The Data Controller

The Board of Trustees for the Royal Botanic Garden Edinburgh (RBGE) of 20A Inverleith Row, Edinburgh, EH3 5LR is data controller for personal data processed for the operational and educational activities of the gardens (Information Commissioner’s Office registration number Z5723674).

For transactions through our online and physical shops, The Botanics Trading Company Limited ("Botanics Trading"), a subsidiary of RBGE, is a data controller (ICO registration number Z1398094).

 

Data Protection Officer

Comments and requests regarding the use of personal data both by RBGE and Botanics Trading can be sent to the Data Protection Officer, Jane McCrorie, Royal Botanic Garden Edinburgh, 20A Inverleith Row, Edinburgh, EH3 5LR. Email - DPO@rbge.org.uk
Why does RBGE process personal data?
We may process information about individuals (personal data) for the purposes of:

• Fulfilling a contract with you, for example
  o to sell you goods or services,
  o or as an employee or contractor.
• Where it is necessary to carry out and promote research and education in plant science in the public interest under our lawful authority, for example:
  o administration of memberships and supporter records;
  o promoting awareness of the gardens, collections and events;
  o administration of visitor services and events;
  o management of volunteers;
  o provision of education and training;
  o management of the collections, including records of collectors, accessions, loans and access;
  o fundraising in support of the above activities.
• To meet a specific legal obligation on RBGE.

RBGE has statutory obligations and lawful authority to promote plant science.

Under Section 11 of the National Heritage (Scotland) Act 1985, RBGE is tasked with the following functions:

(a) carry out investigation and research into the science of plants and related subjects, and disseminate the results of the investigation and research,
(b) maintain and develop collections of living plants and preserved plant material, books, archives and other related objects,
(c) keep the collections as national reference collections, and secure that they are available to persons for the purposes of study,
(d) provide advice, information and education, in any manner which seems appropriate to them, in relation to any aspect of the science of plants or of any related subject,
(e) provide other services (including quarantine) in relation to plants, and
(f) afford to members of the public opportunities to enter any land occupied or managed by the Board for the purpose of gaining knowledge and enjoyment from the Board’s collections.

 

What personal data does RBGE hold?

To fulfil these duties we have to process the personal data of:

• the public, including members, donors, supporters, visitors and customers;
• students and trainees;
• scientific users, including: research visitors, correspondents and enquirers; collectors and donors of items in the collections; and those borrowing samples and research material for other institutions;
• staff, volunteers, contractors and suppliers

We will hold relevant personal data such as:

• Names, addresses, email addresses, phone numbers;
• (For customers, members, supporters and donors) Payment information you provide to RBGE such as bank account details or payment card details; Records of donations, purchases and transactions; Records of events you have attended.
• (For scientific users) Details of your institution and the nature of you research or inquiry; records of attendance at our library or other facilities.
  (For students and trainees) Records of education, attendance and attainment.
• (For volunteers) Records of skills, attendance, training.
• (For staff) Records of bank account details, contractual information, training, attendance and absence, performance.
• (For anyone visiting our gardens or offices) CCTV footage

We retain personal data for the periods set out in our records retention schedule.

RBGE may profile the personal data of members and donors to more efficiently manage our fundraising activity.

For more details on how we use your personal data, please see the more specific information provided for members and donors, students and staff.

 

 

Sharing personal data

As appropriate, we will share relevant personal data with:

• Companies we have a contract with to provide services such as: event management, mail services, payment card services, merchant and sales services, fundraising management, training management.
• Audit Scotland, the Auditor General, the Accounts Commission or one of the audit firms appointed by them
• Our charitable Trust, the Botanics Foundation (Scottish Charity number SC027758)
• The American Friends of the Botanics Foundation
• (For students), the relevant partner university or college
• (For staff) the companies we have a contract with to provide payroll and occupational health services.

You have statutory rights relating to your own personal data:

• Access – you have the right to know what data we hold relating to you and why, and to receive a copy of it;
• Rectification – you have the right to have inaccurate information about you corrected;
• Objection – you have the right to object to RBGE using your information, and we would have to stop unless we have a sound overriding reason to continue;
• Erasure, restriction and portability – in specific circumstances, you have the right to have your personal data deleted, to put limits on what RBGE may do with it or to receive a copy in machine-readable form to take to another organisation;

There are also specific legal rights relating to automated decision making but RBGE does not have any such processes.

For more information on your rights under the GDPR see https://ico.org.uk/for-the-public/

To exercise any of these rights or for more information, contact our Data Protection Officer.

You have the right to instruct us not to process your personal data for marketing purposes. You can exercise the right at any time by contacting us at marketing@rbge.org.uk.

If you believe that RBGE has failed to manage your personal data appropriately, you have the right to complain to the statutory regulator - The Information Commissioner’s Office.

You can telephone them on 0303 123 1113, or you can write to them at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF