This privacy notice outlines how the Botanical Society of Britain & Ireland (BSBI) complies with its data protection obligations as a Data Controller.
Any questions regarding this notice can be sent to:
Email: enquiries@bsbi.org
Phone Number: +44 (0) 7725 862 957
Registered Address: WMT LLP Chartered Accountants, 4 Beaconsfield Road, St Albans, Hertfordshire AL1 3RD..
Our enquiries email and phone line are open Monday to Friday, 10am – 7pm.
This policy is reviewed annually.
About Us
The BSBI is a charity and membership organisation which promotes the study, understanding and enjoyment of botany. We do this through facilitating training, outreach, botanical recording and
research through our networks of staff, members and volunteers.
Our Data Protection Officer is Julia Hanmer, and this policy has been prepared in line with the following legislation:
i. Data Protection Act 1998
ii. Freedom of Information Act 2000
iii. UK General Data Protection Regulation (UK GDPR)
iv. Privacy and Electronic Communications Regulations (PECR)
v. The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019
The BSBI, by virtue of its jurisdiction, operates in the UK and the Republic of Ireland. Following the exit of the UK from the European Union, transfers of personal data remain unrestricted within the
EEA under ‘adequacy regulations’ as long as processing continues to meet the requirements of the GDPR.
As and when a decision is made by the EU GDPR as to the on-going adequacy of the UK for data transfer, this policy will be updated.
The type of personal information we collect
In order to deliver on our charitable aims and to provide and improve our services, we may collect and hold the following personal information:
Information provided by the individual:
• Personal identifiers (such as title and name)
• Contact information (such as email address, address and phone number)
• Demographic information (such as date of birth)
• Information relating to the nature of your interest (for example, in answer to the question ‘Why do you want to join the BSBI?’)
• Financial information to support the processing of payment (such as a recurring Direct Debit or to purchase an event ticket)
• Gift Aid status
Information created or provided through your interaction with BSBI:
• Holding a specific volunteer role (such as a Vice County Recorder or membership of a Committee)
• Record of attendance at events
• Record of interaction with email communications (for example, whether an email is opened or a link visited)
• Record of donations or intended donations
• Record of purchases
• Submission of botanical records
• Applications for grants
• Publications
Information we hold may be analysed and processed in order to understand the efficacy of our communications and processes, and help us decide how best to provide our services. All communications will respect individual contact preferences. Where relevant to the charitable aims of BSBI, publicly available data may be collected and associated with individual records (for example, the holding of an academic position or a publication).
If you wish to update or amend your data or contact preferences at any point, please contact us on the details provided above.
How we get the personal information and why we have it
Most of the personal information we process is provided to us directly by you for one of the following reasons:
• Becoming a member or renewing your membership
• Becoming a volunteer
• Joining our mailing list
• Taking part in an event, either digitally or in person
• Responding to a survey
• Making a donation
• Undertaking botanical recording or research
We also receive personal information indirectly, from the following sources in the following scenarios:
• Where botanical records are submitted by an individual on behalf of a party.
We use the information that you have given us in order to deliver our services and achieve our charitable aims, as well as appropriately interact with those who have engaged with the charity, for example using personal data provided alongside a donation to thank the individual and inform them of the impact of their gift.
We may share this information with third party data processors, such as email automation platforms, payment services or our membership database provider, in order to facilitate the delivery of our membership service and activities.
BSBI will only process your personal data where it has a lawful basis for doing so. In most cases, the lawful basis is that processing such data is necessary for the legitimate interests of BSBI and our
obligation to the individual.
Where consent has been granted, information regarding local members may be shared with appropriate volunteers and staff members in order to facilitate local events, groups and activities.
Such volunteers and staff members receive appropriate data protection training and guidance.
Cookies and usage tracking
A cookie is a small file of letters and numbers that is downloaded on to your computer when you visit a website. Cookies are used by many websites and can do a number of things, e.g. remembering
your preferences, recording what you have put in your shopping basket, and counting the number of people looking at a website.
BSBI does not use cookies for the collection of personal data, however we do use Google Analytics for the purpose of collecting anonymous information about how people use our website in order to improve our services. The data is collected anonymously, stored by Google and used by us to create reports about website usage. Google’s privacy policy is available at https://www.google.com/privacypolicy.html.
The lawful basis for processing
The lawful bases we rely on for processing your information are:
• where you have given clear consent for us to do so. You are able to remove your consent at any time by contacting us.
• where we have a contractual obligation to fulfil, such as the terms of your membership or purchase.
• where we have a legitimate interest to fulfil our charitable aims.
Where we process personal data on the basis of our legitimate interests, we do so for the following purposes:
• to fulfil our charitable aims.
• to manage member, volunteer, donor, staff and external relationships.
• to enable us to tailor our communications on work we believe you may find interesting or may wish to support, respecting your contact preferences.
• for more information about the processing of data contained in botanical records submitted to our Distribution Database, please see below.
As per Articles 13 and 14 of the UK GDPR, individuals retain the right to erasure where personal data has been processed unlawfully and the right to remove consent for the purposes of direct
marketing.
BSBI will comply in all cases except where there is a need to retain certain specific information for legal reasons (such as the requirement to maintain accurate Gift Aid records).
Provision for the information of those under 18 years of age
Information provided by individuals under 18 years of age must be done with the permission of a parent or guardian, who will retain the ability to manage personal data preferences until the individual reaches the age of 18.
How we store your personal information
BSBI is committed to ensuring information is stored securely, including through the operation of suitable protection procedures. Data is accessed on a strict requirement basis and is protected
through passwords and encryption where appropriate, including financial data. Our operations are based within the UK and Ireland, and our data is stored within the EEA. For the storage and
processing of botanical records, the BSBI uses servers that are operated in France and the UK, which meet the current adequacy arrangements as outlined above.
We will only keep your personal information as long as it is necessary to fulfil the purposes for which it was collected. Information that is no longer necessary will then be removed from our systems, with respect to any preferences.
In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, the BSBI shall promptly assess the risk to
people’s rights and freedoms and if appropriate report this breach to the Information Commisioner’s Office.
Your data protection rights
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the the right to object to the processing of your personal information apart from where it forms part of a contract or where it is being processed by
consent (but you may withdraw consent).
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, unless it continues to pertain to our legitimate interests.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us if you wish to make a request.
How to raise a concern or complaint
If you have any concerns about our use of your personal information, please contact us.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Further Information about the processing of botanical records
Limited personal data is associated with botanical records when submitted to our Distribution Database (DDb) and remains associated with the record. Access to the DDb is restricted to registered users who have been issued with a password, but data may be downloaded or accessed by other data processing agencies for the purpose of conservation decision-making, land management,
development control (planning), research, education, policy development, raising public awareness and general natural history activities. BSBI shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation, as per Article 89 of the UK GDPR, including providing descriptions of the datasets it holds (termed
‘metadata’) to allow potential users to assess whether the datasets meet their requirements.
The UK GDPR specifically says that further processing for the following purposes should be considered to be compatible lawful processing operations:
• archiving purposes in the public interest;
• scientific research purposes; and
• statistical purposes.
As per Recital 33 of the UK GDPR, it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection and therefore assumed that individuals submitting botanical records to the DDb consent to these records being used for scientific research, when in keeping with recognised ethical standards for such research. All
recorders that submit records permit BSBI to produce a database of records. The BSBI undertakes to provide governance and oversight of this data set, and to regulate sharing, access and use of the
data. Individuals should refer to the BSBI Data Access Policy for further information about the uses to which submitted records are put.