Data Protection & GDPR

Data Protection Policy for Southerly Owners Association

The Policy is based on the legal requirements of the Global Data Protection Regulations and as such protects Individuals’ Rights Under the GDPR:

  • The right to be informed.
  • The right of access.
  • The right to rectification.
  • The right to erasure.
  • The right to restrict processing.
  • The right to data portability.
  • The right to object.
  • The right not to be subject to automated decision-making including profiling.

Membership Information

  1. The information collected on each individual who applies for membership and is accepted by the SOA will be subject to two specific permissions that need to be granted by the individual via informed consent:
    1. Authority to hold their data
    2. Authority to publish their data.
  1. Application forms will be processed for input to the membership database and then destroyed securely.
  2. All members will be able to see contact and boat data supplied by the individuals. Access to this data is controlled and will be used for the express intent of maintaining a relationship between the SOA and the member in line with the SOA Objectives.
  3. Financial information for members is held for processing of annual fees and relevant rally events. Hard copy financial information except in the processing for accounting purpose is not kept in hard copy.
  4. Membership information is kept up to date with an annual request to members to check their data and confirm its relevance.

Former members

  1. Electronic storage of personal data for former members is retained but hidden from view.
  2. All electronically stored financial information for former members is destroyed when they resign from their membership.

Types of data held for Members:

  1. Name, address, date of birth, e-mail address, phone numbers and other contact details of members.
  2. Names and date of birth of children who live at the same address as a member.
  3. Name and details of the boats owned by members.
  4. Date of joining (and leaving) the Club.
  5. Financial data if a direct debit is used.
  6. Specific activities in which they have expressed an interest.
  7. Relevant qualifications
  8. Types of data held and processed for Suppliers
  9. Name, address, e-mail address, phone numbers and other contact details
  10. Bank details
  11. Qualification details (CVs)

Collecting and Keeping Data

Personal data is only held with the informed consent of the member to:

  1. Meet the legitimate needs of the SOA
  2. Fulfil the contract with the member. See the Data Privacy Statement
  3. Data will only be collected, held and processed for these specific purposes.
  4. Informed Consent will be requested for all activities, and will be specific, informed and unambiguous.
  5. A member may change their mind about any informed consent given at any time and the SOA will respect this.
  6. The Members’ Directory is available through the SOA Forum.

Data to Third Parties

  1. Membership data will not be passed to any third party for marketing purposes.
  2. Legitimate third parties for SOA are:
    1. The SOAs bank
    2. The SOAs database designers and IT consultants)
    3. The RYA for training purpose only
    4. The printers for the SOA magazine
    5. SOA members who organise specific activities.
    6. Law enforcement agencies

Data Breaches

  1. Process for identifying reporting and investigating data breaches.

Identification begins :

  1. with the Chairman for the database
  2. The Chairman for email and website breaches
  1. Reporting
    1. All breaches of data are reported to the individual immediately the information is known.
    2. It will also be reported to 1&1.co.uk (web hosts and any DB designers).
    3. The SOA committee members will be informed.
    4. They will be advised on any further course of action.
  2. Investigating
    1. The Chairman will investigate in the first instance.
    2. If the breach has serious ramifications for members, individuals, staff or suppliers the ICO will be informed and they may conduct their own investigation.

Policy Approved and Signed:

Nigel Campling (Chairman)

David Thomas (Treasurer)