Scope

This policy applies to all directors, staff, contractors and sub-contractors, and Branch volunteers who may collect, process, or have access to personal data held by the Royal Over-Seas League (ROSL).

Policy Statement

The Royal Over-Seas League is committed to a policy of protecting the rights and privacy of individuals, members, volunteers, staff and others in accordance with The Data Protection Act 1998, the General Data Protection Regulations (GDPR), and the Privacy and Electronic Communications Regulation (PECR).

The policy applies to all staff, volunteers, and contractors. Any breach of The Data Protection Act 1998, GDPR, or this Data Protection Policy is considered to be an offence and in that event, disciplinary procedures apply.

As a matter of good practice, other organisations and individuals working with ROSL, and who have access to personal information, will be expected to have read and comply with this policy. It is expected that any staff who deal with external organisations will take responsibility for ensuring that such organisations sign a contract that meets the standards established in this policy

Legal Requirements

Data are protected by the Data Protection Act 1998, and the EU General Protection Regulations. Its purpose is to protect the rights and privacy of individuals and to ensure that personal data are not processed without their knowledge, and, wherever possible, is processed without their consent.

The Act requires us to register the fact that we hold personal data and to acknowledge the right of ‘subject access’ – members, staff, contractors, and others must have the right to copies of their own data.

Managing Data Protection

We will ensure that our details are registered with the Information Commissioner.

Purpose of data held by ROSL

Data may be held by us for the following purposes:

  1. Staff and volunteer administration
  2. Fundraising
  3. Realising the Objectives of a Private Member’s organisation
  4. Accounts & Records
  5. Advertising, Marketing & Public Relations
  6. Information and Database Administration
  7. Journalism and Media relations
  8. Processing in for Not For Profit Organisation

Data Protection Principles

Under the Data Protection Act 1998 and GDPR, we are the ‘data controller’, and as such determine the purpose for which, and the manner in which, any personal data are, or are to be, processed. We must ensure that we have:

  1. Fairly and lawfully processed personal data

We will always put our contact information on all paperwork, stating our intentions on processing the data and state if, and to whom, we intend to give the personal data. We shall also provide an indication of the duration the data will be kept.

  1. Processed for limited purpose

We will not use data for a purpose other than those agreed by data subjects (members, staff, contractors, visitors to the Royal Over-Seas League, and others). If the data held by us are requested by external organisations for any reason, this will only be passed if data subjects (members, staff and others) agree.   External organisations must provide details about the purpose of processing, agree not to copy the data for further use and sign a Data-sharing Agreement or equivalent contract agreeing to abide by The Data Protection Act 1998, GDPR and Club Data Protection Policy.

  1. Adequate, relevant and not excessive

ROSL will monitor the data held for our purposes, ensuring we hold neither too much nor too little data in respect of the individuals about whom the data are held. If data given or obtained are excessive for such purpose, they will be immediately deleted or destroyed.

  1. Accurate and up-to-date

We will provide our members with easily accessible mechanisms for review and updating of their personal data. All amendments will be made immediately and data no longer required will be deleted or destroyed. It is the responsibility of individuals and organisations to ensure the data held by us are accurate and up-to-date. Completion of an appropriate form or on-line system (provided by us) will be taken as an indication that the data contained are accurate. Individuals should notify us of any changes, to enable personnel records to be updated accordingly. It is the responsibility of ROSL to act upon notification of changes to data, amending them where relevant.

  1. Not kept longer than necessary

We discourage the retention of data for longer than it is required, and will operate record-management procedures to ensure that records are promptly and securely destroyed once they are no longer required.

  1. Processed in accordance with the individual’s rights

All individuals that ROSL holds data on have the right to:

  • Be informed upon the request of all the information held about them within 30 calendar days.
  • Prevent the processing of their data for the purpose of direct marketing.
  • Compensation if they can show that they have been caused damage by any contravention of the Act.
  • The removal and correction of any inaccurate data about them.
  1.  Secure

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of data.

All ROSL computers shall be protected with secure credentials and passwords which allow only authorised staff to access personal data. Passwords on all computers will be changed regularly.  Disclosure of passwords to others will be a disciplinary offence. All personal and financial data will be kept in secure storage and shall be accessible only by authorised individuals.

  1.  Not transferred to countries outside the European Economic Area, unless the country has adequate protection for the individual.

Data must not be transferred to countries outside the European Economic Area without the explicit consent of the individual or where the data protection regimes in place at the recipient have been confirmed as adequate.  The Club takes particular care to be aware of this when publishing information on the Internet, which can be accessed from anywhere in the globe. This is because transfer includes placing data on a web site that can be accessed from outside the European Economic Area.