The Data Protection Act 1998 (DPA) and the General Data Protection Regulation (GDPR) govern how personal data is collected, stored, and used.
Personal data means any information that can identify a living person—for example, names, addresses, phone numbers, or email addresses.
Lawful Basis for Processing Personal Data
The Charity processes personal data under one or more of the following GDPR Articles:
6(1)(b) – To perform a contract with you, or to take steps before entering into a contract.
6(1)(c) – To comply with a legal obligation (e.g., VAT reporting).
6(1)(f) – For legitimate interests pursued by the Charity or a third party, unless these are overridden by your rights and freedoms, especially where children are involved.
9(2)(b) – To meet obligations under employment, social security, or social protection law, or a collective agreement.
How We Use Your Personal Data
The Charity will only use your personal data for:
Complying with legal obligations
Managing the hall, its bookings, and finances
Running and marketing events
Employing staff
Fundraising activities
We will not process personal data on the basis of consent (Article 6(1)(a)). Your data will only be collected directly from you.
What We Will Not Do
The Charity will not:
Process children’s personal data
Process sensitive personal data (see below)
Process personal data requiring explicit consent
Share your data with other organisations unless required by law
Transfer your data to another country unless required by law
Carry out automated decision-making or profiling
Sensitive Data includes:
Racial or ethnic origin
Political or religious beliefs
Trade union membership
Physical or mental health information
Sexual orientation
Criminal records or proceedings
Data Retention
Personal data may be kept for up to 7 years for accounting and legal purposes, or longer if required by insurers.
Your Rights
As the owner of your personal data, you have the following rights:
Right to be informed – You will be given a Privacy Notice explaining how your data is used.
Right of access – You can request a copy of the personal data we hold about you (Subject Access Request).
Right to rectification – You can ask us to correct inaccurate or incomplete data.
Right to erasure – You can request deletion of your data if it is no longer needed, processed unlawfully, or must be erased for legal compliance.
Right to restrict processing – You can request that we store your data but do not use it, for example while verifying accuracy or if you oppose erasure.
Right to data portability – You can request your data in a structured, commonly used format.
Right to object – You can object to processing based on legitimate interests, unless we have overriding lawful grounds.
Rights related to automated decision-making and profiling – The Charity does not use these methods.
How to Exercise Your Rights
You can make a request by contacting the Data Protection Officer:
Phone: 07747 860 592
Email: dpo@wasahall.co.uk (please include a contact phone number)
Post:
Data Protection Officer
Washington Village Memorial Hall
School Lane
Washington
RH20 4AP