Privacy notice
This page sets out the details of National Museums Scotland's privacy notice in relation to information collected about you.
1. General information
National Museums Scotland is one of the leading museum groups in Europe. With one of the largest and most diverse collections in the world, we are responsible for the acquisition, preservation and display of a substantial part of Scotland’s cultural, historic and national heritage.
This Privacy Notice sets out how and why we use the personal data you provide to us, which will differ depending on how you interact with us. Please read the sections that apply to you.
Who are we?
National Museums Scotland
Chambers Street
Edinburgh
EH1 1JF
We are registered as a Scottish Charity, and our registration number is: SC 011130
Retention periods
We will only ever collect the information we need. When we ask you to provide your personal information we will let you know why we are asking and how we will use your data, by directing you towards this notice.
We hold your information only as long as necessary for the purpose it was collected. If you decide not to support National Museums Scotland any more or request that we have no further contact with you, we will keep some basic information in order to avoid sending you unwanted communications in the future.
2. If you visit our museums, exhibitions or events
| What we collect... | Why | Legal Bases |
|---|---|---|
| We may collect your name, postal address, email address and phone number | If you sign up to Gift Aid we are required to obtain your name and postal address | It is a legal requirement for this process. |
| To send you your tickets, or a link to access an online event* | This is required for the contract (sale of the product or service) | |
| We may need to contact you if there is a change to an activity you have booked for | This is required for the contract (sale of the product or service) | |
| We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland. | We will only send you these communications via email if we have your consent to do so | |
| Bank details | To buy a ticket for an exhibition or event we require these details to process the sale. We do not receive or retain these details if you pay online or via a Ticket desk. Any information you provide to us over the phone will be securely destroyed. | This is required for the contract (sale of the product or service) |
| CCTV footage | For your safety and security CCTV is in operation in public areas of National Museums Scotland premises. This footage is stored temporarily, and CCTV signage is prominently displayed. | Our and your legitimate interests – keeping you, our buildings, people and collections safe. |
* We use third party providers to manage and broadcast our online events. Please see Section 12 to understand more about how we share your data.
3. If you become a Member or are given a gift Membership
| What we collect... | Why | Legal Bases |
|---|---|---|
| We may collect your name, postal address, email address and phone number | To contact you regarding your Membership, provide you with your Membership benefits including Explorer magazine. | This forms part of the Terms and Conditions of your Membership contract with us. |
| If you sign up to Gift Aid we are required to obtain your name and postal address | It is a legal requirement for this process. | |
| We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland. | We will only send you these communications via email if we have your consent to do so. | |
| Proof of concessionary status (for Concessionary Memberships only)* | This data is used to check your eligibility for this category of Membership. | This forms part of the Terms and Conditions of your Concessionary Membership contract with us. |
| Bank details | To allow us to set up your direct debit, or process your payment. | This is required for the contract (sale of the product or service) |
*We will ask to see proof of your concessionary status as part of the application for a Concessionary Membership. This data is only used to check your eligibility for this category of Membership. Once your application is complete the data will be destroyed/deleted.
If you buy a Gift Membership
| What we collect... | Why | Legal Bases |
|---|---|---|
| We may collect your name, postal address, email address and phone number | To contact you in relation to membership you are purchasing as a gift. | This forms part of the Terms and Conditions of the Membership contract with us. |
| If you sign up to Gift Aid we are required to obtain your name and postal address | It is a legal requirement for this process. | |
| We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland. | We will only send you these communications via email if we have your consent to do so. | |
| Bank details | To allow us to set up your direct debit, or process your payment. | This is required for the contract (sale of the product or service) |
4. If you are a Gift Shop or online Shopping Customer
| What we collect... | Why | Legal Bases |
|---|---|---|
| We may collect your name, postal address, email address and phone number | To provide you with the products you purchase | This is required for the contract (sale of the product or service) |
| Bank details | We require these details to process the sale. We do not receive these details if you pay online or by card in our Gift shops. Any information you provide to us over the phone will be securely destroyed. | This is required for the contract (sale of the product or service) |
| We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland | We will only send you these communications via email if we have your consent to do so |
5. If you are an E-newsletter subscriber
| What we collect… | Why | Legal Bases |
|---|---|---|
| We may collect your email address and communication preferences | We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland | We will only send you these communications via email if we have your consent to do so |
If you consent to receive information by email, your email address and communication preferences are held by MailChimp or Wordlfy, which are the email marketing systems we use to send out e-newsletters, and they are used only for the purpose of sending you these communications.
You can choose to opt out of these marketing communications at any time by contacting us at info@nms.ac.uk or by using the unsubscribe link at the bottom of every e-newsletter.
6. If you make a financial donation to National Museums Scotland
| What we collect… | Why | Legal Bases |
|---|---|---|
| We may collect your name, postal address, email address and phone number | If you sign up to Gift Aid we are required to obtain your name and postal address | It is a legal requirement for this process. |
| We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland. | We will only send you these communications via email if we have your consent to do so. | |
| Bank details | To allow us to process your payment. | This is required for the contract (sale of the product or service) |
7. If you enter a competition
| What we collect… | Why | Legal Bases |
|---|---|---|
| We may collect your name, postal address, email address and phone number | To contact you if you win | On the basis of legitimate interests – to contact you if you win. |
| We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland. | We will only send you these communications via email if we have your consent to do so. |
We will destroy your personal data after the competition has closed unless you have expressly chosen to opt-in to our email list. See Section 5.
8. If you visit our website
In order to make the National Museums Scotland website easier to use and improve our service, we sometimes place small amounts of information on your computer. These are known as cookies and they are used by most major websites. You can find out more about National Museums Scotland's use of cookies here.
9. Managing our collections
We hold personal data in order to manage the collections of National Museums Scotland.
| What we collect… | Why | Legal Bases |
|---|---|---|
| We may collect your name, postal address, email address, phone number and date of birth. | To record the details of disposals from and gifts, purchases and loans to our collections | It is necessary for us to carry out our Public Task or exercise our official authority as a National Museum and it is a legal requirement for this process. |
| To record and manage details of makers/creators of items in our collections | It is necessary for us to carry out our Public Task or exercise our official authority as a National Museum | |
| To enable us to lend items to other institutions or researchers | It is necessary for us to carry out our Public Task or exercise our official authority as a National Museum and it is a legal requirement for this process. | |
| To ensure that we comply with copyright legislation when providing copies of items in our collections | This is a legal requirement for this process | |
| To undertake object conservation and/or scientific analysis (for outside agencies) | This is a legal requirement for this process and forms part of the Terms and Conditions of contract with us. |
10. If you contact us with an enquiry
| What we collect… | Why | Legal Bases |
|---|---|---|
| Your name, contact address, personal e-mail address, telephone number | To enable us to respond to your general business enquiry | On the basis of Legitimate Interests |
| To enable us to respond to Freedom of Information requests, complaints and requests made under Data Protection legislation | This is a legal requirement | |
| To enable us to respond to enquiries about our collections | This is part of our Public Task as a National Museum | |
| To enable us to respond to your enquiry about a booking, purchase or reservation. | This is required for the contract (sale of the product or service) |
11. If you supply us with goods or services
| What we collect… | Why | Legal Bases |
|---|---|---|
| Your name, company name, contact address, e-mail address, telephone number | To enable us to make payments, send remittances, answer queries etc and fulfil our relationship with you as a supplier. | This is a legal requirement and forms part of the Terms and Conditions of contract with us. |
| Bank details | To enable us to make payments, send remittances, answer queries etc and fulfil our relationship with you as a supplier. | This is a legal requirement and forms part of the Terms and Conditions of contract with us. |
| Unique Taxpayer Reference (UTR), Company Registration Number (CRN) | To enable us to make payments, send remittances, answer queries etc and fulfil our relationship with you as a supplier. | This is a legal requirement and forms part of the Terms and Conditions of contract with us. |
12. Sharing information
We do not disclose personal data to any third parties or external organisations, other than companies carrying out work on our behalf. We retain responsibility for your data and ensure that these organisations only act on our instructions.
Examples of when we share data:
- Mailing house sending out Explorer magazine
- Email marketing services (eg Mailchimp or Wordfly)
- Telephone fundraising agencies working on our behalf
- Wealth screening organisations
- Data cleaning organisations
- Ticketing and sales services (e.g. Tessitura or Eventbrite)
We may occasionally need to transfer your personal information overseas, for instance to our email marketing providers (MailChimp or Wordfly) or our ticketing service providers (Tessitura or Eventbrite). We ensure any transfers of data are secure, in accordance with best practice, and in compliance with the UK Data Protection legislation.
For information on each of these services please see:
Your data will never be sold or passed to any third party for any other purpose.
We use a third-party provider, Zoom Video Communications Inc to broadcast our online events. Zoom requires users to register in advance. When you subscribe to their service the processing of your personal data by Zoom will be covered by the terms of the agreement between you and Zoom. For more information on how they process your personal data, please see Zoom's privacy notice.
Data Protection law permits us to share personal data with a law enforcement authority for the purpose of preventing and/or detecting crime. In these instances we will always ensure that the disclosure is necessary and proportionate.
13. Legitimate interests
We have a number of legal bases that mean we can use (or 'process') your personal information. One basis 'Legitimate Interests', which means we can process your personal information if:
- We have a genuine and legitimate reason
and - We are not harming any of your rights and interests.
The following are some examples of when and why we would use this approach in our work:
- Direct Marketing: We will send postal marketing and fundraising requests which further the aims and objectives of National Museums Scotland.
- Wealth screening and research, to help us understand our Members, donors and potential donors, including gathering information from publicly available resources to give an insight into your philanthropic interests and ability to support National Museums Scotland.
When we process your personal information for our legitimate interests, we will consider and balance any potential impact on you and your rights under data protection and any other relevant law. Our legitimate business interests do not automatically override your interests.
14. How we update, screen and analyse your information
We continuously review records of supporters to ensure your data is as accurate as possible. For example, we may consult alternative sources in order undertake these checks for wealth screening, data cleaning or analysis, such as:
- Royal Mail National Change of Address database (NCOA)
- BT Operator Services Information System (OSIS)
- Prospecting for Gold
- Reviewing employment information that you have made publicly available via social media
- Newspaper articles, publications and company websites
- Companies House and other company information databases
- Charity Commission and Office of the Scottish Charity Regulator (OSCR) registers
- Any other publicly available sources.
Where we appoint an external party to undertake a screening of information, any such arrangements will be subject to a formal agreement between National Museums Scotland and that organisation, to protect the security of your data.
Third party organisations may provide us with additional categories of personal data that we do not routinely hold, including:
- Age
- Interests
- Wealth Band
- Positions of influence & Responsibility (Trusteeships, Directorships etc)
This data is collated from publicly available sources such as industry directories, online sources, newspapers and journals.
We may segment the information we hold about you in our database based on a proprietary score. These scores are calculated using personal data, as well as how engaged with us you have previously been, and indicators of future engagement. Analysis of this helps us understand our Members, donors and potential donors to ensure we are efficient and that only relevant communications are sent to you.
You can opt-out of your data being utilised for these purposes simply by contacting development@nms.ac.uk
15. How we keep your information secure
We have implemented security procedures, rules and technical measures to protect the personal data that we have under our control from:
- Unauthorised access
- Improper use or disclosure
- Unauthorised modification.
All our employees and data processors, who have access to and are associated with the processing of personal data, are legally obliged to respect the confidentiality of the personal data that we hold.
16. Your Data Protection Rights
Under new data protection laws taking effect in May 2018, you have rights in relation to your personal data. These rights are:
The right of access: you have the right to know whether we are processing any of your personal data. If we are, you have the right to access the data and certain information, such as why we are processing the data
The right of rectification: you have the right to ensure that we correct inaccuracies in your personal data that we are processing
The right of erasure (the 'right to be forgotten'): in certain situations you have the right to ensure that we erase your personal data
The right to restriction of processing: in certain situations you have the right to ensure that we restrict our processing of your personal data
The right of data portability: in certain situations you have the right to receive personal data that you provided to us in a structured, commonly used and machine-readable format
The right to object: in certain situations you have the right to object to our processing of your personal data and we are normally obliged to stop processing your data when requested. This right includes the right to object to our processing of your personal data for the purposes of direct marketing
The right to complain: you have the right to make a complaint to the UK Information Commissioner's Office (ICO) about our processing of your data, the exercise of your rights, and other data protection matters
The right to withdraw consent: you have the right at any time to withdraw your consent for us to process your personal data.
These rights are not absolute and may not apply in all situations or in relation to all processing activities.
Requests to exercise any of these rights should be sent to:
Data Protection Officer
National Museums Scotland
Chambers Street
Edinburgh
EH1 1JF
Email: dataprotection@nms.ac.uk.
At any time you may request that we delete or correct your personal information by simply contacting dataprotection@nms.ac.uk.
17. Changes to this Privacy Notice
We regularly review our privacy notice, and may make changes time to time. Any changes made will be posted to this page, and will apply from the time we post them. Please visit this page periodically, to ensure you are aware of any changes.
This privacy notice was last changed on 1 August 2024.
18. How to contact us
To contact the Data Protection Officer:
Data Protection Officer
National Museums Scotland
Chambers Street
Edinburgh
EH1 1JF
dataprotection@nms.ac.uk
If you have any comments on our Privacy Notice, or information we hold about you please contact us:
- by email to dataprotection@nms.ac.uk
- or write to us at Data Protection Officer, National Museums Scotland, Chambers Street, Edinburgh, EH1 1JF.
You can use our complaints procedure to make a complaint about data protection.
You have the right to make a complaint directly to the UK Information Commissioner's Office (ICO), which is the data protection supervisory authority in the UK.