Who we are
GrowScotland (“we”, “us”, “our”) publishes gardening guides and interactive tools for growing in Scotland at growscotland.co.uk. For the purposes of UK data protection law — the UK GDPR and the Data Protection Act 2018 — the data controller is GrowScotland, based in the United Kingdom.
While the site is written for Scottish gardeners, our tools are available to visitors from anywhere, including the EU and the US. Where the EU GDPR applies to your data instead of, or alongside, the UK GDPR, we apply the same standards described in this policy to you. We do not knowingly direct advertising or marketing specifically at any EU country, and we process EU visitor data at the same hobby-project scale described throughout this policy.
You can reach us about anything in this policy, including to exercise your rights, at privacy@growscotland.co.uk.
Summary
We keep data collection to a minimum. In plain terms:
- You can read the whole site without giving us any personal data.
- We use Google Analytics to understand how the site is used. This sets cookies — you can opt out (see Cookies and analytics).
- If you sign up to our email list, submit the frost-data form, or use the pest identifier, we only process what that feature needs. Each is described below.
- We never sell your data, and we never share it for others to market to you.
What we collect and why
1. Email sign-ups (our monthly growing reminder)
What: your email address, and the date you subscribed.
Why: to send you our monthly Scottish growing reminder — what to sow, plant and harvest that month.
How: our email list is managed by Brevo, our email processor. When you subscribe, your email address is stored by Brevo on our behalf.
Opting out: every email includes an unsubscribe link. Unsubscribing removes you from the list at any time, with no need to contact us, and we action unsubscribe requests promptly.
To reduce spam sign-ups, the form uses a hidden anti-bot field and basic rate limiting (see Our legal bases).
For US subscribers, we follow the CAN-SPAM Act: our emails do not use misleading subject lines or sender information, are clearly identifiable as coming from GrowScotland, and include a working unsubscribe link and a valid postal address in the footer.
2. The crowdsourced frost-data form
On our Scottish frost-dates page you can share local frost dates to help other growers.
What: a postcode prefix (for example “EH10”, not your full postcode), the frost dates you observed, your garden type (for example lowland or upland), and an optional note.
Why: to build a community picture of real Scottish frost timings that improves our tools and guidance.
A postcode prefix on its own does not identify you and is not treated as personal data under UK GDPR. Please do not include personal information (your name, full address, contact details or anyone else’s details) in the optional note — notes may be displayed publicly in aggregated form. We strip HTML from notes and limit their length before storing them, and we escape everything before it is shown, so submissions cannot inject content into the page.
Submissions are stored using Cloudflare Workers KV. As with all our forms, we log your IP address briefly to enforce submission limits and prevent abuse (see below).
3. The pest identifier
Our pest identifier lets you upload a photo of a plant problem for help identifying it. (This tool is being rolled out; this section explains what happens when you use it.)
What: the image you upload.
Why: to analyse the image and suggest what the pest or problem might be.
How: the image is sent to Anthropic, which runs the AI model that analyses it. GrowScotland does not keep your image after it has been processed. Anthropic’s handling of images sent to its API is governed by Anthropic’s own privacy and API terms.
Please do not upload photos containing people, or any image you would not be comfortable sharing. Upload plants only.
4. Analytics and site usage
We use Google Analytics 4 to see how many people visit, which pages and tools are popular, and roughly where visitors come from. This is described in Cookies and analytics.
5. Affiliate links (Amazon)
Some pages link to products on Amazon. As an Amazon Associate we earn from qualifying purchases. If you click an affiliate link, Amazon may set its own cookies and process your data under Amazon’s privacy notice — this happens on Amazon’s site, not ours, and only if you choose to click.
6. Security and server logs
Like most websites, our hosting (Cloudflare) processes technical information such as your IP address to serve pages, keep the site secure, and enforce fair-use limits on our forms. We use IP addresses only for these operational and security purposes, and we do not use them to build a profile of you.
Our legal bases
Under UK GDPR we rely on the following legal bases:
| Processing | Legal basis |
|---|---|
| Sending you our email reminder | Consent — you opt in, and can withdraw any time |
| Storing your frost-form submission | Consent — you choose to submit it |
| Processing a pest-identifier image | Consent — you choose to upload it |
| Analytics cookies | Consent (see Cookies and analytics) |
| IP logging for security and rate limiting | Legitimate interests — keeping the site secure and preventing abuse |
Who we share data with
We do not sell your personal data. We share it only with the service providers that make specific features work, and only for that purpose:
- Google (Google Analytics) — website analytics and analytics cookies.
- Brevo — sends and manages our email list (your email address).
- Anthropic — analyses images you upload to the pest identifier.
- Cloudflare — hosts the site and stores frost-form submissions; processes technical/security data such as IP addresses.
- Amazon (Associates programme) — if you click an affiliate link and shop on Amazon.
If we begin showing advertising in future (for example through an advertising partner such as Mediavine), we will update this policy to describe the advertising cookies and data involved before those ads go live.
International data transfers
Some of our providers are based outside the UK — for example Google and Anthropic are in the United States. Where your data is transferred outside the UK, we rely on the safeguards required by UK data protection law, such as the UK’s international data transfer agreement or addendum, standard contractual clauses, or a relevant adequacy decision, depending on the provider.
If you are visiting from the EU or the US, your data may also be transferred to and processed in the UK or elsewhere as described in this policy. We apply the same safeguards regardless of where you are visiting from.
How long we keep data
- Email address: kept until you unsubscribe or ask us to remove it.
- Frost-form submissions: kept as part of our aggregated Scottish frost dataset. As these contain a postcode prefix rather than personal data, they may be retained to keep the dataset useful over time.
- Pest-identifier images: not stored by GrowScotland after processing.
- IP addresses (security/rate limiting): kept only briefly, for as long as needed to enforce fair-use limits and investigate abuse.
- Analytics data: retained according to our Google Analytics configuration and Google’s retention controls.
Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to erase your data;
- restrict or object to our processing;
- data portability, where applicable;
- withdraw consent at any time (for example, unsubscribing from emails) — this does not affect processing already carried out.
To exercise any of these, email us at privacy@growscotland.co.uk. We will respond within the timeframes set by law (normally one month).
Children's privacy
This site is intended for adults and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to this policy
We may update this policy as the site develops — for example, when a new tool goes live. We will change the “last updated” date at the top, and for significant changes we will make the update clear on the site.
Contact and complaints
For any privacy question or request, contact us at privacy@growscotland.co.uk.
If you are unhappy with how we have handled your data, you have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk. We’d appreciate the chance to put things right first, so please consider contacting us before you do.