Transparency notice - education & learning

In this section, please read all instances of “you” to include “your child(ren)” in those cases where you provide us with information about minors who are in your care.

When you engage with our Education and Learning Services we will collect information about your school (where relevant), as well as your contact details, and certain other data required to ensure that your visit is safe (which will include Sensitive Personal Information in relation to your special needs or dietary requirements).

We will use your personal information to provide you with the Services that you have requested from us, such as school workshops, teacher events, family events, or adult learning courses (e.g. in the performance of a contract with you). We will also use your contact information in order to supply you with relevant transactional documentation. We will use the Sensitive Personal Information that you provide to ensure that your use of our Services is safe (e.g. in the vital interests of the data subject).

We may use your contact information to contact your school with information about our Services which we believe may be of interest to you. This is on the basis of our legitimate interests, as set out in the Privacy of Electronic Communication Regulations 2003 (as amended), which covers business to business email communications.

We may analyse information about your transactions to carry out our legitimate interests in monitoring, auditing, and developing our Learning & Education Services.

Please note that photography (both video and still) for publicity purposes is often undertaken at our events, either by us, by third party photographers acting on our behalf under contract, or by media organisations. Such photography will primarily be focussed on groups and activities rather than on individuals. If you have any objection to such photography please make this known to a member of staff at the event. If we wish to take individual photographs or video recordings that are specifically focussed on you then we will always ask for your specific consent at the time.

We may use various organisations to provide IT capabilities in support of our Services, and who may process your information on our behalf. These Data Processors will process your information only under contract to the Library, and may not use your information in any other way. In particular, we use the following systems to process your information:

  • We use Google Drive, from Google Inc., to coordinate and administer our education and learning activities. Google may process your information in the United States, and is certified under the Eu-US Privacy Shield Framework in order to implement appropriate safeguards in relation to your information. Google’s Privacy Policy can be found at
  • We use WeTransfer, from WeTransfer B.V, to transfer photographs between us and our photographers. WeTransfer’s Privacy Policy can be found at
We will retain your information for the current year plus a further six years after the date of your transaction in order to comply with tax and accounting rules. Photos taken for publicity purposes will be retained indefinitely.


To support NHS Test and Trace (which is part of the Department for Health and Social Care) in England, we have been mandated by law to collect and keep a limited record of staff, customers and visitors who come onto our premises for the purpose of contact tracing. The legal basis for the collection of this information is therefore 'a legal obligation to which the Library is subject'.

By maintaining records of staff, customers and visitors, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to the coronavirus.

As a customer/visitor of the Library you will be asked to provide some basic information and contact details. The following information will be collected:

- the names of all customers or visitors

- a contact phone number for each customer or visitor

- date of visit and arrival time and departure time

In addition, if you only interact with one member of staff during your visit, the name of the assigned staff member will be recorded alongside your information.

The Library, as the data controller for the collection of your personal data, will be responsible for compliance with data protection legislation for the period of time it holds this information. If that information is requested by the NHS Test and Trace service, the service will at that point become responsible for compliance with data protection legislation in relation to this personal data.

The NHS Test and Trace service as part of safeguarding your personal data, has in place technical, organisational, and administrative security measures to protect your personal information that it receives from the Library from loss, misuse, and unauthorised access, disclosure, alteration, and destruction.

NHS Test and Trace have asked us to retain this information for 21 days from the date of your visit, to enable contact tracing to be carried out by NHS Test and Trace during that period. We will only share information with NHS Test and Trace if it is specifically requested by them.

For example, if another customer at the venue reported symptoms and subsequently tested positive, NHS Test and Trace can request the log of customer details for a particular time period (for example, this may be all customers who visited on a particular day or time-band, or over a 2-day period).

We may require you to pre-book appointments for visits or to complete a form on arrival in order to facilitate the collection of this data.

The information that we collect to support this requirement contains personal data which we would not ordinarily collect from you and which we therefore collect only for the purpose of contact tracing. Information of this type will not be used for other purposes, and will be destroyed by us 21 days after the date of your visit.