Explanation of the purpose

We process personal data that you provide to us in the course of making a purchase or similar exchange, for example obtaining a permission or copyright licence or making a purchase from our shop.

Legal basis

Processing of this data is necessary for performance of a contract or for undertaking steps necessary for entering into a contract.

Recipients of the data

This data will be processed by the National Library of Scotland for this purpose and certain data will be sent to third parties (see 'Will the data be transferred to third parties?').

Payments for purchase made online are completed by a third party, PayPal. When you are ready to pay for your order or purchase you will be directed to PayPal's own website where you will be asked to provide payment details. If you supply these, you will be providing these details to PayPal, not to the Library. PayPal (not the Library) will be the 'data controller' of the personal data you provide on the PayPal website. You should read PayPal's privacy information before sending personal data to PayPal.

Retention period

We process purchase records for six years after the end of the financial year in which the purchase took place.

We have a detailed range of retention periods for different types of records, some of which may also apply to information processed for the purpose of buying online. Please see our retention schedules (195 KB; 86 pages) for details, in particular under business classification 06.02.004 'Expenses and transactions' on page 51.

While we are implementing our retention schedules, some data may be retained longer than required under the schedules.

Your rights in relation to this data

Your core rights as a data subject apply to this processing. Additionally, the right of data portability also applies to this processing.

Will the data be transferred to third parties?

Online payments will be completed by a third party, PayPal. (see 'Recipients of the data')

Payments made in person using a credit or debit card are processed through a third party, First Data. First Data uses the information you provide through your credit or debit card to process your payment to the Library. For more information about how First Data uses this data, please see First Data's privacy policy.

Will the data be transferred outside the European Union?

Online payments will be completed by a third party, PayPal, which is based outside of the European Union. (see 'Recipients of the data')

Transfers of data from credit or debit card payments to First Data may involve transfers outside of the European Union. For more information on their international transfers of data please see First Data's privacy policy.

Is it obligatory to supply this data and what are the consequences of not supplying the data?

Yes, in order to purchase from the Library (or in order to undertake a similar exchange) you are obliged to provide certain personal data. If you are unable to supply this data you will not be able to purchase certain goods or services from the Library.

Will the data be used in automated decision-making?

No.