1. Your personal data
Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the Trust’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).
2. Data Controller/Data Protection Officer
The SDRT is registered with the Information Commissioners Office (ICO), Registration number Z2309593, Registered 11/8/2010.
The Somerset & Dorset Railway Trust Ltd (SDRT) is a Data Controller.
The appointed Data Protection Officer is recorded on the Public Register and is:
Nigel Davies, who can be contacted by post at: Data Protection Officer, SDRT, Washford Station, Washford, Somerset TA23 0PP or by email via info[@]sdrt.org. (Please remove the square brackets before sending; these deter automated emails.)
3. Use of Personal Data
The SDRT complies with its obligations under the “GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
The SDRT uses personal data for the following purposes: –
- To administer membership records.
- To send members their individual copies of “Pines Express”.
- To send members sales items they request.
- To manage volunteers.
- To maintain its accounts and records (including the processing of gift aid applications).
- To inform the membership of news, events, activities and services of the SDRT, (e.g. AGM, Annual Model Railway Exhibition, Annual Special Train).
- To ask members their opinions regarding aspects of the Trust including via surveys.
4. Legal basis for processing of personal data
- Consent of the subject so that the SDRT can keep members informed about news, events, activities and services.
- Processing is necessary for carrying out legal obligations in relation to Gift Aid. Processing is carried out by a not-for-profit body and:-
- the processing relates only to members or former members (or those who have regular contact with it in connection with those purposes.
- there is no disclosure to a third party without consent.
5. Sharing of personal data
Personal data will be treated as strictly confidential and will only be shared
with other individuals of the SDRT administration in order to carry the services
connected with the Trust.
6. Keeping of personal data
Data will only be kept for as long as absolutely necessary to enable the SDRT
to carry out the items listed in 3.
7. Rights regarding personal data
Unless subject to an exemption under the GDPR, an individual has the
following rights with respect to your personal data: –
- The right to request a copy of their personal data which the SDRT holds about that individual.
- The right to request that the SDRT corrects any personal data if it is found to be inaccurate or out of date.
- The right to request their personal data is erased where it is no longer necessary for the SDRT to retain such data.
- The right to withdraw consent to the processing at any time, noting that the SDRT will not be able to communicate with such individuals or send copies of “Pines Express”.
- The right to request that the Data Controller provide the data subjectwith his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable). [Only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means].
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.
- The right to object to the processing of personal data, (whereapplicable). [Only applies where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics].
- The right to lodge a complaint with the Information Commissioners Office.
8. Further processing
If the SDRT wishes to use personal data for a new purpose, not covered by
this Data Protection Policy, then the SDRT will provide you with a new notice
explaining this new use prior to commencing the processing and setting out
the relevant purposes and processing conditions. Where and whenever
necessary the SDRT will seek an individual’s prior consent to the new
processing.
9. Contact Details
To exercise all relevant rights, queries or complaints an individual should
contact the Data Protection Officer as set out in item 2 above or as on the ICO
Public Register.