Bishopstone Village Hall Trust – Privacy Policy – May 2018

Introduction

The General Data Protection Regulation (GDPR) 2018 is a European Union (EU) wide set of standardised rules for the handling and storage of personal information within the EU. This will apply to anyone who is controlling the information of an EU citizen or processing it on their behalf, even if the processor or controller are based outside the UK.

This Privacy Statement tells you what information we may obtain and hold about you, how and why we collect it, and what we do with it, as well as who we share it with. It also sets out your various rights pertaining to your data. You should read this statement when you give us information, so that you are aware of how and why we are using this. Please update us if any of the information supplied by you changes.

In pursuance of maintaining and operating the Trust, we are committed to helping everyone concerned in what we do, to protect the privacy of their Personal Data or Sensitive Personal Data. Personal Data being any information that could directly or indirectly, be linked to the identity of an individual person, who may be referred to as a Data Subject.

Who We Are and What We Do

Bishopstone Village Hall Trust is Registered Charity Number 264370. The trust exists to provide a village hall for use by the residents of Bishopstone, The trustees are all elected, designated or co-opted volunteers, who are charged with maintaining the village hall and this includes raising monies to finance this. The monies are raised through such initiatives as 100 Club, Quizzes, Film Nights, Jumble Sales and lettings. Some of these lets are regular long term, whilst others are ad hoc and last anything from two hours upwards.

The Data We May Hold (Process) Together With The Reasons Why

The various purposes for which it may be necessary for us to process your information include ‘Contractual performance’, ‘Legal obligation, ‘Legitimate interest’ and ‘Consent’. The relevance of these terms is set out in Table 1 below.

We will only obtain and hold such data that is necessary for us to carry out any of the processes and functions related to the effective lawful operation of the trust. (see Table 1 below).

Personal Information That We May Collect

Data Subject	Personal Information Collected	Mode of Collection	Purpose
Trustees	Name, Age, Gender & and contact details as required by The Charity Commission and to enable contact between trustees.	Personally in writing or via telephone.	To facilitate the correct supply of details to The Charity Commission as required by law. Enable the effective operation of the village hall.
Participants in the Village 100 Club	Name, Address, telephone numbers	Verbally, electronically or in writing.	To facilitate the correct allocation and delivery of numbers. To ensure that the correct number of tickets are issued to each person and the correct amount of money is received in return. Thereafter, facilitate the delivery of prizes to winners. To facilitate timely annual renewal,
Hirers	Full Name, Address, Name of Organisation if applicable, Email, telephone numbers, Date of and period of hire.	Verbally, in writing or Electronically, including the ‘On-line Contact Form’ that facilitates contact from and dialogue with a village hall administrator and the ‘Hire Agreement Form’.	To facilitate use of the village hall and its facilities pursuant to contract. To facilitate invoicing and ensure that full timely payment is received for the hire fee or charged as a result of damage or breach of contract. To notify the hirer of any matter adversely affecting the interests of the hirer or organisation or group that they represent, i.e. power cut rendering the hall unusable during the hours of darkness.
Participants and attendees to events	Name, Email & telephone	Verbal or email from Subject,	To allow initial bookings, purchase of appropriate food, drink, raffle prizes and tickets, ensure the viability of the event or initiative, deployment of the correct amount and type of furniture and other necessary utensils. Correct amount of printing. To facilitate notification in the event of changes to dates, timings etc or related queries.
Volunteer Helpers	Name, Email & Telephone	Verbal or email	To enquire about personal availability or confirm arrangements or notify of a variance in arrangements.
Services/Contractors/Utilities	Company, Name, Address, Mobile Telephone, Email, Current Bank Account Details.	Verbally, email or in writing.	To pay fees being pursuant to contract. Arrange services or facilitate consultation,

Sharing Data with Others

We will never share your personal data with any third party unless you have consented in advance.

Storage and Security of Data

Where we obtain Personal Data in respect of any person, it will stored in a secure place, and protected by appropriate security measures, to prevent it from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Once stored all Personal Data will only accessed by the appropriate event or initiative leader. This access will only be to facilitate the lawful furtherance of maintaining and operating Bishopstone Village Hall i.e. the organisation or marketing of a specific event.

Data Security Breaches

In the event of any security breach occurring, intentionally or otherwise, which leads to the destruction, loss, alteration, unauthorised disclosure of or access to personal data, we are obliged by law, to consider and if appropriate, notify yourself without undue delay (if there is a high risk of the breach threatening your individual rights and freedoms) and the relevant supervisory authority within 72 hours of us becoming aware of it. Record of all breaches must be recorded and retained.

Period of Retention

We will only retain Personal Data for as long as is necessary to fulfil the purpose(s) for which we collected it. These will include 7 years for all financial data, 3 years in respect of health & safety matters. All Personal Data or Sensitive Personal Data retained by us will be subject of at least an annual (if not shorter) ‘weeding process’ conducted by our ‘Data Controllor’.

Sharing or Selling Personal Data or Sensitive Personal Data

We will only share personal data or sensitive personal data if you have given express itemised consent. We will never sell or seek to sell any personal data or sensitive personal data for marketing or any other reason.

Third Party Data Processors

Sometimes the operation of our business involves the supply of personal information to third parties, such as The Charity Commission, Utility Companies and our Local Authority, who by law, require personal data or sensitive personal data to fulfil legal obligations effectively. These are defined as ‘Third Party Data Processors’. The trust acknowledges that as the Data Controllers, it is responsible for their ‘compliance’ (what they do with the data that we provide them with) with the ‘guarantees’ we are obliged to require of them in respect of GDPR and the protection of the personal and sensitive personal data This must be done using the form of a written contract. Though as ‘Processors’, they may also be liable to a sanction, if they fail to comply.

There are also occasions when the Trust acts as a ‘Third Party Data Processor’, but it will only do so when all parties have consented in advance or where practical, the data is anonymised i.e. the publishing of the monthly 100 Club Draw results.

Marketing

We will usually advertise events, initiatives, appeals or personal vacancies via ‘flyers’ or email, but on occasions may need to visit persons at home to inform, explain, share or make requests for assistance or participation.

Website and Cookies

The Bishopstone Village Hall website fundamentally exists to provide information about the hall to potential hirers. To this end, it hosts pictures of both the inside and outside of the hall together with text describing the facility. There are also three PDF’s, which comprise a Booking Form and Terms & Conditions, Health & Safety Document and Prices. Potential hirers also have the ability to view an event calendar for availability, hall news and make contact with a village hall representative electronically with a view to opening up dialogue regarding a potential booking or viewing. A Booking Form/Hire Agreement, including Standard Conditions is available. These are designed to facilitate a booking and ensure that all contractual matters are communicated, understood and agreed prior to hire. The information requested is the minimum required to administrate hire of the hall effectively and address our legitimate business interests, based on previous experience.

The website does not use cookies.

Rights of Persons Whose Personal Data We Hold

Rectification - If we hold your Personal Data or Sensitive Personal Data, you have the right to request a correction to the detail if it is inaccurate or incomplete. Though, we may need to verify the accuracy of any new data to satisfy a legal requirement or protect The Trust from being a victim of Fraud.

Erasure - Persons whose Personal Data or Sensitive Personal Data we hold, may also request that we erase some or all of their Personal Data, or Sensitive Personal Data where there is no good reason for us to continue retain it.

Withdrawal of Consent - Where persons have consented to us processing or holding their Personal Data or Sensitive Personal Data, they may withdraw that consent at anytime. If this occurs, it will not affect the lawfulness of any processing that took place prior to that withdrawal.

The actual removal of any Personal Data or Sensitive Personal Data may not be instant, as any request for removal will require balancing with other legal requirements and due consideration in association with the law by our ‘Data Controller’, who may not be immediately available. It will be done as soon as practicable though.

Portability - Persons whose Personal Data or Sensitive Personal Data we hold, may request that we transfer their data to them or a third party that they nominate. If requested in electronic form, such transfers will be made in a structured, commonly used and machine readable format.

Copy of Information Held - Persons whose Personal Data or Sensitive Personal Data we hold, may also request a copy of the data we hold on them (known as a ‘Data Subject Access Request’). Any such application, should be made in writing to our Chair of Trustees, via The Village Hall.

No fee will usually be required for this service, unless an individual makes multiple or unreasonable applications, in which case a reasonable fee will be charged. Generally, we undertake to respond to ‘Data Subject Requests’ within one month. However, it may take longer if your request is particularly complex or you have made a number of requests. As part of the process, we may need to verify the identity of the applicant in order to ensure that there is no disclosure of Personal Data or Sensitive Personal Data to an unauthorised person. Any identification verification would require production of two forms of identity.

Complaints

If you are dissatisfied with our actions or response to a request you have made to us, the higher authority from which you may wish to seek advice or formally complain, is the Information Commissioner, Wycliffe House, Wilmslow, SK9 5AF.