privacy policy

Data Protection Policy

This Data Handling Policy sets out how Transition Tynedale ltd. collects, stores, processes and uses personal data in accordance with the General Data Protection Regulation 2016 (“GDPR”). This policy applies to all personal data we process for all purposes related to membership and to all our volunteers.

Data Protection Principles

We will comply with the following data protection principles under the GDPR:

1) Personal data will be processed lawfully, fairly and transparently

2) Personal data will be collected for specified, explicit and legitimate purposes

3) Personal data will be adequate, relevant and limited to what is necessary

4) Personal data will be accurate and kept up to date

5) Personal data will not be kept for longer than necessary

6) Personal data will be processed in a manner that ensures appropriate security

7) TT will be accountable for complying with these principles

Legal Basis for Processing Data

We will process personal data only where we have a legitimate reason, such as:

1) Where we need to comply with a legal obligation

2) Where we have obtained consent from the data subject

4) Where it is necessary for our legitimate interests like holding a database of membership and for sharing project information

Data Collection

We will collect personal data by lawful and fair means, and only where it is necessary for the purpose. Where possible, we will collect data directly from the data subject. We will inform the data subject about the purpose of the data collection, any third-party recipients, the right to access, rectify, and erase the data and the right to lodge a complaint.

Data Storage and Retention

We will store personal data securely and ensure that it is not accessible by unauthorized third parties. We will keep personal data only for as long as necessary for the purpose for which it was provided or as required by law. Once the retention period ends, we will delete or anonymize the data

Data Processing

We will ensure that personal data is processed in accordance with the data protection principles and that it is only used for the purpose for which it was collected. We will not disclose personal data to third parties, except as necessary for the purpose. We will ensure that any third party who processes personal data on our behalf is reliable and has adequate security measures in place.

Data Subject Rights

We will respect the rights of data subjects, including the right to access, rectify, erase, restrict or object to processing, the right to data portability, and the right not to be subject to automated decision making or profiling. We will respond to requests for data subject rights within one month.

Data Breach

We will report any data breach to the Information Commissioner’s Office within 72 hours and to the data subject, where the breach is likely to result in a high risk to their data rights and freedoms.

Training

We will provide regular data protection training to all employees /volunteers regarding our data protection policies and procedures.

Policy Review

We will review our Data Handling Policy regularly to ensure that it remains effective and complies with new data protection legislation.