Privacy Notice

RBGE is a public body carrying out scientific research, conservation, education and public engagement across its four gardens.

This notice covers personal data used for those activities and, where relevant, retail transactions through the Botanics Trading Company.

The Data Controller

The Board of Trustees for the Royal Botanic Garden Edinburgh, 20A Inverleith Row, Edinburgh, EH3 5LR, is the data controller for RBGE’s activities (ICO registration number Z5723674).

For shop transactions, The Botanics Trading Company Limited is a separate data controller (ICO registration number Z1398094).

Data Protection Officer

For questions about this notice or your personal data, please contact our Data Protection Officer.

The Data Protection Officer, Jane McCrorie, Royal Botanic Garden Edinburgh, 20A Inverleith Row, Edinburgh, EH3 5LR.

Email - DPO@rbge.org.uk

We only use personal data where UK GDPR allows us to. The lawful basis we rely on depends on why we need the information and your relationship with us.

• Contract - to provide goods, services, bookings, memberships and other arrangements you ask us to manage.
• Legal obligation - to meet legal and regulatory duties, including employment, pensions, tax, health and safety, safeguarding and audit requirements.
• Public task - to carry out our official functions as a public body, including scientific research, conservation, education, collections management and public engagement.
• Legitimate interests - for limited administration, security, service improvement and some fundraising activity, where these interests are not overridden by your rights.
• Consent - where we ask for your permission, for example for some marketing communications. You can withdraw consent at any time.

The personal data we use depends on your relationship with us. It may include contact details, payment or transaction information, booking and attendance records, correspondence, CCTV images, and employment, volunteer or recruitment records.

This may relate to visitors, customers, members, donors, students, researchers, staff, volunteers, applicants, contractors and suppliers.

Special category data and criminal offence data

Some personal data we process may be sensitive personal data, such as health, equality or accessibility information. This is most likely to arise in relation to staff, applicants, volunteers, students, safeguarding or occupational health. We only use this information where the law allows, including for employment, social security and social protection purposes, health and safety, occupational health, substantial public interest reasons, or where explicit consent is appropriate, and always with appropriate safeguards.

We usually collect personal data directly from you, but sometimes from universities, employers, public bodies, service providers, emergency contacts or other lawful sources.

We may share personal data with service providers, regulators, auditors, partner organisations, fundraising partners and public authorities where necessary and lawful.

We do not routinely transfer personal data outside the UK. If we do, we will make sure a lawful transfer mechanism and appropriate safeguards are in place.

You have rights under data protection law, including the right to ask for access to your personal data, have inaccurate data corrected, object to certain processing, ask us to restrict or delete data in some circumstances, receive certain data in a reusable format, and withdraw consent where consent is used.

To exercise your rights, please contact the Data Protection Officer. You also have the right to complain to the Information Commissioner’s Office if you are unhappy with how we have handled your personal data.

We may use limited profiling for fundraising, supporter engagement and service improvement. This may include grouping people by their interests, past engagement or relationship with us so we can tailor communications and understand supporter interests more effectively. We do not use automated decision-making with legal or similarly significant effects.

Where we send direct marketing, we do so on the basis of consent or, where permitted, our legitimate interests, depending on the type of communication and your relationship with us. You can opt out at any time by using the unsubscribe option or contacting us at marketing@rbge.org.uk

We keep personal data only for as long as needed for the purpose it was collected, taking account of the type of information, the reason we hold it, and any legal, regulatory, safeguarding, audit or operational requirements. Retention periods are set out in our retention schedule and in any more specific privacy information that applies.

We use cookies and similar technologies to make our website work, remember your preferences and help us understand how people use our site. For more information, including how to manage your choices, please see our Cookie Notice.

If you follow a link to another website, we recommend reading its privacy notice, as we are not responsible for how other sites handle personal data.

The Royal Botanic Garden Edinburgh (RBGE) is a charitable body registered in Scotland (registration SC007983).

The Development Office supports RBGE’s community of members, patrons, students and former students (alumni), current and potential supporters and other individuals and stakeholders, to develop mutually beneficial relationships; to provide membership services and benefits; to promote the development of alumni networks; and to fundraise in support of our world leading science, conservation activities, education, community engagement, art, culture and collections.

Further information can be found in our Development Privacy Notice.

Information on how the Education Department uses your personal data can be found in our Education Privacy Policy