Data Protection Policy

Policy

The objectives of this policy are to ensure that: 

• Proper procedures are in place for the processing and management of personal data;
• There is documentation within the organisation to provide knowledge about data protection compliance; 
• All staff understand their responsibilities when processing personal data, and that methods of handling that information are clearly understood;
• Individuals are assured that their personal data is processed in accordance with the data protection principles, that their data is secure and safe from unauthorised access, alteration, use or loss; 
• Other organisations with whom the Charity needs to share or transfer data, meet compliance requirements; 
• Prior to entering into a contract with a new supplier/third party service provider, who has access to personal data, a Vendor Risk Assessment is carried out, along with a Data Protection Impact Assessment, where needed.

Appendix A: Data Controller Names for the Central YMCA Group 

Data Controller: The Central Young Men’s Christian Association. Registration Number: Z670975X

Address:

112 Great Russell Street
London
WC1B 3BQ

Other Names:

CENTRAL SERVICES
CENTRAL YMCA
ONE KX
POSITIVE HEALTH
THE CLUB
YMCA AWARDS
YMCA FITNESS INDUSTRY TRAINING (YMCAFIT)
YMCA TRAINING

Appendix B: Data Protection Definition and Terms

Data
Information which is recorded in any format, whether stored electronically or in a structured paper-based filing system.

Personal Data 
Any information that identifies a living individual. This includes any expression of opinion about the individual and any Intentions towards the individual. 

Special Category Personal Data
Personal data relating to racial or ethnic origin, political opinion, religious beliefs, trade union membership, sexual life, physical or mental health, commission or alleged commission of any offence. 

Processing 
Any activity where the data is used, such as obtaining, recording, storing, viewing, copying, accessing, disclosing, erasing, destroying. 

Data Subject 
An individual who is the personal data relates to. 

Data Controller 
The organisation that determines how the personal data will be used and the way it will be processed.

Data Processor 
An organisation that processes personal data on behalf of a Data Controller. 

Subject Access Request 
A request by a Data Subject, to the data controller, asking to see their personal data. 

Third Party 
This can either mean that the data is about someone else, or someone else is the source; i.e. any other person or organisation other than -the Data Subject;

• the data controller; 
• a data processor.

Appendix C: Conditions for Processing Personal Data 

The UK GDPR  requires personal data to be processed fairly and lawfully, and, not to be processed unless one of the conditions (below) is met.

At least one of the following conditions must be met for personal data to be considered fairly processed:

• the individual has consented to the processing 
• processing is necessary for the performance of a contract with the individual 
• processing is required under a legal obligation (other than one imposed by the contract) 
• processing is necessary to protect the vital interests of the individual 
• processing is necessary to carry out public functions, e.g. administration of justice 
• processing is necessary to pursue the legitimate interests of the data controller or third parties 

Appendix D: Rights under the Act 

There are eight rights under the Data Protection Bill: 

1. The right to be informed
The right to be informed covers some of the key transparency requirements of the UK GDPR. It is about providing individuals with clear and concise information about what we do with their personal data.. 

2. The right of Access
The right of access, commonly referred to as subject access, gives individuals the right to obtain a copy of their personal data as well as other supplementary information. It helps individuals to understand how and why we are using their data, and check we are doing it lawfully. 

3. The right to rectification
Individuals have the right to have inaccurate personal data rectified. An individual may also be able to have incomplete personal data completed – although this will depend on the purposes for the processing. This may involve providing a supplementary statement to the incomplete data.

4. The right to erasure
Individuals have the right to have personal data erased. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances. 

5. The right to restrict processing
An individual has the right to restrict the processing of their personal data in certain circumstances. This means that an individual can limit the way that an organisation uses their data. This is an alternative to requesting the erasure of their data. 

6. The right to data portability
The right to data portability gives individuals the right to receive personal data they have provided to a controller in a structured, commonly used and machine-readable format. It also gives them the right to request that a controller transmits this data directly to another controller.

7. The right to object
Individuals have the right to object to the processing of their personal data. This effectively allows individuals to ask us to stop processing their personal data. The right to object only applies in certain circumstances. Whether it applies depends on our purposes for processing and our lawful basis for processing.

8. Rights in relation to automated decision making and profiling
Individuals who are Data Subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Appendix E: Privacy Electronic Communication Regulations 2003 

• The Privacy and Electronic Communications (EC Directive) Regulations 2003 (‘PECR’) are derived from European law. They implement European Directive 2002/58/EC, also known as ‘the e-privacy Directive’.
• PECR complements the general data protection regime and sets out more-specific privacy rights on electronic communications. It recognises that widespread public access to digital mobile networks and the internet opens up new possibilities for businesses and users, but also new risks to their privacy.
• PECR have been amended seven times. The more recent changes were made in 2018, to ban cold-calling of claims management services and to introduce director liability for serious breaches of the marketing rules; and in 2019 to ban cold-calling of pension schemes in certain circumstances.
• This guide covers the latest version of PECR, which came into effect on 9 January 2019, with some updates to cover changes made by the UK GDPR from 25 May 2018.
• The EU is in the process of replacing the e-privacy Directive with a new e-privacy Regulation to sit alongside the EU GDPR. However, the new Regulation is not yet agreed but will not be implemented in the UK. PECR will continue to apply alongside the UK GDPR.

Internal transfers

• Personal data shall not be transferred to a country or territory outside the United Kingdom (UK), unless that country or territory ensures an adequate level of protection for the ‘rights and freedoms’ of Data Subjects in relation to the processing of personal data.
• The transfer of personal data outside of the UK is prohibited unless one or more of the safeguards or exceptions specified below apply:

Binding corporate rules 
Central YMCA may adopt approved Binding Corporate Rules for the transfer of data outside the UK.

EU Standard contract clauses
Central YMCA may adopt approved EU model contract clauses for the transfer of data outside of the UK. If Central YMCA adopts the model contract clauses it will also incorporate the UK Addendum.  Alternatively, Central YMCA can rely on an International Data Transfer Agreement for any transfers of personal data out of the UK.  

Ad Hoc contractual clauses 
Central YMCA may adopt ad hoc contractual clauses that will have to be approved by the ICO. They allow the Central YMCA to individually tailor the transfer to its needs. 

Exceptions
In the absence of the above, transfer of data shall only take place subject to the fulfilment of the following conditions:

• the Data Subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the Data Subject due to the absence of an adequacy decision and appropriate safeguards;
• the transfer is necessary for the performance of a contract between the Data Subject and the controller or the implementation of pre-contractual measures taken at the Data Subject’s request;
• the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the Data Subject between the controller and another natural or legal person;
• the transfer is necessary for important reasons of public interest;
• the transfer is necessary for the establishment, exercise or defence of legal claims;
• the transfer is necessary to protect the vital interests of the Data Subject or of other persons, where the Data Subject is physically or legally incapable of giving consent;
• the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down in Union or Member State law for consultation are fulfilled in the particular case.

The Charity’s Data Protection Officer will assess the adequacy of the safeguards considering the following factors:

• the nature of the information being transferred;
• the country or territory of the origin, and destination, of the information;
• how the information will be used and for how long;
• the laws and practices of the country of the transferee, including relevant codes of practice and international obligations; and
• the security measures that are to be taken about the data in the overseas location. (This is a UK-specific option.)

A list of countries that satisfy the adequacy requirements of the Commission are published in the Official Journal of the European Union and in the UK GDPR.

Appendix F: Data Storage and Management 

Data storage 

These rules describe how and where data should be safely stored. Questions about storing data safely can be directed to the IT Manager or Data Protection Officer.

Hard Copies

• When data is stored on paper, it should be kept in a secure place where unauthorised people cannot see it.
• These guidelines also apply to data that is usually stored electronically but has been printed out for some reason. In such instances:
  • When not required, the paper or files should be kept in a locked drawer or filing cabinet;
  • Employees should make sure paper and printouts are not left where unauthorised people could see them, like on a printer;
  • Data printouts should be shredded and disposed of securely when no longer required. 

Soft Copies

• When data is stored electronically, it must be protected from unauthorised access, accidental deletion and malicious hacking attempts
• Data should be protected by strong passwords that are changed regularly and never shared between employees.
• If data is stored on removable media (like a USB, CD or DVD), these should be kept locked away securely when not being used.
• Data should only be stored on designated drives and servers, and should only be uploaded to an approved cloud computing services.
• Servers containing personal data should be sited in a secure location, away from general office space.
• Data should be backed up frequently. Those backups should be tested regularly, in line with the Charity’s standard back up procedures.
• Data should never be saved directly to laptops or other mobile devices like tablets or smart phones.
• All servers and computers containing data should be protected by approved security software and a firewall.

Data use

• Personal data is of no value to the Charity unless the business can make use of it. However, it is when personal data is accessed and used that it can be at the greatest risk of loss, corruption or theft
• When working with personal data, employees should ensure the screens of their computers are always locked when left unattended
• Personal data should not be shared informally. In particular, it should never be sent by email, as this form of communication is not secure
• Data must be encrypted before being transferred electronically
• Personal data should never be transferred outside of the UK
• Employees should not save copes of personal data to their own computers. Always access and update the central copy of any data.

Data accuracy

• The data protection legislation requires the Charity to take reasonable steps to ensure data is kept accurate and up to date.
• The more important it is that the personal data is accurate, the greater the effort the Charity should put into ensuring its accuracy.
• It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date possible.
• Data will be held in as few places as necessary and should not be duplicated wherever possible
• Staff should take every opportunity to ensure data is updated. For instance, by confirming a customer’s details when they call.
• Central YMCA will make it easy for Data Subjects to update the information the Charity holds about them. Data should be updated as inaccuracies are discovered. For instance, if a customer can no longer be reached on their stored telephone number, it should be removed from the database.
• It is the marketing department’s responsibility to ensure marketing databases are checked against industry suppression files every six months.

**Some processes are for internal use only.