Privacy Notice

Plant Health Centre - Privacy notice

Who we are

The Plant Health Centre (“PHC”, “us” or “we”) is a virtual centre of expertise funded by Scottish Government through RESAS (Rural and Environment Science and Analytical Sciences Division). PHC brings together expertise from The James Hutton Institute (“Hutton”), Royal Botanic Garden, Edinburgh (“RGBE”), Scotland’s Rural College (“SRUC”) and Forest Research (“FR”).

Hutton primarily manages day-to-day running of PHC and is usually responsible for deciding how your personal data is used (known as the data controller).

In some cases, we may work with our partner organisations on projects or other activities. When this happens they may also act as data controllers for the personal data involved.

This privacy notice explains what personal data we collect and how we use it when you interact with the PHC. This includes when you:

use our website
contact us
complete surveys or questionnaires
apply for or take part in projects
submit an Integrated Pest Management (IPM) plan
attend our events

Data protection principles

We are committed to protecting your personal data and adhere to the principles of the UK General Data Protection Regulation (GDPR) when using your personal data. This means we:

use your personal data lawfully, fairly and transparently
collect it only for clear and specific purposes
only use data that is relevant and necessary
keep it accurate and up to date.
keep it only for as long as needed
Keep it secure

What is personal data?

Personal Data means any information that can identify you, either directly or indirectly (for example, your name, contact details or location data).

Some types of personal data are more sensitive and need extra protection. This includes information about your health, ethnicity, political or religious beliefs. We only collect this type of data where necessary and with appropriate safeguards.

How we use your personal data

	Purpose	Personal Data	Where do we get it from?	Legal Basis
1	To respond to your enquiries	Name Email address Telephone number (if provided)	You	Legitimate Interest.
2	To keep you informed about our work	Name Work contact details Communication preferences	You	Legitimate Interests (for business-to-business communications) Consent (when you have signed up to receive updates)
3	To organise and manage events	Name and contact details Dietary requirements (if provided)	You	Consent (you provide this when registering for an event)
4	To improve our website	Technical information such as IP address, browser type and usage data	You	Legitimate Interests – for essential functionalities Consent – for non-essential cookies.
5	Integrated Pest Management (IPM) plans: To process your IPM plan submission To analyse how IPM practices are being applied across the sector To support research and policy development Please note: This forms one of a number of optional management activities that farmers may choose to complete as part of the Scottish Government’s Whole Farm Plan requirements. Although participation in the IPM plan is voluntary, it may contribute towards meeting scheme requirements where selected by the farmer.	Names Ages Email addresses Farm or business name Postal addresses	You	Consent – participation in the IPM plan is voluntary. By submitting an IPM plan, you consent to the processing of your personal data for the purposes described, including analysis and sharing with our research partners (UHI and ADAS). You may choose an alternative activity within the Whole Farm Plan instead. Please see the IPM privacy policy for further details.
6	To assess funding applications, manage projects and communicate with applicants and participants.	Contact details Job role and organisation Application and project information	You	Public task (carrying out research and funding activities in the public interest)
7	When you are involved in a funded project with an aim to: administering and managing awarded projects monitoring progress publishing information about funded work reporting on outcomes and impact staying in contact about relevant activities.	Contact details Project and organisational information Outputs and impact information	You	Public task

Do we use Cookies?

Yes. Further information on how the Plant Health Centre uses cookies is available in our Cookies Policy.

Where your data is stored

Your personal data will be stored on a secure server at The James Hutton Institute located in the UK.

Will we share your personal data with third parties?

We only share your personal data when it is necessary and appropriate. This may include:

Our partner organisations

We may share data with organisations involved in the Plant Health Centre (such as The James Hutton Institute, SRUC, RGBE and Forest Research) where needed for projects or activities.

Funders and advisors

Where relevant, we may share limited data with funders (such as the Scottish Government), external reviewers, advisors or referees to assess applications or support projects.

Research partners

We may share your data with trusted partners for research and analysis purposes related to PHC projects (including for purposes relating to the IPM consultation). In such cases, data sharing agreements and appropriate contractual safeguards will be in place to ensure your personal data is protected and used only for specified purposes.

Event partners

If we run events with other organisations, we may share your data where needed to organise the event.

Service providers

We use trusted third parties (e.g. survey tools, event platforms, email services, event organisers) to support our work. They only process your data on our behalf and must keep it secure.

Legal or regulatory requirements

We may share your data if we are required to do so by law.

Where possible, we will anonymise or pseudonymise data before sharing it for analysis.

Will your data be shared outside of the UK?

Sometimes we may need to share your personal data with organisations which are based or store/process data outside the UK (for example, service providers or project partners).

When we do this, we make sure your data is protected by:

only sharing data where necessary
carrying out checks on the organisation receiving the data
putting safeguards in place, such as standard contractual clauses or other legally approved agreements

Some countries provide a similar level of protection to the UK (for example, countries in the European Economic Area). In these cases, your data can be transferred easily, without additional measures in place.

Where this is not the case (for example, in the United States), we take extra steps to ensure your data is protected in line with UK data protection law.

Is your personal data safe?

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it.

While no method of transmitting information via the internet is completely secure, we take reasonable steps to safeguard your data and reduce risks both during transmission and once it is received, in line with UK data protection requirements.

How can I stop receiving communications from PHC?

If you no longer wish to receive marketing or other non-essential communication from PHC and would like your personal data removed from our database, you can opt-out at any time by e-mailing info@planthealthcentre.scot.

We will remove your contact details from our mailing lists. We will continue to retain and use your personal data where necessary for other purposes (for example, where we have a legal or contractual reason to do so).

How long we keep your personal data

We will keep your personal data for no longer than is necessary for the purpose we obtained it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements or until such time that you withdraw your consent and/or exercise your right to request that PHC stops processing your personal data.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we use your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

Do we make any automated decisions about you or profile your personal data?

No. We do not make automated decisions about you and also do not profile your personal data.

We may use digital tools, including AI-based assistants, to support our work. However, these tools are used under human supervision and are not used to make decisions that have legal or significant effects on you.

What we do NOT do

- We do not sell your personal data

- We do not publish information that identifies you

- We do not use automated decision-making or profiling

Your rights

You have rights over your personal data. More information can be found on the ICO's website.

Please note that some of these rights are not absolute rights and there are instances where we can refuse to comply with your request. Each request will be reviewed on a case-by-case basis.

You have the right to be informed about the collection and use of your personal data.
Access - You have the right to ask for a copy of the personal data we hold about you.
Correction - You can ask us to correct inaccurate or incomplete data
Restriction - You can ask us to limit how we use your personal data in certain cases.
Objection - You can object to how we use your personal data where we are relying on a legitimate interest or where we are using it for marketing purposes.
Deletion - In certain circumstances you have the right to ask us to delete your personal data.
Data portability - In certain circumstances, you can ask to receive your personal data in a structured, commonly used and machine-readable format. You can also ask us to transmit your personal data directly to another controller.
Withdraw consent – where we rely on consent, you can withdraw this t at any time, at which point we shall stop processing your personal data in that way. Please note this does not affect the legality of our processing up to the date of your withdrawal of consent. If you withdraw your consent, we may not be able to provide certain services to you e.g. have you at events. To exercise any of these rights, please contact our Data Protection Officer at DPO@hutton.ac.uk .

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we use your data. You can find more information about reporting a matter on the ICO’s website.

Third Party Links

Our website may from contain links to other websites. If you follow a link to a third-party site, please note that these websites have their own privacy notices and practices.

We do not control these websites and are not responsible for how they use your data. We recommend that you read their privacy notices before providing any personal information or using their services.

Changes to Privacy Notice

We reserve the right to amend this privacy notice. However, any changes we may make to our privacy notice in the future will be communicated to you in some manner.

This Privacy Notice was last updated in May 2026.

Contact us

Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to: DPO@hutton.ac.uk