top of page

GENERAL DATE PROTECTION REGULATION (GDPR)

Renfrew Burgh Band

 

Data Protection Policy

​

1.    INTRODUCTION

 

The personal data that Renfrew Burgh Band (“RBB”) processes relates to its band members and those who contact us about events and with any queries.

 

This policy sets out RBB’s commitment to ensuring that any personal data, including special category personal data, which RBB processes is carried out in compliance with Data Protection Law.  RBB is committed to ensuring that good data protection practice is imbedded in our culture.

 

‘Data Protection Law’ includes the General Data Protection Regulation 2016/679; the UK Data Protection Act 2018 and all relevant EU and UK data protection legislation.

 

RBB is committed to ensuring that its complies with the GDPR Data Protection Principles when processing any personal data and that it meets its legal obligations as laid down in Data Protection Law.

 

2.    SCOPE

 

This policy applies to all personal data processed by RBB and is part of RBB’s approach to compliance with Data Protection Law. 

 

3.    DATA PROTECTION PRINCIPLES

 

RBB confirms that it complies with the following data protection principles and undertakes to ensure that when it processes personal data:

 

  • it is processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

  • it is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; (‘purpose limitation’)

  • It is all adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; (‘data minimisation’)

  • It is all accurate and, where necessary, kept up to date and that reasonable steps will be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’)

  • It is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; (‘storage limitation’)

  • It is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

RBB is committed to facilitating and complying with any request from a data subject who wishes to exercise their rights under Data Protection Law in a transparent manner and without undue delay. 

 

4.    PROCESS/PROCEDURES/GUIDANCE

 

RBB will:

 

  • only collect and process the personal data that it is necessary for the purpose or purposes that it has identified in advance.

  • ensure that the legal basis for processing the personal data is identified in advance, including any special category data.

  • ensure that as far as possible the personal data it holds is accurate.

  • only process your data for as long as is it required for its purposes and then it will be securely disposed of, or deleted.

  • will provide anyone they collect personal data from with a privacy notice which provides more detail on why it is asking for that data and what it intends to do with it.

  • not do anything with personal data that is unexpected given the content of this policy and the privacy notice provided at the time it is provided.

  • ensure that appropriate security is in place in relation to personal data held in paper and digital formats.

​

5.    DATA SUBJECT RIGHTS

 

RBB will ensure that it has procedures in place to allow data subject to exercise the following data subject rights under the GDPR:

 

Subject access: the right to request information about how personal data is being processed including whether personal data is being processed and the right to be allowed access to that data and to be provided with a copy of that data along with the right to obtain the following information:

 

  • the purpose of the processing;

  • the categories of personal data;

  • the recipients to whom data has been disclosed or which will be disclosed;

  • the retention period;

  • the right to lodge a complaint with the ICO;

  • the source of the information if not collected direct from the subject; and

  • the existence of any automated decision making.

 

Rectification: the right to allows you to rectify inaccurate personal data concerning you without undue delay.

 

Erasure: the right to have data erased in certain circumstances, and to have confirmation of erasure, but only where:

  • the data is no longer necessary in relation to the purpose for which it was collected;

  • where consent is withdrawn;

  • where there is no legal basis for the processing; or

  • there is a legal obligation to delete data.

 

Restriction of processing: the right to ask for certain processing to be restricted in the following circumstances:   

  • if you contest the accuracy of your personal data;

  • if our processing is unlawful and you do not want it to be erased;

  • if we not no longer need the data for the purpose of the processing but it is required by you for the establishment, exercise or defence of legal claims; or

  • if you have objected to the processing, pending verification of that objection.

Data portability: you have the right to receive a copy of the personal data you have provided to us and certain information generated by us, if our processing is carried by automated means, which will allow you to transfer it to another data controller.  This only applies if our legal basis for processing is consent or under a contract.

 

Object to processing: you have the right to object, on grounds relating to your particular situation, to the following:

  • processing carried out in the public interest or in the exercise of official authority; or

  • processing relying on the legitimate interests processing condition unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

You have an absolute right to object to any direct marketing that we are sending to you and there are no exemptions to this which would allow you to refuse to comply.

 

You cannot exercise this right in the following circumstances when the processing is:

  • necessary for entering into or the performance of a contract;

  • authorised by law; or

  • based on explicit consent.

 

6.    SPECIAL CATEGORY PERSONAL DATA

 

This includes the following personal data revealing:

 

  • Racial or ethnic origin,

  • Political opinions,

  • Religious or philosophical beliefs,

  • Trade union membership,

  • The processing of genetic data, biometric data for the purpose of uniquely identifying a natural person,

  • Data concerning health,

  • Data concerning a natural person's sex life or sexual orientation,

  • Data about criminal convictions and offences.

This policy sets out the safeguards we believe are appropriate to ensure that we comply with the Data Protection Principles set out above. We only process special category data when we have a legal basis to do so; access to this data is restricted; extra security measures are in place and we will only retain it as long as it strictly necessary.

 

7.    RESPONSIBILITY FOR THE PROCESSING OF PERSONAL DATA

 

RBB’s Committee takes ultimate responsibility for data protection.

 

If you have any concerns or wish to exercise any of your rights under the GDPR then you can contact the Data Protection Lead in the following ways:

 

Allan McGranaghan

c/o McMaster Centre

Robertson Park

Renfrew PA4 8LX

Tel: 07986 016510

renfrewburghband@gmail.com

 

8.    MONITORING AND REVIEW

 

This policy was last updated in August 2021 and shall be regularly monitored and reviewed, at least every two years.

bottom of page