To provide and manage free wi-fi access to visitors and others at NGS sites.

Device MAC and IP addresses Temporary location data Apps used Categories of sites visited.

Contract
This data is required to provide the service in line with the terms of use.

To help protect visitors, staff, contractors and others on-site, as well as the collection and NGS property.

Images captured by CCTV.

Public task
NGS has a duty to secure the collection.

Legitimate interest
To protect NGS property and people visiting or working in the gallery buildings.

To improve the visitor experience.

To understand who our audiences are and what they want/ need.

Details left in comments books by visitors which may include:

Date of visit

Name

Home location (eg city/ country/ postcode)

Comments/opinions

Email address (if they are happy to be contacted about their experience/ opinions).

Data provided via social media channels (on our accounts or making reference to us).

Legitimate interest
NGS uses this data internally to monitor performance, and to improve the services offered to the public; to meet and exceed expectations of existing visitors, attract new visitors and ensure satisfaction.

If we believe someone expects a response to their comment, and they have left an email address, we may follow this up.

Consent
All data provided in comments books is voluntary. If visitors are happy to be contacted about their experience, they can choose to leave their email address which will be added to a list to receive surveys.

Marketing/ promotional activities

Comments left in comments books

First name

Home town/ country

Legitimate interest
Some positive comments left voluntarily in comments books may be used in marketing and promotional material.

To respond to enquiries, requests for information and complaints made by individuals.

Name

Contact details

Any opinions or biographical information contained within correspondence.

Outcome of request/enquiry

Legal obligation
Requests for information will be handled under Freedom of Information or Environmental Information legislation. Requests to exercise data protection rights will be handled under GDPR. Complaints will be handled and responded to as stipulated in the Ombudsman’s model complaints handling procedure.

Public task
Responding to enquiries about the collection is part of our statutory role.

Legitimate interest
Processing personal data contained in any other type of enquiry so that we may respond to that enquiry will be on the basis of legitimate interest (ours, yours or a third party).

Effective communication and consultation with private individuals, stakeholders and other organisations.

Name
Contact details

Contents of correspondence (email, mail, voicemail) including biographical information.

Personal opinions, experience and other detail shared in consultation responses.

Public task
Most correspondence and consultation is undertaken in the course of delivering our statutory duties.

Some communication and consultation will be on the basis of contract, legal obligation or consent. Any communication not covered by the above will be on the basis of legitimate interest.

To document and record our activities and to promote our work.

Photographs

Footage (general crowd, no individuals as focus of image/ footage).

NB. Photography/footage of events is addressed in the relevant privacy notice.

Public task
Documentation of our work is undertaken part of our public task.

Legitimate interest
Any promotional use will be on the basis of our legitimate interest.

To run competitions, give-aways etc.

Name
Contact details

Other personal data required by particular competitions/ give-aways etc.

Depending on the particular circumstances, data processing may be on the basis of contract, legitimate interest or consent.

We may be required to provide evidence that a valid award took place. In this case, data processing will be on the basis of legal obligation.

To assist in returning lost property to owners.

Finder’s name and contact details where given.

Claimant’s name and contact details, signature and details which may help to prove ownership (if needed).

Time and date of visit, where applicable.

Any personal data contained within found objects.

Legal obligation
Civic Government (Scotland) Act 1982

MAC and IP addresses; location data; usage.

Our public wi-fi is provided by a third party which stores data for us to analyse.

The provider is based in the US; a data processing agreement is in place.

CCTV footage, images.

Police and others where it is required for the prevention or detection of crime.

-

Positive comments left in comments books with first name and city/country.

These may be viewed by anyone.

If they are posted on our website or social media sites, these may be viewed anywhere in the world.

Details of complaints, FOI requests, data subject requests in case of statutory appeal.

Scottish Information Commissioner
UK Information Commissioner
SPSO.

-

Names and contact details as provided in comments books for survey purposes.

Opinions, experience.

Surveys are administered through an online third party service.

Images of people visiting NGS or participating in NGS activities.

These may be viewed by anyone depending on where they’re published.

If they are posted on our website or social media sites, these may be viewed anywhere in the world.

Comments and questions made in relation to planning notices and planning applications.

Project partners for capital projects.

-

Names, contact details and other information provided or associated with lost and found property or personal data contained within found objects.

Police Scotland (Fettes Avenue, Edinburgh).

-