Who we are

The Board of Trustees of the National Galleries of Scotland is the Data Controller for any personal data you give to us or we collect about you. Our full contact details are:

National Galleries of Scotland
73 Belford Road
Edinburgh
EH4 3DS

0131 624 6200
[email protected]

National Galleries of Scotland is a charity registered in Scotland, No. SC003728. VAT No. GB 100 1904 82

National Galleries of Scotland (NGS) is a data ‘controller’ which means we are responsible for deciding how we hold and use your personal information. This notice explains how and why we will collect and use your personal information in the context of your volunteering with us and your rights in relation to your personal information. It covers the use of your personal data during volunteering and functions of the Development department and also how your personal data may be used more generally in the course of your volunteering at NGS. We may amend this notice at any time. Please refer back to this page for the most recent version. You may be notified directly of any significant changes which affect you where we believe it is appropriate and proportionate to do so.

Who does this notice apply to?

This notice applies to all volunteers.

Does this notice form part of my volunteer agreement?

This notice does not form part of your volunteer agreement. We may amend this notice at any time.

Data protection queries

The NGS Compliance Manager acts as our Data Protection Officer. If you have any questions about this privacy notice or how we handle your personal information, please contact the data protection officer. They can be contacted by email at [email protected].

Your personal information

In this privacy notice, ‘your personal information’ means your personal data i.e. information about you from which you can be identified. The appendix to this notice lists ‘your personal information’ that we may process.

Your ‘personal information’ does not include data where the identity has been removed (anonymous data).

The use of ‘we’/’us’ throughout this notice refers to the National Galleries of Scotland as a volunteer involving organisation (VIO).

It is important that your personal information is accurate and up to date. Please keep the Development Department informed if your personal information changes during your engagement by emailing [email protected]. This includes name changes, and amendments to postal address, email address, telephone number, emergency contact details, etc.

Where does your personal information come from?

Your personal information will be provided by you at various points during your volunteering, or will be created/ compiled by you or us during the course of your volunteering, and may also come from the following sources:

• Partner agencies (JobCentres, Volunteer Centres, External Charities, etc.)
• Disclosure Scotland
• Parents/Guardians/Carers, former education providers, employers or other referees, whom you have given us permission to contact
• Members of NGS staff, clients or customers
• Any professional bodies that confirm membership / qualifications or training and quality assurance inspectors

Examples of the type of information that may be provided to us are detailed in the appendix.

If you would like more information on the source of your personal information, please contact the Development Department or the data protection officer.

Processing your personal information

We may process your personal information during and after your volunteering with us. This may include collecting your personal information, recording it, storing it, using it, amending it, destroying it and, in some circumstances, disclosing it.

The appendix to this notice provides detailed information on what we do with the personal data we hold about you and our legal grounds for doing so.

Data necessary for the volunteer agreement

The appendix sets out your personal information that is necessary for us to enter or carry out our agreement with you. If you don’t provide this data, we may not be able to enter into, or carry out, a volunteer relationship. For example, if you don’t provide your bank details, we may not be able to reimburse your travel expenses.

Failure to provide, create or compile some other types of personal information may prevent us from discharging our functions where these are part of our public task or we believe we have a legitimate interest.

Statutory requirement to provide your personal information

In some circumstances, the provision of your personal information is a statutory requirement. This includes but is not limited to:

• Documentation confirming your right to volunteer in the UK – if you don’t provide this, we may not be able to enter into a volunteer relationship with you.
• Protecting Vulnerable Group (PVG) scheme membership for regulated work.

Special categories of personal information

‘Special categories of personal information’ means information about your racial or ethnic origin; political opinions; religious or philosophical beliefs; health; sex life or sexual orientation; genetic data; or biometric data for the purpose of uniquely identifying you. Data marked * in the appendix falls within these ‘special categories’ or might disclose special categories of personal information. Information relating to criminal convictions, offences or alleged offences are protected in a similar way to the special categories.

We must have additional legal grounds for processing special categories of personal information or criminal convictions data. These are set out in the appendix. We are also required to have policy documents in place with details of the processing that we undertake using this data.

Sharing your personal information

Your name, photograph and volunteer role title assigned by us when you join the organisation will be available internally to your colleagues who are paid and your fellow volunteers. Your contact details will be available internally to colleagues with responsibility for processing documentation related to your volunteering, colleagues with responsibility for supervising or supporting your volunteer role, and colleagues with responsibility for your duty of care while you are volunteering.

Depending on your volunteer role, your name and other information may be shared externally to enable us to perform our functions as an organisation effectively, promote our work and raise the profile of our volunteers and volunteer related activity. This may include publication on the NGS website of a named contact for a particular aspect of our work and is likely to include sharing volunteers’ names and contact details to enquirers, partners or other stakeholders as appropriate.

• We may also share your personal information with the following third parties if this is required by law; necessary to enter or carry out our volunteer agreement with you or administer the relationship with you; where we have another legitimate or public interest in doing so; or where it is necessary to protect your vital interests or those of another person:
• Health and safety executive;
• Relevant regulators and accreditation bodies;
• Our professional advisors;
• Honours and awards giving bodies for the purpose of recognising you as a volunteer;
• Any person specified by you, where you ask us to provide a reference to that person;
• Other third parties as necessary to comply with the law.

We use a third-party web-based system to manage the volunteer programme, including storing information about you as a volunteer. In some other limited circumstances, we may use third party service providers to process relevant personal data on our behalf which may include IT service providers. We may also use third party tools to enhance internal communications and facilitate volunteer engagement. All third-party processing activity is undertaken on the basis of a processing agreement with documented instructions.

We will always ensure that any personal information we share is necessary and kept to a minimum.

Automated decision-making

We do not currently take, and do not envisage taking, any decisions about you based solely on automated processing (i.e. without human involvement), which have a legal or similarly significant effect on you.

Transferring your personal information outside the EU

We do not currently transfer or intend to transfer your personal information to any country outside of the EU, or to any international organisation. Some third-party systems that we use are hosted outside the EU but we will always ensure appropriate safeguards are in place.

Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes for which we collected it, including to satisfy any legal, accounting or reporting requirements.

We will retain all of your personal information during your engagement and for no longer than is necessary after your volunteering ends to fulfil the terms of your volunteer agreement and allow us to establish, exercise or defend legal claims.

Alumni membership

At the end of your volunteering if you wish to be added to our alumni network of former volunteers, we will retain your name, postal address, email address, telephone number, and volunteering history to contact you about opportunities or events you may be interested in, to learn about what impact or effect volunteering may have had on you, and about contributing to volunteer programme publicity.

Your rights

Subject to some legal exceptions, and depending on the legal basis for processing, you have the right:

• To access the data we hold about you and to know what we are doing with it
• To have any inaccuracies corrected
• To have your personal data erased
• To place a restriction on our processing of your data
• To object to processing
• To request your data to be ported (data portability)

To learn more about these rights, please visit www.ico.org.uk, the website of the UK Information Commissioner’s Office (ICO).

If we are processing your data on the basis of your consent, you also have the right to withdraw your consent at any time. For processing based on Public Task or Legitimate Interest, you have the right to object to the use of your personal data at any time, but if we believe that this would interfere with the performance of our functions and/or your volunteer responsibilities, we will inform you that this is the case.

Complaints

As well as contacting the Data Protection Officer using the details above, you can use our Feedback procedure to make a complaint about the way we process your personal information.

You also have the right to lodge a complaint directly with the UK Information Commissioner's Office (ICO), the data protection supervisory authority in the UK.

Appendix

 

Volunteer Recruitment Purposes

Reason for processing your personal information	Legal basis for processing, and legitimate interest (where applicable)	Your personal information
Make a decision about your recruitment or selection, including assessing your suitability for the role Carry out background and reference checks, where applicable Determine the expectations of your volunteer agreement and advise you of these Check you are legally entitled to volunteer in the UK Contact you	To perform a task in the public interest To enter into or carry out the volunteer agreement To comply with a legal obligation * For Criminal Convictions Data: For reasons of substantial public interest, to enable NGS to exercise its statutory functions	Personal contact details (including name, postal address, email address, telephone number) Your expression of interest form, CV and informal interview notes Correspondence and results regarding any background checks, including data relating to criminal convictions and offences (including alleged offences) through Basic Disclosure or PVG schemes as appropriate * References and details of referees Professional memberships and qualifications Copy of your identification Volunteer placement letter Volunteering location Start date

Volunteer Programme Management Purposes

Reason for processing your personal information	Legal basis for processing, and legitimate interest (where applicable)	Your personal information
Administer our agreement with you Ensure adherence to the terms of your agreement Provide and process reimbursements for genuinely incurred expenses during your volunteering according to the Volunteer Programme Policy Manage performance and conduct Submit applications for Volunteering Awards Alumni membership	To enter into or carry out the volunteer agreement Legitimate interest Consent	Bank account details Information confirming you have read and understood our policies and procedures Record of performance Name, postal address, email address, telephone number, and volunteering history
Assess skills, qualifications and suitability for a task Manage flexible scheduling Make decisions about continuing the volunteer relationship Monitor sickness absence for the purpose of providing support as appropriate and to assess your fitness to volunteer Consider reasonable adjustments for volunteers with disabilities Carry out education, training and development Conduct problem-solving meetings for raising concerns and resolving issues proceedings Maintenance of Investing in Volunteers Award	To perform task in the public interest To enter into or carry out the volunteer agreement *For special categories of information: For health or social care purposes (occupational medicine, capacity to undertake volunteering tasks)	Details of volunteer role titles and tasks, and support and supervision sessions Records of attendance and absence Information and correspondence regarding breaks from volunteering due to significant life events including but not limited to pregnancy, birth, adoption, bereavement; and / or jury service Health information relating to sickness absence and disability status* Information and correspondence relating to raising concerns and resolving issues Professional memberships and qualifications Training records
Carry out equal opportunities monitoring and review equality of opportunity or treatment Comply with health and safety obligations Maintain records of your volunteer contribution	To comply with a legal obligation *For special categories of information: To review equality of opportunity or treatment For health or social care purposes To protect the vital interests of you or another person, if you are incapable of giving consent	Sex and/or gender identity Age and date of birth   Health data and sickness records, including disability information* Information on gender reassignment* Data revealing race, nationality, religious beliefs or sexual orientation* Accident records Hours volunteered, shift records
Inform your contacts in the event of sickness, accident or other emergency Protect your vital interests or those of another person (in exceptional circumstances, such as a medical emergency)	To protect vital interests	Emergency contact details
Make arrangements for the end of the volunteer relationship Collect information regarding your reasons for leaving	To enter into or carry out the volunteer agreement To fulfil a task in the public interest	Personal details detailed above Information from exit interviews
To provide a reference regarding your time at NGS	Consent	Volunteer reference information limited to volunteer role description and dates of volunteering

Business Purposes

Reason for processing your personal information	Legal basis for processing, and legitimate interest (where applicable)	Your personal information
Security of people, buildings, information and the collection	To perform a task in the public interest	Location information Photographs CCTV images Information about your use of our information and communication systems, and emails passing through our systems
Internal communications Volunteer engagement External engagement with members of the public and other stakeholders	To enter into or carry out the volunteer agreement To perform a task in the public interest For the purposes of the legitimate interests pursued by the controller or a third party eg fundraising or other promotional activity not covered by another lawful basis	Names, volunteer role titles, NGS-assigned contact details Photographs Biographical information Correspondence to and from you (electronic or otherwise) and telephone voicemail messages during times when you are absent from the office
Corporate governance, including decision-making/ audit trails, accountability etc Historical record	To perform a task in the public interest	Name, volunteer role title, NGS-assigned contact details on corporate documents (created by you or for which you have a responsibility) Attendance at and participation in meetings at which a minute was taken Recorded opinions and contributions (e.g. in email, reports, notes, voicemail) Decisions taken by you and approvals made by you, including your signature where required Other information relating to your role as required