Data privacy policy

1. Introduction

This document details how we fulfil the requirements of the General Data Protection Regulations (GDPR). It explains how we will collect, store, and manage the personal data of our members and of other groups (Data Subjects) with whom we need to interact from time to time.

2. Who we are and what we do

Wallasey Beach CIC is a community interest company (company number 14299785). With a focus on health, lifestyle, building community and sustainability, we are creating an iconic non-powered water sports and wellbeing beach club. In particular the company will be a focal point to provide a friendly, accessible space for water sports and beach access with a primary, but not exclusive focus on sailing, kitesurfing, SUP, and other non-powered water sports activities. We are located at Wallasey Beach Club, Coastal Drive, Wallasey, CH45 3PZ. Email address: secretary@wallaseybeach.org.uk

3. Who is affected by this policy

Data Subject Type

Description

Club or Interest Group Members

Signed up members of any club or interest group who use the facilities and resources of the CIC.

Management Team (Officers, Trustees & Directors)

Members of any committee or board operating within the overall framework of the CIC.

Customers and Suppliers

Those contacts with whom we need to communicate in order for us to fulfil the terms of a business agreement e.g., bar stock and food suppliers.

Members of the Public

Any individual, not being a member of any club or interest group, including the guests of members, that might use the CIC’s premises, facilities, and resources.

4. Lawful bases used for processing personal data

The GDPR requires us to select from six pre-defined legal bases for handling the personal data of data subjects, and for our purposes we will use the following four:

GDPR Lawful Basis

Consent

The explicit consent of the data subject is required.

Legitimate Interest

Where we have a legitimate and fair reason to use personal data. Consent is not required. A separate Legitimate Interest Assessment explains where and why we rely on this basis.

Contract

Where consent is assumed in order for us to fulfil the terms of an agreement e.g., with customer and suppliers.

Vital Interests

Where the use or transfer of personal data is necessary to protect someone’s life or otherwise prevent harm.

In some instances, more than one legal basis will apply to a data subject as defined below.

5. Lawful basis used, description and purpose(s)

Information Stored & Purpose

Lawful Basis Used & Description

All

Purpose

Protection of life

Information Stored

• All as relevant listed below.

The Vital Interests legal basis will take precedence over any other bases defined below.

Security and safety

Information Stored

• CCTV Images

For security and safety reasons, it is likely that that electronic images of any data subject will be captured by CCTV covering the buildings, interiors, and approaches to the premises. For this purpose, we will use the Legitimate Interest legal basis. CCTV will not be used in personal areas such as the toilets and showers.

Fulfilling our contract and general relationship with the member.

• Name and address
• Email address
• Telephone number
• Membership no
• Membership type
• For boat storage members. Boat name and where possible SSR/Sail no
• Date of birth (optional)
• Next of kin/emergency contact details

1. a)By signing (or having signed) a membership agreement, consent is assumed for general administrative communications relating to such memberships. For this purpose, the Legitimate Interest legal basis will be used.
2. b)For communications relating to marketing, events, merchandise sales and similar non-essential communications, consent is required, and the Consent Basis will be used.
3. c)Individual data subjects may at any time withdraw consent, but they might not then receive important communications relating to their membership or related activities.

Enabling the proper management and the free flow of administrative information between withing the CIC, clubs and interest groups.

• Role in Management Team
• Date appointed
• Full name and address
• Email address
• Telephone number
• Membership no
• Membership type
• For boat storage members. Boat name and where possible SSR/Sail no
• Date of birth (optional)
• Next of kin/emergency contact details

1. a)In order to ensure unhindered administration and the free flow of information, full consent is assumed for all management team data subjects for all types of communication.
2. b)Individual data subjects in this category may opt-out of consent but will not then receive important communications required to effectively run the CIC. This choice may negate their ability to function as a member of the management team.

To enable us to fulfil our agreements and relationships with such parties.

Information stored

• Business details as necessary for contracts

Contract consent will be used for employees of customer and suppliers for any proper communication relation to a business relationship.

General safety and security

• Safety & Physical Security.
• Ability to report a crime.

• Prevent unauthorised activities.

Where members of the public (including members’ guests) use any facility of the CIC we will use Legitimate Interest to ensure the safety and security of our assets, members, staff, and officers/directors. This will generally be limited to the use of recorded CCTV both inside and outside the clubhouse, boatyard and approached to our buildings.

6. Your rights

We fully respect your rights under the GDPR. These include: the right to be informed, the right of access, the right to rectification, the right to erase, the right to restrict processing, the right to data portability, the right to object, rights in relation to automated decision making and profiling. We will never sell your personal data or transfer it to any external party unless required to do so by Law. Full details of these rights can be viewed on the website of the Information Commissioner here – https://ico.org.uk/. For the full text of the GDPR visit here – https://gdpr-info.eu/. If you would like to complain about the way in which we use or process your data, or to opt-out of any type of communication, please email the Secretary at secretary@wallaseybeach.org.uk

7. Technical structure and data security

Personal data is stored in a secure electronic environment comprising of password protected Google Drive cloud servers. External access to our electronic systems is not permitted and they are protected by firewalls. Anti-virus software is installed on all platforms. Data is backed-up daily and archived within the secure environment. Physical access to our systems is via locked doors. Any physical records are held in locked filing cabinets behind locked main doors. Access to these systems is limited to only those persons necessary to manage the technical/database architecture. All data sent to and received by our website is encrypted and protected by the HTTPS protocol. Our website does not use cookies.

8. Data controller

The Secretary, Wallasey Beach CIC, Coastal Drive, Wallasey, CH45 3PZ. Email: secretary@wallaseybeach.org.uk