PRIVACY NOTICE FOR VOLUNTEERS, PATRONS, MEMBERS, DONORS AND LENDERS AND TRUSTEES
Data controller: Coastal Communities Museum Trust (CCMT)
1. Introduction
CCMT is a ‘data controller’. This means that we are responsible for deciding how we hold and use personal information about you.
CCMT collects, stores and processes personal data relating to its Volunteers, Members, Patrons, Trustees, Donors and lenders and any person for who we take personal identifying information (name, address) in order to manage the relationship
This privacy notice sets down how CCMT collects and uses personal information about you during and after your relationship with us.
CCMT is committed to protecting the privacy and security of your personal information and is committed to being clear and transparent about how it collects and uses that data and to meeting its data protection obligations.
2. Data protection principles
CCMT will comply with data protection law. This means that the personal information we hold about you must be:
Used lawfully, fairly and in a transparent way;
Collected only for valid purposes that we have explained to you clearly and not used in any way that is incompatible with these purposes;
Relevant to the purposes we have told you about and limited to those purposes only;
Accurate and kept up to date;
Kept only for such time as is necessary for the purposes we have told you about; and
Kept securely.
Must not be transferred to other countries without adequate protection
Must be processed in line with the data subjects’ rights
3. Information CCMT collects and processes
CCMT collects and processes personal data. Personal data means any information about an individual from which the person can be identified. Depending on your relationship with CCMT, the following information may be required:
Members, Patrons, Donors and Lenders will be asked for their personal contact details, including name, title, address and contact details, including email address and telephone number.
Trustees also have to provide their date of birth and occupation details
Volunteers will also complete an application detailing work history, education and training; these are not considered ‘personal information’ under GDPR but we will keep all records about you securely
GDPR describes other forms of ‘personal data’ called ‘sensitive personal data’; this relates to health, criminal convictions and biometric data; CCMT does not collect this type of personal information.
Data is collected through the application and recruitment process for Volunteers and during work-related activities including Front of House volunteers or administrative volunteers who can record personal information of any person making an enquiry.
In some cases, CCMT collects personal data about you from third parties, such as references supplied by former employers.
Data is stored securely in the CCMT’s Data Protection files holding recruitment information and Volunteer information and in locked file cabinets. Some information is held on paper, some is held on the CCMT computer system which is password protected and only accessible to authorised personnel.
4. Why and how CCMT processes personal data
CCMT needs to process data to enable safe recruitment of volunteers and to enter into communications with Volunteers, Members, Patrons, Donors and Lenders.
We will process your personal information in order to:
make decisions about recruitment of Volunteers;
maintain accurate and up-to-date contact details
operate and keep a record of museum processes;
keep records of training and development requirements;
provide references on request for current or former employees;
deal with any disputes
Facilitate equal opportunities monitoring when required.
5. Data retention
CCMT will only hold your personal data for as long as is necessary to fulfil the purposes we collected it for, including any legal or reporting requirements. When someone leaves CCMT Volunteering service, data is held for one year; paper data is disposed of confidentially and digital data is deleted
6. Who has access to data?
Your information will be shared internally with FOH coordinators who need contact details to cover shifts and with Trustees who need contact details to arrange meetings and send information and communications to Volunteers, Patrons and Members and to assist in all administrative duties. The DPO also has access to all files held securely in the administrative systems of the museum.
Personal information will only be used in connection with the Coastal Communities Trust (CCMT) and ELC Museums Service (ELCMS) and will not be used for any other purposes nor will it be disclosed to any third party outside the CCMT and ELCMS.
Your Rights
As a data subject, you have a number of rights.
ask CCMT to suspend the processing of your personal data for a period of time if data is inaccurate or there is a dispute about its accuracy or the reason for processing it.
The right to be informed; why data is held and how it is used (the purpose of this Privacy Notice)
The right of access; access and obtain a copy of your data on request
The right to rectification; ask CCMT to change incorrect or incomplete data;
The right to erasure; you to ask CCMT to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
The right to restrict processing; you can ask CCMT to limit the way that your data is used for example you still want to receive information about work patterns and shifts but you no longer want to receive circulars and marketing emails
The right to data portability; this applies to digital information only. CCMT does not hold any data in format which are not transferrable via email or printed materials.
The right to object; you can ask CCMT to stop using your personal information in certain circumstances which would exclude the legitimate purpose of the organisation. You can object however to direct marketing emails and communications
Rights in relation to automated decision making and profiling; CCMT does not use personal data to make automated decisions about any of its functions
If you would like to exercise any of these rights, or you have any questions about the privacy notice, please contact the Data Protection Officer Kathryn Smith at Ksmith2028@aol.com
If you believe that the Company has not complied with your data protection rights, you have the right to make a complaint to the Information Commissioner’s Office.
Commissioner's Office – Scotland, 45 Melville Street, Edinburgh EH3 7HL
Telephone: 0303 123 1115
Email: Scotland@ico.org.uk