Data Protection and Privacy Policies

The security and privacy of your personal information is extremely important to us. The Data Protection Policy and Privacy Policy explain how and why we use your personal data.

 

1. DATA PROTECTION POLICY

1.1 Scope of the policy

This policy applies to the work of Holmes Chapel & District U3A. The policy sets out the requirements that Holmes Chapel & District U3A has to gather information for membership purposes. The policy details how personal information will be gathered, stored and managed in line with data protection principles and the UK General Data Protection Regulation. The policy is reviewed on an ongoing basis by Holmes Chapel & District U3A committee members to ensure that we are compliant. This policy should be read in tandem with Holmes Chapel & District U3A's Privacy Policy below.

1.2 Reasons for the Policy

This data protection policy describes how Holmes Chapel & District U3A will:

1.3 General guidelines for committee members and group leaders/conveners

The only people able to access data covered by this policy should be those who need to communicate with or provide a service to the Holmes Chapel & District U3A members.

1.4 Data protection principles

The UK General Data Protection Regulation identifies key data protection principles:

Principle 1 - Personal data shall be processed lawfully, fairly and in a transparent manner

Principle 2 - Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes.

Principle 3 - The collection of personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.

Principle 4 – Personal data held should be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased, or rectified without delay.

Principle 5 – Personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for  which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest , scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals.

Principle 6 - Personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.

1.5 Lawful, fair, and transparent data processing

Holmes Chapel & District U3A requests personal information from members and potential members, for membership applications and for sending communications about their involvement with the U3A. The forms used to request personal information will contain a privacy statement informing members and potential members as to why the information is being requested and what the information will be used for. The lawful basis for obtaining member information is provided by the contractual relationship that the U3A has with individual members. In addition, members will be asked to provide consent for specific processing purposes. U3A members will be informed as to who they need to contact should they wish for their data not to be used for specific purposes for which they have provided consent. Where these requests are received, they will be acted upon promptly and the member will be informed as to when the action has been taken.

1.6 Processing for specified, explicit and legitimate purposes

Members will be informed as to how their information will be used and the Committee of Holmes Chapel & District U3A will seek to ensure that member information is not used inappropriately. Appropriate use of information provided by members will include:

Holmes Chapel & District U3A will ensure that group conveners are made aware of what would be considered appropriate and inappropriate communication. Inappropriate communication would include sending U3A members marketing and/or promotional materials from external service providers.

Holmes Chapel & District U3A will ensure that members' information is managed in such a way as to not infringe an individual member's rights which include:

1.7 Adequate, relevant, and limited data processing

Members of Holmes Chapel & District U3A will only be asked to provide information that is relevant for membership purposes. This will include:

Where additional information may be required such as health related information this will be obtained with the consent of the member who will be informed as to why this information is required and the purpose that it will be used for.

Where Holmes Chapel & District U3A organises a trip or activity that requires emergency contact information to be provided, the member’s agreement to provide emergency contact information as part of the application to join the trip or activity will authorise the group convener to disclose that information should it become necessary.

1.8 Photographs

Photographs are classified as personal data. Where group photographs are being taken members will be asked to step out of shot if they don’t wish to be in the photograph. Otherwise consent will be obtained from members in order for photographs to be taken and members will be informed as to where photographs will be displayed. Should a member wish at any time to remove their consent and to have their photograph removed then they should contact Chair@holmschapelu3a.og.uk to advise that they no longer wish their photograph to be displayed.

1.9 Zoom video and voice recordings

Holmes Chapel & District U3A procured a licence to use Zoom in May 2020 and increasing use has been made of it for hosting virtual meetings online.  The Zoom system provides facilities to create and retain Video and Sound recordings of the meeting.

The Committee has confirmed that Video and Sound recordings of members will be regarded as personal information.

Recordings may only be made with the express permission of all participants and may only be kept for a stated purpose and limited retention period.

Participants in Zoom online meetings will be offered the options to mute/unmute themselves, and to show or hide their video stream.

1.10 Accuracy of data and keeping data up to date

Holmes Chapel & District U3A has a responsibility to ensure members' information is kept up to date. Members will be informed to let the membership secretary know if any of their personal information changes. In addition, on an annual basis, the membership renewal process will provide an opportunity for members to inform Holmes Chapel & District U3A as to any changes in their personal information.

1.11 Accountability and governance

The U3A Committee are responsible for ensuring that the U3A remains compliant with data protection requirements and can evidence that it has. Where consent is required for specific purposes then evidence of this consent (either electronic or paper) will be obtained and retained securely.

The U3A Committee will ensure that new members joining the Committee receive an induction into the requirements of GDPR and the implications for their role.

Holmes Chapel & District U3A will also ensure that group conveners are made aware of their responsibilities in relation to the data they hold and process.

Committee Members shall also stay up to date with guidance and practice within the U3A movement and shall seek additional input from the Third Age Trust National Office should any uncertainties arise.

The Committee will review data protection and who has access to information on a regular basis as well as reviewing what data is held. When Committee Members and Group Conveners relinquish their roles, they will be asked to either pass on data to those who need it and/or delete data.

1.12 Secure Processing

Holmes Chapel & District U3A Committee Members have a responsibility to ensure that data is both securely held and processed. This will include:

 1.13 Subject Access Request

U3A members are entitled to request access to the information that is held by Holmes Chapel & District U3A. The request needs to be received in the form of a written request to the Membership Secretary of the U3A. On receipt of the request, the request will be formally acknowledged and dealt with expediently (the legislation requires that information should generally be provided within one month) unless there are exceptional circumstances as to why the request cannot be granted. Holmes Chapel & District U3A will provide a written response detailing all information held on the member. A record shall be kept of the date of the request and the date of the response.

1.14 Data Breach Notification

Were a data breach to occur, action shall be taken to minimise the harm. This will include ensuring that all Holmes Chapel & District U3A Committee Members are made aware that a breach has taken place and how the breach occurred. The Committee shall then seek to rectify the cause of the breach as soon as possible to prevent any further breaches. The Chair of the U3A shall contact National Office within 24 hours of the breach occurring to notify of the breach. A discussion will take place between the Chair and National Office as to the seriousness of the breach, action to be taken and, where necessary, the Information Commissioner's Office would be notified. The Committee shall also contact the relevant U3A members to inform them of the data breach and actions taken to resolve the breach.

Where a U3A member feels that there has been a breach by the U3A, a committee member will ask the member to provide an outline of the breach. If the initial contact is by telephone, the committee member will ask the U3A member to follow this up with an email or a letter detailing their concern. The alleged breach will then be investigated by members of the committee who are not in any way implicated in the breach. Where the committee needs support or if the breach is serious, they should notify National Office. The U3A member should also be informed that they can report their concerns to National Office if they do not feel satisfied with the response from the U3A. Breach matters will be subject to a full investigation, records will be kept and all those involved will be notified of the outcome.

 

2. PRIVACY POLICY

2.1 Introduction

Holmes Chapel & District U3A treats your privacy rights seriously. This privacy policy sets out how we will deal with your ‘personal information’, that is, information that could identify, or is related to the identity of, an individual.

2.2 Who is responsible for the data we collect?

Holmes Chapel & District U3A is the data controller for the purposes of data protection law, in respect of your personal data collected and used by us.

2.3 What personal information do we collect?

When you express an interest in becoming a member of Holmes Chapel& District U3A you will be asked to provide certain information. This includes:

We will only collect the personal data that we need. You may occasionally be asked by a committee member or group leader to be in a photograph that will be posted on the website, you can always refuse to give this consent.

In mid-2020 we decided to introduce the Zoom virtual meeting system to counter the limits on physical gatherings imposed by Coronavirus restrictions. All participants shall be provided with the ability to mute/unmute themselves, and to stop/start showing their Video image to others.

Video and sound recordings may only be made and stored with the agreement in advance of all participants, and with the permission of the Zoom Administrator (zoom@holmeschapelu3a.org.uk) or other committee member.

2.4 How do we collect this personal information?

All the information collected is obtained directly from you. This is usually at the point of your initial registration. The information will be collected via membership forms or online contact forms. The lawful basis for collecting and storing your information is due to the contractual relationship that you, as a member, have with the U3A. In order to inform you about the groups, activities, and events that you can access as a member we need to store and process a certain amount of personal data.

You can give us your personal data by filling in forms on our website or by completing a paper application form. We will always ask for your consent to collect and use the data supplied. This may be in the form of an agreement when joining or renewing your membership.

2.5 How do we use your personal information?

We use your personal information:

We will send you messages by email, post, other digital methods, and telephone to advise you of U3A activities.

2.6 What technical information do we collect?

Certain information is collected by most websites or automatically through your electronic device, such as your IP address (your computer’s address on the internet), screen resolution, operating system type (Windows or Mac) and version, internet browser type and version, electronic device manufacturer and model, language, time of the visit and pages visited.

Cookies are pieces of information stored directly on the device you are using to access our Website. Cookies allow us to recognise your device and to collect information such as IP address, internet browser type, and time spent using the Website.

2.7 Automated Processing

We do not use your personal data to make any automated decisions that might affect you.

2.8 Who do we share your personal information with?

We may disclose information about you, including your personal information

Where we need to share your information outside of the U3A we will seek your consent and inform you as to who the information will be shared with and for what purpose.

Officers of Holmes Chapel & District U3A authorised to receive personal information from the database must take reasonable precautions to keep this information secure and confidential. Members must take care not to disclose to unauthorised parties the information, intentionally or otherwise, and must ensure that any information received or gathered is destroyed once the purpose for which it was provided is fulfilled.

2.9 How long do we keep your personal information?

We need to keep your information so that we can provide our services to you. In most instances information about your membership will not be stored for longer than for a maximum of six months after the member resigns. The exceptions to this are instances where there may be legal or insurance circumstances that require information to be held for longer whilst the issues are investigated or resolved. Where this is the case member/s will be informed as to how long the information will be held for and when it is deleted. Information regarding Gift Aid donations is retained for as long as required under HMRC regulations

2.10 How can your information be updated or corrected?

To ensure the information we hold is accurate and up to date, member's need to inform the U3A as to any changes to their personal information. You can do this by contacting the membership secretary via our website (holmeschapelu3a.org.uk) or by sending an email to membership@holmeschapelu3a.org.uk or at our Monthly meeting.

You can also correct or change any information by selecting ‘My Information’/ ‘Check My Details’ on our website.

On an annual basis you will have the opportunity to update your information, via the membership renewal process. Should you wish to view the information that the U3A holds on you, you can make this request by contacting the membership secretary – as detailed above.

There may be certain circumstances where we are not able to comply with this request. This would include where the information may contain references to other individuals or for legal, investigative or security reasons. Otherwise, we will usually respond within 14 days of the request being made. No charge will be made for this request.

2.11 Right to complain to the relevant data protection authority

Should you believe we have not used your personal data in accordance with data protection law, you have the right to complain to the Information Commissioner's Office (ICO). The ICO's contact details are

Information Commissioner's Office

Wycliffe House,

Water Lane

Wilmslow, Cheshire SK9 5AF

2.12 How do we store your personal information?

We have in place a range of security safeguards to protect your personal information against loss or theft, as well as unauthorised access, disclosure, copying, use or modification. Security measures include technological measures such as Secure Socket Layer (SSL) encryption, which creates a secure connection with your browser when you register and login into our online services. Your membership information is held on a database and accessed by Committee Members and Group Conveners – as appropriate. We keep our computers, files, and buildings secure. We have received assurance from the provider of U3AWeb that their computers, housing your data, comply with all the security measures required by the UK Data Protection Act 2018 and GDPR.

2.13 Links to other websites

Our website contains links to other websites you may find of interest. This privacy policy only applies to our website and we cannot be responsible for the privacy policies and practices of our associated organisations and recommend that you check their privacy policies.

2.14 Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google, Inc. (Google). Google Analytics uses cookies, which are text files placed on your computer, to help the website analyse how users use the site.

The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage.

Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

2.15 Access to and changes to this policy

This policy is available in the ‘Data Protection, Privacy' menu selection on our website. This policy may change from time to time. If we make any material changes, we will make members aware of this via an email and the monthly newsletter.

2.16 Who to contact

If you have any queries about this policy, or have any complaints about our privacy practices, please contact us at chair@holmeschapelu3a.org.uk or contact a committee member either at the Monthly meeting or the monthly Library desk meeting in Holmes Chapel Library.

2.17 Cookies Policy

We use cookies in our website to improve its performance and enhance your user experience. Cookies are small text files which a website may put on your computer or mobile device when you first visit a site or page. The cookie will help the website to recognise your device the next time you visit. They also help us to remember your username and preferences (e.g., the groups you select in the 'Group Planner').

2.18 Effective Date

Effective 12th February 2021.