permission to photograph objects for research purposes  
• Request photographic prints or digital files  
• Are associated with objects in the Royal Collection  
• Are invited to attend RCT events 
• Make a donation  
• Contact the RCT Press Office  
• Receive information from us on a regular basis 
• Lose property when visiting our sites
• Use other websites and social media platforms 

Your privacy is extremely important to us. Any personal information we gather from you will be used in accordance with the Data Protection Act 2018 and UK GDPR and with the policy of the Royal Household.  

1  THE INFORMATION WE COLLECT 

1.1     Purchasing tickets from us 

When you purchase tickets from us, we may collect your name and contact details. This personal data is retained for six financial years in line with HMRC requirements on the retention of financial records. Any purchase of tickets in advance of the visit date will require the collection of your name, e-mail address, postcode, house number, country and telephone number. We will use your e-mail address to confirm the booking and to send you information about your visit. We may also use your e-mail address to deliver your electronic tickets and receipt if you have chosen to receive e-tickets. If you book or contact us via telephone, we may record your call for training and quality control purposes.  When registering for a 1-Year Pass we may collect your name, address and telephone number if you are over the age of 18. 

As most of our sites are working Royal residences, they are subject to closure at short notice. If you book in advance, we will use your telephone number and e-mail address to contact you if we are made aware of a closure that affects your visit date in order to offer you an exchange or a refund. 

We will use your postal address to deliver your tickets to you if you choose to pay to have your tickets sent by post, as proof of purchase on collecting tickets, or to process a Gift Aid declaration as described in 1.18.2. 

Where food and drink are offered during the visit, we may collect information about dietary requirements, such as allergens. Where visits require step-free access, we may collect vehicle details (registration, make, model, colour, registered owner). For school visits where there are students with special needs, we may be provided with details of your requirements (students are not identified by name). 

For guests who visit on one of our Exclusive Guided Tours, or who choose to make use of our parking facilities (available to those who require step-free access during Buckingham Palace Summer Opening or the annual opening of Clarence House), or on a School visit or Special Learning Event on a day the Royal residence is usually closed to the public, we may collect additional personal details. These details are collected and processed as stipulated in the Royal Household’s Privacy Policy in the section When you are invited to attend a Royal event or visit a Royal site either by us or a third party. 

If you wish to use a feature on the RCT websites that requires you to register with us, we ask you to create an online account. To do this, you need to supply some of your personal information on our web registration form. We ask for your name, e-mail address, postcode, country, telephone number, interests and a password (‘Personal Information’). When you create an account, you will be asked if you would like to receive regular e-mail updates about the latest news, exclusive events and competitions. 

1.2     Giving feedback 

If you visit one of our sites or attend one of our events, you may be asked to provide feedback. 

For learning events, this may include a request for personal details, such as postcode and age range. We ask for these details in order to build a profile of those taking part in particular learning events, and we process this information in a way that ensures that it does not identify you personally. We may also contact schools and other education institutions for feedback regarding learning outcomes and the learning experience on the visit. 

We also gather feedback from visitors to our sites. Feedback forms may include a request for your e-mail address. This enables us to respond to you about a specific issue or question you have raised. Your e-mail address is not used for marketing purposes, unless you have specifically consented to that. 

1.3     Photography 

On occasions there may be a photographer engaged by RCT at an event or exhibition (including the Buckingham Palace Summer Opening). We may ask you to sign a Model Release Form to confirm your consent to be photographed. If we wish to take photographs of children at an event, we will obtain consent from parents or guardians before doing so. Often schools assist us in obtaining that consent. We keep consent forms indefinitely as proof of consent. If there is a large group of children at a family event, such as a Festival Day, we may ask that children who do not wish to be photographed wear a sticker, so that we do not include them in any photographs. We use these photographs to promote RCT activities.   

1.4     Accidents 

If you have an accident while visiting one of our sites, we will ask you to complete an Accident Form and give your name, contact details, and the nature of your injury. We are obliged to do this under Health and Safety Regulations. Depending on the nature of the accident, we may also have to report it to Government regulators. We will retain your personal information securely in locked facilities for six years in order to comply with relevant legislation. We may also ask for your personal details if you are involved in a near-miss incident while visiting one of our sites. 

1.5     CCTV 

There are CCTV cameras around the Royal residences, Galleries and shops. These have been installed for the purpose of the prevention and detection of crime and may collect images of members of the general public. The Data Controller for the footage of the CCTV cameras is the Keeper of the Privy Purse. The footage may be shared with the police when they are investigating an incident. The footage is kept securely, and access to the images is strictly limited. The footage is normally retained for 30 days and then recorded over.     

1.6     Purchasing our merchandise   

When you purchase goods from our website or over the telephone using our home delivery service, we will ask you to provide your name, e-mail address, telephone number, billing address and delivery address. We do this in order to process your order and to maintain a record of correspondence. We retain this information for six financial years in line with HMRC requirements on the retention of financial records and while the customer continues to use our service.  We may share your delivery details with an external provider, who will deliver your goods, where that provider satisfies our due diligence assessments and there is an agreement in place.  If your delivery address is overseas, your personal data will be transferred overseas by that provider as part of their delivery chain. Our legal basis for sharing your data with such providers is that we have a legitimate interest in doing so. 

1.7    Subscribing to be contacted by us 

1.7.1 Receiving our e-mail updates on exhibitions and events 

We send out e-mails several times a month to subscribers to our e-mail updates on the topics they wish to hear about, depending on their stated preferences. You can edit your preferences or unsubscribe via the links in the footer of every e-mail.   

If you have not clicked on any e-mail communications from us for 15 months, you will no longer receive our e-mail updates. 

Unsubscribed data is kept securely in our e-mail system in order to ensure we have a record of those who do not wish to be contacted. If you would like your data to be deleted, your record can be deleted from the e-mail system on request.      

1.7.2 Group mailings 

If you represent a group or the travel trade, we offer regular notifications about new exhibitions, site news and an up-to-date opening and closures list. These will be emailed to you from time to time if you have made a group booking with us previously and have provided us with your contact details for this purpose, and/or have indicated to us that you wish to receive this material. In order to do this, we collect your name and e-mail address. You can edit your preferences or unsubscribe via the links in the footer of every e-mail. 

We also collect the personal information of individuals who make group bookings with us, or who request to be added to our groups mailing list in order to receive a copy of our annual Group Visits and Private Tours brochure. For this purpose, we process your name and address, and details of the group with which you are affiliated. You may request your details be deleted from our group mailing list at any time by contacting the Trade Sales and Marketing team at RCT by telephone, e-mail or post.   

We rely on the legitimate interest basis for consent to process the personal data of people who receive our group mailings. 

1.7.3 Regular updates on merchandise   

We offer regular updates on merchandise available through our retail outlets. If you wish to receive this, we ask you to give us your e-mail address. You can edit your preferences or unsubscribe via the links in the footer of every e-mail. 

1.7.4 'Stay-in-touch’ cards 

In each retail outlet, we have a newsletter registration form that enables you to subscribe to our merchandise mailing list. We ask for your name (optional) and e-mail address, which is entered into our secure e-mail system. The registration forms are subsequently securely shredded.      

1.8    Competitions 

When you enter any of our competitions or prize draws, we collect your name and e-mail address only in order to administer the competition. If you win, we will notify you by e-mail and ask for your full name, postal address and telephone number so that delivery can be arranged. 

All competition data will be deleted one month after the winner has received their prize. During this time the surname and county of the winner will be made available on request only, in accordance with applicable rules.

On an ad hoc basis, we may also receive the personal information of new subscribers who have opted in to receive our e-mail updates via a competition entry with a third party. 

1.9    Guest WiFi service 

At selected sites, we offer free guest WiFi. On the registration page, you must enter your name, e-mail address and country of residency to join the network. We collect this information to personalise your online experience and to allow you to reconnect easily if you visit one of our other sites. Users may also choose to subscribe to our merchandise and newsletter mailing lists via the opt-in checkboxes. 

1.10 E-mailing the retail help desk 

We use an external provider to process the enquiries made via the customer account. This feature is only available to logged-in customers. No additional personal data is required; you just need to enter a subject line and message. 

1.11 Browsing our websites 

When you browse RCT websites (rct.uk) or our retail website (royalcollectionshop.co.uk), we use first-party cookies (cookies that we have set and which can only be read by our website) to keep track of your current session and to personalise your online experience. We also use third-party cookies (cookies that are set by an organisation other than the owner of the website) for the purposes of website measurement and targeted advertising. You can control the use of cookies by adjusting your browser settings, ad settings, ad settings for mobile apps, or any other available means. You may experience technical difficulties in using our websites if you have disabled cookies. Further information on cookies and those used on our websites can be found on the following two webpages: www.rct.uk/cookies and www.royalcollectionshop.co.uk/privacy-and-security. 

We may also collect information about where you are on the internet (e.g. the URL you came from, IP addresses, domain types such as .co.uk and .com), your browser type, the country and telephone area code where your computer is located, the pages of our website that were viewed during your visit, the advertisements you clicked on, and any search terms that you entered on our website (‘User Information’). We may collect this information even if you do not register with us. 

We collect this information for statistical or survey purposes to improve our websites and services to our users, and to recognise users when they return to our website; to serve website content and advertisements to users; to administer our websites and to notify users about changes to our services; and for the detection of fraud.   

Personal information collected from a user’s browsing activity is kept for two years. 

1.12 Contacting us via RCT websites 

When you complete a contact form on one of our websites we ask you for your name and e-mail address as well as other information particular to the nature of your enquiry. The data is sent via e-mail to the relevant recipient within RCT to process and is retained in accordance with RCT's and the Royal Household's retention schedules. 

1.13 Making an enquiry about the Royal Collection   

If you come on site to undertake research on the Collection, you are required to provide the following personal details: name, address, date of birth and place of birth, and whether or not you have a criminal record. We collect this information as part of our security procedures for security accreditation purposes. This is done in order to keep people safe, and the premises and the Collection secure. We may also collect details of any required access arrangements, and details of your vehicle, if applicable, in order to facilitate your visit. These details are collected and processed as stipulated in the Royal Household’s Privacy Notice in the section When you are invited to attend a Royal event or visit a Royal site either by us or a third party.   

If you write to us with an enquiry, we may keep your name and postal address or email address on file together with your enquiry and our response, should there be any follow-up correspondence.    

1.14 Requesting permission to photograph objects for research purposes 

You may request to undertake photography of work in the Royal Collection for research purposes. In order to process this request, we ask you to provide your name, e-mail address and postal address on a Copyright Assignment Form, which you must also sign. These forms are retained indefinitely in a secure manner. The purpose of processing and retaining this personal information is to protect the copyright of RCT material. 

1.15 Requesting photographic prints or digital files 

You may request photographic prints of items in the Royal Collection for personal use or for research, or digital files for reproduction purposes. In order to process, complete and deliver your order, we request your name, e-mail address, postal address and payment details, and use these details to process the order. Secure methods of payment are used to complete the transactions. 

Details are held indefinitely, but not shared with any third parties, nor are they used for promotional or any other activities. 

1.16 Associations with objects in the Royal Collection   

As part of maintaining a record of the history of the objects in the Royal Collection, we record personal information about those responsible for the production and/or acquisition of works. For this purpose, where relevant, we may record on our database such personal details as your name, postal address, e-mail address, and your association with the object, and we keep that information indefinitely. We do not share your personal information outside the Royal Household, unless consent has been provided.     

1.17 Invitations to attend RCT events 

From time to time we host special events, such as exhibition openings or publication launches, at Royal residences. When we invite people to these events, we process names and addresses (residential or business) in order to send out invitations. These details are obtained from people who are already associated with RCT or from public sources. 

We may share this information with our external printers who prepare the invitations. We may also prepare short biographies of our guests, sometimes including a photograph. This information has either been provided to us by the relevant guest or comes from public sources. We do this in order to facilitate our engagement with our guests at the events. When a person accepts an invitation, we retain a record of the event they have attended and their contact details on our events database, which is securely stored on our internal network.     

1.18 Donations 

1.18.1 Charitable donations 

When you support us, for example by making a donation to a specific project, we will usually collect your name and contact details. We collect this data so that we can update you on how your donation has been used. We may ask for more support through donations. Names of donors may be published in RCT's Annual Report, with the donor’s permission. If you have donated to us, we are required to keep this data for six financial years. 

1.18.2 Gift Aid donations 

When you make a Gift Aid donation, we may collect the following information: title, forename, surname, postal address and information regarding your eligibility to make a Gift Aid donation. This personal data is retained for six financial years. 

1.19 Journalists who contact the Press Office 

The RCT Press Office accesses and uses contact details for journalists who register on a third-party media database. We also process the personal details of journalists who contact us directly for information. In this case, your personal information is added to RCT's mailing list held on our secure network. 

The RCT Press Office uses these contact details in order to send journalists press information, invitations to events and to respond to enquiries. These details may include name, telephone number, postal address, and e-mail address. We may share journalists' names and addresses with a third party mailing house for RCT purposes only. They are not passed on to any other external body.   

Journalists may unsubscribe from RCT mailing lists at any time by contacting the RCT Press Office by telephone, e-mail or post. Journalists' contact details remain on our mailing list indefinitely, unless we become aware of, or are advised of, a change of postal address or e-mail address, or someone unsubscribes. We actively manage our mailing lists to keep them up to date.   

Journalists who wish to apply to visit RCT premises complete our Press Visits Form, available on the RCT website. This form asks for the following personal data from the applicant: name, e-mail address, telephone number, name of media outlet, position. We collect these details in order to assess and process the application. The personal data provided on this form is gathered by a third-party provider and stored securely. It is released to RCT for processing. The personal information is retained according to RCT's retention schedule.

1.20 Receiving information from us on a regular basis 

If you have an interest in RCT you may be sent promotional material, such as our Annual Report, from time to time. We process your name and contact details (postal address or e-mail address) for this purpose. The legal basis for processing these details is that RCT has a legitimate interest in providing this material to you in order to keep you up to date with our activities. You would expect to receive this material because you have legitimate links to RCT. 

1.21 Lost property 

If we find lost property on our premises, your goods may be examined in order to find your contact details and, if found, to contact you to arrange for collection. If you contact us about your lost property, we may take your contact details (name, address, telephone number, e-mail address) so that we can communicate with you should the item be found.  

1.22 Using other websites and social media platforms 

We may share limited amounts of your data with third parties in order to perform services on your behalf, and to help promote RCT by serving you advertisements and content online about our products, exhibitions and events that we think might be of interest to you. You will be given the opportunity to opt out of receiving this content whenever you are shown this information online. On social media sites, you would only ever be shown this information if you already have a social media account with those third parties. We never sell your personal information to other organisations for their direct-marketing purposes. 

2  SHARING YOUR PERSONAL INFORMATION 

We work with a number of technology partners to maintain and improve our services to you. This may include sharing limited amounts of your personal data (e-mail address) with other websites and social media platforms as described in 1.22 and also sharing information about our services for look-alike audience marketing. 

We never sell your personal information to other organisations for their direct marketing purposes. 

In limited circumstances, RCT may be required to disclose certain details to the Metropolitan Police Service and the respective county constabularies to ensure the security of our premises. We may share your personal information with Government regulators if required.   

3  HOW WE PROTECT YOUR PERSONAL DATA 

When you purchase RCT tickets or merchandise, whether over the telephone, via one of our websites, at a Royal residence or Gallery, or in one of our retail outlets, we use a third-party provider to process credit or debit card sales. Our provider adheres to the international security standards within the credit-card industry. 

We keep your information on secure servers and fully comply with all applicable UK data protection and consumer legislation.   

When we engage our technology partners to process personal information on our behalf, they do so on the basis of written instructions that require them to process your personal data and keep it secure in line with relevant legislation.   

4  YOUR RIGHTS 

As a data subject, you have a number of rights (‘Subject Rights’).  You can: 

• Access and obtain a copy of your data on request 
• Ask us to change incorrect or incomplete data
• Ask us to delete or stop processing your data, for example, where the data is no longer necessary for the purposes of processing 
• Object to the processing of your data where we are relying on our legitimate interests as the legal ground for processing 
• Receive your personal data provided by you to us and send the data to another organisation (or ask us to do so if technically feasible), and 
• Object to any automated decision-making and profiling 

You can at any time request a copy of personal information held about you or exercise any of your other Subject Rights by emailing the Data Protection Manager at [email protected] or write to: The Data Protection Manager, Digital Services, Buckingham Palace, London SW1A 1AA. 

RCT has appointed IT Governance Europe Limited to act as its EU representative. If you wish to exercise your rights under the EU General Data Protection Regulation (EU GDPR), or have any queries in relation to your rights or general privacy matters under EU legislation, please email our Representative at [email protected]. Please ensure to include our company name in any correspondence you send to our Representative. 

5  CONTACTING US AND COMPLAINTS

The Data Protection team based at Buckingham Palace is responsible for ensuring compliance with data protection legislation across the Royal Household including RCT. If you have any queries about this privacy notice or about how RCT handle your personal data, please email our Data Protection Manager at: [email protected], or write to: The Data Protection Manager, Digital Services, The Royal Household, Buckingham Palace, London, SW1A 1AA.

If you wish to submit a complaint because you consider that RCT has infringed data protection legislation, please contact the Data Protection Manager by email or post as above. We will acknowledge your complaint within 30 days, and conduct our investigations and provide our final response to you without undue delay. If your complaint is complex and requires more lengthy investigation which means we will not be able to respond within 30 days, we will let you know when to expect an answer from us.

Please note we may need to ask you for proof of identity. If you are making a complaint on behalf of someone else, before we can begin our investigations we will require written authorisation from that person as evidence that they are happy for you to act for them.

If you have concerns about the handling of your personal data that we cannot resolve with you through the complaints process, the Information Commissioner’s Office (ICO) is an independent body set up to uphold information rights in the UK. They can be contacted through their website (Make a complaint about how an organisation has used your personal information | ICO) or via their helpline on 0303 123 1113.

6  CHANGES TO THIS PRIVACY NOTICE 

Please check back frequently to see any updates or changes to our Privacy Notice. It was last updated on 15 June 2026.