Who we are
Museums Galleries Scotland
33 Castle Street
Edinburgh, EH2 3DN
We are a charity registered in Scotland and our registration number is SC015593. We are also a registered company limited by guarantee in Scotland. Our registration number is SC074264.
We are registered as a Data Controller with the Information Commissioners Office under the Data Protection Act 2018 and our registration number is ZB303612.
The legal basis for collecting and processing your data
In a small number of circumstances we will collect and process your data using consent. For example, when you sign up to receive our e-newsletter.
In some circumstances we require your personal data to comply with a contractual obligation. For example, when you book a training course with us we will collect data such as your name, email, details of your organisation and payment information. We will also collect special category data on any access requirements you may have.
In specific situations we collect and process your data to pursue our legitimate interests, which would be expected as part of the running of our organisation, but which does not impact your rights or interests.
For example, we will use information on previous training courses you attended to suggest follow-on training which may benefit you.
Types of personal data collected
The data we collect may be personal data and may include your name, e-mail address, work telephone number, postal address, and interests.
How personal data is collected
- We collect the personal data that you may volunteer via forms on this website.
- We will collect personal data that is volunteered via forms on MGSonline, our grants processing system.
- We will collect personal data through the management of the Accreditation and Recognition schemes.
- We will collect personal data in order to facilitate your participation in our training and events through services such as Eventbrite and ClickMeeting.
Who we share your data with
We do not disclose personal data to other organisations other than data processors working on our behalf unless you have given us consent to do so.
We occasionally need to transfer your personal information outside of the EEA, for example, to our email distributor Mailchimp. Any data processors acting on our behalf outside of the EU are certified subscribers to the EU-US and Swiss-US Privacy Shield.
Our current list of data processors are:
- Survey Monkey
- The Scottish Qualifications Authority (SQA)
- Stripe Payments
- DC Research
- Chiene + Tait
- Peninsula (Health Assured Employee Assistance Programme/Occ Health)
- Lothian Pension Fund
- Rachel Forrest
- Arrow Communications
- Annette Yauger
- Morton Ward
- Thomson Cooper
- Axiom Consultancy (Scotland) Ltd
- BlueSky Experiences Ltd
- Centre for Human Ecology
- Changeworks Recycling Ltd
- Intercultural Youth Scotland
- The Diffley Partnership Ltd
- Thorntons Law LLP
How long we will keep your data
When we gather or process personal data, we will only keep it for as long as is necessary for the purpose for which it was originally collected.
At the end of that retention period, your personal data will either be deleted completely or anonymised, for example by processing it in non-identifiable way for statistical analysis.
Download a copy of our full records retention schedule.
We do not give you the option of using a secure transmission method to send us your personal data. We have implemented security policies, rules and technical measures to protect the personal data that we have under our control from:
- Unauthorised access
- Improper use or disclosure
- Unauthorised modification
All our employees and data processors, who have access to, and are associated with the processing of personal data, are obliged to respect the confidentiality of our user’s personal data.
Cookies and Website Traffic Analysis
When you enter the MGS website your computers will automatically be issued with 'cookies'. Cookies are text files which identify your computer to the MGS's server. The website then creates "session" cookies to store some of your preferences moving around the website, e.g. retaining a text-only preference. Cookies in themselves do not identify individual users but identify only the computer used and they are deleted on departure from the website. Many websites do this to track traffic flows, whenever users visit those websites.
You have the opportunity to set your computers to accept all cookies, to notify you when a cookie is issued, or not to receive cookies at any time. If you choose the last option this means that certain services cannot then be provided to you.
Log files stored on MGS's web server allow the recording and analysis of users' use of the website. Log files do not contain any personal information.
Please be aware that MGS is not responsible for the privacy practices of other sites. We encourage you to be aware when you leave our site and to read the privacy statements of each and every Website that collects personally identifiable information. This privacy statement applies solely to information collected by this Website.
Rights for access to personal data
You can ask us if we are keeping any personal data about you and you can also request to receive a copy of that personal data. For such requests, please contact firstname.lastname@example.org
At any time you may request that we delete or correct your personal information.