GDPR Privacy Notice


You really should read the below in full, but in summary, it’s stating that you need to agree to us holding (limited) personal information about you in order to provide you with an account. Some of that information - such as your name - will be visible to all users of the system.

Who are we

The James Hutton Institute (“Hutton”) is the Data Controller over any personal data we process about you for the purposes set out in this Privacy Notice. Hutton is committed to protecting your personal data and adheres to the principles of the General Data Protection Regulation (GDPR) when processing your personal data. If you have any concerns about Hutton’s processing of your personal data or you have a general enquiry in relation to data protection please contact our Data Protection Officer at or by telephone on 01382 346814.

What is personal data?

Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

What personal data is Hutton processing?

In order to provide you with an account on the Crop Diversity HPC system, Hutton is processing the following types of personal data about you:

  • your name

  • email address

  • host institution

  • telelphone number

  • IP address

Where did Hutton obtain my personal data from?

Your name, email address, host institution, and telephone number are provided by you when initially requesting an account. Your IP address is logged whenever you access and use the system.

Where will Hutton keep my data?

Your personal data is stored within the UK on secure servers located in either Invergowrie, near Dundee, or Aberdeen.

Why is Hutton processing my personal data?

Hutton is processing your personal data so that we can provide you with an account on the Crop Diversity HPC system.

Our legal basis for this processing is [Insert Legal Basis. N.B. If the Legal Basis is legitimate interests, explain here what that legitimate interest is. If it is based on performance of a contract or for statutory purposes, Hutton needs to inform the individual whether he or is obliged to provide the personal data and the consequences if he or she does not. Speak to Hutton’s DPO if unsure].

Will my personal data be shared with any other organisation/third parties and if so, why?

Will my personal data be shared outside of the EEA?


Is my personal data safe?

Hutton works hard to protect your personal data and has adopted appropriate technical and organisational measures to keep it safe from unauthorised disclosure, alteration or destruction.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted to Hutton via the internet; any transmission is at your own risk.

How long will Hutton retain my personal data?

Hutton will keep your personal data for as long as you have an account on the system.

Does Hutton make any automated decisions about me or profile my personal data?


What are my rights in relation to the personal data Hutton holds about me?

We have summarised your rights below. Please contact our Data Protection Officer at to exercise these.

  • If we are relying on your consent, you can withdraw your consent at any time, at which point we shall stop processing your personal data in that way. Please note this does not affect the legality of our processing up to the date of your withdrawal of consent.

  • You can seek to restrict our processing of your personal data, ask us to rectify any personal data we hold about you or object to us processing your personal data for the purposes stated above.

  • You have the right to lodge a complaint with the Information Commissioners Office (ICO) if you think that we have infringed your rights. You can find more information about reporting a matter to the ICO at the following link:

  • You have the right to access personal data held by us about you.

  • In certain circumstances you have the right to ask us to provide you with your personal data in a structured, commonly used and machine-readable format to allow you (or us on your behalf) to transmit this information to another party. More information can be found at

  • In certain circumstances you have the right to ask us to erase the personal data we hold about you. Such circumstances include (a) where we no longer need your personal data for the purposes set out above; (b) if you withdraw your consent to our processing; (c) if you object to our processing based on our legitimate interest and we have no overriding legitimate grounds to continue processing your personal data; (d) if we process the data unlawfully; or (e) where the personal data has to be erased to comply with legal obligation to which we are subject. We will consider any such request in line with GDPR. Please note this is not an absolute right and there may be circumstances where we choose not to delete all of the personal data we hold about you. More information about your right of erasure can be found at

Changes to privacy notice

Any changes we may make to our privacy notice in the future will be communicated to you in some manner.


Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to: