Acquisitions and loans privacy notice

Explanation of the purpose

The Library acquires collection items by a number of methods, including donation, deposit, purchase, bequest, and gift, as well as under the Legal Deposit Libraries Act 2003.

Depending on the method of acquisition, the Library may process certain personal data for the purposes of collecting items and maintaining acquisition records.

The Library loans collection items from time to time and also accepts loans of items from third parties. Personal data may be processed for the purposes of negotiating, managing, and recording loans.

For information on how we may use personal data held in our collections see our Collections privacy notice.

Legal basis

Processing of this data is necessary for the performance of a task carried out in the public interest or for our official functions, and for performance of a contract or for undertaking steps necessary for entering into a contract.

Recipients of the data

This data will be processed by the National Library of Scotland for this purpose and certain data will be sent to third parties (see 'Will the data be transferred to third parties?').

Retention period

We process records related to acquisition and loan of collection items for various periods, depending on the method of acquisition or loan.

We retain:

• Records related to items held on deposit for at least five years after the end of the deposit period
• Records related to donation of items for at least three years after the date of last action and we retain donation agreement records permanently
• Records related to items acquired through legal deposit permanently
• Collection provenance information permanently
• Records related to loaned items for at least five years after the end of the loan period

We have a detailed range of retention periods for different types of records, some of which will apply to information processed in the course of handling acquisitions and loans. Please see our retention schedules (811 KB; 77 pages) for details, in particular under business classification 01.02.000 'Acquisition of material' on page 2, and 01.05.02.01 'Loans' on page 6.

While we are working to implement our retention schedules, some data may be retained longer than required under the schedules.

Your rights in relation to this data

Your core rights as a data subject apply to this processing. If you enter into a contract with us, for example by signing a donation or deposit agreement, then the additional right of data portability applies to this processing. If the processing is carried out for the performance of a task carried out for our official functions, the additional right of objection also applies to this processing.

Will the data be transferred to third parties?

Personal data of donors and venders are processed in our library management system (which we use to track item requests and the way people use our items). A third party, Ex Libris, provides some of our systems, including our library management system. The services Ex Libris provides are cloud-based, which means personal data on them is located on servers managed by Ex Libris. For more information see the Ex Libris privacy policy.

We use a third party, the University of Edinburgh, to host our library management system. Personal data on this system is therefore located on servers which are hosted by the University of Edinburgh. For more information see the University of Edinburgh's data protection policy.

Will the data be transferred outside the UK or the European Economic Area (EEA)?

No.

Is it obligatory to supply this data and what are the consequences of not supplying the data?

You are not obliged to supply this data. However, if you are unable to supply this data we may be unable to collect certain items from you or from those you represent or we may be unable to loan items to you or accept the loan of items from you.

Will the data be used in automated decision-making?

No.