Data Processing Policy and Privacy Notice

Data Processing Policy and Privacy Notice

In relation to Leigh on Mendip WI, Somerset Federation of WIs

Dated:   7 October 2018

WI Data Protection /MCS Representative:  Helen Gulvin

Introduction

The WI takes the processing of Members’ personal details very seriously and does its utmost to ensure they are protected.

This document sets out what information the WI holds, why it needs to hold and process it, and how it is protected.

Where “the WI” is referenced this relates to Leigh on Mendip WI, a charity registered with the Charity Commission.

Where “Federation” is referenced this relates to Somerset Federation of WIs, a charity registered with the Charity Commission.

Where “NFWI” is referenced this relates to the National Federation of WIs, an incorporated charity registered with the Charity Commission.

Context

The WI is a membership organisation which holds personal information submitted by its members and by the public who express an interest in joining or the work of the WI.

The WI is a local group run by volunteers for its members.  It is affiliated to the Federation and NFWI as part of a large charitable organisation.

As a membership organisation a contract exists between the member, her local WI, the County Federation and the National Federation. 

The WI also receives requests for information at local, County and National level.  At local level this is, in the main, from women wanting to join, or visit with a view to joining, the local group.

The WI may also hold additional information which enhances the contract but does not form part of it.

The WI ensures that all committee members and ordinary members are aware of their responsibilities under the Data Protection Act and take all reasonable steps to ensure the security of data held and ensure that it is appropriately processed.

Privacy

The WI takes the use and storage of personal data very seriously.  It will only collect and store information which relates to the WI.  Any information it holds will only be shared with committee members as appropriate.

The WI will never share your information with any third party without your express consent.

This Privacy and Policy Notice will be available at every meeting for members and visitors to review and will be made available on all online platforms used by the WI.

The Federation and NFWI have their own privacy notice which can be seen on the relevant website.

When do we collect information

The WI will collect your contact information upon joining the WI.  It will also ask for your consent for any additional information it wishes to collect.

Lawful Processing

There are 6 lawful bases that are used under GDPR.  The WI uses the following:

1.       Contractual Relationship

Where it is necessary for us to process your personal information in order to fulfil the contract created by your membership.

2.      Legitimate Interests

This basis is used to ensure you, as a member of the WI, are kept up to date on activities and opportunities open to you.  This basis is also used where non-members contact the WI asking for more information.

3.      Consent

Where you have provided your consent for the WI to use your personal data.

4.      Vital Information

If you feel you would like the WI to hold medical details or an emergency contact.

Information held, use and lawful basis

The following will illustrate the information held, how it is used and the lawful basis for holding the information.

Personal Information	Use	Lawful Basis
Members
Name	To identify the member	Contractual
Address	To send information regarding their membership including WI Life, event tickets, newsletters, etc.	Contractual
Telephone Number	To contact the member regarding their membership, booked events, meetings. The WI may also use the telephone number if the member has not attended meetings or is unwell to check on their welfare.	Legitimate Interest
Email Address	To contact the member regarding their membership, booked events, meetings, newsletters. To allow access to the member only sections of the NFWI Website	Legitimate Interest Contractual
Date of Birth/Birthday	To celebrate the member’s birthday month and/or to celebrate a special milestone birthday.  This may be with cards, flowers or recognition at a meeting.	Consent
Photographs	Photographs of members and events are taken and shared within the group, on websites, in newsletters or on social media.  We may also share photographs in a press release.	Consent
Medical Conditions and Emergency Contact	Where a member has a medical condition that they feel their WI should be made aware of, this information will be held in a sealed envelope to be given to a medical professional.  The emergency contact will be used in a medical emergency.	Vital Information
Non-members
Name, Address, Telephone Number and/or email address	Details held on non-members will vary dependent on the information they provide when making contact.  This information is used to respond to a request for information or to keep them informed of future meetings and events.  Information is not used for any other purpose.	Legitimate Interest

Storing and Security of Data

Data may be held electronically or in hard copy. 

NFWI holds a central database called Membership Communication System (MCS).  This database holds all contact details for members and is used by all levels of NFWI.  The details are also used by WI Enterprises to send the member magazine to all members.  This database is managed within the UK and is subject to stringent security.  It is only accessible by registered MCS Representatives for each local WI, Federation Representatives and National Representatives.  The MCS is managed by NFWI and as such it covered by their privacy policy.

Personal data may also be held in email contact lists

Locally, data may be held in spreadsheet form or in paper copy.  All personal details are kept secure and only shared with members of the committee of the WI to fulfil their role in supporting the contract between the group and the member.

Every effort is made to ensure that personal details are secured in an appropriate manner and only shared on a need to know basis.  All members given access are aware of their responsibility to maintain the confidentiality of the information.

Storage of Consent Forms

Consent forms will be filed and kept whilst the member is active.  They will be held in an archive within the WI for 3 years following the end of the membership to ensure that they are available should an information request be received.

Consent forms will be updated on a regular basis to ensure that every member is aware of the consent held and to change or update it as they wish.

Archives

The WI has a long history and it is important to maintain this history.  Records may be archived, in line with any relevant consent.  Any material archived is done so under the section 6 Public Interest lawful basis and the section 9 Archiving lawful basis. 

Personal information other than name will not be used in publicly available records.

Rights of Individuals

Every member, lapsed member or non-member has the following rights:

Right to be Informed

This notice informs you what generic information the WI holds, how the WI stores it and what the WI do with the information the WI holds.

Right of Access

You have the right to know what information the WI holds on you.  The WI will respond to requests for information within one calendar month (in line with current legislation).

Right to Rectification

You have the right to request that we correct any inaccurate information.  The WI will respond to all requests within one calendar month.

Right to Erasure

You have the right to request us to erase information held on you.  The WI will respond to this request within one calendar month and confirm what information the WI has erased.

Right to Object

You have the right to object if you feel any of your personal information has been used in a way that you feel is inappropriate.  The WI will respond to requests within one calendar month.

  

The WI will endeavour to respond as quickly as possible to all requests and work with you to resolve any queries.

Activities outside the Monthly Meeting

The WI runs outings and one-off activities which are in addition to the contractual monthly meeting.

Your contact details will be taken from the member register and passed to the organiser.

This information is required for the WI to fulfil the contract with the member for the activity or group.

If you do not wish your contact details to be passed to the organiser, you must advise one of the WI Officers or your WI Data Protection Representative at the time of booking.  In this situation, it will be your responsibility to make all contact with the organiser for information regarding the activity.  No responsibility is accepted by the WI for contact or information sharing about the activity.

Paperwork

The WI will use all both the following forms to gather and store information

·         NFWI Membership Form

·         Consent Form

Length of Storage and Destruction of Data

As the WI is a charity and has a strong public interest with archiving and documenting the activities of the WI, the WI will not destroy minutes, records of meetings and activities, scrapbooks or other records. 

However, the WI will destroy information held about members contact details or medical details.  The destruction schedule will be as follows:

Financial Information	Seven years in line with legal requirements
Membership Forms	Immediately after entering on MCS
Consent Forms	Three years following the end of membership
Emergency Contact and Medical Information	Upon membership lapse

Updating this privacy notice

This privacy notice will be updated periodically and be available for members and non-members to read.

If the privacy notice is updated in a way that significantly changes how we use your personal information, we will bring these changes to your attention.

Change Log

October 2018 – Initial Preparation by Caroline Harris