• Name
• Email address
• Home address
• Phone number
• Date of birth
• Gender
• Ethnicity
• Employment and educational background
• Nationality
• Photographs of students and staff
• Images of students and staff in videos of online classes
• IP Address (stored by the Moodle site, PropaGate Learning)
• Records of attendance, completion and performance
• Coursework and portfolios

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• To enable you to apply for a course
• To enable us to contact you
• To enable us to create an online account for you on PropaGate Learning and MyPortfolio

Some other personal information is captured in the following scenarios:

• Video recordings of some classes and tutorials or study weekend sessions
• When you add a picture or information about yourself to your profile page or a forum post
• When you add personal information to a forum post
• When images of staff are added to courses or orientation activities
• When you use the PropaGate Learning site (IP Address)
• When you share your name and question content with us as part of the Q&A in a webinar

We also receive personal information indirectly, from the following sources in the following scenarios:

• From the University of Edinburgh for students studying on undergraduate and postgraduate courses 
• From Scotland’s Rural College for students studying on undergraduate and postgraduate courses 
• External organisations delivering the Certificate in Practical Horticulture Course 
• From the University for Leeds for students on the Botany for the Built Environment course 
• From various academic institutions where their PhD students are studying with us 

We use the information that you have given us in order to:

• To administer your education and training, including evaluation of your work
• Create online accounts in order for you to access your online course(s) on PropaGate Learning
• Create Microsoft accounts for you if required
• To enable us to contact you about your application/enrolment
• Send you certificates of completion and for the accreditation of awards
• Ask you for feedback
• Process your payment for a course or other purchase
• Gather statistics so we can understand our audience and widen participation 

We share some of this information with the University of London who hosts our online learning sites. The University of London accesses your information in order to provide technical assistance, together with storing the sites securely for RBGE. 

We use the AuthSMTP service to enable us to send notification emails to you in a secure manner.

If you are a student on a course which RBGE delivers in partnership with another institution, your information will be shared as appropriate with that institution (for example, Royal Horticultural Society, Scottish Rural College, Glasgow University, Edinburgh University, Edinburgh College of Art).

Occasionally we give short term access to PropaGate Learning and/or My Portfolio to auditors or external examiners. For accessibility auditing, an auditor will have access to what students can see in a selection of courses.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

• We need it to perform a public task. We carry out these activities to fulfil our public interest role under Section 11 of the National Heritage (Scotland) Act 1985 to "provide advice, information and education, in any manner which seems appropriate to them, in relation to any aspect of the science of plants or of any related subject".
• Your consent (e.g. for the use of photographs or videos which you appear in; health related data e.g. for field trips). You are able to remove your consent at any time. You can do this by contacting education@rbge.org.uk.
• We have a contractual obligation (for payment) to provide education and training.

Online courses

Your online account information and online coursework is securely stored by the University of London (CoSector), our Moodle and Mahara hosting organisation. The University of London stores your information within the EU Microsoft Cloud Azure Services in North Europe.

Student online coursework will be kept for no longer than 3 years after you have finished your course, unless it is kept for quality and review purposes, when it may be held for up to 6 years. Selected coursework may be permanently preserved in the RBGE archive as historical records. This covers any coursework held in My Portfolio and PropaGate Learning.

PropaGate Learning student accounts will normally be removed after 4 years of inactivity unless you specifically ask for your account to be kept open. Accounts will be checked once per year and inactive accounts deleted accordingly. Occasionally forum posts may remain if part of a longer discussion, so we recommend refraining from posting any personal information on forums. Profile pictures and names are removed from posts after account deletion.

Where we work with an academic partner and use their VLE, the retention schedules may differ.

Attended courses

Student coursework will be kept for no longer than 3 years after you have finished your course. Other student work is retained for evaluation and quality purposes and will be deleted or destroyed 6 years after the end of your course. Selected coursework may be permanently preserved in the RBGE archive as historical records. 

Emails

Emails are stored by Microsoft and AuthSMTP. Messages are removed from the AuthSMTP servers after on average 4 days.

Application data

Your application data is stored at RBGE on RBGE servers or Microsoft servers. Application forms are kept for one year. 

Student results

This information is archived indefinitely.

Online resources

Some online activities are created in Articulate 360 which sometimes involves using Articulate Rise and Review, two online services which involve uploading these activities to Articulate servers. The personal data included in these activities is limited to staff names and images and is kept to a minimum.

Virtual class recordings

In some courses, class/lecture recordings are made to allow students to review classes or for catch up purposes. Recordings and live-stream broadcasts (where used) containing student and tutor images, voice and any personal opinions you express will be made available to your class group after your class. If an event/class is being recorded, we will always notify you in advance.

These recordings can be viewed by students and staff enrolled on the course with which the recording is associated, along with any PropaGate Learning site managers or administrators. RBGE uses Microsoft Stream to process the recordings. Occasionally Vimeo will be used when students do not have RBGE Microsoft 365 accounts and access will be password protected. RBGE ensures that all recordings are only available to/shared with students within your class group. RBGE will hold the personal data you provide within a recording for up to two years from the date of recording. Stream recordings are held by Microsoft within the European Union.

Under data protection law, you have rights, including:

• Your right of access - You have the right to ask us for copies of your personal information.
• Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

To exercise any of these rights or for more information, contact our Data Protection Officer: Jane McCrorie, Royal Botanic Garden Edinburgh, 20a Inverleith Row, Edinburgh, EH3 5LR. Email: dpo@rbge.org.uk

This notice was updated on the 21st November 2024