This privacy notice explains how we will use any personal information we collect about you as a member of the National Galleries of Scotland’s Patrons’, Curators’ or Directors’ Circles.

Who we are

The Board of Trustees of the National Galleries of Scotland is the Data Controller for any personal data you give to us or we collect about you. Our full contact details are:

National Galleries of Scotland
73 Belford Road
Edinburgh
EH4 3DS

0131 624 6200
[email protected]

National Galleries of Scotland is a charity registered in Scotland, No. SC003728. VAT No. GB 100 1904 82

We are a data ‘controller’, which means we are responsible for deciding how we hold and use your personal information.

This notice explains how and why we will collect and use your personal information and your rights in relation to your personal information. We may amend this notice at any time. Please refer back to this page for the most recent version. You may be notified directly of any significant changes which affect you where we believe it is appropriate and proportionate to do so.

What personal data do we collect and what do we use it for?

The purposes for which we might gather and use your data are set out in the following table. Regardless of the purpose for which we collect and use your data, we will keep your details safe and process all personal information in accordance with applicable data protection legislation, including the UK General Data Protection Regulation and the Data Protection Act 2018.

Purpose	What data do we collect?	What’s the legal basis?
To process your Circles membership and donations, and send annual renewal notices (if preferred method of payment is not Direct Debit).	Title, name, address, email address, mobile number, postal address, landline number.	Contract Legitimate interest
To contact you about your Circles membership and develop our relationship with you to show you how your philanthropy is helping to support our mission, unless your preference is for no contact.	Email address, mobile number, landline number.	Legitimate interest
To process your Direct Debit (if preferred method of payment), comply with the legal requirement to send advance notification of Direct Debit payments, and issue BACS refunds (if applicable).	Your bank name, account holder name(s), account number and sort code.	Consent Your signed Direct Debit form provides us with permission to process your Direct Debit and send your details to your bank.
To process your Gift Aid declaration and claim Gift Aid on your donations (where possible).	Your name and address.	Consent Your signed Gift Aid declaration, clicked web declaration or verbal declaration (confirmed through subsequent email or letter from the National Galleries of Scotland) provide us with permission to send your name, address and donation details to HMRC.
To recognise your philanthropy on our website and in our annual review.	Your name(s), unless anonymity is preferred.	Consent
To send you by post The Art of Giving, our biannual philanthropy update, unless your preference is by email.	Your name and address, or email address.	Legitimate interest
To update you on events, news and offers; exhibitions and public events; and other opportunities to support the National Galleries of Scotland.	Your consent to receive emails on these particular subject areas, as well as your interactions with these emails (opens, clicks on links, etc) where possible.	Consent You have the right to withdraw your consent to marketing at any time by contacting us or clicking the unsubscribe link in the communication we send you or telling us over the telephone.
To assess whether certain individuals might have an interest in our work and a propensity to give.	In limited cases only, information from publicly available sources about your work or interests.	Legitimate interest

Please see the Events privacy notice for details of how we use your personal information if you’re attending any events, including Circles events.

Automated decision-making and Profiling

We do not undertake any automated decision-making or profiling based on the personal data covered by this privacy notice.

Who sees my data?

We will not disclose data to third parties unless under contract with you, with your consent or obliged to by law. Existing data sharing arrangements or likely sharing scenarios are set out below, including where we use a third party processor on our behalf. A data processing agreement will always be put in place with third party processors.

What might be shared?	Third party recipients?	International transfers?
Direct Debit information	Banks	-
Gift Aid and donation information	HMRC	-
Name and address	Mailing house	-
Donation and contact history	CRM system provider	-
Email address and consent to receive email newsletter	CRM system provider	-

 

NGS is subject to the requirements of the Freedom of Information (Scotland) Act 2002 and other legislation which may require us to disclose information to third parties, including personal data. However, this must also be done in compliance with data protection legislation.

How long do we keep data?

We only hold your information for as long as is necessary for the purpose it was collected.  When we no longer need the data for that purpose, we will either delete or destroy it, or remove any data which can identify you and retain the anonymised data for analytical purposes.

If you withdraw consent you have given, or ask us not to have any further contact with you, we will keep some basic information in order to avoid sending you unwanted communications in the future.

What are my rights over access to the data you hold on me?

If we are processing your data on the basis of your consent, you can withdraw your consent at any time.  You can also object to the use of your personal data at any time, where we have based our processing on public interest or legitimate interest. This may mean however, that we are no longer able to provide you with a particular service or communication where the information processing is an integral part of the service. We will tell you if this is likely to be the case.

Subject to some legal exceptions, you also have the right:

• To access the data we hold about you and to know what we are doing with it
• To have any inaccuracies corrected
• To have your personal data erased
• To place a restriction on our processing of your data
• To object to processing
• To request your data to be ported (data portability)

If you want to learn more about these rights, please see the Information Commissioner’s Office (ICO) website.

How to contact us about your personal data or this privacy notice

If you have any questions about this privacy notice or about your personal data, please contact: 

Data Protection Officer
Director-General’s Office
National Galleries of Scotland
73 Belford Road
Edinburgh
EH4 3DS

Tel: 0131 624 6473

Email: [email protected]

Complaints

As well as contacting the Data Protection Officer using the details above, you can use our Feedback procedure to make a complaint about the way we process your personal information.

You also have the right to lodge a complaint directly with the UK Information Commissioner's Office (ICO), the data protection supervisory authority in the UK.