Scope of the Policy
This policy applies to the work of the Land Rover Camping & Caravan Club (LRCCC). The policy sets out the requirements that LRCCC must gather personal data for membership purposes. The policy details how personal data will be gathered, stored and managed in line with data protection principles and the General Data Protection Regulation (GDPR). The policy is reviewed on an ongoing basis by LRCCC Committee members to ensure that LRCCC is compliant. This policy should be read in tandem with LRCCC Privacy Notice.
Principles of the Data protection Regulations Article 5 of the GDPR requires that personal data shall be:
a. Processed lawfully, fairly and in a transparent manner in relation to individuals
b. Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposed, further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purpose.
c. Adequate, relevant and limited to what is necessary in relation to the purpose for which they are processed;
d. Accurate and, where necessary, kept up to date, every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purpose for which they are processed, are erased or rectified without delay.
e. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of the individuals
f. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Article 5(2) requires that:
“the controller shall be responsible for, and to demonstrate, compliance with the principles” This policy exists to ensure that LRCCC
• Complies with data protection law and follows good practice
• Protects the rights of members
• Is open about and how it stores and processes member’s data
• Protects itself form the risks of a data breach
Lawful, fair and transparent data processing
LRCCC requests personal information from potential members and members for the purpose of sending communications about their involvement with LRCCC. LRCCC have determined that the lawful basis for holding and processing data on members is Legitimate Interest and that LRCCC is a Data Controller. LRCCC have completed a Legitimate Interest Assessment to confirm that this is the lawful basis of processing that is the best fit for our purpose. The forms used to request personal information will contain a privacy notice informing potential members and members as to why the information is being requested and what the information will be used for. The Committee of LRCCC will seek to ensure that personal information is not used inappropriately. Appropriate use of information provided by personal members will include
• Communicating with members about LRCCC events, activities and rallies
• Sending members issues of the LRCCC newsletter
• Communicating with members about their membership and / or renewal of their membership with LRCCC
• Communicating with members about specific issues associated with their membership of LRCCC.
Members of LRCCC will only be asked to provide information that is relevant for membership purposes. This will include:
• Name & Partner’s Name
• Postal Address
• Email Address
• Telephone Number
Accuracy of Data and Keeping data up to Date
LRCCC has responsibility to ensure members’ information is kept up to date. Members will be asked to let LRCCC know if any of their personal information changes
Accountability and Governance
• The LRCCC Committee is responsible for ensuring that LRCCC remains compliant with data protection requirements and can evidence that it has. The LRCCC Committee shall ensure that new members joining the Committee receive an induction into how data protection is managed within LRCCC and the reasons for this. The Committee will review data protection and who has access to information on a regular basis as well as reviewing that data held.
Secure Storage and Processing
LRCCC has assessed that the data held on members by LRCCC is readily available from many other sources and that therefore the harm that could be caused to any individual by loss or theft of the data as held by LRCCC is very low. The LRCCC Committee members have a responsibility to ensure that data is both securely held and processed. In consideration of risk of harm to individuals caused by unauthorised or unlawful processing or by accidental losses being insignificant; the following will apply:
• Only granting access of personal data of members to those on the Committee & Official Designates who need to communicate with members.
• Access will be granted to rally marshals, when requested by rally marshals, for specific reasons relating to LRCCC events, activities or rallies.
• Using password protection on electronic devices that contain or access personal information.
• Using password protection or secure cloud systems when sharing data between committee members.
• Checks will be performed to validate the security regularly to ensure adherence.
Privacy Notice
The Land Rover Camping & Caravan Club (LRCCC) can be contacted by post to the Club Secretary, address can be found at www.lrccc.co.uk or in the Rally Book. LRCCC has a legitimate interest in using personal data you give to LRCCC on this form for the purpose of communicating with you on matters relating to LRCCC .
Your personal data will not be transferred to any other person or organisation and will be deleted from LRCCC records one year after your membership of LRCCC has terminated. You have the right to request from LRCCC access to and rectification of your personal data. If you feel that your personal data has been misused you have the right to complain to the Information Commissioners Office