Effective as of February 2025

Introduction

The Village Hall Committee is committed to ensuring the privacy and protection of personal data in accordance with and the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 and other relevant legislation. This policy outlines our approach to data protection and provides information on how we manage and safeguard personal data.

Scope

This policy applies to all members of the Village Hall Committee, volunteers, employees, contractors, and any other individuals who have access to personal data held by the committee.

Data Protection Principles

We adhere to the following principles when processing personal data:

  • Lawfulness, fairness, and transparency: Personal data is processed lawfully, fairly, and in a transparent manner.
  • Purpose limitation: Personal data is collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
  • Data minimisation: Personal data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
  • Accuracy: Personal data is accurate and, where necessary, kept up to date.
  • Storage limitation: Personal data is kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed.
  • Integrity and confidentiality: Personal data is processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.
  • Accountability: The committee is responsible for, and must be able to demonstrate, compliance with these principles.

Data Collection

We collect personal data for the following purposes:

  • Managing hall bookings and events.
  • Communicating with committee members, volunteers, and users of the hall.
  • Processing payments and donations.
  • Complying with legal obligations.

Types of Data Collected

The types of personal data we collect include, but are not limited to:

  • Names and contact details (address, email, phone number).
  • Financial information (bank details for payments, donation information).
  • Records of hall bookings and event participation.
  • Photographs or video recordings of events, with consent.

Data Subject Rights

Individuals have the following rights regarding their personal data:

  • Right to be informed: Individuals have the right to be informed about the collection and use of their personal data.
  • Right of access: Individuals have the right to access their personal data and obtain information about how it is processed.
  • Right to rectification: Individuals have the right to have inaccurate personal data corrected or completed if it is incomplete.
  • Right to erasure: Individuals have the right to have their personal data erased under certain conditions.
  • Right to restrict processing: Individuals have the right to request the restriction or suppression of their personal data under certain conditions.
  • Right to data portability: Individuals have the right to obtain and reuse their personal data for their own purposes across different services.
  • Right to object: Individuals have the right to object to the processing of their personal data under certain conditions.
  • Rights related to automated decision making and profiling: Individuals have rights regarding decisions made solely by automated means and profiling.

Data Security

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, alteration, disclosure, or destruction. These measures include:

  • Using password-protected systems and secure storage solutions.
  • Limiting access to personal data to authorised individuals only.
  • Regularly reviewing our security practices and updating them as necessary.
  • Providing training to committee members and volunteers on data protection principles and practices.

Data Breaches

In the event of a data breach, we will take immediate steps to mitigate the impact and comply with our legal obligations. This includes:

  • Notifying the relevant authorities within 72 hours of becoming aware of the breach, where required.
  • Informing affected individuals if the breach is likely to result in a high risk to their rights and freedoms.
  • Conducting a thorough investigation to determine the cause of the breach and preventing future occurrences.

Third-Party Data Sharing

We do not share personal data with third parties except in the following circumstances:

  • When we have the individual’s explicit consent.
  • When it is necessary for the performance of a contract.
  • When we are required to do so by law.
  • When it is necessary to protect vital interests of the data subject or another person.

Data Retention

We retain personal data for no longer than is necessary for the purposes for which it was collected. Our retention periods are determined based on legal requirements, operational needs, and best practices. Once personal data is no longer needed, we will securely dispose of it.

Policy Review

This policy is reviewed annually, or more frequently if required, to ensure it remains compliant with relevant legislation and reflects best practices. Committee members will be informed of any updates to the policy.

Contact Information

For any questions or concerns regarding this data protection policy, individuals can contact the Village Hall Committee Chair Sophy Howard at sophy1999@hotmail.co.uk

This policy was approved by the Village Hall Committee on 11/2/25 and is effective as of 1//3/2025