Privacy Policy

Date Created: 23/05/2018

Status: Approved

Version: 1.0

Review Date: 12 Months

Owner: Claire Thorpe

Approved By: Centre Manager

 

1. INTRODUCTION 

The EU General Data Protection Regulation (GDPR) includes rules on giving privacy information to data subjects. These are more detailed and specific than in the Data Protection Act (DPA) and place an emphasis on making privacy notices understandable and accessible. Data controllers are expected to take ‘appropriate measures’.

The GDPR says that the information you provide to people about how you process their personal data must be:

• Concise, transparent, intelligible and easily accessible
• Written in clear and plain language, particularly if addressed to a child
• Free of charge.

These requirements are about ensuring that privacy information is clear and understandable for data subjects.

The Centre at Mawsley CIC shall comply with the GDPR requirements by ensuring our privacy statement includes: 

• Identity and contact details of The Centre at Mawsley CIC and the data protection officer
• Purpose of the processing and the lawful basis for the processing
• The legitimate interests of The Centre at Mawsley or third party, where applicable
• Categories of personal data/any recipient or categories of recipients of the personal data
• Details of transfers to third country and safeguards
• Retention period or criteria used to determine the retention period • The existence of each of data subject’s rights
• The right to withdraw consent at any time, where relevant
• The right to lodge a complaint with a supervisory authority
• The source the personal data originates from and whether it came from publicly accessible sources
• Whether the provision of personal data is part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data
• The existence of automated decision making, including profiling and information about how decisions are made, the significance and the consequences

 

1. RESPONSIBILITIES

 

The Data Protection Officer is responsible for ensuring that this notice is made available to data subjects prior to The Centre at Mawsley CIC collecting/processing their personal data. All Employees/Staff of The Centre at Mawsley CIC who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and their consent to the processing of their data is secured.

 

PRIVACY STATEMENT 

Identity and contact details 

If you would like to discuss anything in this privacy notice, please contact: The Data Protection   Officer at 

• Claire Thorpe, Data Protection Officer, The Centre at Mawsley CIC, 9 The Green, Mawsley, Kettering, NN14 1GY

Tel: 01536 799528       Email: [email protected]

Purpose of the processing

The Centre at Mawsley CIC take your privacy seriously and will only use your personal information to provide the products and services you have requested from us and to process any enquiries, registration with, or applications to, our service.

In order for ‘users’ to use some of our services and to respond to enquiries we need to collect and process various personal data. Users may be asked to complete a form(s) which request, name, address, e-mail and telephone number. The personal data we collect is used to process your request for our services.

All information provided will be treated as confidential and will only be used for the purpose intended.  Anyone can contact The Centre at Mawsley CIC to correct or update personal information in our records. 

What information do we collect?

We collect information that you provide to us when making bookings or when you make an enquiry to request information from us. If you contact us, we may keep a record of that correspondence.

 The sort of information we hold includes your name, address, telephone number, email   address or website.

 What do we use personal information for?

 We may use the information we hold about you in the following ways:

• to send newsletters and/or notifications to you if you have signed up to receive them;
• to provide you with information about our products, services, and upcoming events if you have consented to be contacted for such purposes;
• to notify you about any important information about, or changes to, our products and services
• to provide you with products and services requested by you

 

 

Corrections/Accuracy

We will endeavour to ensure that all personal data held in relation to all data subjects is

accurate. Data subjects must notify The Centre at Mawsley CIC of any changes to information held about them.

The lawful basis

The Centre at Mawsley CIC will process data for the specific and lawful purpose for which it is collected and not further process the data in a manner incompatible with this purpose. 

 We collect and use information for general purposes where:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• the data subject has given explicit consent to the processing of those personal data for one or more specified purposes

Categories of personal data

We will ensure that the reason for which we collected the data originally is the only reason for which we process this data, unless the individual is informed of any additional processing before it takes place. We will ensure that the data is adequate, relevant and not excessive in relation to the purpose for which it is processed.

Personal data

We may collect ‘personal data’ relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. This may include the data subjects name, identification number, location data or online identifier. 

Sensitive Personal Data

We may, from time to time, be required to process sensitive personal data. Sensitive personal data includes photographic images of customers, to be used on our website or on social media for the purpose of marketing.

Disclosure to third parties

We will not sell or license your personal information to any third party. However, we may disclose your personal information:

• to any member of The Centre at Mawsley CIC staff or Directors
• contractors engaged by us to provide services on our behalf;
• in order to provide you with any products or services you have purchased or requested;
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation to do so. 

 

 

Details of transfers to third country

We will not transfer your personal information to countries outside of the European Economic Area that do not have adequate data security law.

 

Retention period

The Centre at Mawsley CIC may retain data for differing periods of time for different purposes as required by statute or best practices.

Data subject’s rights

You have the right to request access to information about you that we hold. You also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress
• prevent processing for the purpose of direct marketing
• object to decisions being taken by automated means
• have inaccurate personal data rectified, blocked, erased or destroyed

 Any data subject wishing to access their personal data should put their request in writing to the Data Protection Officer at The Centre at Mawsley CIC who will endeavour to respond to any such written requests as soon as is reasonably practicable and, in any event, within 40 days. 

The right to withdraw consent

Withdrawal of consent shall be without effect to the lawfulness of processing based on consent before its withdrawal.

 

• We make it easy for individuals to withdraw their consent at any time
• We act on withdrawals of consent as soon as we can
• We don’t penalise individuals who wish to withdraw consent.

You may withdraw consent at any time by putting your request in writing to the Data Protection Officer at [email protected] who will endeavour to respond to any such written requests as soon as is reasonably practicable and, in any event, within 40 days.

The right to lodge a complaint

 Data subjects are able to complain to The Centre at Mawsley CIC about: 

• how their personal data has been processed
• how their request for access to data has been handled
• how their complaint has been handled
• appeal against any decision made following a complaint.

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance by emailing the Data Protection Officer [email protected].   Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/

The source of the personal data

All personal information provided to us is either stored on our secure servers located in the UK, or on the secure servers of sub-contractors that we have engaged to provide services on our behalf.

 

Statutory or contractual requirements

We will make you aware if we need to collect data for the purpose of statutory or contractual requirements. We will keep this data and use it to enable us to run our business and manage our relationship with you effectively, lawfully and appropriately.

Unsubscribing

You may unsubscribe from our direct marketing communications at any time by putting your request in writing to the Data Protection Officer at [email protected]. If you no longer wish to see us on Facebook, you would need to click on “unfollow” on our page.