Events privacy notice

This page clarifies how we process your personal data when you book and attend our events. It also explains your associated rights. Please read our general privacy information in addition to the specific information contained in this privacy notice.

Purpose

Events

Explanation of the purpose

We use an external website, Eventbrite, for online event bookings. To make a booking to attend an event run by the Library through Eventbrite, you will be asked to register with your name and email address through the Eventbrite website. We will use your personal data to register your booking and manage the event.

We may take photographs, films or videos at our events, on our premises, or in relation to activities that we run. Images may be used for promotional and advertising material, for example, through social media, on our website, or in publications.

We engage in outreach, teaching, and engagement activities, online and in person. Sometimes we do this ourselves and sometimes we work with third parties, such as outreach specialists.

Legal basis

Processing of this data is necessary for the performance of a task carried out in the public interest or for our official functions.

We will only process your personal data for marketing, analytics and promotional purposes if you give us consent to do so.

Recipients of the data

This data will be processed by the National Library of Scotland for this purpose and certain data will be sent to third parties (see 'Will the data be transferred to third parties?').

Retention period

We process event attendance records for one year following the end of an event.

We process images captured for promotional or marketing purposes until we no longer require the images or until you withdraw your consent.

We have a detailed range of retention periods for different types of records, some of which may also apply to information processed for the purpose of making event bookings. Please see our retention schedules (811 KB; 77 pages) for details,, in particular under business classification 02.02.02.01 'Events' on page 11.

While we are working to implement our retention schedules, some data may be retained longer than required under the schedules.

Your rights in relation to this data

Your core rights as a data subject apply to this processing.

For processing that is carried out on the basis of consent, you have the right to withdraw your consent at any time and the rights of erasure and data portability also apply.

Will the data be transferred to third parties?

We use a third party provider, Eventbrite, as a platform for enabling online bookings to our events. For more information, please see Eventbrite's privacy policy.

We may use third party photographers to capture images of our events or activities. Details are available from staff at our events or activities.

Personal data that is processed for promotional or marketing purposes may be transferred to third parties. For more details see our communications notice.

We use a third-party provider, Zoom Video Communications Inc for remote conferencing services including meetings and public events. For more information, please see Zoom's privacy notice.

We use services from Microsoft's cloud-based Office 365 suite, such as Teams, for some remote events and services. Personal data exchanged or managed electronically are processed within Microsoft Office 365. For more information, please see Microsoft's privacy policy.

We work with third party outreach and engagement specialists from time to time on specific activities or projects. When we do so, we will make available details of the third parties working on our behalf, for example in the paperwork or communications that we provide.

We use a third party provider, Otter.ai, to caption our online events. For more information, see Otter.ai's privacy policy.

Will the data be transferred outside the UK or the European Economic Area (EEA)?

Eventbrite is registered in the United States of America and your personal data may be transferred there. Eventbrite is compliant with the EU-US Privacy Shield Framework which provides a mechanism to comply with Data Protection requirements when transferring data.

Zoom is registered in the United States of America and your personal data may be transferred there. Zoom will transfer personal data from the EU in accordance with the European Commission-approved Standard Contractual Clauses. Please see Zoom's privacy notice for more information.

Data that is processed in Microsoft Office 365 may be transferred outside of the European Union.

Is it obligatory to supply this data and what are the consequences of not supplying the data?

If you wish to attend a Library event you are required to supply your data for the purpose of making a booking. If you do not wish to supply your data we will be unable to book you a place at the event.

You do not have to agree to have your image captured for promotional or marketing purposes. You can speak with a member of staff at any of our events or activities if you would like to ensure that you are not captured on film that may be used for these purposes.

Will the data be used in automated decision-making?

No.