Summary:
Bramshill Scout district is committed to compliance with UK Data Protection Act 2018 and best practice in how it meets its duties. All personnel are required to adhere to the full policy.
Bramshill Scout district is the data controller and works with the Scout Association and others to process data. We are an educational children’s charity that runs a programme of activities for the development of young people and supports other Scout groups doing the same. Personal information of young people, adults, helpers and donors is processed.
The legal basis of this processing is for our legitimate interests, including administration of the Scout programme, governance, safety and safeguarding, employment reasons, fundraising and public relations. We process data for legal reasons including maintaining safety and safeguarding records in compliance with the Scout Association’s Policy Organisation and Rules, employment purposes, and maintaining accounting records as required by authorities. We process data by reason of data subjects’ consent including providing direct electronic communications, fundraising and statistical reporting about inclusion relating to ethnicity and disability.
Personal information is only used and shared internally and externally as required for the purposes of Scouting or as required by law.
Personal data is retained as required for the good administration of the Bramshill Scout district and as required by law. Members’ data may not be completely erased from the Scout Association database for reasons of legitimate interest, including safeguarding.
Data subjects may make a subject access request by contacting the Data Protection Officer, via [email protected]. Data Subjects have rights in accordance with the Data Protection Act 2018. The data protection officer is the District Chairperson.
The full Data Protection, Confidentiality and Privacy Policy is available on our website (see below).
The full policy:
Who is this for and what does it apply to?
The UK’s Data Protection regulations were last updated in May 2018 to be consistent with European legislation known as the General Data Protection Regulations (GDPR). Data Protection regulations apply to all organisations that hold any information that identifies living people.
In Scouts, Data Protection applies to the lists of young people, adults and any other people recorded in a structured way for future contact. It applies to the use of the Compass membership system, from recruitment onwards, and Online Scout Manager (OSM). It applies to information gathered from our website, to activity information forms and fundraising list information.
It does not apply to incidental naming of people in, for example, minutes of meetings or action lists.
Our commitment
Bramshill Scout district is committed to fully complying with Data Protection rules. This means that every person (leaders, administrators, honorary officers and trustees) involved in the district will observe this policy.
Formal contact
Bramshill Scout district is the data controller. The position of Data Controller is currently held by the District Chair, enquiries can be forwarded to [email protected] who will direct the enquiry to them.
Not registered with the ICO
As a charity, Bramshill Scout district handles personal data only for the purposes of maintenance of its membership and donors and is not required to register with the Information Commissioners Office (ICO) or to pay the Data Protection fee.
How we use data.
Bramshill Scout district and our people processes personal data using paper and electronic systems. It works with partner data processors including the Scout Association, Google, Microsoft, Online Scout Manager (OSM) and Dropbox for the district’s administration and that of our groups. We have determined that our partner organisation’s processing of data on our behalf is compliant with GDPR and Data Protection regulations as far as we can assess.
The legal basis of our data processing
Bramshill Scout district is an educational children’s charity. The young people it serves are members. Adults in leader, trustee and supporter roles are either members or non-members. Bramshill Scout district also processes data of helpers and benefactors.
To achieve our charitable purposes, we process data for our legitimate interests.This includes processing for the purposes of
- Administration of the Scout programme and activities
- Governance
- Safety and safeguarding
- Fundraising and Public /Community relations
This includes processing by holding paper and electronic records, processing with the facilities of our data processing partners and sending communications by paper and electronic means.
We process data for legal reasons. This includes for the purposes of
- maintaining safety and safeguarding records in compliance with the Scout Association’s Policy Organisation and Rules (POR) and other statutory requirements e.g RIDDOR.
- maintaining accounting records as required by HMRC and the Charity Commission.
We process data by reason of data subjects’ consent. This includes for the purposes of
- Statistical reporting about inclusion, including ethnicity and disability;
- Fundraising by direct mail or electronic communications.
What personal data do we collect?
Data will be processed about members’ and adult helpers’ Ethnicity, Health, Disability and Religious Belief to enable efficient monitoring of inclusion. Information about criminal records will be processed to inform recruitment decisions but will not be kept. (Disclosure of all criminal convictions and cautions and the provision of an enhanced certificate from the Disclosure and Barring Service is required for all adults in relevant roles, this being in compliance with the relevant legislation about filtering and rehabilitation of offenders.)
The personal data of members and adult helpers we process will include full name and contact details, date of birth and age, records of service and training. Records of service will include roles and activities undertaken and role reviews. Relevant records will be kept for the management of safety, safeguarding and personnel.
Website information will be kept for the effective management of the website and statistical purposes.
Financial information about bank accounts, payment of membership and activity fees, donations, the processing of gift aid and the maintenance of records will be kept as required by regulations.
Sharing of your personal data
Subject to Data Protection regulations Bramshill Scout district will share your data as relevant with the Scout Association, the local Scout County (Hampshire Scouts) and Scout groups to enable to provision of Scout programme and activities, training opportunities, administration and promotion.
Data would be shared to comply with legal requirements when necessary or others when we have your consent. Data would be shared with medical services to protect your vital interests. Data would be shared when relevant for the good administration of the charity and security of our processes.
Data will be processed by partner data processors including cloud-based services for the good administration of Bramshill Scout district and achievement of its charitable purposes. Personal data may be transferred outside the UK and European Economic Area (EEA) through the use of cloud computing systems.
Confidentiality
Bramshill Scout district is an organisation with approximately 100 volunteer leaders with various levels of access to groups of Young Person’s and Adult’s information. All persons with access to personal data are required to maintain that personal data in confidence and not to share it outside a “need to know” basis. All persons with access to personal data are required to undergo training in data protection and security.
Anyone accessing personal information is required to only use devices that are secure by being in their own homes or scouting premises else be protected by password and encrypted, and with system security and data back-up.
Safeguarding partnership
Bramshill Scout district is a member of the Scout Association and complies with its Policy, Organisation and Rules (POR). POR details our safeguarding processes, involving recruitment and safeguarding investigations. Personal information will be passed to the Scout Association for their processes in safer recruitment and safeguarding. Information will be passed to the Police when there is a relevant concern.
Your rights under Data Protection Regulations
Your rights
Your rights are as follows:
- To be informed about how we process your personal data: this Data Protection and Privacy Policy seeks to provide that information.
- To have any erroneous personal data corrected: Bramshill Scout district requests all members to notify any changes and will update information without delay.
- To object to processing: Bramshill Scout district will comply with your request as far as possible. Some records are maintained for the formal administration of the charity, for safety and for safeguarding purposes when retention of records will be required.
- To restrict processing: we will comply with your request as far as possible,
- To have your personal data erased: we will comply with your request as far as possible.
- To request access: we will comply with current regulations.
- To move, copy or transfer your personal data: we will comply with your request as far as possible acknowledging that adult member records are included in the Scout membership system, Compass. The transfer of young persons data in OSM may be possible.
Subject access
Any person who is the subject of personal data held by the group may make a subject access request by contacting the Data Protection Officer as listed above. The request will be processed in accordance with current regulation.
Adults may access their personal data by logging into the Scout membership system, Compass. Adults are encouraged to keep this up-to-date themselves.
If used by their local Scouting section, Parents and Young People can log into Online Scout Manager (OSM) to access and edit their data. Otherwise they can contact their leader who will be able to amend the data or grant access to Parent Portal of OSM.
Any questions or comments about data protection or this policy, not withstanding your rights above, should be addressed to the Data Protection Officer.
Adult member’s personal records
The personal membership profile of each adult member is kept on the Scout membership system, Compass. It is the responsibility of each member to ensure that they keep their own record up to date. If anyone has difficulty in accessing their membership record then they should ask their line manager for assistance. The Scout Information Centre (0345 300 1818; [email protected]) may also be able to help.
Internal and other directories
The compilation of any directory must have the approval of the board of trustees. Directories must only contain the information that is specifically consented to include. The request for consent must include information about access to or distribution of the directory.
Programme, activity and training registration
Adult volunteers will use appropriate and secure methods to gather information for registration. Only information that is necessary for the purpose will be requested.
Information may be gathered by paper or online forms. A data protection statement will be included in the form stating the whole use of the data and specifically identifying any sharing or not.
Activity registration data will often form part of relevant training and safeguarding information and so will be kept for the relevant time scale.
Retention of records
Records will be retained for the good administration of Bramshill Scout district. Records kept and timescales are below:
- For governance matters – indefinitely.
- Attendance records for safeguarding purposes – indefinitely.
- Adult membership, involvement and training records will be kept on Compass and not in other forms of record, therefore kept in compliance with the person’s membership and Scout Association policy.
- Notes and records from Safeguarding investigations will be sent to the Scout Association for retention and not kept locally.
- For accounting purposes – for 6 years after the end of the relevant year.
Consent for children
Consent for children (under 18’s) to participate in activities and to receive communications will require parental / guardian consent.
Consent to electronic mailings – unsubscribe
Mailings may be sent for notification of events, administration and governance. Anyone who wishes not to receive such mailings, providing it is not a duty, will be unsubscribed. All mailings will have an Unsubscribe facility.
Communication and Review of this Policy
This Policy will be reviewed periodically as any changes in regulations or best practice occur; this will be at least every 3 years.