Introduction

In order to operate, Bristol Concert Wind Band needs to gather, store and use certain forms of information about individuals.

These can include members, employees, contractors, suppliers, volunteers, audiences and potential audiences, business contacts and other people the group has a relationship with or regularly needs to contact.

​

This policy explains how this data should be collected, stored and used in order to meet Bristol Concert Wind Band’s data protection standards and comply with the law.

​

Why is this Policy Important?

This policy ensures that Bristol Concert Wind Band:

• Protects the rights of our members, volunteers and supporters

• Complies with data protection law and follows good practice

• Protect the group from the risks of a data breach

​

Roles and Responsibilities

Who and What does this Policy Apply to?

This applies to all those handling data on behalf of Bristol Concert Wind Band, e.g.:

• Committee members

• Employees and volunteers

• Members

• Contractors/3rd-party suppliers

 

It applies to all data that Bristol Concert Wind Band holds relating to individuals, including:

• Names

• Email addresses

• Postal addresses

• Phone numbers

• Media (e.g. photos) where the individual is identifiable

• Any other personal information held (e.g. financial)

​​

Roles and Responsibilities

Everyone who has access to data as part of Bristol Concert Wind Band has a responsibility to ensure that they adhere to this policy.

​

Data Controllers

The Data Controllers for Bristol Concert Wind Band are the Membership Officer (Jill Watson) and Marketing/Promotion Officer (Matt Landick). They are responsible for ensuring that our data protection policy is followed and kept up to date in line with current regulation and best practice. They, together with the committee, are responsible for why data is collected and how it will be used. Any questions relating to the collection or use of data should be directed to the Data Controllers.

​

Data Protection Principles

We fairly and lawfully process personal data

Bristol Concert Wind Band will only collect data where lawful and where it is necessary for the legitimate purposes of the group.

• A member’s name and contact details will be collected when they first join the group and will be used to contact the member regarding group membership administration and activities. Other data may also subsequently be collected in relation to their membership, including on their payment history for ‘subs’.

• The name and contact details of volunteers, committee members, employees and contractors will be collected when they take up a position and will be used to contact them regarding group administration related to their role.

• Further information, including personal financial information and criminal records information may also be collected in specific circumstances where lawful and necessary (in order to process payment to the person or in order to carry out a DBS check).

• An individual’s name and contact details will be collected when they make a booking for an event. This will be used to contact them about their booking and to allow them entry to the event.

• An individual’s name, contact details and other details may be collected at any time (including when booking tickets or at an event), with their consent, in order for Bristol Concert Wind Band to communicate with them about group activities, and/or for Direct Marketing. See ‘Direct Marketing’ below.

​​

We only collect and use personal data for specified and lawful purposes.

When collecting data, Bristol Concert Wind Band will always explain to the subject why the data is required and what it will be used for.

​

We will never use data for any purpose other than that stated or that can be considered reasonably to be related to it. For example, we will never pass on personal data to 3rd parties without the explicit consent of the subject.

​

We ensure any data collected is relevant and not excessive

Bristol Concert Wind Band will not collect or store more data than the minimum information required for its intended purpose.

​

E.g. we need to collect telephone numbers from members in order to be able to contact them about group activities, but data on their marital status or sexuality will not be collected, since it is unnecessary and excessive for the purposes of group activities.

​

We ensure data is accurate and up-to-date

Bristol Concert Wind Band will remind members, volunteers and staff to check and update their data on an annual basis.

​

It is very important that data is kept accurate and up-to-date for group administration purposes. Any individual will be able to update their data at any point by contacting the Membership Officer.

​

We ensure data is not kept longer than necessary

Bristol Concert Wind Band will keep data on individuals for no longer than 12 months after our involvement with the individual has stopped, unless there is a legal requirement to keep records or consent has been given by the individual to retain information for longer.

​

We process data in accordance with individuals’ rights      

The following requests can be made in writing to the Data Controllers:  

• Members, volunteers and supporters can request to see any data stored on about them. Any such request will be actioned within 14 days of the request being made.

• Members and supporters can request that any inaccurate data held on them is updated. Any such request will be actioned within 14 days of the request being made.

• Members and supporters can request to stop receiving any marketing communications. Any such request will be actioned within 14 days of the request being made.

• Members and supporters can object to any storage or use of their data that might cause them substantial distress or damage or any automated decisions made based on their data. Any such objection will be considered by the committee, and a decision communicated within 28 days of the request being made

​​

We keep personal data secure

Bristol Concert Wind Band will ensure that data held by us is kept secure.

• Electronically-held data will be held within a password-protected and secure environment

• Passwords for electronic data files will be re-set each time an individual with data access leaves their role/position

• Physically-held data (e.g. membership forms or email sign-up sheets) will be stored in a locked cupboard and destroyed when no longer needed or information has been transferred to electronic data files

• Keys for locks securing physical data files should be collected by the Data Controllers from any individual with access if they leave their role/position. The codes on combination locks should be changed each time an individual with data access leaves their role/position

• Access to data will only be given to relevant trustees/committee members/contractors where it is clearly necessary for the running of the group. The Data Controllers will decide in what situations this is applicable and will keep a master list of who has access to data

​​

Transfer to countries outside the EEA

Bristol Concert Wind Band will not transfer data to countries outside the European Economic Area (EEA), unless the country has adequate protection for the individual (e.g. USA).

​

Member-To-Member Contact

We only share members’ data with other members with the subject’s prior consent

As a membership organisation Bristol Concert Wind Band encourages communication between members. To facilitate this:

• Members are encouraged to request personal contact data from other members directly in person. In this situation, Bristol Concert Wind Band is not responsible for the data that a member shares with another.

• Members may voluntarily sign up to members’ portals and social media pages created and administered by Bristol Concert Wind Band. In this situation, Bristol Concert Wind Band is not responsible for the data that a member shares with another in these environments, however will intervene through moderation if data posted is considered to contravene data protection policies, ‘house rules’ or other Bristol Concert Wind Band policies or procedures.

• Members can request the personal contact data of other members in writing via the Data controller or Membership Officer. These details will be given, as long as they are for the purposes of contacting the subject (e.g. an email address, not financial or health data) and the subject consents to their data being shared with other members in this way, consent to be obtained on a case-by-case basis.

​​

Direct Marketing

Bristol Concert Wind Band will regularly collect data from consenting supporters for marketing purposes. This includes contacting them to promote concerts, updating them about group news, fundraising and other group activities.

Any time data is collected for this purpose, we will provide:

• A clear and specific explanation of what the data will be used for (e.g. ‘Tick this box if you would like Bristol Concert Wind Band to send you email updates with details about our forthcoming events, fundraising activities and opportunities to get involved’)

• A method for users to show their active consent to receive these communications (e.g. a ‘tick box’)

Data collected will only ever be used in the way described and consented to (e.g. we will not use email data in order to market 3rd-party products unless this has been explicitly consented to).

Every marketing communication will contain a method through which a recipient can withdraw their consent (e.g. an ‘unsubscribe’ link in an email). Opt-out requests such as this will be processed within 14 days.

​

Cookies on the Bristol Concert Wind Band Website

A cookie is a small text file that is downloaded onto ‘terminal equipment’ (e.g. a computer or smartphone) when the user accesses a website. It allows the website to recognise that user’s device and store some information about the user’s preferences or past actions.

Bristol Concert Wind Band uses cookies on our website www.bcwb.co.uk in order to monitor and record their activity. This allows us to improve users’ experience of our website by, for example, allowing for a ‘logged in’ state, and by giving us useful insight into how users as a whole are engaging with the website.

​

We will implement a pop-up box on www.bcwb.co.uk that will activate each new time a user visits the website. This will allow them to click to consent (or not) to continuing with cookies enabled, or to ignore the message and continue browsing (i.e. give their implied consent).