Explanation of the purpose

We process personal data that you provide to us in the course of making a purchase or similar exchange, for example obtaining a permission or copyright licence or making a purchase from our online shop.

Legal basis

Processing of this data is necessary for performance of a contract or for undertaking steps necessary for entering into a contract.

Recipients of the data

This data will be processed by the National Library of Scotland for this purpose. 

Payments for purchase made online are completed by a third party, PayPal. When you are ready to pay for your order or purchase you will be directed to PayPal's own website where you will be asked to provide payment details. If you supply these, you will be providing these details to PayPal, not to the Library. PayPal (not the Library) will be the 'data controller' of the personal data you provide on the PayPal website. You should read PayPal's privacy information before sending personal data to PayPal.

Retention period

We process purchase records for six years after the end of the financial year in which the purchase took place.

We have a detailed range of retention periods for different types of records, some of which may also apply to information processed for the purpose of buying online. Please see our retention schedules (195 KB; 86 pages) for details, in particular under business classification 06.02.004 'Expenses and transactions' on page 51.

While we are implementing our retention schedules, some data may be retained longer than required under the schedules.

Your rights in relation to this data

Your core rights as a data subject apply to this processing. Additionally, the rights of erasure and data portability also apply to this processing.

Will the data be transferred to third parties?

No, but your payment will be completed by a third party, PayPal. (see 'Recipients of the data')

Will the data be transferred outside the European Union?

No, but your payment will be completed by a third party, PayPal, which is based outside of the European Union. (see 'Recipients of the data')

Is it obligatory to supply this data and what are the consequences of not supplying the data?

Yes, in order to purchase from the Library (or in order to undertake a similar exchange) you are obliged to provide certain personal data. If you are unable to supply this data you will not be able to purchase certain goods or services from the Library.

For clarification, certain purchases made in person from the Library do not require the processing of personal data (e.g. purchases not made online or by other remote means).

Will the data be used in automated decision-making?

No.