Feedback and complaints privacy notice

Explanation of the purpose

We may process personal data that you provide to us in the course of giving feedback or making a complaint. We may use this information to handle and respond to your feedback or complaint.

Legal basis

The processing of this data is necessary for the performance of a task carried out in the public interest or for our official functions. in some cases we will only process your personal data for this purpose if you give us consent to do so.

Recipients of the data

This data will only be processed by the National Library of Scotland for this purpose, and certain data will be sent to third parties, (see 'Will the data be transferred to third parties?').

Retention period

We process records documenting the handling of complaints for five years after the date of last action.

We have a detailed range of retention periods for different types of records, some of which may also apply to information processed in the course of handling complaints. Please see our retention schedules (500 KB; 80 pages) for details, in particular under business classification 05.01.02.01 'Feedback and complaints', on page 32.

While we are working to implement our retention schedules, some data may be retained longer than required under the schedules.

Your rights in relation to this data

Your core rights as a data subject apply to this processing. Additionally, the right of objection applies to processing carried out in the public interest or for our official functions. For processing that is carried out on the basis of consent, you have the right to withdraw your consent at any time and the rights of erasure and data portability also apply.

Will the data be transferred to third parties?

We sometimes use services provided by Microsoft's cloud-based Office 365 tools for gathering feedback and complaints. This includes email and online forms. Information submitted by email or managed electronically, for example through online forms, are processed within Microsoft Office 365.

We occasionally use a third party provider, The Audience Agency, for conducting surveys and audience research. For more information, contact The Audience Agency or the Library's Data Protection Officer.

We occasionally use a third party provider, the Scottish Government Consultation Hub, for gathering feedback. For more information, please see the Scottish Government's privacy policy.

We occasionally use a third party provider, Lookback, during optional usability testing sessions. For more information, please see Lookback's privacy policy.

We occasionally use a third party provider, Frankly, Green, and Webb, for user research. For more information, please see Frankly, Green, and Webb's privacy policy.

Will the data be transferred outside the UK or the European Economic Area (EEA)?

We occasionally use third party providers, Microsoft and Lookback, for conducting surveys and audience research. For more information, please see Microsoft's privacy policy and Lookback's privacy policy.

Data that is processed in Microsoft Office 365 my be transferred outside of the European Union. The Library has a Standard Contractual Clauses agreement with Microsoft to ensure adequate protection for any personal data transferred outside of the European Union.

Data that is processed by Lookback may be transferred outside the European Union. Lookback are registered in the United States of America and your personal data may be transferred there. Lookback are compliant with the EU-US Privacy Shield Framework which provides a mechanism to comply with Data Protection requirements when transferring data.

Is it obligatory to supply this data and what are the consequences of not supplying the data?

No, you are not obliged to supply your personal data for this purpose. However, if we are not able to process your personal data for this purpose we will not be able to respond to your feedback or complaint and, depending on the circumstances, it may not be possible for us fully to deal with the nature of your feedback or complaint.

Will the data be used in automated decision-making?

No.