Our Privacy and Fair Processing Notice describes the categories of personal data we process and for what purposes. We are committed to collecting and using such data fairly and in accordance with the requirements of the General Data Protection Regulation (GDPR).  This Notice should be read in conjunction with the Scout Association’s Data Protection Policy.

Who are we?

We, Solihull Scout County, are a youth charity. Our mission is to actively engage and support young people in their personal development, empowering them to make a positive contribution to society. We are incorporated by royal charter and are regulated as a member of the The Scout Association, (see www.scouts.org.uk for more information.) As part of The Scout Association we are not required to be individually registered with the UK Charity Commission, but we have chosen to register and our registration number is 505527.

Every year we hold an annual general meeting where members of the charity executive committee (our trustees), are nominated, elected or co-opted in accordance with Scout Association rules. Every parent of a youth member and every adult member of the Scout Association has the right to attend the Annual General Meeting.

The Solihull Scout County Headquarters is based at 30 Hob’s Meadow, Solihull B92 8PG.

Our County Executive Committee is the data controller for the information we collect from you for the purposes of County-level events, activities and appointments. Any personal data that we collect will only be in relation to the work we do with our members and through our relationship with supporters, donors and funders. The Executive Committees of the two Districts, Cole and Blythe, and of the individual Scout Groups are separately the data controllers of the information collected for the purposes of the work they do with their members.

Your personal data – what is it?

Personal data relates to a living individual who can be identified from that data.  Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).

How we gather personal information

The majority of the personal information we hold, is provided to us directly by yourself or by parents / legal guardian in either paper form or via our online membership systems, in the case of an adult member, data may also be provided by third party reference agencies, such as the Disclosure and Barring Service (DBS).

Where a member is under the age of 18, this information will only be obtained from a parent / guardian. However, we are able to obtain data and consent from young people from the age of 13 for online services (This is particularly applicable to the Explorer section where we encourage young people to start to make decisions for themselves). Link

Photography

When an event takes place it is very likely that photographs and videos will be taken. We will make every effort to inform you beforehand of the photographer’s presence so if there is an issue it can be resolved beforehand.  Consent will be sought before using photographs or videos along with personal data on any publically accessible medium.

Why we collect data

The data we collect in support of our activities and operation will include data that is Personal Data and Sensitive Personal Data.  The GDPR requires that there is a lawful basis to process personal data. We collect under the following bases:

Consent

Where we maintain mailing lists for sending information out about events and activities run by Solihull Scout County and the Districts and Scout Groups within it, we will require “opt in” consent to be added to the mailing list.  All emails sent to the mailing list will include a link to unsubscribe from the mailing list.

Legitimate Interest

We have a legitimate interest to process personal data and sensitive personal data in order to provide membership services and activities.

Membership Services

Where someone has agreed to become a member of Solihull Scout County we will collect personal data from them in order to maintain membership records and to undertake vetting checks as required in law and by the Scout Association as a condition of membership.  The personal data items we collect can be found on the Adult Information Form.  Additionally, where a role requires references, we will collect and store references from referees provided to us.

Activities

Where we provide an activity, there is a requirement to ensure that we know who is on an activity and some details about them.  This will enable us to ensure that the correct amount of money is collected for an activity, to process any awards that may result from an activity, to be able to contact participants before, during and after an activity, and to be able to provide information to any third-parties as required in support of the activity or to respond to an emergency.  Additionally, there may be a need to store sensitive personal data about an individual’s health in order to ensure that suitable support can be given to them on an event.

We comply with our obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

How we store personal data

We are committed to the protection of your personal information.

We use the following data processors:

Compass: – is the online membership system of The Scout Association, this system is used for the collection and storage of Adult personal data.

Online Scout Manager is an online membership system run by Online Youth Manager Ltd, this is a secure membership database where we store the personal information of Adults and Youth members for the day to day running of Solihull Scout County.  Their data policy can be found at https://www.scouts.org.uk/about-us/policy/data-protection-policy

Duke of Edinburgh Award Scheme is an award scheme for young people aged between 14 and 25.  Their privacy policy can be found at https://www.dofe.org/privacy-statement

Google Forms are used within Solihull Scout County’s Google drive system and are purely used for new joining requests for young people and small County events, such as attendance at award evenings.  Their data policy can be found at https://policies.google.com/privacy

Event data – Scouts EMS is an online event management company which we use for larger events.  Their privacy policy can be found at https://scouts-ems.org.uk/docstore/ScoutsEMSPrivacyPolicyPDF.pdf

Flickr is a online photo sharing website, where we privately store photos taken at events, where parents can download them via a link. The folders are kept private (apart from events where full public permission has been gained) so the images cannot be publicly found.  Their data policy can be found at https://www.flickr.com/help/privacy

JotForm is used to operate forms on the County website used to operate the online Nights Away Notification submission system and to capture information about attendance at Awards ceremonies.  Their data policy can be found at https://www.jotform.com/privacy

OneSignal is used to push notifications from the County website.  Their privacy policy can be found at  https://onesignal.com/privacy_policy

Freshdesk is used to manage workflows generated by enquiries via email.  Their privacy policy can be found at https://www.freshworks.com/privacy

Zapier is used to automate workflows within the County website.  Their privacy policy can be found at https://zapier.com/privacy

Stripe is used to process payments.  Their privacy policy can be found at https://stripe.com/en-gb/privacy

Where data is required to be held in off-line system (e.g. a paper system on an event) we will ensure that there is suitable protection for the paper records (e.g. locked filing cabinet) and that paper records will be securely destroyed after an event (unless there is a requirement to maintain a paper record for a legal reason such as an injury on the event, in which case the paper record will be stored securely).

Awards

Sometimes we may nominate a member for a national award, (such as Queen’s Scout or Duke of Edinburgh awards); such nominations require we provide contact details to the awarding organisation, this is most often done through secure emails or secure online databases.

Sharing and transferring personal Information

We will only normally share personal information within our executive members.

We will however share your personal information with others outside of Solihull Scout County where we need to meet or enforce a legal obligation, this may include The Scout Association and its insurance subsidiary “Unity”, local authority services, and law enforcement. Where we need to share information, we will only share your personal information to the extent needed for those purposes.

If you move from one Scout County to another, we will transfer your personal information to them upon your request.

We will never sell your personal information to any third party for the purposes of marketing.

Your personal data will be treated as strictly confidential.  We will only share your data with third parties outside of the organisation where there is a legitimate reason to do so. We will take steps to anonymise the data we provide (i.e. collective reporting on gender, ethnicity, age, etc.).  If identifiable data is to be shared we will seek your consent.

Automated decision making

Solihull Scout County does not have any automated decision-making systems.

Transfers outside the UK

Solihull Scout County will not transfer your personal information outside of the UK, with the exception where an Event is taking place outside of the UK and it is necessary to provide personal information to comply with our legal obligations, although generally such an event will have its own data collection form which will be securely held and disposed of after the event.  Solihull Scout data controllers may use information stores located outside of the UK inline with their privacy policies and the GDPR.

How long do we keep your personal data?

We will retain your personal information, throughout the time you/your child(ren) are a member of Solihull Scout County.

We will retain your full personal information for a period of one year after you have left Solihull Scout County and in a much more limited form (just name, badge and attendance records) for a period of upto 15 years (or until the age 21) to fulfil our legal obligations for insurance and legal claims.  Where awards have been gained we will keep a record of name and the award in perpetuity unless requested to delete this data.

We will also keep any Gift Aid Claim information for the statutory 7 years as required by HMRC (which may be beyond age 21)

Your rights and your personal data  

You have the right to object to how we process your personal information. You also have the right to access, correct, sometimes delete and restrict the personal information we use. In addition, you have a right to complain to us and to the data protection regulator.

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: –

• The right to be informed – you have a right to know how your data will be used by our Scout County
• The right to access your personal data – you can ask us to share with you the data we have about you
• The right to rectification – this just means you can update your data if it is inaccurate or if something is missing. Adult members can view and edit their own personal information directly on our online membership system Compass
• The right to erasure – this means that you have the right to request that we delete any personal data they have about you. There are some exceptions, for example, some information can be held for legal reasons
• The right to restrict processing – if you think there is something wrong with the data being held about you, or you are not sure if we are complying to rules, you can restrict any further use of your data until the problem is resolved
• The right to data portability – this means that if you ask us we will have to share your data with you in a way that can be read digitally – such as a pdf. This makes it easier to share information with others
• The right to object – you can object to the ways your data is being used. This should make it easier to avoid unwanted marketing communications and spam from third parties
• Rights in relation to automated decision making and profiling – this protects you in cases where decisions are being made about you based entirely on automated processes rather than a human input.

Whether or not you exercise your new rights is up to you – the main thing to remember is that they’re there if you need them.

Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Privacy and Fair Processing Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

Contact Details

To exercise all relevant rights, queries, or complaints please in the first instance contact our Data Protection Lead Andrew Baynes at andrew.baynes@solihullscouts.org.uk

New at:  May 2018

Updated at: May 2021