Background:

From May 2018 all organisations which use personal data of service users, staff or any other individuals need to be compliant with a new set of data protection regulations.

These regulations are referred to as GDPR.

GDPR overlaps with, and sit in relationship to the Privacy and Electronic Communications Regulations (PECR) which governs the use of electronic communications such as email and SMS messages.

This policy document, alongside with its related policies outlines in practical terms, how SanKTus will comply with GDPR and PECR.

Six Lawful Basis for Processing Data

There are six lawful bases for processing the data of an individual. In this instance ‘processing’ qualifies as both using their data to send information and using their data to achieve operational objectives.

The six lawful basis are;

1. Where we have the consent of the data subject

2. Where processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract

3. Where processing is necessary for compliance with a legal obligation

4. Where processing is necessary to protect the vital interests of a data subject or another person

5. Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

6. Where necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject.

While all six basis are of interest to Kentish Town Community Centre, within this policy paper we are primarily concerned with points one and six, consent of the data subject (individual) and purposes of legitimate interest.

Other Related Policies:

Consent and Legitimate Interest

The above covers what we can legitimately send to individuals and representatives of organisations, and the basis upon which e do this. In terms of GDPR the ‘use of data’ applies to using someone’s data to send them fundraising requests and other information which may (or may not) be of interest to them.

Consent or Opting In:

If an individual is new to Kentish Town Community Centre (in their own right or as the representative of an organisation), we will be explicit how we will use their data, which includes what we will send them at the point of sign-up. All communication will signpost the Privacy Statement and a Public Version of this paper. We cannot send any publications or correspondence which has not been made explicit at the point of sign-up, unless it meets a ‘legitimate interest’, of which the criteria is set out below.

Opting Out:

Above both consent and legitimate interest is the individual’s right, at any time, to make any changes to the ways in which Kentish Town Community Centre contacts them; through the mail, telephone, email, or messaging service. Any individual, either in their own right or as a representative of an organisation can request changes to what we send them and by which medium.

This includes opting out of all communications.

In the case of representatives of organisations, we can request the details of another individual who can receive the materials on behalf of the organisation.

Administrative Communication

In addition to these specific publications we will also send correspondence which relates to the administration of peoples relationship with Kentish Town Community Centre; for example a Thank You letter or email to acknowledge receipt of gifts or information regarding membership of Kentish Town Community Centre. These are contained within points 2 to 5 of the Six Lawful Basis above.

Retaining Consent:

If anyone falls outside of this ‘legitimate interest’ rationale, we will give them one opportunity to ‘opt-in’ before assuming their non-response represents an opt out.

Making changes to contact preferences

In all cases, Kentish Town Community Centre Coordinator is able to change people’s contact preferences. Where appropriate, the following contact details can be included on forms, or a visible place within any materials or publications.

To make changes to your contact preferences

Please email info@ktcc.org.uk or call 020 7482 3212

Changes to the way Kentish Town Community Centre complies with GDPR

This policy may be updated from time to time so you may wish to check it each time you submit personal information to Kentish Town Community Centre. If you do not agree to these changes, please contact us to change your contact preferences.

If material changes are made to the policy we will notify you through one of the mediums we currently use to communicate with you.

Data Protection Officer: we are required by law to have a person appointed to fulfil this role. Please contact Kentish Town Community Centre by phone, text or email for details.