- It is a mandatory requirement that the u3aTrust requires all u3as to comply with data protection legislation (currently the Data Protection Act 2018, incorporating the requirements of the General Data Protection Regulations (GDPR) ) .
- As part of this requirement, Winchcombe u3a has established a lawful basis for processing membership data based on either a principle of legitimate interest, or of contractual agreement.
- Legitimate Interest
As a membership charity, Winchcombe Area u3a will:
- Collect and process personal information supplied by members on joining the u3a
- Communicate with existing members to inform them of activities relating to their membership
- Retain information on files as part of any legitimate interest in administering the activities of the u3a
- Contractual agreement As part of paying an annual membership fee, a member of Winchcombe Area u3a consents to the lawful processing and retention of data provided by them in their application to join the u3a.
- This data, in either case, includes information relating to that person for membership purposes, such as: his or her full name; postal address; telephone number; email address; gift aid information; or any other information obtained from that member, provided that Winchcombe Area u3a can justify that such information is needed; that the member is provided with that reason; and the reason satisfies the requirements of GDPR.
Photographs
- Winchcombe u3a recognises that photographs constitute personal data, and that consent is needed for the taking and displaying of members’ photographs. Members retain their rights not to be photographed, either singly, or as part of a group, and can properly ask that their image is not displayed, or is removed from any display. Group leaders or individual members must ensure that before photographs are taken, all members have consented to being photographed and that they are aware, and consent to the photograph being displayed as part of any legitimate publicity activities of Winchcombe Area u3a, either within, or indeed outside of the existing membership.
- Members should be aware that publicity photographs, or other membership data might be furnished or shared to third parties, such as newsletter publishers, Beacon, or the distribution company for the national magazine “Third Age Matters” or similar u3a organisations, on the lawful basis of legitimate interest or contractual consent, unless an objection is made.
- Exceptionally, at the specific request of the u3a Trust, Winchcombe Area u3a might be asked to obtain additional special categories of personal data about members, but in such rare cases we will ensure that such information requested accords fully with the requirements of the GDPR, and can be fully justified on the principles of legitimate interest and/or contractual consent. Winchcombe Area u3a will strive to prevent additional personal data being passed to any third party in such a case, and we will never request such additional information without members being fully informed that such a request has been made, the reasons for it, and the decision of Winchcombe Area u3a in relation to the request, and the reasons for it.
- In relation to personal data, Winchcombe Area u3a will process data lawfully, fairly and transparently, by informing members on what basis they are being asked to supply the information, what that information will be used for, and by whom, and for how long it will be securely stored and held.
- Winchcombe Area u3a will only collect personal data for specified, clear, and legitimate purposes, which may include retention of data for public interest or research purposes, but only where those purposes have been notified to members in advance, or where prior consent has been obtained. Winchcombe Area u3a does not regard the provision of personal data for any marketing purposes as a legitimate interest, and will not provide material for such purposes, or for any similar inappropriate purpose. Should any member feel they have received an inappropriate communication using data they have supplied, they should promptly report the issue to the committee who will investigate it and provide a response.
- Winchcombe Area u3a will only collect data that is adequate, relevant and limited to material that is necessary for membership purposes, and will monitor whether the continued gathering of such material remains relevant to that aim.
- Winchcombe Area u3a will endeavour to ensure that data is accurate and updated, and that errors and irrelevant material is corrected or removed. In particular, we will retain data for no longer than is strictly necessary for the administration of that member’s continuing membership, save only for the interests of research or the public interest, such as group or activity photographs, when we may wish to retain data for such legitimate purposes, but then only where necessary, and with a member’s consent. Similarly, we may retain data for any additional period that may be needed to satisfy legal or statutory requirements relating to a member, when the member will be so informed.
- Winchcombe Area u3a will keep personal data secure, and ensure it is held only by those who have a specific need to hold it. The committee will limit access for its individual members, to restrict data provided by any u3a member, only to such data as is necessary for the fulfilment of a committee member’s specific role. Further, we will ensure that data will only be passed to a third party where it is necessary, and when a member is informed and consents. The u3a will seek to ensure that any third party complies with GDPR.
- Winchcombe Area u3a will ensure that its trustees and group leaders are aware of the obligations of this policy and that upon relinquishing their respective roles, they return all data in their possession, however held, to their successors, or an officer of the committee, and that access to data from members is suitably restricted.
- In dealing with our members, Winchcombe u3a will keep in mind always the rights of members to be kept informed; to be given access to their data held; and to correct or remove errors, as well as the right to limit or restrict how data is processed, and to make objections.
- Winchcombe Area u3a will follow GDPR rules so far as the reporting of certain breaches of data protection, and will investigate any potential breach as to its nature, its extent, and probable cause. The committee reserve the right to contact National Office for advice and guidance, and will keep any affected person(s) fully aware of any breach and the steps being undertaken to deal with it.
- The committee will keep this policy under annual review and will undertake a full examination of its details every 3 years, or as may be required by the 3rd Age Trust.
This Policy was adopted by the committee on the 8th August 2024
It will be formally reviewed next (on or before the 3rd anniversary of the policy being
adopted) in the month of August 2027
Signed on behalf of Winchcombe u3a by the Chairman