Privacy

Updated 17/10/2025

2. Important information about this policy

The purpose of this privacy policy ("policy") is to: (i) make you aware of what personal information we will hold, how and why your personal information will be used, and how long it will be retained for, and (ii) provide you with certain information that we are required to notify you of under the UK data protection laws.

Please read this policy carefully as it explains how we use personal information. We keep this policy under regular review and may change this policy and, when we do, we update this page, so please check back frequently.

We have designed this policy to make it easier for you to navigate the information contained within it and locate the information that is most relevant to you. For example, we use clearly worded sections headings, which are always visible as a navigation tool on the left-hand side of the page, to make it easy for you to explore the information of most interest to you by clicking on the relevant section heading.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us, for example a new address or email address.

Our Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Website, we encourage you to read the privacy policy of every website you visit.

3. Personal information we process

Personal information (also referred to as "personal data") means any information describing or relating to an identified or identifiable individual, which we process during our interactions with you. To the extent permitted by applicable laws, and only under the circumstances identified in this policy, we may collect and process a limited amount of personal information falling into "special categories of personal information" often referred to as "sensitive personal information".

We collect and process various types of personal information about you during our interactions with you, which we have set out in the table below, as well as identifying the relevant Blenheim processing entity:

We only collect children's personal data where it is provided by a parent or individual with parental responsibility. If you purchase an Admissions Ticket or additional experience that includes a child, we only collect information about the child necessary for such purchase [and will only use this information to better understand how to improve our future offerings to families in terms of offers and events, we will not contact your child directly]. Our Education Department welcomes children from various local schools, and we only collect information about children necessary for the purposes of administering educational visits.

If you have contacted us on behalf of an organisation, for example making an enquiry regards filming at Blenheim or an educational visit, we will also store details of individuals in their professional capacity including the name of their employer and any relevant business contact details.

Apart from personal information relating to you, if you provide us with the personal information of any third parties, before you provide such third-party personal information to us, you must first inform these third parties of any such information which you intend to provide to us and of the processing that we will carry out, as detailed in this policy.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal information as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' Usage Data to analyse general trends in how users are interacting with our Website to help improve it and our product and service offering.

4. How we collect personal information

We use different methods to collect information from and about you including through:

5. How we use personal information and our lawful basis for processing it

Whenever we process your personal information we do so on the basis of a lawful basis or justification for that processing. Processing of sensitive personal information is always justified on the basis of an additional lawful basis.

In most cases, we rely on one or more of the following lawful bases:

• Performance of a contract with you: where the processing is necessary to perform the contract we are about to enter into or have entered into with you.
• Legal obligation: where the processing is necessary for compliance with a legal obligation that we are subject to.
• Legitimate interests: where the processing is necessary for our legitimate interests, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal information.

In exceptional circumstances we may carry out processing based on your consent. Where we rely on consent, we will make it clear at the time.

We have set out below, in a table format, a description of all the ways we use your personal information, and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are (where appropriate).

We only process the following types of sensitive personal information if the circumstances set out below arise during our interactions with you, in which case, we will rely on the additional lawful basis set out below:

6. Marketing & Fundraising

You will receive marketing communications from us if you have requested information from us (such as a newsletter), purchased products or services from us, donated to us, or not opted out of receiving the marketing.

You can ask to stop sending you marketing communications at any time by following the unsubscribe links within any marketing communication sent to you or by contacting us via the contact details provided below. It may take up to 14 days for your change in preference to take effect and the change will not affect any marketing emails which have already been scheduled to be sent in the future. If you opt out of email marketing, we may still need to send you service communications by email occasionally, such as information about changes to our services.

We may also analyse your Personal and Contact Details, Technical Information and Usage Data to form a view which of our products and services may be of interest to you so that we can then send you relevant marketing and fundraising communications.

For more information about the cookies we use and how to change your cookie preferences, please see our Cookie Policy.

7. Disclosures of your personal information

Within BPHF and BVL personal information is shared internally on a need-to-know basis with each entity's respective staff and personnel including trustees, directors, shareholders, employees, contractors and other temporary workers.

Depending on your dealings with us, we may share some or all of the personal information set out in section 3 where necessary with the following third parties for the purposes set out in section 5:

We require all third parties to respect the security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.

8. International transfers

We may transfer your personal information to service providers that carry out certain functions on our behalf. This may involve transferring personal information outside the UK to countries which have laws that do not provide the same level of data protection as the UK law.

Whenever we transfer your personal information out of the UK to service providers, we ensure a similar degree of protection is afforded to it by ensuring that the following safeguards are in place (as applicable):

• We will only transfer your personal information to countries that have been deemed by the UK to provide an adequate level of protection for personal data.
• We may use specific standard contractual terms approved for use in the UK which give the transferred personal information the same protection as it has in the UK, namely The International Data Transfer Addendum to the European Commission's standard contractual clauses for international data transfers. To obtain a copy of these contractual safeguards, please contact us at the contact details set out in section 12 below.

9. Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

10. How long we retain personal information

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

By law we must keep basic information about our visitors (including Personal and Contact Details) for 7 years after they ceased being active customers for tax and financial reporting purposes. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. If you opt-out of future marketing from us, we will only retain the information required to appropriately record your opt-out for the purposes of our opt-out/suppression list for an indefinite period.

In some circumstances you can ask us to delete your personal information: see section 11 below for further information.

11. Your legal rights

Depending on the circumstances, you have a number of rights under data protection laws in relation to your personal information. You have the right to:

If you wish to exercise any of the rights set out above, please contact us at the contact details provided in section 12.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

12. Contact details

If you have any questions about this policy or about the use of your personal information or you want to exercise your privacy rights, please contact us at dataprotection@blenheimpalace.com. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.