Our Policies

Charnwood District Scout Council GDPR Policy

Introduction

This documents sets out the policies and procedures defined by Charnwood District Scout Council as deemed appropriate for compliance with the EU GDPR regulations which come into force on 25th May 2018.  It defines specific rules and processes which must be followed to ensure the safe and secure capture, retention and disposal of data associated with the running of the Scout district.

For a more detailed description of the details of GDPR, please see the website of the Information Commissioner’s Office at:

http://www.ico.org.uk

For details of The Scout Association Policy, see the website at :

https://members.scouts.org.uk/supportresources/search/?cat=55,888

The details contained within this document are meant to explain how we locally implement the requirements detailed in the GDPR regulations, and are an extension of The Scout Association policy.

GDPR guidance continues to be reviewed to provide additional clarity, and this document will be periodically reviewed to ensure it remains in line with the rules.

Version History

Use and Sharing of Data

Data is captured as part of the joining process for youth members and adults, and in association with specific activities where additional information may be required.  All data is collected purely for the safe operating of the organisation and its activities, and is shared only with partners requiring such data in order to safely and legally provide a part of these.  Data is captured and retained in controlled storage using password protection wherever possible, using Compass for Adult membership information, Online Scout Manager (OSM) for youth information, and eDoE for active Duke of Edinburgh participants.

Adult members and the parents/guardians of youth members (Explorers) are provided with access to the relevant systems to view and update data as may be required, including deletion of data which they do not wish to be stored.  Other youth data is only held temporarily by The District, generally in association with a new member request or a specific activity or event such as a District camp.

The Data We Collect

Data is collected in a variety of ways, on paper forms, through web entry forms, via telephone etc. and for a variety of purposes, such as membership enquiries, event bookings etc.  This section details the data we collect and the justification for each data item.

Joining Data

Personal data is collected via a website form as part of the membership application process.  This data includes demographic data such as is required by The Scout Association for membership application, and which groups require to process the membership application, and to report on our diversity statistics as is required.  Additional data is requested around learning and health challenges, and attended school.  This data is transcribed onto OSM by the Group Scout Leader and either a hard or digital copy sent to the District Secretary.  This data will be kept until the placement is accepted by a group, and then the District Secretary will delete the original request.

Adult Appointments

Adult appointments require a paper form to be completed, providing various items of data required as part of the DBS checking process, as well as contact details for referees.  This form also includes the signature of the adult agreeing to their data being held on Compass, as well as a local form requesting permission to include the recipient on our District Newsletter system, and for contact details to be retained in controlled storage using password protection wherever possible.  These paper forms are held securely by the District Appointment Secretary, and added to by printed copies of references received.

These forms are provided to the Appointments Committee immediately prior to the sitting of the committee, to allow all members to read the information in advance of the interview.  Following a successful interview, all relevant data (with the exception of references) is transcribed to the relevant IT system, and the paper copies and any electronic/email version will be securely destroyed in line with the detailed retention policy below providing there are no potentially adverse indications within the documents.  Should this be the case, it will be kept securely by the District Comissioner, who will present it to the Appointments Panel for their decision. The form is then signed by the District Commissioner, Appointment Secretary and the Panel Chair showing their decision. If it is not considered a problem the Appointments Secretary sends either a hard or digital copy to Gilwell and then all documents are destroyed by shredding.

Permit Approvals

Similar to the appointment process, applications for an adventurous activity permit may involve submission of paper or electronic forms containing personal data, and will likely lead to a paper copy of a form being used as part of the assessment process, particularly for Nights Away permits, where visits to campsites with no internet connectivity are common.  In these cases, all paper records and electronic records will be stored in the manner detailed below in the relevant record handling policy section.  Following the relevant assessments, the permits are added to Compass, including a brief note of any stipulations or conditions arising from the evaluation, with assessment notes (paper or electronic) destroyed as per the retention policy below.

Citations

When good service and similar awards are given, it is common for the nominator to write a citation regarding the nominee.  When publishing these citations in awards programmes or local press, care must be given to minimise the personal data included.  Nominees will be given the opportunity to review and edit citations prior to going to press.  Once citations are published to a wider audience, they are beyond the direct control of The District and may be kept as part of the documented history of The District.

Incidents and Accidents (those requiring first aid or emergency treatment and all safeguarding issues)

Incident and accident reporting follows the guidelines of The Scout Association, and data may need to be kept beyond the normal retention period as part of ongoing investigations / insurance claims etc.  In these cases, all data must be stored as per the policies detailed below.  Once all documentation of any incident is appropriately logged and handed over to HQ, and all interactions with the local team have been completed, this data should be destroyed as per the standard retention policy below.

Documentation collected as part of an incident is likely to be written notes, and as such must be stored securely as long as retained.  If such documents must be sent on to HQ, a local copy must be kept until confirmation of receipt of the original has been received.  Any paper documents containing personal information which are sent to HQ must be sent via Recorded Delivery.  Electronic version must be sent securely as per the guidance below.

Blank accident reporting forms will be provided to the event leader for any District event.  Completed forms will be returned to the District Commissioner immediately following the event and stored as per the relevant record handling policy.

Record Handling Policy

Telephone communication

Occasionally data will be provided during a telephone call, for instance to confirm an event booking.  If any information is written down, this must be recorded on the official form or system as required, and any notes shredded at the earliest opportunity. 

Paper Records

Paper records, or printouts of electronic records are occasionally required.  Any such records must be kept safely and securely, in an opaque folder or case.  As soon as any paper records have been transcribed to the relevant system, or an event is over, the paper copies should be securely destroyed.  Examples of this include Health Forms, membership applications etc.  The security of the storage must be balanced against the requirements for access.  For instance, during an activity, it is vital that those with first aid responsibility have unimpeded access to the health forms.

Email

Emails are commonly used by us all for arranging events, and provide a useful, quick and easy method of communication.  Email addresses however are also personal data, and as such, will have been provided to you as a leader or event co-ordinator for communication with the individual concerned in relation to Scouting activities (for example, arranging meetings, training, planning activities, sharing best practice etc.).  As such, when sending an email to multiple recipients, it is important to ensure that each recipient is addressed in the BCC (Blind Carbon Copy) field, rather than in the To or CC field.  This prevents the recipients seeing the email addresses of each other.  Where there may be a genuine benefit to sharing addresses, such as to enable lift sharing etc. to events, permission should be sought from those concerned to share their email addresses for this purpose.

It is good practice to use a separate email for your Scouting role.

It is also often useful to send other personal information using email, for instance sharing an attendee list for camp with the catering team.  For this sort of communication, the personal data should not be in the main body of the text.  It should be provided as an attachment, which has been securely encrypted (eg Zip with a password).  It is best practice to provide the password to the recipient by means other than email (eg SMS / Phone call).

If you receive insecure communication (for example from a parent booking a place on an event), the information should be transferred to the central, secure, store, and the original email deleted.

Many email clients also keep copies of Sent Emails, and include a ‘Deleted’ folder.  These folders should also be checked to ensure emails are completely deleted.

Electronic Files

When storing data electronically on a local computer, precautions should be in place to prevent unauthorised access to the file.  A password should be required to access the computer, and if the computer is used by multiple people, any personal data as defined above should be stored in a password protected file or encrypted drive.  If data must be carried around, the device carrying the data (eg a Flash Drive) should be encrypted and password protected, or if not possible, the files on the drive must be password protected. 

Photos and Videos are also considered as personal data

Photographs and videos are also considered as personal data.  Care must be taken to ensure any photographs taken do not include people who have not given their permission to be photographed.  Whilst it is perfectly acceptable to keep a selection of photographs of an event, particularly if there are no individuals explicitly identified, we should not keep the entire selection of photos taken.  It is the responsibility of any event organiser to ensure that all adults taking photographs at a private Scouting event are aware of the rules.  Public events, such as St. Georges’ Day parade, cannot be policed as to prevent photos being taken.

Social Media

Social media is a common part of modern day Scouting.  Most platform include the ability to host both public and private (or secret) groups.  Public groups must be treated as any other published medium.  Personal details must be kept to the absolute minimum, with photographs only used where appropriate permissions are in place.  Particular care must be taken when publicising upcoming events.

Private / Secret groups may be used for particular clubs and events etc. to allow communication to attendees and their parents/guardians etc.

Adult volunteers should consider using a separate social media account for Scouting activities.

Backups

It is common that both computers and mobile phones will have automated backups enabled to external drives or cloud services such as Google Photos.  It is important to remember that this data is also covered by GDPR.  Any data which is deleted from main systems must also be deleted from all backups as well.

Financial Records

Financial records are required to be kept for 7 years in accordance with HMRC regulations.  This includes records of expenses paid and items such as Gift Aid declarations.  These shall be kept by the District Treasurer in accordance with the policies detailed above for paper and electronic records.

Data Retention

The guiding principle of the GDPR is that data should be retained only for as long as it is absolutely required.   As a district, we perform an annual data audit of the data we hold and delete anything which is deemed to be unnecessary.

There are a number of explicit legal guidelines however which must still be adhered to as part of this process.  Such data will be removed at the first annual review following the legal term :

1. Financial Records – HMRC require these to be kept for 7 years
2. Accident Records – HSE require these to be kept for 3 years
3. Adverse DBS Information – Such information may result in stipulations on the involvement of an individual. This information is communicated to the individual concerned and their direct line manager.  A copy is retained by the District Commissioner until the next DBS renewal.

Enquiries

All enquiries and complaints regarding data are handled by the District Secretary.

Such contacts can be made via :

Email to : Secretary@charnwoodscouts.org,uk

Phone : 0116 2303353 or 07941711760

Letter : The Secretary, Charnwood District Scout Council, c/o 69 Castle Road, Mountsorrel, Loughborough, Leicestershire, LE12 7ET

BACKGROUND:

Charnwood Scouts understands that your privacy is important to you and that you care about how your personal data is used and shared online. We respect and value the privacy of everyone who visits our website, www.charnwoodscouts.org.uk (“Our Sites”) and will only collect and use personal data in ways that are described here, and in a manner that is consistent with Our obligations and your rights under the law.

Please read this Privacy Policy carefully and ensure that you understand it. Your acceptance of Our Privacy Policy is deemed to occur upon your first use of either of Our Sites. You will be required to read and formally accept this Privacy Policy when signing up for an Account. If you do not accept and agree with this Privacy Policy, you must stop using Our Sites immediately.

1. Definitions and Interpretation

In this Policy, the following terms shall have the following meanings:

2. Information About Us

1.1 Our Sites are owned and operated by Charnwood Scouts.

3. What Does This Policy Cover?

This Privacy Policy applies only to your use of Our Sites. Our Sites may contain links to other websites. Please note that We have no control over how your data is collected, stored, or used by other websites and We advise you to check the privacy policies of any such websites before providing any data to them.

4. Your Rights

1.1 As a data subject, you have the following rights under the GDPR, which this Policy and Our use of personal data have been designed to uphold:

1.a.1 The right to be informed about Our collection and use of personal data;

1.a.2 The right of access to the personal data We hold about you (see section 12);

1.a.3 The right to rectification if any personal data We hold about you is inaccurate or incomplete (please contact Us using the details in section 14);

1.a.4 The right to be forgotten – i.e. the right to ask Us to delete any personal data We hold about you (We only hold your personal data for a limited time, as explained in section 6 but if you would like Us to delete it sooner, please contact Us using the details in section 14);

1.a.5 The right to restrict (i.e. prevent) the processing of your personal data;

1.a.6 The right to data portability (obtaining a copy of your personal data to re-use with another service or organisation);

1.a.7 The right to object to Us using your personal data for particular purposes; and

1.a.8 Rights with respect to automated decision making and profiling.

1.2 If you have any cause for complaint about Our use of your personal data, please contact Us using the details provided in section 14 and We will do Our best to solve the problem for you. If We are unable to help, you also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.

1.3 For further information about your rights, please contact the Information Commissioner’s Office or your local Citizens Advice Bureau.

5. What Data Do We Collect?

Depending upon your use of Our Sites, We may collect some or all of the following personal and non-personal data (please also see section 13 on Our use of Cookies and similar technologies and Our Cookie Policy):

1.1 name;

1.2 business/company name

1.3 job title;

1.4 profession;

1.5 contact information such as email addresses and telephone numbers;

1.6 demographic information such as post code, preferences, and interests;

1.7 information about the animals in your care;

1.8 IP address;

1.9 web browser type and version;

1.10 operating system;

1.11 a list of URLs starting with a referring site, your activity on Our Site, and the site you exit to;

6. How Do We Use Your Data?

1.1 All personal data is processed and stored securely, for no longer than is necessary in light of the reason(s) for which it was first collected. We will comply with Our obligations and safeguard your rights under the GDPR at all times. For more details on security see section 7, below.

1.2 Our use of your personal data will always have a lawful basis, either because it is necessary for Our performance of a contract with you, because you have consented to Our use of your personal data (e.g. by subscribing to emails), or because it is in Our legitimate interests. Specifically, We may use your data for the following purposes:

2.a.1 Providing and managing your Account

2.a.2 Providing and managing your access to Our Sites;

2.a.3 Personalising and tailoring your experience on Our Sites;

2.a.4 Replying to emails from you;

2.a.5 Supplying you with emails that you have opted into (you may unsubscribe or opt-out at any time by clicking the unsubscribe link in the emails);

2.a.6 Analysing your use of Our Sites and gathering feedback to enable Us to continually improve Our Sites and your user experience;

1.3 Third parties whose content appears on Our Sites may use third party Cookies, as detailed below in section 13. Please refer to section 13 for more information on controlling Cookies. Please note that We do not control the activities of such third parties, nor the data they collect and use and advise you to check the privacy policies of any such third parties.

1.5 You have the right to withdraw your consent to Us using your personal data at any time, and to request that We delete it.

1.6 We do not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected. Data will therefore be retained for the following periods (or its retention will be determined on the following bases):

6.a.1 We will keep your data for a period of three years after the date that you last logged into the website r;

7. How and Where Do We Store Your Data?

1.1 We only keep your personal data for as long as We need to in order to use it as described above in section 6, and/or for as long as We have your permission to keep it.

1.2 Your data will only be stored in the UK.

1.3 Data security is very important to Us, and to protect your data We have taken suitable measures to safeguard and secure data collected through Our Sites.

1.4 Steps We take to secure and protect your data include:

4.a.1 Using appropriate technical and organisational steps including storing it on our database within a secure network.

8. Do We Share Your Data?

1.1 We may compile statistics about the use of Our Sites including data on traffic, usage patterns, user numbers, sales, and other information. All such data will be anonymised and will not include any personally identifying data, or any anonymised data that can be combined with other data and used to identify you. We may from time to time share such data with third parties such as prospective investors, affiliates, partners, and advertisers. Data will only be shared and used within the bounds of the law.

1.2 In certain circumstances, We may be legally required to share certain data held by Us, which may include your personal data, for example, where We are involved in legal proceedings, where We are complying with legal requirements, a court order, or a governmental authority.

9. How Can You Control Your Data?

1.1 In addition to your rights under the GDPR, set out in section 4, when you submit personal data via Our Sites, you may be given options to restrict Our use of your data. In particular, We aim to give you strong controls on Our use of your data for direct marketing purposes (including the ability to opt-out of receiving emails from Us which you may do by unsubscribing using the links provided in Our emails and at the point of providing your details).

1.2 You may also wish to sign up to one or more of the preference services operating in the UK: The Telephone Preference Service (“the TPS”), the Corporate Telephone Preference Service (“the CTPS”), and the Mailing Preference Service (“the MPS”). These may help to prevent you receiving unsolicited marketing. Please note, however, that these services will not prevent you from receiving marketing communications that you have consented to receiving.

11. Your Right to Withhold Information

1.1 You may access certain areas of Our Sites without providing any data at all. However, to use all features and functions available on Our Sites you may be required to submit or allow for the collection of certain data.

1.2 You may restrict Our use of Cookies. For more information, see section 13 and Our Cookie Policy .

12. How Can You Access Your Data?

You have the right to ask for a copy of any of your personal data held by Us (where such data is held). Under the GDPR, no fee is payable and We will provide any and all information in response to your request free of charge. Please contact Us for more details at media@charnwoodscouts.org.uk or using the contact details below in section 14.

13. Our Use of Cookies

Our Sites may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by Us and are used only by Us. We use Cookies to facilitate and improve your experience of Our Sites and to provide and improve Our products and services. By using Our Sites you may also receive certain third party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than Us. Third party Cookies are used on Our Sites for various services. In addition, Our Sites use analytics services provided by Google Analytics, which also use Cookies. Website analytics refers to a set of tools used to collect and analyse usage statistics, enabling Us to better understand how people use Our Sites. For more details, please refer to Our Cookie Policy.

14. Contacting Us

If you have any questions about Our Sites or this Privacy Policy, please contact Us by email at media@charnwoodscouts.org.uk. Please ensure that your query is clear, particularly if it is a request for information about the data. We hold about you (as under section 12, above).

15. Changes to Our Privacy Policy

We may change this Privacy Policy from time to time (for example, if the law changes). Any changes will be immediately posted on Our Sites and you will be deemed to have accepted the terms of the Privacy Policy on your first use of Our Site following the alterations. We recommend that you check this page regularly to keep up-to-date.

This website https://charnwoodscouts.org.uk/ (“Our Site”) uses Cookies and similar technologies in order to distinguish you from other users. By using Cookies, We are able to provide you with a better experience and to improve Our Site by better understanding how you use it. Please read this Cookie Policy carefully and ensure that you understand it. Your acceptance of Our Cookie Policy is deemed to occur if you continue using Our Site OR when you press the Okay, thank you button on Our Cookie pop-up. If you do not agree to Our Cookie Policy, please stop using Our Site immediately.

1. 1. Definitions and Interpretation
      1 In this Cookie Policy, unless the context otherwise requires, the following expressions have the following meanings:

2.

2. Information About Us
   • Our Site is owned and operated by Charnwood Scouts

3. How Does Our Site Use Cookies?

1.1 Our Site may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by Us and are used only by Us. We use Cookies to facilitate and improve your experience of Our Site and to provide and improve Our products and services. We have carefully chosen these Cookies and have taken steps to ensure that your privacy and personal data is protected and respected at all times.

1.2 By using Our Site, you may also receive certain third party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than Us. Third party Cookies are used on Our Site for advertising services. For more details, please refer to section 4 below.

• All Cookies used by and on Our Site are used in accordance with current Cookie Law. We may use some or all of the following types of Cookie:

3.a.1 Strictly Necessary Cookies
A Cookie falls into this category if it is essential to the operation of Our Site, supporting functions such as logging in, your shopping basket, and payment transactions.

3.a.2 Analytics Cookies
It is important for Us to understand how you use Our Site, for example, how efficiently you are able to navigate around it, and what features you use. Analytics Cookies enable us to gather this information, helping Us to improve Our Site and your experience of it.

3.a.3 Functionality Cookies
Functionality Cookies enable Us to provide additional functions to you on Our Site such as personalisation and remembering your saved preferences. Some functionality Cookies may also be strictly necessary Cookies, but not all necessarily fall into that category.

3.a.4 Targeting Cookies
It is important for Us to know when and how often you visit Our Site, and which parts of it you have used (including which pages you have visited and which links you have visited). As with analytics Cookies, this information helps us to better understand you and, in turn, to make Our Site and advertising more relevant to your interests.

3.a.5 Third Party Cookies
Third party Cookies are not placed by Us; instead, they are placed by third parties that provide services to Us and/or to you. Third party Cookies may be used by advertising services to serve up tailored advertising to you on Our Site, or by third parties providing analytics services to Us (these Cookies will work in the same way as analytics Cookies described above)

3.a.6 Persistent Cookies
Any of the above types of Cookie may be a persistent Cookie. Persistent Cookies are those which remain on your computer or device for a predetermined period and are activated each time you visit Our Site.

3.a.7 Session Cookies
Any of the above types of Cookie may be a session Cookie. Session Cookies are temporary and only remain on your computer or device from the point at which you visit Our Site until you close your browser. Session Cookies are deleted when you close your browser.

1.4 Cookies on Our Site are not permanent and will expire after a minimum of 30 days OR as indicated in the table below.

1.5 For more details of the personal data that We collect and use, the measures we have in place to protect personal data, your legal rights, and our legal obligations, please refer to our Privacy Policy.

1.6 For more specific details of the Cookies that We use, please refer to the table below.

4. What Cookies Does Our Site Use?

1.1 The following first party Cookies may be placed on your computer or device:

1.2 The following third party Cookies may be placed on your computer or device:

1.3 Our Site uses analytics services provided by Google Analytics. Website analytics refers to a set of tools used to collect and analyse anonymous usage information, enabling Us to better understand how Our Site is used. This, in turn, enables Us to improve Our Site and the products and services offered through it. You do not have to allow Us to use these Cookies, however whilst Our use of them does not pose any risk to your privacy or your safe use of Our Site, it does enable Us to continually improve Our Site, making it a better and more useful experience for you.

1.4 The analytics service(s) used by Our Site use(s) analytics Cookies to gather the required information.

1.5 The analytics service(s) used by Our Site use(s) the following analytics Cookies:

5.Consent and Control

1.1 Before Cookies are placed on your computer or device, you will be shown a pop-up requesting your consent to set those Cookies. By giving your consent to the placing of Cookies you are enabling Us to provide the best possible experience and service to you. You may, if you wish, deny consent to the placing of Cookies unless those Cookies are strictly necessary; however certain features of Our Site may not function fully or as intended. In addition to the controls that We provide, you can choose to enable or disable Cookies in your internet browser. Most internet browsers also enable you to choose whether you wish to disable all Cookies or only third party Cookies. By default, most internet browsers accept Cookies but this can be changed. For further details, please consult the help menu in your internet browser or the documentation that came with your device.

1.2 The links below provide instructions on how to control Cookies in all mainstream browsers:

2.a.1 Google Chrome:

https://support.google.com/chrome/answer/95647?hl=en-GB

2.a.2 Microsoft Internet Explorer:

https://support.microsoft.com/en-us/kb/278835

2.a.3 Microsoft Edge:

https://support.microsoft.com/en-gb/products/microsoft-edge

(Please note that there are no specific instructions at this time, but Microsoft support will be able to assist)

2.a.4 Safari (macOS):

https://support.apple.com/kb/PH21411?viewlocale=en_GB&locale=en_GB

2.a.5 Safari (iOS):

https://support.apple.com/en-gb/HT201265

2.a.6 Mozilla Firefox:

https://support.mozilla.org/en-US/kb/enable-and-disable-Cookies-website-preferences

2.a.7 Android:

https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DAndroid&hl=en

(Please refer to your device’s documentation for manufacturers’ own browsers)

6. Changes to this Cookie Policy

• We may alter this Cookie Policy at any time. If We do so, details of the changes will be highlighted at the top of this page. Any such changes will become binding on you on your first use of Our Site after the changes have been made. You are therefore advised to check this page from time to time.