Privacy

The National Library of Scotland collects and processes data for some aspects of our activities and services.

On this page we explain:

• Why and how we collect and process personal data
• Your rights in relation to your personal data
• Details of the third parties we share personal data with
• How to complain about our processing of personal data

We process personal data for many of our functions. For example:

• Works in our collections may contain personal data
• We process some personal data when you register as a Library user
• We process personal data when you purchase from us online or register to attend an event with us

Our privacy notices provide specific information about some of the different ways we may process your personal data. For example, the notices explain how long this data is retained and whether this data is shared with any third parties. It is likely that only one or a few of these purposes will apply to you and your personal data. Privacy considerations may vary according to the different purposes. If you are not sure which purposes apply to you, please contact us.

In our privacy notices we split these rights into two categories; three core rights which normally apply to all processing activities, and four additional rights which only apply in specific circumstances depending on the lawful basis for us processing your data. These lawful bases are defined in the legal basis for processing data section. Our privacy notices detail all of your rights in relation to each specific data processing activity undertaken by the Library.

Your core rights

Subject to relevant conditions, the core rights normally apply to all data processing activities we undertake.

• The right of access: you have the right to know whether we are processing any of your personal data. If we are, you have the right to access the data and certain information, such as why we are processing the data.
• The right of rectification: you have the right to ensure that we correct inaccuracies in your personal data that we are processing.
• The right to restrict processing: in certain situations you have the right to ensure that we restrict our processing of your personal data. For example, if you contest the accuracy of the data you may request that we restrict our processing of that data while we verify its accuracy.

Contact our Data Protection Officer to exercise your rights in relation to your personal data.

For further information about your core rights see the guidance from the UK Information Commissioner's Office.

Your additional rights

Your additional rights, which apply under specific circumstances are:

• The right to withdraw consent: you have the right at any time to withdraw your consent for us to process your personal data. This right only applies in situations where our processing of your personal data is based on your explicit consent (for example, this right does not apply in situations where we are processing your personal data in accordance with a task carried out in the public interest).
• The right of erasure: (the ‘right to be forgotten’): in certain situations you have the right to ensure that we erase your personal data. For example, you may request that we erase your personal data if it is no longer necessary in relation to the purpose for which it was collected or processed.
• The right of data portability: in certain situations you have the right to receive personal data that you provided to us in a structured, commonly used and machine-readable format.
• The right to object: in certain situations you have the right to object to our processing of your personal data and we are normally obliged to stop processing your data when requested. This right includes the right to object to our processing of your personal data for the purposes of profiling and direct marketing, as well as for research in some cases.

Contact our Data Protection Officer to exercise your rights in relation to your personal data.

For further information about your additional rights see the guidance from the UK Information Commissioner's Office.

We must have a lawful basis for processing your personal data, as set out in the General Data Protection Regulation. There are six available lawful bases for processing, at least one of which must apply.

• Consent: you have given clear consent for us to process your personal data for a specific purpose.
• Contract: the processing is necessary for a contract you have with us, or you have asked us to take steps before entering into a contract
• Legal obligation: the processing is necessary for us to comply with the law.
• Vital interests: the processing is necessary to protect someone’s life.
• Public task: the processing is necessary for us to perform a task in the public interest or for our official functions.
• Legitimate interests: the processing is necessary for our legitimate interests.

For further information about the lawful bases see the guidance from the UK Information Commissioner's Office.

The National Library of Scotland collects and processes personal data for a number of purposes.

These purposes are listed below.

You can follow the links to read the privacy notice for each purpose. Each notice provides information about our processing of personal data for the stated purpose, the retention of the data, as well as your associated rights.

Since our functions and activities change, we may add to or edit this list of purposes. We may also add to or edit the information in the notices in the event of change, for example, if we change which third party we are sharing personal data with. We will publish the most up to date information on this page.

• Acquisitions and loans
• Catalogue records
• CCTV
• Collections
  
• Communications
• Competitions
• Contact preferences
• Donating online
• Employment
• Enquiries
• Events
• Feedback and complaints
• Fundraising
• Legal compliance
• Legal deposit
• Purchases
• Registration
• Safety
• Wi-Fi

We are currently updating our international transfer arrangements. Please see the Information Commissioner's Office website for more information on international transfers following Brexit.

You can read the Library's Data Protection Policy (Word document) (114 KB; 46 pages).

You can use our complaints procedure to make a complaint about data protection. You may also contact the Data Protection Officer using the contact details below. You have the right to make a complaint directly to the UK Information Commissioner's Office (ICO), which is the data protection supervisory authority in the UK.

If you wish, you do not need to make a complaint to us before making a complaint to the ICO; you may make an initial complaint directly to the ICO.

To contact our Data Protection Officer:

Email: privacy@nls.uk

Write to:
Data Protection Officer
National Library of Scotland
George IV Bridge
Edinburgh
EH1 1EW
Scotland, UK

Tel: +44(0)131 623 3700