Data Processing Policy and Privacy Notice
In relation to Leigh on Mendip WI, Somerset
Federation of WIs
Dated:
7 October 2018
WI Data Protection /MCS Representative: Helen Gulvin
Introduction
The WI takes the processing of Members’
personal details very seriously and does its utmost to ensure they are
protected.
This document sets out what information the
WI holds, why it needs to hold and process it, and how it is protected.
Where “the WI” is referenced this relates
to Leigh on Mendip WI, a charity registered with the Charity Commission.
Where “Federation” is referenced this
relates to Somerset Federation of WIs, a charity registered with the Charity
Commission.
Where “NFWI” is referenced this relates to
the National Federation of WIs, an incorporated charity registered with the
Charity Commission.
Context
The WI is a membership organisation which
holds personal information submitted by its members and by the public who express
an interest in joining or the work of the WI.
The WI is a local group run by volunteers
for its members. It is affiliated to the
Federation and NFWI as part of a large charitable organisation.
As a membership organisation a contract
exists between the member, her local WI, the County Federation and the National
Federation.
The WI also receives requests for
information at local, County and National level. At local level this is, in the main, from
women wanting to join, or visit with a view to joining, the local group.
The WI may also hold additional information
which enhances the contract but does not form part of it.
The WI ensures that all committee members
and ordinary members are aware of their responsibilities under the Data
Protection Act and take all reasonable steps to ensure the security of data
held and ensure that it is appropriately processed.
Privacy
The WI takes the use and storage of personal
data very seriously. It will only
collect and store information which relates to the WI. Any information it holds will only be shared
with committee members as appropriate.
The WI will never share your information
with any third party without your express consent.
This Privacy and Policy Notice will be
available at every meeting for members and visitors to review and will be made
available on all online platforms used by the WI.
The Federation and NFWI have their own
privacy notice which can be seen on the relevant website.
When
do we collect information
The WI will collect your contact
information upon joining the WI. It will
also ask for your consent for any additional information it wishes to collect.
Lawful
Processing
There are 6 lawful bases that are used
under GDPR. The WI uses the following:
1.
Contractual
Relationship
Where
it is necessary for us to process your personal information in order to fulfil
the contract created by your membership.
2.
Legitimate
Interests
This
basis is used to ensure you, as a member of the WI, are kept up to date on activities
and opportunities open to you. This
basis is also used where non-members contact the WI asking for more
information.
3.
Consent
Where
you have provided your consent for the WI to use your personal data.
4.
Vital
Information
If
you feel you would like the WI to hold medical details or an emergency contact.
Information
held, use and lawful basis
The following will illustrate the
information held, how it is used and the lawful basis for holding the
information.
|
Personal
Information
|
Use
|
Lawful
Basis
|
|
Members
|
|
|
|
Name
|
To identify the member
|
Contractual
|
|
Address
|
To send information
regarding their membership including WI Life, event tickets, newsletters,
etc.
|
Contractual
|
|
Telephone Number
|
To contact the member
regarding their membership, booked events, meetings.
The WI may also use the
telephone number if the member has not attended meetings or is unwell to
check on their welfare.
|
Legitimate Interest
|
|
Email Address
|
To contact the member
regarding their membership, booked events, meetings, newsletters.
To allow access to the
member only sections of the NFWI Website
|
Legitimate Interest
Contractual
|
|
Date of Birth/Birthday
|
To celebrate the member’s
birthday month and/or to celebrate a special milestone birthday. This may be with cards, flowers or
recognition at a meeting.
|
Consent
|
|
Photographs
|
Photographs of members and
events are taken and shared within the group, on websites, in newsletters or
on social media. We may also share
photographs in a press release.
|
Consent
|
|
Medical Conditions and Emergency
Contact
|
Where a member has a
medical condition that they feel their WI should be made aware of, this
information will be held in a sealed envelope to be given to a medical
professional. The emergency contact
will be used in a medical emergency.
|
Vital Information
|
|
Non-members
|
|
|
|
Name, Address, Telephone
Number and/or email address
|
Details held on non-members
will vary dependent on the information they provide when making contact. This information is used to respond to a
request for information or to keep them informed of future meetings and
events. Information is not used for
any other purpose.
|
Legitimate Interest
|
Storing
and Security of Data
Data may be held electronically or in hard
copy.
NFWI holds a central database called
Membership Communication System (MCS).
This database holds all contact details for members and is used by all
levels of NFWI. The details are also used
by WI Enterprises to send the member magazine to all members. This database is managed within the UK and is
subject to stringent security. It is
only accessible by registered MCS Representatives for each local WI, Federation
Representatives and National Representatives.
The MCS is managed by NFWI and as such it covered by their privacy
policy.
Personal data may also be held in email
contact lists
Locally, data may be held in spreadsheet
form or in paper copy. All personal
details are kept secure and only shared with members of the committee of the WI
to fulfil their role in supporting the contract between the group and the
member.
Every effort is made to ensure that
personal details are secured in an appropriate manner and only shared on a need
to know basis. All members given access
are aware of their responsibility to maintain the confidentiality of the
information.
Storage
of Consent Forms
Consent forms will be filed and kept whilst
the member is active. They will be held
in an archive within the WI for 3 years following the end of the membership to
ensure that they are available should an information request be received.
Consent forms will be updated on a regular
basis to ensure that every member is aware of the consent held and to change or
update it as they wish.
Archives
The WI has a long history and it is
important to maintain this history.
Records may be archived, in line with any relevant consent. Any material archived is done so under the
section 6 Public Interest lawful basis and the section 9 Archiving lawful basis.
Personal information other than name will
not be used in publicly available records.
Rights
of Individuals
Every member, lapsed member or non-member
has the following rights:
Right to be Informed
This
notice informs you what generic information the WI holds, how the WI stores it
and what the WI do with the information the WI holds.
Right of Access
You
have the right to know what information the WI holds on you. The WI will respond to requests for
information within one calendar month (in line with current legislation).
Right to Rectification
You
have the right to request that we correct any inaccurate information. The WI will respond to all requests within one
calendar month.
Right to Erasure
You
have the right to request us to erase information held on you. The WI will respond to this request within one
calendar month and confirm what information the WI has erased.
Right to Object
You
have the right to object if you feel any of your personal information has been
used in a way that you feel is inappropriate.
The WI will respond to requests within one calendar month.
The WI will endeavour to respond as quickly
as possible to all requests and work with you to resolve any queries.
Activities
outside the Monthly Meeting
The WI runs outings and one-off activities
which are in addition to the contractual monthly meeting.
Your contact details will be taken from the
member register and passed to the organiser.
This information is required for the WI to
fulfil the contract with the member for the activity or group.
If you do not wish your contact details to
be passed to the organiser, you must advise one of the WI Officers or your WI
Data Protection Representative at the time of booking. In this situation, it will be your
responsibility to make all contact with the organiser for information regarding
the activity. No responsibility is
accepted by the WI for contact or information sharing about the activity.
Paperwork
The WI will use all both the following
forms to gather and store information
·
NFWI
Membership Form
·
Consent
Form
Length
of Storage and Destruction of Data
As the WI is a charity and has a strong
public interest with archiving and documenting the activities of the WI, the WI
will not destroy minutes, records of meetings and activities, scrapbooks or
other records.
However, the WI will destroy information
held about members contact details or medical details. The destruction schedule will be as follows:
|
Financial Information
|
Seven years in line with
legal requirements
|
|
Membership Forms
|
Immediately after entering
on MCS
|
|
Consent Forms
|
Three years following the
end of membership
|
|
Emergency Contact and
Medical Information
|
Upon membership lapse
|
Updating
this privacy notice
This privacy notice will be updated
periodically and be available for members and non-members to read.
If the privacy notice is updated in a way
that significantly changes how we use your personal information, we will bring
these changes to your attention.
Change
Log
October 2018 – Initial Preparation by Caroline
Harris
