Purchases privacy notice

Explanation of the purpose

We process personal data that you provide to us in the course of making a purchase or similar exchange, for example obtaining a permission or copyright licence or making a purchase from our shop.

Legal basis

Processing of this data is necessary for performance of a contract or for undertaking steps necessary for entering into a contract.

Recipients of the data

This data will be processed by the National Library of Scotland for this purpose and certain data will be sent to third parties (see 'Will the data be transferred to third parties?').

Payments for purchases made on our online shop are completed by a third party, ClearAccept. When you are ready to pay for your order or purchase you will be directed to ClearAccept's own website where you will be asked to provide payment details. If you supply these, you will be providing these details to ClearAccept, not to the Library. ClearAccept (not the Library) will be the 'data controller' of the personal data you provide on the ClearAccept website. You should read ClearAccept's privacy information before sending personal data to ClearAccept.

Payments for most other purchases made online are completed by a third party, PayPal. When you are ready to pay for your order or purchase you will be directed to PayPal's own website where you will be asked to provide payment details. If you supply these, you will be providing these details to PayPal, not to the Library. PayPal (not the Library) will be the 'data controller' of the personal data you provide on the PayPal website. You should read PayPal's privacy information before sending personal data to PayPal.

Payments made for our Historic Maps Subscription API from our Map images website are completed by a third party, Klokan Technologies. For these purchases, Klokan Technologies or their payment services provider (not the Library) will be in control of the personal data you provide on the Klokan Technologies' payment website. You should read Klokan Technology's MapTiler privacy information and any privacy information provided by their payment provider before sending personal data to Klokan Technologies or their payment provider.

Retention period

We process purchase records for six years after the end of the financial year in which the purchase took place.

We have a detailed range of retention periods for different types of records, some of which may also apply to information processed for the purpose of buying online. Please see our retention schedules (811 KB; 77 pages) for details, in particular under business classification 06.02.04.05 'Expenses and transactions' on page 50.

While we are implementing our retention schedules, some data may be retained longer than required under the schedules.

Your rights in relation to this data

Your core rights as a data subject apply to this processing. Additionally, the right of data portability also applies to this processing.

Will the data be transferred to third parties?

Most online payments will be completed by a third party, PayPal, and online payments for our Historic Maps Subscription API will be completed by Klokan Technologies or their payment provider (see 'Recipients of the data')

Payments made in person using a credit or debit card are processed through a third party, First Data. First Data uses the information you provide through your credit or debit card to process your payment to the Library. For more information about how First Data uses this data, please see First Data's privacy policy.

We use a third party provider, EKM, for our online shop. Purchases made through our online shop are processed by EKM. For more information see EKM's privacy policy.

We use a third party provider, Signiant, to send large file transfers using their product Media Shuttle. For more information see Signiant's privacy policy.

We use a third party provider, Booksource, to distribute some orders from our shop. For more information see Booksource's privacy notice.

Will the data be transferred outside the UK or the European Economic Area (EEA)?

Online payments will be completed by a third party, PayPal, which is based outside of the European Union. (see 'Recipients of the data')

Transfers of data from credit or debit card payments to First Data may involve transfers outside of the European Union. For more information on their international transfers of data please see First Data's privacy policy.

Signiant are registered in the United States of America and your personal data may be transferred there. Signiant are compliant with the EU-US Privacy Shield Framework which provides a mechanism to comply with Data Protection requirements when transferring data.

Is it obligatory to supply this data and what are the consequences of not supplying the data?

Yes, in order to purchase from the Library (or in order to undertake a similar exchange) you are obliged to provide certain personal data. If you are unable to supply this data you will not be able to purchase certain goods or services from the Library.

Will the data be used in automated decision-making?

No.