National Galleries of Scotland Events Privacy Notice

Who we are

The Board of Trustees of the National Galleries of Scotland is the Data Controller for any personal data you give to us or we collect about you. Our full contact details are:

National Galleries of Scotland
73 Belford Road

0131 624 6200
[email protected]

National Galleries of Scotland is a charity registered in Scotland, No. SC003728. VAT No. GB 100 1904 82

What personal data do we collect and what do we do with it?

We collect and process personal data from and about individuals who wish to attend events run by NGS. This includes information for the administration of event bookings, mailing lists for specialist programmes and invitation-only events. Photographs may be taken at some events for publicity purposes.  Further information on Event Photography is included separately below.

NB. Friends-only and Patrons-only events are covered in the respective privacy notices for these groups.

Ticketed Events

Free or paid tours, talks and lectures, workshops, courses, concerts etc

Purpose What data do we collect? What’s the legal basis?

To process event bookings you make online, in person or over the phone, including processing payment (where relevant), delivering tickets/ e-tickets, and to contact you in regard to any issues or updates relating to your order during and after payment.

First name, last name, email address (optional), delivery address (if required), contact telephone number.

We may also gather details of any access requirements to ensure you can participate as fully as possible.

Sale of Service

Explicit Consent
Provision of access requirements is voluntary but enables us to make appropriate arrangements.


Specialist Programmes Mailing Lists

Purpose What data do we collect? What’s the legal basis?

To compile and maintain a mailing list of people with particular access needs or specific interests to ensure they receive details of the relevant events/ programmes.

First name, last name, email address.

For our Communities and Access programmes, you can ask to be added to a particular mailing list, such as BSL tours, without being a BSL user or providing any other health or disability information. However, your data will be processed in relation to these event categories.

Anyone can sign-up to receive these mailings, there is no obligation.

Please see the newsletter privacy notice for further details on how personal data is used.


Invitation-Only Events

Purpose What data do we collect? What’s the legal basis?

To compile and maintain a mailing list of supporters and key contacts to be invited to events such as private views, in order to promote the work of NGS (marketing).

Name, address, email address, telephone number; names of invitees’ guest(s) at a particular event; record of attendance; job title and organisation, where relevant

Legitimate Interest
Important to maintain contact details for our supporters and key contacts to invite them to promotional events and ensure ongoing support for our work..

For invitations issued by email – postal mailings based on legitimate interest.

To invite artists, lenders, sponsors etc involved in the creation of an exhibition to related events.

Name, address, contact details

Legitimate Interest

To recognise the contribution made by individuals to an exhibition and build relationships.

Who sees my data?

In order to deliver our services effectively, we sometimes need to use a third party.  NGS remains responsible for keeping the data we hold about you safe and secure.  We will ensure that other organisations processing your data on our behalf do so only on our instruction and with appropriate safeguards in place.

  Third-party recipients? International transfer?

Event bookings

Freelancers who may be running our events.

Some events are managed through Eventbrite. NGS has a data processing agreement with them.

Eventbrite is an online service based in the US. They have signed up to the EU-US Privacy Shield Framework.

Specialist programmes mailing lists

Mailchimp for email distribution; NGS has a data processing agreement in place.

Mailchimp is based in the US. They have signed up to the EU-US Privacy Shield Framework.

Invitation-Only Event Guest Lists


We use a mailing house to issue postal invitations. Where this involves processing personal data, NGS will ensure an appropriate agreement is in place.

Occasionally, we may pass contact details to a partner organisation (also a data controller) if they are issuing the invitations for a joint event.


How long will we keep the data?

We only hold your information for as long as is necessary for the purposes set out in this privacy notice.  When we no longer need the data for these purpose, we will either delete or destroy it, or remove any data which can identify you and retain the anonymised data for analytical purposes.

If you withdraw consent you have given, or ask us not to have any further contact with you, we will keep some basic information in order to avoid sending you unwanted communications in the future.

Event Photography

Many of our events are photographed and some may be filmed or audio-recorded for our own records or for publicity purposes. Signage will be displayed at events where any form of recording is taking place which will explain what is happening and how the images or recordings will be used. If we intend to use an image or recording of you in a way which identifies you, you will be asked to give your consent by a member of NGS staff.

What are my rights over access to the data you hold on me?

If we are processing your data on the basis of your consent, you can withdraw your consent to the use of your personal data at any time.  You can also object to the use of your personal data at any time, where we have based our processing on legitimate interest.  This may mean however, that we are no longer able to provide you with a particular service or communication where the information processing is an integral part of the service. We will tell you if this is likely to be the case.

Subject to some legal exceptions, you have the right:

  • To access the data we hold about you and to know what we are doing with it
  • To have any inaccuracies corrected
  • To have your personal data erased
  • To place a restriction on our processing of your data
  • To object to processing
  • To request your data to be ported (data portability)

If you want to learn more about these rights, please see the Information Commissioner’s Office (ICO) website.

How to contact us about your personal data or this privacy notice

If you have any questions about this privacy notice or about your personal data, please contact: 
Data Protection Officer
Director-General’s Office
National Galleries of Scotland
73 Belford Road

0131 624 6473
[email protected]


As well as contacting the Data Protection Officer using the details above, you can use our Feedback procedure to make a complaint about the way we process your personal information.

You also have the right to lodge a complaint directly with the UK Information Commissioner's Office (ICO), the data protection supervisory authority in the UK by visiting