PRIVACY POLICY.

We will only process data using one or more legal bases.    We will always use consent as the basis for any email marketing.  The basis on which we process data will be recorded in an appendix to this policy.

When new data is collected we will document the legal basis and amend this policy and our privacy notice as appropriate.

We will explain our policy in a privacy notice which will be posted online and linked to from our newsletters, referenced on our forms and on our website.  The privacy notice will be updated from time to time as necessary.

We will only use the data for the purposes that are specified.  We will keep data for our different projects and member types separate and not use data collected for one purpose for another purpose unless we first obtain consent.  We will not pass, sell or release data to any third party without consent unless legally required to do so.

We will only collect data that is relevant to the purpose for which it was collected and we will review at least annually whether the data is still relevant to that purpose.  We will aim to collect the minimum amount of data that is necessary. 

We will make it easy to opt out of email newsletters using an unsubscribe link in each email.

Members of the organisation can update their data when renewing their membership or on request to the membership secretary.  Network members can update their own profile information to ensure it is accurate themselves using their log-in.  Newsletter list subscribers can amend their data by using a link in each newsletter.

We will not ask or require individuals to provide personal data on social media which we do not control. Individuals may of their own volition post personal information to our social media addresses or our website. We will keep Network member data and newsletter list data as long as the subscription remains in force.  We will keep member data for up to two years after a member’s subscription lapses.

We will respond to all requests relating to access, rectification, erasure, restriction of processing or objection in line with data subjects rights.  Data subjects can make such requests by email to info@sustainablehackney.org.uk or in writing to the address of the organisation. See Appendix 3 for details of rights and how we respond to them.

We will use our best endeavours to ensure data is protected from loss and not transferred outside the EEA without adequate protection.

We have checked and are satisfied with the data privacy and security policies of our non EEA data processing partners, Ning (network members) and Mailchimp (newsletters).  

1. We have set up an EU Privacy Shield agreement with Mailchimp.

2. We will limit access to personal data to those who need it for their role.

3. We will ensure that personal electronic data is password protected.

4. We will avoid inadvertent disclosure of personal emails by using BCC where appropriate.

5. We will make regular backups of member data, network data and mailing list data, which will be kept secure.

We will report any substantial data breach to the Information Commissioner and, where appropriate, to the data subject.