(Where the words 'BAY Centre', 'us' or 'we' are used it will mean the registered charity known as the 'Burnham Area Youth Centre', registration number 304500.)
A new EU General Data Protection Regulation (GDPR) came into effect on 25th May 2018. This new regulation changes the way that businesses and charities process personal data.
This Retention Policy explains how long the BAY Centre keeps documents and records that may contain personal data.
Any personal data like names and contact data like emails, phone numbers, addresses or Employee bank details that are contained in any documents pertaining to the contract between the BAY Centre and the Hirer, Vendor or Employee will be kept for 7 years from the last date that the contract expired or terminated. 7 years will meet the legal obligations to retain documents as specified in the Charities Act & HMRC.
Data may be contained in, but not restricted to, -
• booking forms, • Emails concerning all aspects of the contract • Invoices • Receipts
Contact data held in our contact spreadsheet, Gmail contacts lists and phone contact lists will be deleted 15 months after the last contract we had with a Hirer, the last contract we had with a Vendor or the leaving date of an Employee.
The BAY Centre keeps it for 15 months in case of further bookings or further Vendor contracts and, in the case of an Employee, the need for a reference.
The EU General Data Protection Regulation requires the BAY Centre to keep records of any requests made under an individual’s right to view their personal data, amend their personal data, object to the use of their personal data, request deletion of their personal data and requests for data portability.
The BAY Centre will keep any SAR records for 7 years.
4. Hirers Contact details on our website, www.bayc.uk
The BAY Centre will, with an individual's consent, show the individual’s contact details for a Hirer (Group) on our websites.
The BAY Centre will delete any personal contact data shown on our website, www.bayc.uk - • 15 months after the Hirer (Group) last hired a BAY Centre room • Immediately, if requested by the individual or it is known that the Hirer (Group) will not rebook (e.g. the group has disbanded)
The BAY Centre will delete any personal data held in documents pertaining to a Volunteer’s work after 15 months after a volunteer stops volunteering. Any Volunteer/ Committee members/Trustees names that are recorded in BAY Centre meeting minutes or Administration documents will be retained for the length of time the BAY Centre remains a registered Charity plus two year. This will meet our legal obligations under the Charities Act.
Volunteer contact data held in the BAY Centre contact spreadsheet and email Gmail contacts lists will be deleted • 15 months after the Volunteer as ceased volunteering. • Immediately if requested by the Volunteer
The BAY Centre will keep any Donor personal data contained in documents or emails pertaining to the donation for 7 years after the donation. 7 years will meet the legal obligations to retain document including correspondence pertaining to a donation as specified in the Charities Act.
The BAY Centre will delete any Donor information held in a publicity article held on the the BAY Centre website, www.bayc.uk or BAY Centre Facebook website - • 15 months after the Donor donated • Immediately, if requested by the Individual
The BAY Centre will keep any Grantor personal data contained in documents or emails pertaining to a grant for 7 years after the award. 7 years will meet the legal obligations to retain document including correspondence pertaining to a grant as specified in the Charities Act & HMRC.
The BAY Centre will delete any Grantor personal data held in a publicity article held on the BAY Centre website, www.bayc.uk or BAY Centre Facebook website - • 15 months after the grant has been awarded • Immediately, if requested by the individual
The BAY Centre will delete any personal data held in a publicity article published on the BAY Centre website or BAY Centre Facebook website - • 15 months after the publicity article has been published • Immediately, if requested by the owner of the personal data
In the case of photos, it may be that blurring the individual’s image and blanking out a person’s name may be sufficient.
The BAY Centre deletes the CCTV images captured in the hallway & exterior 28 days after their capture.
If the BAY Centre receives an objection to the capturing of an individual’s image by the CCTV camera then the BAY Centre is obligated under the GDPR to assess whether the individuals rights and freedoms outweigh the the BAY Centre’s Legitimate Interest in detecting and preventing crime and providing a safe and reassuring environment for all and, if the BAY Centre agrees with the individual, then the images will be deleted or rendered unrecognisable. If the individual does not agree with the BAY Centre’s assessment then the individual has the right to complain to the ICO.
March 2018 Document initially published. The policy is one of a series of policy documents that replace all previous policy documents that existed in a variety of different formats, some electronic, some paper and some verbal.
