This website is operated by Lyndhurst and District Community Association, Registered Charity number 301883, also known as Lyndhurst Community Centre, and referred to in this document as ‘the Centre’, ‘we’ or ‘us’. This notice provides you with details of our policy for collecting and processing your personal data collected through this website www.lyndhurstcomm.org

The Data Controller for this website is Lyndhurst and District Community Association. If you wish to view the information we store about you, have it corrected, or request for it to be deleted please contact the Manager at admin@lyndhurstcomm.org

What information do we collect about you?

We collect the following types of personal data in order to operate the Centre. Personal data is any data which could be used to identify an individual person. It does not include anonymised data, or data which relates solely to a corporate entity.

We may collect and process the following personal data:

• Identity data may include first name, last name, username, date of birth, title and gender
• Contact data may include contact address, billing address, delivery address, email address, phone number(s)
• Financial data may include bank account details. We do not store debit or credit card details on this website or on any systems within our company. We may transfer you to a Paypal or Stripe payment gateway in which case they will process your data in line with policies which may be viewed on their websites https://www.paypal.com and https://stripe.com/gb
• Transaction data may include details of payments and transactions between us
• Technical data may include your IP address, login information, browser type and device type, operating system and platform, time zone setting and location. We do not correlate this data to any identifiable individual.
• Profile data may include username and encrypted password, purchases and orders, your account preferences and interests, review feedback and survey responses.
• Usage data may include information about how you use our website such as which pages you have visited, when and for how long. We do not correlate this data to any identifiable individual.
• Marketing and communications data may include your preferences as to how you would like to be contacted by us.

We make use of aggregated data collection through services such as Google Analytics for website traffic but we never use such data to identify individuals and regard it as anonymised for the purposes of this policy.

We do not collect any Sensitive Data about you such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data or information about criminal convictions and offences.

If we operate any service which is targeted at a sexual, religious or ethnic minority, that service is equally available to all and not just to that minority, and any use by you of that service is not regarded as inferring that you are a member of that minority.

Where you have established a contract with us e.g. for the supply of facilities or services, or where we are obliged by law to process certain data about you, we will only be able to deliver the contract if you provide us with the necessary personal data. If you don’t provide us with that data, we will not be able to fulfil the contract. We will endeavour to immediately inform you that we are not able to fulfil the contract for this reason, provided that we have contact data for you.

How we collect your personal data

We collect personal data by a number of methods:

• direct contact via email, phone, post, or contact form on this website
• ordering a product or service
• signing up to any membership area on this website
• signing up for any newsletter
• requesting resources or quotations to be sent to you
• automated technologies such as Google Analytics. Such data will normally be treated as anonymous
• cookies to maintain logged in user sessions (please see our cookie policy)
• webserver logs – server logs will store IP addresses but we never relate these to any individual
• public domain resources such as your own website, Companies House, or public directories

How do we use your data?

We will only process your personal data legally and fairly. We may use it for the following purposes:

1. to perform a contract between us for the delivery of goods or services
2. where it is in your legitimate interest and/or our legitimate interest to process your data, such as replying to a question which you have submitted via our contact form or an email link on this website
3. where there is a legal requirement for us to comply with a statutory obligation such as taxation or employment law
4. Where you have consented to receive marketing material by signing up for a newsletter

Generally unless stated otherwise we rely on the first of these purposes, the existence of a contract between us for the supply of products or services. The situations in which we may rely on different purposes are listed below.

Where we are contacting you solely for marketing purposes, other than in relation to a service which we currently supply to you, or have supplied within the past 12 months, then we will rely on your consent to send you marketing material and will request that consent in a clear and unambiguous manner. You may withdraw your consent at any time by emailing us at admin@lyndhurstcomm.org or by using the unsubscribe link on any newsletter which we send to you.

If you withdraw your consent for receiving marketing communication this will not apply to any personal data stored in the course of fulfilling any contract with you, which will be retained for a period of 7 years in order to comply with taxation law.

We will only use your personal data for the purpose for which we collected it, unless we have subsequently obtained your consent to use it for a different purpose, or need to do so in our own legitimate interest such as debt collection.

All the personal data we process is processed by our staff or subcontractors in the UK. For the purposes of IT hosting and backup copies of this information may be stored on servers elsewhere within the European Union. No 3rd parties will be permitted access to use your personal data unless the law allows them to enforce this.

We have a Data Protection regime in place to oversee the effective and secure processing of your personal data.

Who will we share your data with?

We do not share your data with third parties for their use, unless obliged to do so for legal reasons. Your data may be processed on our behalf by our subcontracted Data Processors such as bookkeepers and accountants, payroll bureaus, debt collection agencies, website hosting providers, marketing agencies working on our behalf, and other subcontractors acting on our behalf. These subcontractors will only process your data in line with our instructions.

Accessing and correcting your information

You have the right to request a copy of the information that we hold about you. If you would like a copy of your personal information held by us, please email admin@lyndhurstcomm.org or write to us at Lyndhurst Community Centre, Central Car Park, High Street, Lyndhurst SO43 7NY.

We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.

What are your rights

If at any point you believe the information we process on you is incorrect you can request to see this information and have it corrected or deleted. If you wish to raise a complaint on how we have handled your personal data, please contact us at the above address so that we can investigate.

If you are not satisfied with our response you can complain to the Information Commissioner’s Office https://ico.org.uk/ . However we would appreciate it if you can first contact us to express your dissatisfaction so that we can attempt to resolve your concerns.

Policy updated 24/05/2018