National Galleries of Scotland Events Privacy Notice

Who we are

The Board of Trustees of the National Galleries of Scotland is the Data Controller for any personal data you give to us or we collect about you. Our full contact details are:

National Galleries of Scotland
73 Belford Road
Edinburgh
EH4 3DS

0131 624 6200
[email protected]

National Galleries of Scotland is a charity registered in Scotland, No. SC003728. VAT No. GB 100 1904 82

We are a data ‘controller’, which means we are responsible for deciding how we hold and use your personal information.

This notice explains how and why we will collect and use your personal information and your rights in relation to your personal information. We may amend this notice at any time. Please refer back to this page for the most recent version. You may be notified directly of any significant changes which affect you where we believe it is appropriate and proportionate to do so.

What personal data do we collect and what do we do with it?

We collect and process personal data from and about individuals who wish to attend events run by NGS. This includes information for the administration of event bookings, mailing lists for specialist programmes and invitation-only events. Photographs may be taken at some events for publicity purposes.  Further information on Event Photography is included separately below.

NB. Friends-only and Patrons-only events are covered in the respective privacy notices for these groups.

Ticketed Events

Free or paid tours, talks and lectures, workshops, courses, concerts etc

Purpose What data do we collect? What’s the legal basis?

To process event bookings you make online, in person or over the phone, including processing payment (where relevant), delivering tickets/ e-tickets, and to contact you in regard to any issues or updates relating to your order during and after payment.

First name, last name, email address (optional), delivery address (if required), contact telephone number.

We may also gather details of any access requirements to ensure you can participate as fully as possible.

Contract
Sale of Service

Explicit Consent
Provision of access requirements is voluntary but enables us to make appropriate arrangements.

 

Group Bookings including School Visits

 

Purpose What data do we collect? What’s the legal basis?

To process event bookings, identify the most appropriate person to lead your sessions and make any special arrangements as required to meet the needs of your group. Also to contact you in regard to any issues or updates relating to your booking, and afterwards to keep a record of the events/ activities.

First name, last name, email address, address, contact telephone number of individual making the booking.

It may also be necessary for you to provide details of any access requirements to ensure all members of your group can participate as fully as possible.

Contract
Sale of Service

Public Task
Details of the group/ school contact and session will be retained for analysis, as a record of the activity and to follow-up if necessary.

Explicit Consent
Provision of access requirements enables us to make appropriate arrangements for the session; the group leader making the booking must have appropriate permissions etc in place before sharing participants’ data

 

Specialist Programmes Mailing Lists

Purpose What data do we collect? What’s the legal basis?

To compile and maintain a mailing list of people with particular access needs or specific interests to ensure they receive details of the relevant events/ programmes.

First name, last name, email address.

For our Communities and Access programmes, you can ask to be added to a particular mailing list, such as BSL tours, without being a BSL user or providing any other health or disability information. However, your data will be processed in relation to these event categories.

Consent
Anyone can sign-up to receive these mailings, there is no obligation.

Please see the newsletter privacy notice for further details on how personal data is used.

 

Invitation-Only Events

Purpose What data do we collect? What’s the legal basis?

To compile and maintain a mailing list of supporters and key contacts to be invited to events such as private views, in order to promote the work of NGS (marketing).

Name, address, email address, telephone number; names of invitees’ guest(s) at a particular event; record of attendance; job title and organisation, where relevant

Legitimate Interest
Important to maintain contact details for our supporters and key contacts to invite them to promotional events and ensure ongoing support for our work..

Consent
For invitations issued by email – postal mailings based on legitimate interest.

To invite artists, lenders, sponsors etc involved in the creation of an exhibition to related events.

Name, address, contact details

Legitimate Interest

To recognise the contribution made by individuals to an exhibition and build relationships.

 

For all events

Purpose What data do we collect? What’s the legal basis?

To manage attendance at and allow access to the event.

As provided when you made the booking or sent an RSVP, including name, guest’s name, and contact details.

Contract
To ensure you can access the event which you have indicated you wish to attend

To ensure the health, safety and security of event attendees.

As above.

Legal obligation

To comply with relevant health and safety and other relevant legislation.

Who sees my data?

In order to deliver our services effectively, we sometimes need to use a third party.  NGS remains responsible for keeping the data we hold about you safe and secure.  We will ensure that other organisations processing your data on our behalf do so only on our instruction and with appropriate safeguards in place.

  Third-party recipients? International transfer?

Ticketed event bookings

Freelancers who may be running our events.

Some events are managed through Eventbrite. NGS has a data processing agreement with them.

Eventbrite is an online service based in the US. They have signed up to the EU-US Privacy Shield Framework.

Group bookings including School Visits

Freelancers who deliver our sessions on our behalf will have access to relevant booking information including names of participants and, where provided, health/ access information. Freelancers are also required to have signed a data processing agreement.

A web-based system is soon to be introduced to manage bookings. This will be hosted by a third party for which a data processing agreement is in place.

A web-based system is soon to be introduced to manage bookings. This will be hosted by a third party for which a data processing agreement is in place. Maybe change it to A third-party web-based system is used to manage bookings; a data processing agreement is in place.

Specialist programmes mailing lists

A third party is used for email distribution; a data processing agreement is in place.

 

Invitation-Only Event Guest Lists

 

We use a mailing house to issue postal invitations. Where this involves processing personal data, NGS will ensure an appropriate agreement is in place.

Occasionally, we may pass contact details to a partner organisation (also a data controller) if they are issuing the invitations for a joint event.

No.

How long will we keep the data?

We only hold your information for as long as is necessary for the purposes set out in this privacy notice.  When we no longer need the data for these purpose, we will either delete or destroy it, or remove any data which can identify you and retain the anonymised data for analytical purposes.

If you withdraw consent you have given, or ask us not to have any further contact with you, we will keep some basic information in order to avoid sending you unwanted communications in the future.

Event Photography

Many of our events are photographed and some may be filmed or audio-recorded for our own records or for publicity purposes. Signage will be displayed at events where any form of recording is taking place which will explain what is happening and how the images or recordings will be used. If we intend to use an image or recording of you in a way which identifies you (e.g. with your name printed alongside an image of you), a member of NGS staff will ask you for your consent. In the case of images or recordings which might identify individual children, young people or adults at risk of harm, consent will be sought from a parent, carer or other responsible person, as appropriate, in line with our Protection of Children, Young People and Adults at Risk of Harm Policy.

Schools groups will not be photographed without written consent from the school. This might not apply if a school group is attending an open public event, when the arrangements described above would apply.

What are my rights over access to the data you hold on me?

If we are processing your data on the basis of your consent, you can withdraw your consent to the use of your personal data at any time.  You can also object to the use of your personal data at any time, where we have based our processing on legitimate interest.  This may mean however, that we are no longer able to provide you with a particular service or communication where the information processing is an integral part of the service. We will tell you if this is likely to be the case.

Subject to some legal exceptions, you have the right:

  • To access the data we hold about you and to know what we are doing with it
  • To have any inaccuracies corrected
  • To have your personal data erased
  • To place a restriction on our processing of your data
  • To object to processing
  • To request your data to be ported (data portability)

If you want to learn more about these rights, please see the Information Commissioner’s Office (ICO) website.

How to contact us about your personal data or this privacy notice

If you have any questions about this privacy notice or about your personal data, please contact: 

Data Protection Officer
Director-General’s Office
National Galleries of Scotland
73 Belford Road
Edinburgh
EH4 3DS

Tel: 0131 624 6473

Email: [email protected]

Complaints

As well as contacting the Data Protection Officer using the details above, you can use our Feedback procedure to make a complaint about the way we process your personal information.

You also have the right to lodge a complaint directly with the UK Information Commissioner's Office (ICO), the data protection supervisory authority in the UK.