This page clarifies how we process your personal data when you buy from the National Library of Scotland. It also explains your associated rights. Please read our general privacy information in addition to the specific information contained in this privacy notice.
Purpose: Purchases | |
---|---|
Explanation of the purpose |
We process personal data that you provide to us in the course of making a purchase or similar exchange, for example obtaining a permission or copyright licence or buying from our shop. |
Legal basis |
Processing of this data is necessary for performance of a contract or for undertaking steps necessary for entering into a contract. |
This data will be processed by the National Library of Scotland for this purpose and certain data will be sent to third parties (see 'Will the data be transferred to third parties?'). Payments for most purchases made online are completed by a third
party, PayPal. When you are ready to pay for your order or purchase
you will be directed to PayPal's own website where you will be
asked to provide payment details. If you supply these, you will be
providing these details to PayPal, not to the Library. PayPal (not
the Library) will be in control of the personal data you provide on
the PayPal website. You should read PayPal's privacy information before
sending personal data to PayPal. |
|
Retention period |
We process purchase records for six years after the end of the
financial year in which the purchase took place. |
Your rights in relation to this data |
Your core rights as a data subject apply to this processing. Additionally, the right of data portability also applies to this processing. |
Most online payments will be completed by a third party, PayPal, and online payments for our Historic Maps Subscription API will be completed by Klokan Technologies or their payment provider (see 'Recipients of the data') Payments made in person using a credit or debit card are processed through a third party, First Data. First Data uses the information you provide through your credit or debit card to process your payment to the Library. For more information about how First Data uses this data, please see First Data's privacy policy. We use a third party provider, Signiant, to send large file transfers using their product Media Shuttle. For more information see Signiant's privacy policy. We use a third party provider, Booksource, to distribute some orders from our shop. For more information see Booksource's privacy notice. |
|
Will the data be transferred outside the European Union? |
Online payments will be completed by a third party, PayPal, which is based outside of the European Union. (see 'Recipients of the data') Transfers of data from credit or debit card payments to First Data may involve transfers outside of the European Union. For more information on their international transfers of data please see First Data's privacy policy. Signiant are registered in the United States of America and your personal data may be transferred there. Signiant are compliant with the EU-US Privacy Shield Framework which provides a mechanism to comply with Data Protection requirements when transferring data. |
Is it obligatory to supply this data and what are the consequences of not supplying the data? |
Yes, to buy from the Library (or to undertake a similar exchange) you are obliged to provide certain personal data. If you are unable to supply this data you will not be able to purchase certain goods or services from the Library. |
Will the data be used in automated decision-making? |
No. |