CAMP GDPR and Privacy Policy

COMMUNITY ARCHAEOLOGY ON THE MENDIP PLATEAU PRIVACY POLICY

Community Archaeology on the Mendip Plateau (CAMP) is committed to protecting and respecting the privacy of its members. This policy is to explain to you how CAMP collect and use the information about its members. Your comments provide us with valuable feedback; if you have any comments about this policy, please let the Data Controller know.

The Privacy Policy explains:

· Who we are

· What personal data we collect and store about you, and how we collect it

· Why we collect personal data and what we do with it

· The categories of third parties with whom we share your personal data

· How we retain your information and keep it secure

· Your rights and how to exercise them

· How to contact us

Who we are. For the purposes of data protection law, the “controller” is Community Archaeology on the Mendip Plateau (CAMP), a non-incorporated membership organisation set up to explore and research the landscape in the parishes of the Chewton area from both an archaeological and an historical viewpoint.

As “controller” we are responsible for, and control the processing of, your personal data. As a not-for-profit organisation we are not required to register with the Information Commissioner’s Office (ICO) which is the UK’s supervisory authority for data protection matters. However, although not registered with the ICO we follow the good practice guidance as laid down by the ICO.

The Officer of CAMP responsible for ensuring the data protection requirements are met is the Treasurer, Julie Bassett. If you have any comments about this Privacy Policy please contact Julie by email at jb1241@my.bristol.ac.ukor by post to Julie Bassett, CAMP, c/o 384 Wells Road, Bristol BS4 2QP.

Lawful Processing

The lawful reasons for processing data that apply to camp are set out in Article 6 of the EU GDPR 2018:

6.1(a) The data subject has given consent to the processing of his/her personal data for one or more specific purposes

6.1(b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

6.1(c) Processing is necessary for compliance with a legal obligation to which the controller is subject. CAMP will only use your personal data for the purposes for which it has been collected, unless we fairly consider that we need it for another reason that is compatible with the original purpose.

The data we collect from you

We collect information about you for membership purposes, in order to maintain our list of members and contact details. We also collect information about our members who are involved in our excavation work and other practical work in order that we meet our health and safety responsibilities. The data collected is in the form of personal details (name and title), contact details (home address, email address, phone numbers), medical information and emergency contact information (used for emergencies during excavation work). We also collect data in the form of photographs taken during events, outings and excavation work; these photographs may be published on our website, in our publications and on any display boards if we have your consent to do so. We collect financial data from you only in the form of your membership subscription (whether or not it has been paid to us and the amount paid).

We do not keep information about your banking details. We do not collect data about your age, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, gender, sexual orientation, genetic or biometric data, nor about criminal convictions or offences.

How we collect the data about you

We collect the data about you when you request to join CAMP as a member and whenever you update your personal contact information in order to continue receiving membership information. We collect health and emergency contact data from you if you join us in excavation work; this data is collected when you complete the mandatory health and safety form prior to each excavation or practical work project and is used by us only in case of accident or emergency.

You are not obliged to provide CAMP with any of your personal data, but if you choose not to provide this data we will be unable to provide the service that you have requested.

How we use your data

We only use your data when the law allows us to. We will use your data in the following ways:

6.1(b) Contractual basis: we will process your personal data to enable us to carry out the services of CAMP for which you subscribe as a member. This is to maintain our membership list, to identify you, to respond to your enquiries and to forward information to you in connection with our services (excavations, other practical work, events, lectures, walks, visits and meetings) which allows us to fulfil our contract with you.

6.1(c) Legal basis: we will process your personal data in order that we can meet our health and safety obligations when you are involved in any excavation work or other practical work with CAMP. This will allow us to react appropriately in case of accident, illness or other emergency during an excavation or other practical work. Financial information: we only record data about how much you have paid in membership subscriptions and when, in order to maintain our membership list and fulfil our contractual obligations with you and to meet the requirements of HMRC in terms of book keeping records.

6.1(a) Consent basis: if we have information from another organisation about an event of archaeological or historic interest that we wish to share with you, we will do so only with your consent. CAMP does not share your personal data with any other third party unless it is for legal reasons connected with excavation and other practical work e.g. medical personnel, insurance company, Health & Safety Executive, RIDDOR.

We will only share your data with other members of CAMP if we have your consent to do so.

How we store your personal data, retention and deletion

Your membership data is stored on an external hard drive held by the Treasurer and is used on the Treasurer’s personal laptop only which is kept securely locked away. The data held on the external hard drive is password protected. Your health and safety data is kept on the paper forms completed at the time of excavation and other practical work and held by the Excavation Director, securely locked away. Your email addresses are shared with the Officers of CAMP in order that they may email you with information about services provided by CAMP.

Your personal data is never stored on a cloud or third party server.

Your data is held only for the length of your membership or your involvement with an excavation or practical work. When you no longer wish to subscribe to CAMP your personal data will be deleted. At the end of each excavation or practical work project your completed health and safety forms will be shredded (unless required for accident/insurance purposes in which case they may be retained for up to 40 years).

Financial records will be retained, as required by HMRC, for 6 years, then deleted from the external hard drive and paper documents will be shredded.

When CAMP Officers send out email information to the membership, they will ALWAYS insert the personal email addresses of members in the “BCC” line of the email address field. This ensures that you only see your own email address; the email addresses of other members will not be shared amongst the membership unless consent is given.

Your rights

You have the right to be informed about the collection and use of your personal data.

You have the right of access to your personal data and the right to request a copy of the information that CAMP holds about you. CAMP has the right to a reasonable period of time to fulfil requests for information. This reasonable period of time is considered to be 28 days.

You have the right to have inaccurate personal data corrected..

You have the right to have personal data blocked, removed or destroyed. You have the right to raise any concern about the way CAMP have processed your data by contacting the Information Commissioner’s Office (ICO) at www.ico.org.uk.

Review of this policy

CAMP will review this policy annually, or sooner if circumstances change.

Created: 15thMay 2018 Review date: May 2019