PRIVACY NOTICE FOR VOLUNTEERS AND TRUSTEES
Data controller: Coastal Communities Museum Trust (CCMT)
1. Introduction
CCMT is a ‘data controller’. This means that we are responsible for deciding how we hold and use personal information about you. This privacy notice sets down how CCMT collects, stores and processes personal data relating to its Volunteers, and Trustees
CCMT is committed to protecting the privacy and security of your personal information and to being clear and transparent about how it collects and uses that data in meeting its data protection obligations.
2. Data protection principles
Personal information we hold about you must be used lawfully, collected only for valid purposes, it must be accurate and up to date and only kept for as long as necessary during your volunteering relationship with CCMT Please be assured that we do not transfer personal data to third parties or through other countries servers and all information is held within your rights as a data subject.
3. Information CCMT collects and processes
Personal data means any information about an individual from which the person can be identified. Depending on your relationship with CCMT, the following information may be required:
Volunteers and Trustees will be asked for their personal contact details, including name, title, address and contact details, including email address and telephone number.
Trustees also have to provide their date of birth and occupation details
Volunteers will also complete an application detailing work history, education and training; these are not considered ‘personal information’ under GDPR but will be kept securely
GDPR describes other forms of ‘personal data’ called ‘sensitive personal data’; this relates to health, criminal convictions and biometric data; CCMT does not collect this type of personal information.
In some cases, CCMT collects personal data about Volunteers from third parties, such as references supplied by former employers.
Data is stored securely in the CCMT’s files holding recruitment information and Volunteer information and in locked file cabinets. Some information is held on paper, some is held on the CCMT computer system which is password protected and only accessible to authorised personnel.
Security: CCTV is in use on the museum premises. Images of individuals who come within range of the internal cameras and external footage taken from the car park and entrance is controlled and processed by East Lothian Council. To understand how your personal data is used by ELC, please see East Lothian CCTV Notice
4. Why and how CCMT processes personal data
We will process your personal information in order to make decisions about recruitment and maintain up to date, accurate contact details. We do need to keep records of museum activities so your details maybe included on rosters and as evidence of training received. Other uses for your personal data are only to provide references on request or to deal with any disputes
5. Data retention
Personal data is held for as long as is necessary to fulfil the purposes we collected it for, including any legal or reporting requirements. When someone leaves CCMT Volunteering service, data is held for one year; paper data is disposed of confidentially and digital data is deleted
6. Who has access to data?
Your information will be shared internally with the FOH coordinator who need contact details to cover shifts and with Trustees who need contact details to arrange meetings and send information and communications to assist in all administrative duties, the names of all Volunteers is provided to the library staff to facilitate secure handover of the keys for opening and closing the museum The Data Protection Lead also has access to all files held securely in the administrative systems of the museum.
Personal information will only be used in connection with the Coastal Communities Trust (CCMT) and ELC Museums Service (ELCMS) and will not be used for any other purposes nor will it be disclosed to any third party outside the CCMT and ELCMS.
7. Your Rights
As a data subject, you have a number of rights.
The right to be informed; why data is held and how it is used (the purpose of this Privacy Notice)
The right of access; access and obtain a copy of your data on request
The right to rectification; ask CCMT to change incorrect or incomplete data; ask CCMT to suspend the processing of your personal data for a period of time if data is inaccurate or there is a dispute about its accuracy or the reason for processing it
The right to erasure; you to ask CCMT to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
The right to restrict processing; you can ask CCMT to limit the way that your data is used for example you still want to receive information about work patterns and shifts but you no longer want to receive circulars and marketing emails
The right to data portability; this applies to digital information only. CCMT does not hold any data in format which are not transferrable via email or printed materials.
The right to object; you can ask CCMT to stop using your personal information in certain circumstances which would exclude the legitimate purpose of the organisation. You can object however to direct marketing emails and communications
Rights in relation to automated decision making and profiling; CCMT does not use personal data to make automated decisions about any of its functions
If you would like to exercise any of these rights, or believe that the CCMT has not complied with your data protection rights, or you have any questions about the privacy notice, please contact the Data Protection Lead, Jo Palmer at generalccm@gmail.com.
As a small, voluntary not for profit organisation, CCMT is exempt from registration with the Information Commissioner however, you can find useful information about the rights of data subjects and how your information should be handled on their website. Click here to visit the ICO website.