Data Protection

FEB 2024

DATA PROTECTION PROCEDURE

This procedure is to help the committee of directors collect, store, use, amend, share, destroy and delete shareholders’ personal data in line with the Company’s data protection policy.

Only members of the committee have access to the personal data covered by the policy. The committee will ensure that new committee members understand their responsibilities when handling shareholders’ data.

A. COLLECTING DATA

Shareholders

1. We keep: 

A List of Shareholders.  This consists of shareholders’ names, chalet number, home address if different, email address, telephone number, and any individual contact requirements.

A Register of Shareholders.  This consists of shareholders’ names, chalet number, home address if different, number of shares held, the cost, date becoming a shareholder, and date they cease to be a shareholder.

2. We will not use the list of shareholders in any way that the shareholders have not explicitly consented to.

Directors

1. The Companies Act 2006 says every company must keep a register of its directors which should be available for inspection at the company’s registered office.  The register shows name and any former name; a service address; the country or state (or part of the United Kingdom) in which the director is usually resident; nationality; business occupation (if any); date of birth.  This information is provided to Montpelier when a director is elected. 

B. STORAGE OF PERSONAL DATA

1. All personal data must be kept securely.

2. Each committee member has a copy of the shareholders’ personal data. 

3. Personal computers, laptops and any other device used to store shareholders’ personal data must: be password protected with a strong passwordhave up-to-date software to protect from malware and viruses.

4. Personal data stored on the internet (e.g. attached to emails, in Google Drive, in Dropbox etc) must be with companies that are UK-GDPR compliant.

5. Personal data stored on paper will be kept in a locked facility.

6. Personal data must not be kept on an ad-hoc basis in personal notes, phones and address books.  It must be added to the central list and deleted from personal phones etc.

C.SHARING PERSONAL DATA WITH OTHERS  

Shareholders 

1. Shareholders’ names are registered at Companies House.  This is a legal requirement. This list is updated annually on 1st August by Montpelier Professional (Galloway) Ltd on behalf of Isle of Whithorn Leisure Limited.  The information is provided by the committee secretary.

2. We must request explicit consent from a shareholder if we need to share personal data with third-parties, (unless we need to do so to fulfill a contract, comply with the law, protect someone’s life or fulfill a public task). Third-parties might be other organisations, but they might also be members of Isle of Whithorn Leisure Limited. Each shareholder is separate from the group itself, and data should not be shared with other shareholders to use in a personal capacity without the explicit consent of the shareholder it relates to.

3. We must be careful to not accidentally share personal data, including with other shareholders. For example, if we send an email to all shareholders, we should not type all the email addresses into the “To” field. By doing this we are sharing all the email addresses with everyone on the list. We must use the “Bcc” field instead. This hides everyone’s email addresses.

Committee members’ data

1. Committee members need to be in contact with one another to carry out tasks on behalf of Isle of Whithorn Leisure Limited and to ensure its legal obligations are met. 

2. Committee members will not pass each other’s contact details onto other people outside the committee without specific consent.

3. Committee members will not use each other’s contact details for anything other than Isle of Whithorn Leisure Limited’s business without specific consent.

4. If someone leaves the committee the other committee members will delete their details, and vice versa, unless specific consent is given to keep them

5. Only the treasurer’s and secretary’s contact details will be on Isle of Whithorn Leisure Limited’s information unless other committee members give their specific consent. 

D. REMOVAL OF PERSONAL DATA 

1. When we have finished using personal data for the purpose it was collected for, it will be deleted, e.g. when a chalet is sold the shareholder’s data will be deleted from the List of Sharehoders. It should not be kept in case we might need it again for something. 

2. When data is deleted, we must be sure it cannot be accessed by someone else, i.e. permanently delete it electronically, or shred if paper.

3. Shareholders have a legal obligation to pay the annual maintenance levy and to abide by the Burdens so we need to have their personal data.  The UK-GDPR gives people the right to ask an organisation to delete their personal data unless the organisation has a specific legal obligation to keep it. While a person is a chalet owner/shareholder we will not agree to a request to have personal data removed from our records as we need the information to carry out our legal duties.

E. IF WE HAVE NOT PROTECTED SOMEONE’S DATA PROPERLY

1. There are lots of ways that there might be a “data breach”. For example: Theft of a laptop or phone with contact details stored on it.

Accidentally sending an email with everyone’s email addresses visible.

Sending personal information to the wrong recipient by mistake Losing the paper forms with owners’ personal details on.

2. The most important thing is to recognise when something has gone wrong, so we can take steps to reduce the impact it will have, and to avoid it in future. 

3. Action to take if there is a data breach:

Inform the other committee members that a breach has happened and how it occurred. The committee should seek to rectify the cause of the breach as soon as possible to prevent further breaches.

Try to get the data back. For example, if we have accidentally emailed someone’s details to the wrong person, contact that person and ask them to delete the information.  

If the data breach is not likely to have a significant impact on the shareholder/s, we should record that it has happened and the action taken, e.g.in committee meeting minutes, and take steps to avoid it re-occurring. 

If the data breach is more serious and will/could have a significant impact on the shareholder’s life it needs to be reported to the person whose data is affected and, depending on the ramifications of the breach,  to the Information Commissioner’s Office (ICO) within 72 hours.  For example, if a laptop is stolen that holds shareholders’ details, we should tell all shareholders. It is much better for the ICO to hear about a data breach from us than from 

someone else. This will show that we are a responsible organisation that takes data protection seriously, which makes it less likely they will have significant concerns about us or issue a penalty fine. Large fines are not intended for small organisations/groups.

A breach must be investigated, a record kept of the breach and the action taken, and all those involved notified of the outcome. 

4. Where a shareholder complains of a breach by a committee member

1. A committee member will ask the shareholder to provide details of the alleged breach in an email or letter.

2. The alleged breach must then be investigated by committee members who are not implicated in the allegation. 

3. A record must be kept of the alleged breach, the investigation and the action taken, and all those involved notified of the outcome.

F. REVIEW

1. These procedures will be reviewed every 12 months.