Data Privacy Policy
Data Privacy Policy
Introduction
The Exotic Fern Group is committed to the proper management of your personal information. This Data Privacy Policy describes our policies and procedures on the collection, use, and disclosure of your personal information that you provide to us when you register as a member of the Exotic Fern Group, use one of the charity’s services, or make contact with the charity.
​
Version 3: Last reviewed and approved by the Trustees on 18 September 2026. It supersedes version 1, approved by the Committee of the Exotic Fern Group unincorporated association on 8 December 2024.
​
The current version of this Data Privacy Policy is available at https://exoticferngroup.org/privacy.
Who we are
The Exotic Fern Group (‘EFG’ or ‘the charity’) is a Charitable Incorporated Organisation registered in England and Wales (registered charity number 1219251). For the purposes of the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is the Exotic Fern Group itself, registered with the UK’s Information Commissioner (registration reference ZC232477). The trustees have designated Matthew Reeve, a trustee, as the charity’s data protection lead, responsible on the trustees’ behalf for data privacy and protection. You can contact the data protection lead via:
​
POSTAL MAIL:

Data Protection Lead
Exotic Fern Group
18 Wadworth Holme
Middleton
Milton Keynes
MK10 9JR
United Kingdom
EMAIL:
What information we collect, use and why
We collect and use the following personal information to communicate with you about the activities of the Exotic Fern Group, to receive donations and claim Gift Aid, to organise events, to manage orders, to run the EFG Pteridology Prize, to operate our website and online services, and to publicise and provide our services.
-
Name and contact details, including any email addresses, telephone numbers and postal addresses you provide
-
The password you define for your EFG website account.
-
Your communication preferences and the records of the consent you give us
-
Your donation, subscription, order history and payment details. If you choose a paid tier of associate membership, this includes the amount and frequency of your donation, your postal address for delivery of the printed journal, and your country, which determines postage. Payment card details are processed by the payment providers used by our website platform and are not stored by the charity.
-
Gift Aid declarations you make, including your home address and confirmation of your UK taxpayer status.
-
Any EFG Event registration or attendance (including any access provisions or dietary requirements you provide).
-
If you enter the EFG Pteridology Prize: your name, contact details, eligibility information and the work you submit.
-
Your IP addresses and any EFG website usage information (including data we collect through the use of ‘cookies’)
-
Images and videos from events and other activities of the charity, and recordings of our online lectures and meetings, for use within our publications, online archive and advertising. If you take part in an online event that is recorded, your name, voice and image may appear in the recording.
EFG associate membership, EFG events and the charity’s online services are for people aged 18 and over. The EFG does not knowingly or intentionally collect or process the personal information of people under 18.
Cookies
On the EFG website, we use web browser functionality known as ‘cookies’ to give you a great experience when you visit the site. We use ‘cookies’ to:
​
-
Enable our website shopping basket and checkout
-
Provide member access to specific areas of the website for registered community members who log in
-
Analyse the performance, operation and effectiveness of our website
-
Help ensure our website is secure and safe to use
​
You can learn more about ‘cookies’ at https://allaboutcookies.org.
Legal basis and data protection rights
Under UK data protection law, we must have a ‘legal basis’ for collecting and using your personal information. Our legal basis for collecting and using your personal information is as follows:
-
Consent – you have given the EFG permission to use your personal data. The EFG has given you all the relevant information on how your data would be used through this policy document and other information on our website. We send newsletters and information about events by email only to people who have opted in to receive them, and every such email includes an unsubscribe link. Messages about your membership, renewals and payments are service messages, not marketing, and we will send them whether or not you have opted in to newsletters. You have the right to withdraw your consent at any time.
-
Contract – the EFG has to collect and use the personal information you provide so we can enter into or carry out a contract with you, such as delivering an order or a subscription, or administering your entry to the EFG Pteridology Prize.
-
Legitimate interest – it is in the legitimate interest of the charity to use the personal information of members, subscribers and supporters to run its activities, keep its records, and further its charitable objects. Where we rely on legitimate interests, we consider whether our use of your information is proportionate and does not override your rights and interests.
-
Legal obligation – where we must keep or share information to comply with the law, for example Gift Aid records, the charity’s accounting records, and health and safety records.
-
Public acknowledgement – some tiers of associate membership include a simple acknowledgement of your support, published in The Glasshouse. We will name you only with your agreement; you can choose how you are named, or not to be named, and you can withdraw your agreement at any time before the volume goes to print. Once printed, it cannot be amended.
Under UK GDPR you have the right to be informed about how we use your information (this policy); to access the personal information we hold about you; to have inaccurate information corrected; to have your information erased; to restrict how we use it; to receive it in a portable form; and to object to our use of it where we rely on legitimate interests. Where we rely on your
consent, you may withdraw it at any time. We do not make automated decisions about you. To exercise any of these rights, contact our data protection lead using the details given above; we will respond within one calendar month. You can read more about your rights from the UK Information Commissioner’s Office at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/.
Special category data
We do not typically collect or store sensitive personal information that would be classified as ‘special category data’ under the UK GDPR. However, there are some circumstances in which we will need to do so, for instance, if you inform us of an allergy, access requirements related to a disability, or experience an accident at one of our events.
If you provide us with any information regarding your health, disabilities, accessibility or dietary requirements, or any other personal information that could be considered ‘special category’ data under UK GDPR, we will use this information with the explicit consent you give when you share it
with us.
The charity is legally obligated to ensure the health, safety, and welfare of our members and event attendees. This includes recording health and safety incidents. Therefore, if you have been involved in or witnessed a health and safety incident at any of our events or while conducting activities on behalf of the charity, we will collect and process the following personal data: name, address, age, gender, details of any injuries that may have been sustained as a result of the incident, including photographs.
We rely on the conditions set out under Article 9(2) of UK GDPR, for collecting and processing special categories of personal data such as details of your injuries or your health or medical information. Our legal basis for collecting and using this personal data is as follows:
​​
-
Legal obligation – processing is necessary for compliance with a legal obligation to which the charity is subject.
-
Vital interest – the processing is necessary to protect someone’s life.
-
Legitimate interest – processing is necessary for the purposes of the legitimate interests pursued by the charity.
In these cases, your personal data will be used to meet our legal responsibilities to report certain accidents and incidents to the UK’s Health and Safety Executive (HSE), as mandated by the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR). This data is also necessary for compliance with the Health and Safety at Work Act 1974 and the Social
Security (Claims and Payments) Regulations 1979. Additionally, it will help us maintain precise and current records of accidents, injuries, and incidents, investigate accidents to reduce the likelihood of future occurrences, and establish, exercise, or defend possible legal claims or judicial acts.
If a safeguarding concern or a report of a breach of our Code of Conduct is raised, we may need to record information about the people involved, which can include health information or allegations of misconduct. We process this information because it is necessary for reasons of substantial public interest, specifically the safeguarding of children and adults at risk and the prevention or detection of unlawful acts, under Schedule 1 of the Data Protection Act 2018, and in accordance with our Safeguarding Statement and Code of Conduct. Such records are kept confidential and shared only with the trustees and, where necessary, the police, the local authority or the Charity Commission.
Donations and Gift Aid
If you make a Gift Aid declaration, we must keep it, together with your name and home address, so that HM Revenue and Customs can verify our claims. We keep declarations for seven years after the date of your last donation, which exceeds the six years HMRC requires. Our legal basis is legal obligation. Where a tier of associate membership includes a benefit such as the printed journal, we take that benefit into account in what we claim, in line with HMRC’s rules on donor benefits. If your circumstances change and you are no longer a UK taxpayer, please tell us so that we can stop claiming on your donations.
​
Pteridobase, the EFG Pteridology Prize and other uses of your information
Additional terms and privacy policy clauses may apply if you participate in other EFG services, such as using Pteridobase, entering for the EFG Pteridology Prize, or being a vendor at an EFG event. You will be informed of these when you register, enter, request or take part in these services.
Pteridobase (pteridobase.org) is the charity’s fern taxonomy, conservation and collection records platform. It has its own privacy policy at https://pteridobase.org/privacy/, which applies to your Pteridobase account, your collection records, your use of the Community Spore Bank and plant
exchange, and the technical information Pteridobase collects. In summary: Pteridobase records the location of private collections at country or approximate level only; it does not publish what any individual grower holds unless the grower chooses to share it; and it publishes aggregate conservation statistics that do not identify individuals. When you register on Pteridobase, your email address is automatically added to the EFG community membership list, from which you can unsubscribe at any time.
The EFG Pteridology Prize (exoticferngroup.org/prize) aims to promote emerging botanists, conservationists and horticulturists working with ferns who have a passion for writing and communication. It has its own guidelines and criteria you agree to if you choose to enter. In summary: We use your details to check your eligibility, administer the competition and contact you
about your entry; entries are shared with the members of the judging panel, who may be based at other institutions and who assess them in confidence; a condition of entry is that the winner’s name is published when the winning work is published and when the winner is announced.​
Where we get personal information from
We get your personal information directly from you when you:
​​
-
Register as a member of any membership tier
-
Use our website
-
Register for or attend our events
-
Place an order, make a donation or subscription
-
Enter any competition, such as the EFG Pteridology Prize
-
Register for any service, such as Pteridobase
-
Create content for the charity, such as authoring an article or sending us photos
-
Contact us or make an inquiry
-
Interact with our accounts on social media platforms
In limited circumstances, we may also receive personal information indirectly, such as if an organisation you are part of supplies us with your information as a nominated representative, if you are given as a witness to an accident or a breach of our Code of Conduct, or if a safeguarding concern is raised.
How long we keep information
We keep your information only for as long as we need it for the purpose we collected it, or as the law requires. Our retention periods are:
-
Membership record and contact details: for as long as you are a member or subscribed to our communications, and for 7 years after you leave or unsubscribe, unless another period below applies.
-
Website technical data and cookies: for the periods set by our website platform, Wix.com.
-
Images, videos and recordings: for as long as they are in use in our publications and online archive. You can ask us to remove an image or recording in which you appear.
-
Competition entries including the EFG Pteridology Prize: the winning entry is published and kept permanently; other entries and entrants’ contact details are deleted six months after the competition closes.
-
Safeguarding and Code of Conduct records: Seven years from the closure of the matter, or longer where a legal claim is possible.
-
Health and safety incident records: Three years from the date of the incident, or longer where a legal claim is possible.
-
Event registrations, including access and dietary requirements: until three months after the event.
-
Postal address held for delivery of the printed journal: for as long as you are a subscriber to the printed journal, and for seven years afterwards. The address on a donation record is kept with that record for the period above.
-
Donation, order and payment records, and Gift Aid declarations: seven years after the date of your last donation. This meets the six-year record-keeping requirements under the Charities Act 2011 and HMRC’s Gift Aid rules, which run from the end of the relevant accounting period, with a small additional margin.
-
Records of your consent and communication preferences: for as long as we send you communications, and for seven years afterwards as evidence of the consent you gave.
-
Pteridobase and other services: for the periods set out in the privacy policy for each additional service you use.
Who we share information with
We will never sell your personal information or allow it to be used for purposes outside this policy.
​
The charity is established in the UK. Personal information you provide to the charity will be transferred from you to the UK and managed in accordance with the UK GDPR and other applicable regulations. If you are a citizen of a country with rights different to those provided by the UK GDPR, please consider this before supplying the charity with any personal information.
We use specialist companies to help us operate the charity. These companies act as ‘data processors’ on our behalf and process your personal information only on our instructions. They are: Wix.com (our website, member accounts, online shop, donations, video hosting and email newsletters); Zoom (online meetings and lectures); IONOS (hosting of Pteridobase) and the further processors used by Pteridobase, which are listed in its privacy policy. Where these companies process personal information outside the UK, we rely on the safeguards permitted by UK GDPR, such as the UK’s adequacy regulations or standard contractual clauses.
We use the Wix.com platform. Wix.com provides us with an online platform that allows us to run our website, run events, collect donations, manage subscriptions and sell our products to you. Your personal information will be stored through Wix.com’s data storage, databases and general Wix.com applications. Wix.com stores your data on secure servers behind a firewall. All direct payment gateways offered by Wix.com and used by the charity for payments adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, a joint effort of brands like Visa, MasterCard, American Express and Discover. PCI-DSS requirements help ensure that our store and its service providers handle credit card information securely. You can access the Wix.com privacy policy at https://www.wix.com/about/privacy.
We share competition entries, such as the EFG Pteridology Prize, with the members of each competition’s judging panel, as described above.
We share safeguarding concerns and reports of breaches of our Code of Conduct with the trustees and, where necessary, with the police, the local authority or the Charity Commission.
In some situations, we may be legally obliged to share personal information with other organisations, such as the police, law enforcement, courts or regulators. In these situations, our data protection lead will document for the trustees that a legal basis exists for any data sharing.
For further information or to obtain a copy of the appropriate safeguard for any of the data transfers we make, please get in touch with our data protection lead, whose contact details are given above.
Security of your information
To help protect the privacy of your personal information, the charity maintains physical, technical and administrative safeguards. We restrict access to your personal information to those within the charity who need to know that information to provide our services to you. Misusing your personal information would be a breach of our Code of Conduct. We do not enter your personal information into artificial intelligence tools except as permitted by our Social Media, Digital Communications and Artificial Intelligence Policy. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72
hours, tell you without undue delay, and report it to the Charity Commission as a serious incident where its guidance requires.
Maintaining our Data Privacy Policy
The EFG’s trustees will review this Data Privacy Policy to ensure it remains up to date and incorporates any new legal requirements. This review will occur at least once every two years. The trustees must approve all amendments.
An earlier review will be considered following a significant data-protection or cyber-security incident; a significant change in relevant law or regulatory guidance; or evidence that this policy is no longer working effectively.
The EFG will communicate any changes the trustees view as significant to all individuals for whom we hold an email address.
Jurisdiction
This Data Privacy Policy shall be governed by and construed in accordance with the laws of England and Wales. Disputes arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to our data protection lead, whose contact details are given above.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the UK’s Information Commissioner’s Office. You do not have to make a complaint to the EFG first; you can go directly to the Information Commissioner’s Office.
​
POSTAL MAIL:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom
​
TELEPHONE:
​
WEBSITE: