This page sets out the details of National Museums Scotland's privacy notice in relation to information collected about you.
  1. General information
  2. Visitors to our Museums, Exhibitions and events
  3. Members or buying a gift Membership
  4. Gift Shop or online shopping customers
  5. E-newsletter subscribers
  6. Financial donors
  7. Competition entrants
  8. Website users
  9. Managing our collections
  10. Sharing information
  11. Legitimate interests
  12. How we update, screen and analyse your information
  13. How we keep your information secure
  14. Your Data Protection rights
  15. Changes to our Privacy Notice
  16. Contact us

1. General information

National Museums Scotland is one of the leading museum groups in Europe.  With one of the largest and most diverse collections in the world, we are responsible for the acquisition, preservation and display of a substantial part of Scotland’s cultural, historic and national heritage.

This Privacy Notice sets out how and why we use the personal data you provide to us, which will differ depending on how you interact with us.  Please read the sections that apply to you.

Who are we?
National Museums Scotland
Chambers Street
Edinburgh
EH1 1JF

We are registered as a Scottish Charity, and our registration number is: SC 011130

Retention periods
We will only ever collect the information we need.  When we ask you to provide your personal information we will let you know why we are asking and how we will use your data, by directing you towards this notice.

We hold your information only as long as necessary for the purpose it was collected. If you decide not to support National Museums Scotland any more or request that we have no further contact with you, we will keep some basic information in order to avoid sending you unwanted communications in the future.

2. If you visit our museums, exhibitions or events

What we collect…

Why

Legal Bases

We may collect your name, postal address, email address and phone number

If you sign up to Gift Aid we are required to obtain your name and postal address

It is a legal requirement for this process.

 

To send you your tickets

This is required for the contract (sale of the product or service)

 

We may need to contact you if there is a change to an activity you have booked for

This is required for the contract (sale of the product or service)

 

We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland.

We will only send you these communications via email if we have your consent to do so

Bank details

To buy a ticket for an exhibition or event we require these details to process the sale.

We do not receive or retain these details if you pay online or via a Ticket desk.

Any information you provide to us over the phone will be securely destroyed.

This is required for the contract (sale of the product or service)

CCTV footage

For your safety and security CCTV is in operation in public areas of National Museums Scotland premises.  This footage is stored temporarily, and CCTV signage is prominently displayed.

Our and your legitimate interests – keeping you, our buildings, people and collections safe. 

3. If you become a Member or are given a gift Membership

What we collect…

Why

Legal Bases

We may collect your name, postal address, email address and phone number

To contact you regarding your Membership, provide you with your Membership benefits including Explorer magazine.

This forms part of the Terms and Conditions of your Membership contract with us.

 

If you sign up to Gift Aid we are required to obtain your name and postal address

It is a legal requirement for this process.

 

We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland.

We will only send you these communications via email if we have your consent to do so.

Bank details

To allow us to set up your direct debit, or process your payment.

This is required for the contract (sale of the product or service)


If you buy a Gift Membership

What we collect…

Why

Legal Bases

We may collect your name, postal address, email address and phone number

To contact you in relation to membership you are purchasing as a gift.

This forms part of the Terms and Conditions of the Membership contract with us.

 

If you sign up to Gift Aid we are required to obtain your name and postal address

It is a legal requirement for this process.

 

We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland.

We will only send you these communications via email if we have your consent to do so.

Bank details

To allow us to set up your direct debit, or process your payment.

This is required for the contract (sale of the product or service)

4. If you are a Gift Shop or online Shopping Customer

What we collect…

Why

Legal Bases

We may collect your name, postal address, email address and phone number

To provide you with the products you purchase

This is required for the contract (sale of the product or service)

Bank details

We require these details to process the sale.

We do not receive these details if you pay online or by card in our Gift shops. Any information you provide to us over the phone will be securely destroyed.

This is required for the contract (sale of the product or service)

 

We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland

We will only send you these communications via email if we have your consent to do so

5. If you are an E-newsletter subscriber

What we collect…

Why

Legal Bases

We may collect your email address and communication preferences

We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland

We will only send you these communications via email if we have your consent to do so

If you consent to receive information by email, your email address and communication preferences are held by MailChimp, which is the email marketing system we use to send out our e-newsletters, and they are used only for the purpose of sending you these communications.

You can choose to opt out of these marketing communications at any time by contacting us at info@nms.ac.uk or by using the unsubscribe link at the bottom of every e-newsletter.

6. If you make a financial donation to National Museums Scotland

What we collect…

Why

Legal Bases

We may collect your name, postal address, email address and phone number

If you sign up to Gift Aid we are required to obtain your name and postal address

It is a legal requirement for this process.

 

We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland.

We will only send you these communications via email if we have your consent to do so.

Bank details

To allow us to process your payment.

This is required for the contract (sale of the product or service)

7. If you enter a competition

What we collect…

Why

Legal Bases

We may collect your name, postal address, email address and phone number

To contact you if you win

On the basis of legitimate interests – to contact you if you win.

 

We would like to keep you up to date with news about our work, events, products, special offers and ways of supporting National Museums Scotland.

We will only send you these communications via email if we have your consent to do so.

We will destroy your personal data after the competition has closed unless you have expressly chosen to opt-in to our email list. See Section 5.

8. If you visit our website

In order to make the National Museums Scotland website easier to use and improve our service, we sometimes place small amounts of information on your computer. These are known as cookies and they are used by most major websites. You can find out more about National Museums Scotland's use of cookies here.

9. Managing our collections

We hold personal data in order to manage the collections of National Museums Scotland. 

What we collect…

Why

Legal Bases

We may collect your name, postal address, email address, phone number and date of birth.

To record the details of disposals from and gifts, purchases and loans to our collections

It is necessary for us to carry out our Public Task or exercise our official authority as a National Museum

and it is a legal requirement for this process.

 

To record and manage details of makers/creators of items in our collections

It is necessary for us to carry out our Public Task or exercise our official authority as a National Museum

 

To enable us to lend items to other institutions or researchers

It is necessary for us to carry out our Public Task or exercise our official authority as a National Museum

and it is a legal requirement for this process.

 

To ensure that we comply with copyright legislation when providing copies of items in our collections

This is a legal requirement for this process

 

To undertake object conservation and/or scientific analysis (for outside agencies)

This is a legal requirement for this process and forms part of the Terms and Conditions of contract with us.

10. Sharing information

We do not disclose personal data to any third parties or external organisations, other than companies carrying out work on our behalf.  We retain responsibility for your data and ensure that these organisations only act on our instructions.

Examples of when we share data:

  • Mailing house sending out Explorer magazine
  • Email marketing services (eg Mailchimp)
  • Telephone fundraising agencies working on our behalf
  • Wealth screening organisations
  • Data cleaning organisations.

We may occasionally need to transfer your personal information overseas, for instance to our email marketing provider, MailChimp. We ensure any transfers of data are secure, in accordance with best practice, and in compliance with the General Data Protection Regulation. You can read the MailChimp Privacy Policy here.

Your data will never be sold or passed to any third party for any other purpose.

11. Legitimate interests

We have a number of legal bases that mean we can use (or 'process') your personal information. One basis 'Legitimate Interests', which means we can process your personal information if:

  • We have a genuine and legitimate reason
    and
  • We are not harming any of your rights and interests.

The following are some examples of when and why we would use this approach in our work:

  • Direct Marketing: We will send postal marketing and fundraising requests which further the aims and objectives of National Museums Scotland.
  • Wealth screening and research, to help us understand our Members, donors and potential donors, including gathering information from publicly available resources to give an insight into your philanthropic interests and ability to support National Museums Scotland.

When we process your personal information for our legitimate interests, we will consider and balance any potential impact on you and your rights under data protection and any other relevant law. Our legitimate business interests do not automatically override your interests.

12. How we update, screen and analyse your information

We continuously review records of supporters to ensure your data is as accurate as possible. For example, we may consult alternative sources in order undertake these checks for wealth screening, data cleaning or analysis, such as:

  • Royal Mail National Change of Address database (NCOA)
  • BT Operator Services Information System (OSIS)
  • WealthEngine, a wealth intelligence database
  • Reviewing employment information that you have made publicly available via social media
  • Newspaper articles, publications and company websites
  • Companies House and other company information databases
  • Charity Commission and Office of the Scottish Charity Regulator (OSCR) registers
  • Any other publicly available sources.

Where we appoint an external party to undertake a screening of information, any such arrangements will be subject to a formal agreement between National Museums Scotland and that organisation, to protect the security of your data.

We may segment the information we hold about you in our database based on a proprietary score. These scores are calculated using personal data, as well as how engaged with us you have previously been, and indicators of future engagement. Analysis of this helps us understand our Members, donors and potential donors to ensure we are efficient and that only relevant communications are sent to you.

You can opt-out of your data being utilised for these purposes simply by contacting development@nms.ac.uk

13. How we keep your information secure

We have implemented security procedures, rules and technical measures to protect the personal data that we have under our control from:

  • Unauthorised access
  • Improper use or disclosure
  • Unauthorised modification.

All our employees and data processors, who have access to and are associated with the processing of personal data, are legally obliged to respect the confidentiality of the personal data that we hold.

14. Your Data Protection Rights

Under new data protection laws taking effect in May 2018, you have rights in relation to your personal data. These rights are:

The right of access: you have the right to know whether we are processing any of your personal data. If we are, you have the right to access the data and certain information, such as why we are processing the data

The right of rectification: you have the right to ensure that we correct inaccuracies in your personal data that we are processing

The right of erasure (the 'right to be forgotten'): in certain situations you have the right to ensure that we erase your personal data

The right to restriction of processing: in certain situations you have the right to ensure that we restrict our processing of your personal data

The right of data portability: in certain situations you have the right to receive personal data that you provided to us in a structured, commonly used and machine-readable format

The right to object: in certain situations you have the right to object to our processing of your personal data and we are normally obliged to stop processing your data when requested. This right includes the right to object to our processing of your personal data for the purposes of direct marketing

The right to complain: you have the right to make a complaint to the UK Information Commissioner's Office (ICO) about our processing of your data, the exercise of your rights, and other data protection matters

The right to withdraw consent: you have the right at any time to withdraw your consent for us to process your personal data.

These rights are not absolute and may not apply in all situations or in relation to all processing activities.

Requests to exercise any of these rights should be sent to:

Data Protection Officer
National Museums Scotland
Chambers Street
Edinburgh
EH1 1JF

Email: dataprotection@nms.ac.uk

At any time you may request that we delete or correct your personal information by simply contacting dataprotection@nms.ac.uk.

15. Changes to this Privacy Notice

We regularly review our privacy notice, and may make changes time to time. Any changes made will be posted to this page, and will apply from the time we post them. This privacy notice was last changed on 23 May 2018.

16. How to contact us

To contact the Data Protection Officer:

Data Protection Officer
National Museums Scotland
Chambers Street
Edinburgh
EH1 1JF
dataprotection@nms.ac.uk

If you have any comments on our Privacy Notice, or information we hold about you please contact us:

  • by email to dataprotection@nms.ac.uk
  • or write to us at Data Protection Officer, National Museums Scotland, Chambers Street, Edinburgh, EH1 1JF.

You can use our complaints procedure https://www.nms.ac.uk/about-us/our-organisation/standards-of-service/ to make a complaint about data protection.

You have the right to make a complaint directly to the UK Information Commissioner's Office (ICO), which is the data protection supervisory authority in the UK.

Back to top