2.1. When you visit the museum

Collection of Personal Data

• When directed to do so by the Socttish Government during the Covid pandemic, for the health and safety of the customers and staff in these premises, we are recording the name and contact details of everyone who enters to support NHS Scotland’s Test and Protect. This information will be used to enable NHS Scotland to contact you should you have been in the premises around the same time as someone who has tested positive for coronavirus. Contacting people who might have been exposed to the virus is an important step in stopping the spread. Your personal data will be retained only for the purposes stated in this privacy notice and will be held by us for no more than 3 weeks (21 days). All personal data will be held and disposed of in a safe and secure manner. Click here for more information and read the NHS Scotland Test and Protect strategy on the NHS website.

Digital Donations

• All donations other than those made on-site, should be completed using information provided on our website. We currently use Donr text messaging service for collecting donations. To find out more about how Donr works, please click here.

Donations using Gift Aid

• We will keep the details specified on Government’s Gift Aid declaration form. It is a legal requirement for this process.

Shopping

• We will keep your financial information (such as credit/debit card details) to process a sale in the museum shop.It is a legal requirement for this process.

Visitor studies

• During your visit, our staff will ask a few questions about you and your visit. This is on the basis of legitimate interest (in order to help us improve our services). You have the right to opt-out from sharing this information with us.

CCTV footage

• Our premises are protected by CCTV. The system is managed in accordance with our standard operating procedures and with good practice guidance issued by the Information Commissioner’s Office. This is on the basis of our and your legitimate interest (to keep you, our buildings, people and collections safe).

2.2. Other forms of engagement

Bookings

• Your contact details (and, if required, bank details) are captured when you are booking for our events in person at the museum or via third party vendors like Art Fund or Eventbrite (external link). This is required for the contract (sale of the product or service) and for keeping you up-to-date about the event.

• We may ask you a few questions which will help us understand our audiences. This is on the basis of legitimate interest (in order to help us improve our services). You have the right to opt-out from sharing this information with us.

• We may also use your data to contact you by email with news and information about the museum that we feel may be of interest to you. This is on the basis of our and your legitimate interest. We will only continue to send you these communications via email if we have your consent to do so.

Group bookings

• We will process your data in order to contact you about your booking. This is required for the contract (sale of the product or service).

• We also record this information to measure, analyse and improve the range and marketing of our services. This is on the basis of our legitimate interest.

Feedback and enquiries

• Your contact details are captured when you contact us to ask about our facilities and services. We use these details on the basis of legitimate interest (in order to help us improve our services). You have the right to opt-out from sharing this information with us.

Photography

• Photographs are usually taken during our events for publicity and archival purposes. If you are not happy with us capturing a picture of you or your child, please notify a member of staff. This is done on the basis of legitimate interest (in order to help us promote our services).

Competitions

• We may collect your name, email address and phone number to contact you in case you win. These details are either processed by us directly or by SurveyMonkey (external link), which is the survey software we use. This is required for contacting you if you win.

• We also ask to keep you up to date with news about our work. We will only send you these communications via email if we have your consent to do so.

E-newsletter subscriptions

• When you sign up to our e-newsletter, we will only send you news that you have signed up to receive. Your email address and communication preferences are held by MailChimp (external link), which is the email marketing system we use to send out our e-newsletters. We will only send you these communications via email if we have your consent to do so.

Visits to our website

• In order to make our website easier to use and improve our service, we sometimes place small amounts of information on your computer. These are known as cookies and they are used by most major websites. See our Cookie Policy below.

• Our website contains links to other external websites. We are not responsible for the content or functionality of those websites.

Collections management

• We retain details of your name, postal address and email address or phone number to record the provenance of gifts, purchases, loans to (and from) and disposals from the collection. It is a legal requirement for these processes.

• If you provide us with some info about objects we hold in our collection, we may also keep your contact details in order to improve the quality of the information we hold about our collection for future generations. This is done on the basis of legitimate interest.

• We will ask for your contact details in order to ensure that we comply with copyright legislation when providing copies of items in our collections. It is a legal requirement for this process.

• We will retain your contact details if you undertake object conservation and/or scientific analysis of our objects. It is a legal requirement for this process.

2.3. When you supply us goods or services

Companies and freelancers

• We keep a record of your contact details (your name, company name, contact address, e-mail address, telephone number), bank details and/or UTR in order to make payments, answer queries etc. and fulfill our relationship with you as a supplier. It is a legal requirement for this process.

Employees and volunteers

• We will ask for your personal details in order to comply with our legal duties and policies.

• When we actively ask you to provide any other personal information we will let you know why we are asking, and how we will use your data.

4.1. Protection

We use a variety of physical and technical measures to protect information we hold and to prevent unauthorised access to or use or disclosure of your personal data. All our data and databases are stored in secure filing cabinets and on secure computer systems and we control who has access to information (using both physical and electronic means). All our employees and data processors, who have access to and are associated with the processing of personal data, are legally obliged to respect the confidentiality of the personal data that we hold.

4.2. Storing your personal data

We will only retain your personal data for as long as it is required for the purposes for which we collected it. This will depend on our legal obligations and the nature and type of information and the reason for which we collected it.

5.1. Your rights

We want to ensure you remain in control of your personal data and that you understand your legal rights, which are:

• the right to know whether we hold your personal data (we aim to respond within one month);
• the right to have your personal data erased (this does not apply where it is necessary for us to continue to use the data for a lawful reason);
• the right to have inaccurate personal data rectified;
• the right to object to your personal data being used for marketing or profiling.

5.2. Complaints

Should you have a complaint about how we have used your personal data, you can complain to us directly by contacting us by email.

You have the right to make a complaint directly to the UK Information Commissioner's Office (external link), which is the data protection supervisory authority in the UK.