The Basingstoke Canal Society and its trading subsidiaries are committed to protecting your privacy and security. This Notice explains how and why we use your personal data, and to ensure you remain informed and in control of your information.
“We” and “Us” – The Basingstoke Canal Society (formal title The Surrey and Hampshire Canal Society Ltd.) and our two trading subsidiaries John Pinkerton Canal Cruises Ltd. and Surrey and Hampshire Canal Cruises Ltd., hereafter all collectively referred to as “The Society”.
“Personal data” – any data which identifies you, or which can be identified as relating to you personally.
For the purposes of data protection law, The Society will be the data controller and data processor.
3. WHAT INFORMATION WE COLLECT
3.1. Personal data you provide
We collect personally identifiable data you provide to us. This includes information you give when:
- joining as a Society member (whether online or via paper-based form)
- registering online as a Canal Friend
- signing up as a volunteer
- making a donation or bequest or making a GiftAid declaration
- joining the “200 Club”
- communicating with us
- you place an order for goods or services (for example, booking a boat trip)
- The Society places an order with you for goods or services
- you require reimbursement for expenditure made on behalf of The Society
- browsing our websites
The data can include:
- Personal details, including your name, email address, postal address, telephone numbers (mobile and landline), date and place of birth (where required) and next of kin (where required)
- Financial information under particular circumstances, as follows: When The Society itself needs to make payments to other organisations for goods and services, or to reimburse expenditure made on behalf of The Society. In these cases, bank account information will be stored by our banking providers, currently CAF Bank, NatWest and HSBC.
Note: Although financial details are collected temporarily for the purposes of receiving membership and 200 Club subscriptions, donations, bequests and payments for goods and services that we provide, these details are not retained by The Society
- Details of your interests and preferences in how you would like to support us
- Skills and training data, in relation to your capability to use potentially hazardous tools and plant, or to undertake potentially hazardous operations, eg chain saw operation, tree felling, or crewing trip boats carrying fare-paying passengers
- Automatically collected tracking cookies that indicate Society web sites usage
3.2. Special Category (Sensitive) Data
We do not collect, store or process special category data (such as information relating to health).
4. HOW WE USE INFORMATION AND YOUR CONSENT
We only ever use your personal data with your consent, or where it is necessary:
- To enter into, or perform, a contract with you;
- for our own lawful, legitimate interests, provided your rights don’t override these.
In any event, we’ll only use your information for the purposes it was collected (or else for closely related purposes):
We use personal data for administrative purposes (that is, in order to run and administer The Society). This includes:
- receiving subscriptions and donations (including standing orders, direct debits or gift-aid instructions);
- maintaining databases of our members, friends, 200 Club subscribers and volunteers;
- meeting our obligations to members, friends, 200 Club subscribers and volunteers, including distribution of the Basingstoke Canal News magazine and online Basingstoke Canal Bulletin (unless you specifically ask us not to)
- our fulfilling orders for goods and services
- our placing orders for goods and services
- helping us respect your choices and preferences (for example, if you ask not to receive online promotional material, we’ll keep a record of this).
4.2. Promotional Materials and Consent
We will make extensive use of social media to promote The Society. Those wishing to receive these promotional updates need to “follow” The Society’s social media channels, and to “unfollow” if you wish to opt out of this.
Occasionally, we will use personal data to:
- communicate with people
- send out online newsletters (to members) and bulletins
- promote The Society, its activities, achievements and commercial operations, and canal-related events
- request for volunteer help with various canal-related activities
- elicit help with fundraising.
This includes keeping you up to date with Society news, and other canal-related information.
We will provide members, volunteers and other supporters the option to “opt in” to receiving such promotional information distributed by email, however please note that the Basingstoke Canal News pack distributed in the post may contain promotional inserts.
You can opt out of receiving online promotional information at any time. If you wish to do so, please use the consent form at basingstoke-canal.org.uk/consent/, or make contact using the details below.
5. DISCLOSING AND SHARING DATA
We will never sell your personal data, nor share it with another company or charity for marketing purposes.
Your personal data will be shared amongst the trustees/committee members of The Society, and designated volunteers who undertake specific tasks on our behalf, in order that we can fulfil our legitimate interests, including meeting our obligations to The Society membership and supporters.
We share personal data with suppliers who provide us with services:
- The electronic newsletter the Basingstoke Canal Bulletin is distributed via email by a third-party (YourMessageListProvider), to which Canal Friends subscribe
- A third-party (Fasthosts) hosts our web sites service
- A third-party facility (WebTicketManager) is used to take on-line bookings and payments for cruises on our two trip boats
- Mailchimp is used to distribute emails to trip boat operation volunteers
- Secured Google Drive and Dropbox are used for cloud storage of some data shared amongst trustee/committee members and designated volunteers.
Each of these organisations has their own privacy policies.
We will also share personal data at their request to the following regulatory and other organisations:
- The Basingstoke Canal Authority, in connection to navigation and volunteering
- The Maritime and Coastguard Agency, in connection with trip boat skipper training and licensing
- Our insurers (administered by the Inland Waterways Association), in connection with providing cover for volunteers who use potentially hazardous equipment (for example, chain saws).
We will only ever share your data when absolutely necessary and if the privacy and security of your data are guaranteed.
6. HOW WE PROTECT DATA
To protect your personal information, we will take whatever precautions we can and follow industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed, altered or destroyed.
Personal data collected and used by The Society will be stored on, or accessed via passworded computers always kept in the homes or offices of trustees/committee members or designated volunteers, and these may be backed up securely to a local device or to the cloud. Any memory sticks or paper-based records containing personal data, including historical archive materials, will be kept in locked cabinets or drawers.
7.1 Where we store information
The Society’s operations are based in the UK and generally we and our service providers store our data within the UK. However, the YourMessageListProvider service operates in the EEA, and the cloud providers and Mailchimp operate in the US.
7.2 How long we store information
We will only use and store information for so long as it is required for the purposes it was collected for. How long information will be stored for depends on the information in question and what it is being used for. We may also be required to store data for financial audit purposes or to satisfy insurance requirements.
That said, in general terms, we will retain personal data for up to 3 years following its last use, after which it will be deleted – an example of this is the personal data associated with a lapsed membership. Note that GiftAid information will be held for at least 6 years. However, if you request that we erase all your personal data, then that will be actioned as soon as possible.
If you ask us not to send you promotional information, we will retain your email address to ensure that we don’t send material to that email address again, with a record of your preference not to be emailed.
At the start of each financial year, we will review what personal data we hold and delete what is no longer required.
Note that our historical archives will be retained in perpetuity.
8. CONTROL OF YOUR PERSONAL DATA
8.1 Your rights
You may exercise the following legal rights regarding your personal data which The Society collects and uses:
- the right to confirmation as to whether or not we have your personal data and, if we do, to obtain a copy of the personal information we hold about you;
- the right to have your data erased;
- the right to have inaccurate data corrected;
- the right to object to your data being used for any purpose.
Please keep in mind that there are exceptions to the rights above and, though we will always try to respond to your satisfaction, there may be situations where we are unable to do so.
For further information on your rights or if wish to exercise them, please make contact using the details below.
Complaints to The Society should be directed via email to the contact address below. If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office which regulates and enforces data protection law in the UK. Details of how to do this can be found at www.ico.org.uk.
Cookies are small text files that are placed on your computer hard drive by a website. They contain anonymous data that is unique to your web browser and are used to track your use of the website.
The Society occasionally makes use of the Google Analytics web service, which evaluates your use of The Society’s websites and compiles website activity and internet usage reports. No personal data is collected from your computer, and it does not associate your IP address with any other data held by Google.
All major browsers allow you not to accept cookies – you can delete cookies that are already on your device and prevent them from being placed. However, if you do this, you may have to manually adjust some preferences every time you visit The Society’s websites, and some features may not work. By using our websites, you consent to the processing of data about you by Google in the manner and for the purposes set out above.
10. LINKS TO OTHER WEB SITES
11. CHANGES TO THIS NOTICE
We’ll amend this Notice from time to time to ensure it remains up-to-date and accurately reflects how and why we use your personal data. The current version of our Privacy Notice will always be posted on our website.
12. QUESTIONS AND CONTACT INFORMATION
If you would like further information on your rights regarding your personal data we hold and process, or wish to exercise them, or to raise a complaint, please contact us by email at firstname.lastname@example.org or call us on 01276-452754.