Data Privacy and Fair Processing Notice
Solihull Scout County
Our Privacy and Fair Processing Notice describes the categories of personal data we process and for what purposes. We are committed to collecting and using such data fairly and in accordance with the requirements of the General Data Protection Regulation (GDPR). This Notice should be read in conjunction with the Scout Association’s Data Protection Policy.
- Who are we?
We, Solihull Scout County, are a youth charity. Our mission is to actively engage and support young people in their personal development, empowering them to make a positive contribution to society. We are incorporated by royal charter and are regulated as a member of the The Scout Association, (see www.scouts.org.uk for more information.) As part of The Scout Association we are not required to be individually registered with the UK Charity Commission, but we have chosen to register and our registration number is 505527.
Every year in June we hold an annual general meeting where members of the charity executive committee (our trustees), are nominated, elected or co-opted in accordance with Scout Association rules. Every parent of a youth member and every adult member of the Scout Association has the right to attend the Annual General Meeting.
The Solihull Scout County Headquarters is based at 30 Hob’s Meadow, Solihull B92 8PG.
Our County Executive Committee is the data controller for the information we collect from you for the purposes of County-level events, activities and appointments. Any personal data that we collect will only be in relation to the work we do with our members and through our relationship with supporters, donors and funders. The Executive Committees of the two Districts, Cole and Blythe, and of the individual Scout Groups are separately the data controllers of the information collected for the purposes of the work they do with their members.
- Your personal data – what is it?
Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s, possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).
How we gather personal information
The majority of the personal information we hold, is provided to us directly by yourself or by parents / legal guardian in either paper form or via our online membership systems, in the case of an adult member, data may also be provided by third party reference agencies, such as the Disclosure and Barring Service (DBS).
Where a member is under the age of 18, this information will only be obtained from a parent / guardian. However, we are able to obtain data and consent from young people from the age of 13 for online services (This is particularly applicable to the Explorer section where we encourage young people to start to make decisions for themselves). LINK
Photography – When an event takes place it is very likely that photographs and videos will be taken. We will make every effort to inform you before hand of the photographers presence so if there is a issues it can be resolved before hand. If we do not inform you before an event of the photographers, we will seek permission before using photographs and videos on its websites and social media accounts, or in any printed or promotional material”.
- Why do we collect data.
The data we collect in support of our activities and operation will include data that is Personal Data and Sensitive Personal Data. The GDPR requires that there is a lawful basis to process personal data. We collect under the following bases:
Where we maintain mailing lists for sending information out about events and activities run by Solihull Scout County and the Districts and Scout Groups within it, we will require “opt in” consent to be added to the mailing list. All emails sent to the mailing list will include a link to unsubscribe from the mailing list.
We have a legitimate interest to process personal data and sensitive personal data in order to provide membership services and activities.
Where someone has agreed to become a member of Solihull Scout County we will collect personal data from them in order to maintain membership records and to undertake vetting checks as required in law and by the Scout Association as a condition of membership. The personal data items we collect can be found on the Adult Information Form. Additionally, where a role requires references, we will collect and store references from referees provided to us.
Where we provide an activity, there is a requirement to ensure that we know who is on an activity and some details about them. This will enable us to ensure that the correct amount of money is collected for an activity, to process any awards that may result from an activity, to be able to contact participants before, during and after an activity, and to be able to provide information to any third-parties as required in support of the activity or to respond to an emergency. Additionally, there may be a need to store sensitive personal data about an individual’s health in order to ensure that suitable support can be given to them on an event.
We comply with our obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
- How we store personal data
We are committed to the protection of your personal information.
We generally store personal information in one of five secure digital online database systems, where access to that data is restricted and controlled.
Compass: – is the online membership system of The Scout Association, this system is used for the collection and storage of Adult personal data.
Online Scout Manager is an online membership system run by Online Youth Manager Ltd, this is a secure membership database where we store the personal information of Adults and Youth members for the day to day running of Solihull Scout County.
Google Forms are used within Solihull Scout County’s Google drive system and are purely used for new joining requests for young people and small County events, such as attendance at award evenings.
Event data – Scouts EMS is an online event management company which we use for larger events. They have their own data policy that can be found here (https://scouts-ems.org.uk/docstore/ScoutsEMSPrivacyPolicyPDF.pdf)
Flickr is a online photo sharing website, where we privately store photos taken at events, where parents can download them via a link. The folders are kept private (apart from events where full public permission has been gained) so the images cannot be publicly found.
Where data is required to be held in off-line system (e.g. a paper system on an event) we will ensure that there is suitable protection for the paper records (e.g. locked filing cabinet) and that paper records will be securely destroyed after an event (unless there is a requirement to maintain a paper record for a legal reason such as an injury on the event, in which case the paper record will be stored securely).
Sometimes we may nominate a member for national award, (such as Queen’s Scout or Duke of Edinburgh awards); such nominations require we provide contact details to the awarding organisation, this is most often done through secure emails or secure online databases.
- Sharing and transferring personal Information
We will only normally share personal information within our executive members.
We will however share your personal information with others outside of Solihull Scout County where we need meet or enforce a legal obligation, this may include The Scout Association and its insurance subsidiary “Unity”, local authority services and law enforcement. Where we need to share information, we will only share your personal information to the extent needed for those purposes.
If you move from one Scout County to another, we will transfer your personal information to them.
We will never sell your personal information to any third party for the purposes of marketing.
Your personal data will be treated as strictly confidential. We will only share your data with third parties outside of the organisation where there is a legitimate reason to do so. We will take steps to anonymise the data we provide (i.e. collective reporting on gender, ethnicity, age, etc.). If identifiable data is to be shared we will seek your consent.
Third Party Data Processors
Solihull Scout County, employs the services of the following third-party data processors: –
- The Scout Association via its adult membership system “Compass” which is used to record the personal information of leaders, adults and parents who have undergone a Disclosure and Barring Service (DBS) check.
- Online Youth Manager Ltd (Online Scout Manager) which is used to record the personal information, badge records, event and attendance records etc, we have a data processing agreement in place with online youth manager, more information is available at https://www.onlinescoutmanager.co.uk/security.php
- Google Drive occasionally used for secure transfer of limited personal information for events.
- eDofE is a secure database run by the Duke of Edinburgh’s Award, for those taking part in the award scheme, their privacy statement can be found here: https://www.dofe.org/privacy-statement/
Automated decision making
Solihull Scout County does not have any automated decision-making systems.
Transfers outside the UK
Solihull Scout County will not transfer your personal information outside of the UK, with the exception where an Event is taking place outside of the UK and it is necessary to provide personal information to comply with our legal obligations, although generally such an event will have its own data collection form which will be securely held and disposed of after the event.
- How long do we keep your personal data?
We will retain your personal information, throughout the time you/your child(ren) are a member of Solihull Scout County.
We will retain your full personal information for a period of one year after you have left Solihull Scout County and in a much more limited form (just name, badge and attendance records) for a period of upto 15 years (or until the age 21) to fulfil our legal obligations for insurance and legal claims. Where awards have been gained we will keep a record of name and the award in perpetuity unless requested to delete this data.
We will also keep any Gift Aid Claim information for the statutory 7 years as required by HMRC (which may be beyond age 21)
- Your rights and your personal data
You have the right to object to how we process your personal information. You also have the right to access, correct, sometimes delete and restrict the personal information we use. In addition, you have a right to complain to us and to the data protection regulator.
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: –
- The right to be informed – you have a right to know how your data will be used by our Scout County
- The right to access your personal data – you can ask us to share with you the data we have about you
- The right to rectification – this just means you can update your data if it is inaccurate or if something is missing. Adult members can view and edit their own personal information directly on our online membership system Compass
- The right to erasure – this means that you have the right to request that we delete any personal data they have about you. There are some exceptions, for example, some information can be held for legal reasons
- The right to restrict processing – if you think there is something wrong with the data being held about you, or you are not sure if we are complying to rules, you can restrict any further use of your data until the problem is resolved
- The right to data portability – this means that if you ask us we will have to share your data with you in a way that can be read digitally – such as a pdf. This makes it easier to share information with others
- The right to object – you can object to the ways your data is being used. This should make it easier to avoid unwanted marketing communications and spam from third parties
- Rights in relation to automated decision making and profiling – this protects you in cases where decision are being made about you based entirely on automated processes rather than a human input.
Whether or not you exercise your new rights is up to you – the main thing to remember is that they’re there if you need them.
- Further processing
If we wish to use your personal data for a new purpose, not covered by this Data Privacy and Fair Processing Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
- Contact Details
To exercise all relevant rights, queries of complaints please in the first instance contact our Data Protection Lead Andrew Baynes at firstname.lastname@example.org
New at: May 2018