Mendip Caving Group – Privacy Notice

Our Intent.

We are committed to safeguarding the privacy of our members. Mendip Caving Group (MCG) will only use the information that we collect about you lawfully and in accordance with current data protection legislation.

Changes to Data Protection Legislation.

The introduction of the European Union’s General Data Protection Regulation (GDPR) on 25th May 2018 and the new British Data Protection Bill that will replace the Data Protection Act is currently passing through Parliament and is the basis of this change. This Privacy Notice is therefore intended to comply with the GDPR but may change over time.

The Data Subjects.

In legal terms, members are ‘Data Subjects’.

The Data Controller.

The MCG is from a legal perspective, classed as the ‘Data Controller’.

The Data Protection Lead (DPL).

The Group’s DPL is the Club Secretary. The DPL fulfils a number of roles, one of which is to be the primary point of contact for data protection matters. The formal mechanism for members to raise concerns regarding the processing of personal data is primarily to email: Secretary@mendipcavinggroup.org.uk or send a letter to the MCG’s cottage at: Nordrach Cottage, Charterhouse on Mendip, Blagdon, Bristol, BS40 7XW. Member’s may also speak directly to the Secretary and such enquiries from members will be treated appropriately.

Data Processor(s).

The Secretary, the Treasurer and the Editor will from time to time and for specific purposes, require to access and process personal data held on its members. Committee members also require access to the basic data held in the next of kin database for emergency situations.

Purpose of Processing Personal Data.

We collect personal data primarily to support and administer your membership of the MCG, its aims and purposes. We also process data for the purpose of obtaining, where necessary, individual British Caving Association membership, which is a requirement for membership of the MCG itself.

For access to the Group’s facilities, all members are provided with a key and access card or Fob. Each card has a unique number, and we record who holds the particular card or fob in a database. This allows the MCG to restrict access to different facilities, for example probationary members are only allowed free access to the tackle store on becoming a full member, and for security purposes, for example for someone’s card to be deactivated after leaving the Group. Each use of a key card or fob is recorded in a database. This is available to the committee for the security of the group’s facilities and equipment.

When a member stays at the group’s cottage they are required to record their stay. This allows the Treasurer to confirm that the correct amount was paid for the stay. Should an incorrect amount have been paid, then the Treasurer will contact the member to correct this.

Lawful Basis of Processing Personal Data.

The lawful basis for processing your personal data is as follows:

• Legitimate Interest. We will process your data in pursuit of yours and our legitimate interests as a member of the MCG. Renewal and administration of membership of the group falls under this lawful basis.

All MCG members MUST hold one of the categories of British Caving Association (BCA) membership. For those members that do not arrange this membership either directly with the BCA or through membership of another Caving club, the MCG will arrange this membership. The BCA requires the following details for membership: Name, Address, Gender and if available, an email address. The MCG email’s these details to the BCA secretary to process BCA membership. As MCG members must hold BCA membership, withholding consent for these details to be sent to BCA would prevent membership of the MCG.

Consent.

We confirm with members that they are happy to receive correspondence by either, telephone, email or by post during membership application and subsequently at membership renewal. By providing next of kin details, members are consenting that this person may be contacted in the event of an emergency. Any of these details can be amended by contacting :-

Secretary@mendipcavinggroup.org.uk or

treasurer@mendipcavinggroup.org.uk or by sending a letter to-

MCG,  Nordrach Cottage, Charterhouse on Mendip, Blagdon, Bristol, BS40 7XW.

If we plan to publish any personal details in any future newsletter, or other publication, we will contact you to obtain your consent before doing so.

For MCG committee members or members that hold other posts, we will seek your consent if we intend to publish your name and basic contact details.

Categories of Personal Data Processed.

The information we hold should be accurate and up-to-date. The personal information which we hold will be held securely in accordance with our internal data protection and security policies. The type or categories of personal data we will collect about you includes your:

• Name in full

• Postal address

• Email address(es)

• Mobile, and/or landline numbers

• Gender

• Consent to be contacted for a cave rescue

• Next of Kin

If you hold or have previously held committee posts or other posts in the MCG, we may request further information and retain additional records about you. Additionally, minutes of meetings and records of decisions may include your name and other information about you.

Recipients of Personal Data.

Your name and contact details will primarily be used internally within the Mendip Caving Group.

All MCG members MUST hold one of the categories of British Caving Association (BCA) membership. For those members that do not arrange this membership either directly with the BCA or through membership of another Caving club, the MCG will arrange this membership. The BCA requires the following details for membership: Name, Address, Gender and if available, an email address. The MCG email’s these details to the BCA secretary to process BCA membership. Please visit the BCA website at british-caving.org.uk/privacy_notice to view how the BCA use your data.

In order for you to receive a copy of MCG publications, your name and email address or home address will be used by the Editor.

If you participate in membership activities, or attend the AGM dinner or other event, we may have to provide your name and possibly other details to other stakeholders – eg. caterers.

Sale or Passing of Personal Data to Third Parties.

Other than for specific purposes as required by suppliers/stakeholders (as outlined above), we will not pass your personal data to any commercial or charitable organisation without your explicit consent. Additionally, we will never sell your personal data.

Transfer of Personal Data Outside the EEA (European Economic Area).

Personal data will only be transferred outside the EEA, for specific events, for example an overseas expedition. If this is required, consent will be explicitly requested from you.

Sensitive Personal Data.

We do not hold and will never collect sensitive personal data about you.

Retention of Personal Data.

We will retain your personal data while you are a member of the Mendip Caving Group. Upon leaving, we will continue to hold electronic records of your name and other relevant details for a period of 5 years, to enable simple administration for re-joining the MCG and potentially for statistical reasons and historical record. This does not affect your right of erasure, which may be requested at any time following termination of your membership. Please see below for further details.

The MCG also holds paper records going back to the formation of the group in the 1960s. The MCG will endeavour to ensure any personal data in these records is removed or deleted when it is found and when it is possible to do so. However, the nature of such published records makes it, that this is not always possible.

Data Subject’s Rights.

Under current legislation, you have a number of Rights which are outlined below:

• Right of Access. You are entitled to access your personal data so that you are aware of and can verify the lawfulness of the processing. This is achieved through the mechanism of a Subject Access Request (SAR) and you have the right to obtain:

• Confirmation that your data is being processed (held)

• Access to your personal data (a copy) and

• Other supplementary information that corresponds to the information in this privacy notice.

This information will be provided without charge; without delay and within 3 months.

To protect your personal data, we may seek to verify your identity before releasing any information. As a member this will normally be a simple process, however if the request is made from a member living overseas, or a former member, or by the relative of a deceased member, then additional verification steps are likely and may take up to 3 months.

• Right of Rectification. You are entitled to have personal data rectified if it is inaccurate or incomplete. The MCG will respond within 3 months of receipt of your request. Your membership renewal contains the details that we currently hold for you. Should these details require rectification, you can amend the form or contact the Secretary directly. Your details will be corrected within 3 months of receipt of your request.

Right to Restrict Processing.

You have a right to ‘block’ or suppress processing of personal data. When processing is restricted, the MCG is permitted to store the personal data, but not further process it. In this event, this may prevent the MCG from completing your membership of the BCA. This may result in your membership of the MCG ending. Should you wish to restrict / block processing, exactly what data is held on you and why, will be explained to you.

• Right of Erasure. You may request the deletion or removal of personal data where there is no compelling reason for its continued processing. The Right to Erasure does not provide an absolute ‘right to be forgotten’. However, you do have a right to have personal data erased and to prevent processing in specific circumstances:

• When you object to the processing and there is no overriding legitimate interest for continuing the processing

• The personal data was unlawfully processed

• The personal data has to be erased in order to comply with a legal obligation

Mendip Caving Group November 2019