Privacy Notice – Climate Action Menston

Version Date: 23 January 2021

This Privacy Notice sets out how we use and share personal data at Climate Action Menston (CAM).

1. WHO WE ARE AND HOW YOU CAN CONTACT US

About us

We are Climate Action Menston (CAM), which is a not-for-profit organisation based in Menston, West Yorkshire, UK. We work with other groups in Menston and the surrounding area but please note that this privacy notice only covers the activities of CAM.

To the extent CAM processes personal data (or to the extent personal data is processed on its behalf) CAM is a controller of personal data and as such CAM is responsible for ensuring that the data is used fairly and lawfully.

Contact details

You can contact us about issues relating to personal data, including the contents of this notice, by the following method:

Email: info@climateactionmenston.org.uk

2. STATUS OF THIS PRIVACY NOTICE

This Privacy Notice governs how we, Climate Action Menston, use your personal data. If you use our website or use our collaboration platform, you will need to consult the privacy notices provided by our website host and the collaboration platform provider respectively to understand how your personal data will be processed by those persons. Please refer to section 7 for more information and links to their respective privacy notices.

3. WHAT PERSONAL DATA DO WE PROCESS AND WHAT DO WE USE IT FOR

This section explains the personal data about you that CAM processes.

Membership registration

When you join CAM as a member we will usually ask you to give us some information which would constitute personal data. That information, as at the date of this Privacy Notice, is the following:

your name;
your address; and
your preferred email address.

This information is used to ensure we:

maintain an accurate record of our members and our Executive Committee;
are able to effectively contact those members in the furtherance of CAM’s constitution and the good running of the organisation;
to inform you of events and meetings; and
to publicise the activities of CAM.

Using our website

When you access our website (currently accessible at https://climateactionmenston.org.uk/), we (or a third party on our behalf) may process some information which might constitute personal data. That information may vary but, as at the date of this Privacy Notice, it is the following:

any user input you provide when completing the contact form on our website; and
information obtained via cookies or text files placed on your user terminal by our servers (or those of our service providers) or by other technological means, in all cases when you access the website.

This information is used to allow you to use the website and, depending on some of your choices (eg with respect to cookies), to optimise your experience of the website. The user input is also used to help us manage our records and create a membership for you.

Using our collaboration platform

When you access our account on our collaboration platform, we (and the third party collaboration platform provider on our behalf and their own behalf) may process some information which might constitute personal data. That information may vary but, as at the date of this Privacy Notice, it is the following:

your name and any identifying information you may provide (for example profile pictures) whether on registration, logging in or thereafter;
any user input you provide when adding posts, maintaining threads and adding documents to the channels on the platform or when engaging in direct messaging on the platform;
information obtained via cookies or text files placed on your user terminal by the platform provider’s servers or by other technological means; and

This information is used to allow you to access and use the collaboration platform and, depending on some of your choices (eg with respect to cookies), to optimise your experience of the platform. The user input is also used to help us manage our membership records.

CAM’s activities

We may, whenever we are undertaking activities in CAM’s name, use your personal data. Such activities will vary in line with the programme of initiatives which CAM undertakes from time to time but will include the following (and the information in brackets is the personal data we would expect to process and examples of the purpose to which it would be primarily put):

tree planting and other physical, environmentally-focused activity (name and contact details and photographs; for health & safety and publicity reasons);
banking (name and contact details; for registration, contact, and due diligence purposes[1]);
fundraising (name and contact details; for registration, contact, due diligence and publicity purposes);
communications in line with and in furtherance of the constitution of CAM. This would include notifications of meetings of CAM (name and contact details; for registration, contact and constitutional purposes);
surveys. CAM will from time to time undertake surveys of its members and of the broader community (name and contact details, special categories of data (provided appropriate additional grounds for processing are established); for registration, contact and analytical purposes); and
lobbying and consultation responses made in the name of CAM (name and contact details; for registration, contact and publicity purposes).

4. WHAT DO WE USE PERSONAL DATA FOR?

We use such personal data as part of our activities as more fully described in section 3. We also may have to use personal data for legal and regulatory purposes. For example, this might include responding to complaints or enquiries from members or regulators about how we have used personal data.

5. HOW LONG IS THE PERSONAL DATA KEPT FOR?

We keep personal data only for as long as is necessary for the purposes for which it is held. You will need to contact us (see section 1) for our specific activities in order to find out exactly how long the data is kept for. The main points we think you might be interested in are:

Your membership information generally stays on our live membership directory for only as long as you are a member. After that it is moved to our legacy membership register and is not used to contact you, but it is still used for a further two years for statistical analysis purposes.
Your personal data on our website is held in accordance with our service provider’s privacy notice. Please refer to section 7 for more information and a link to their privacy notice. We do not separately retain any information about your website usage.
Your personal data on our collaboration platform is held in accordance with our service provider’s privacy notice. Please refer to section 7 for more information and a link to their privacy notice.

6. WHAT IS OUR LEGAL BASIS FOR HANDLING PERSONAL DATA?

This section explains the legal basis on which we process your personal data.

Legitimate interests

The UK’s data protection law allows the use of personal data where necessary for legitimate purposes provided that this isn’t outweighed by the impact it has on you. The law calls this the “legitimate interests” condition for processing personal data.

Most of our processing activities are based on the legitimate interests condition. This includes almost all of our membership activity.

Consent

We sometimes rely on consent in order to process personal data, but this is relatively rare. It is used as the basis for sending some of our promotional materials, for example, and may be the basis for undertaking surveys in which you participate.

7. WHO DO WE SHARE THE PERSONAL DATA WITH?

Our service providers

We may provide your information to third parties who help us use it for the purposes described in section 3. For example:

Our databases of personal data (for example, membership register) may be hosted by third parties on our behalf (for example by a cloud service provider).
Sometimes we may use tools which rely on us sending personal data to third parties who then analyse it and return the results to us.
We may use third party email broadcasting services in order to send emails to our members.
We may use online surveyors in order to undertake surveys of our members, individuals who access our website and the general public.
We may use payment service providers in relation to any payments made by individuals (e.g. membership dues).
We may use cloud-based technologies such as Microsoft Office 365 in the course of our ordinary operations.

These service providers are generally not allowed to use information for their own purposes or on behalf of other organisations.

A list of service providers with whom we deal is set out below, although the list may be updated from time to time.

Service Provider	Function	Privacy Notice URL
WordPress.org	Website host	https://en-gb.wordpress.org/about/privacy/
Slack	Collaboration platform host	https://slack.com/intl/en-gb/privacy-policy

In some cases, our service providers may appoint an intermediary to act on their behalf; these intermediaries will often receive the data too. For more information on this, please refer to the privacy notices for the relevant service provider.

Bank

We may from time to time need to transfer personal data to the bank that is providing us with banking services as part of their due diligence and account management processes. It is highly likely that this will be restricted to the personal data relating to members of the Executive Committee.

Fundraising

If we undertake fundraising, we may need to transfer personal data to the organisation that is offering us funds as part of their due diligence processes.

Regulators

We may sometimes need to pass personal data to a regulator such as the Information Commissioner’s Office or the Charity Commission for England and Wales.

Sharing of anonymised data with third parties

We may share anonymised information with other third parties, but only where the information cannot realistically be identified as relating to you.

8. WHERE IS THE PERSONAL DATA STORED AND SENT?

Within the UK

We are based in the United Kingdom and will access and your information from here.

Elsewhere

We also send information elsewhere in the world. For example, where we use service providers who employ cloud-based technology or a data centre or backup facility overseas. People in other countries may also need to access that database for purposes such as technical support or system development and testing.

While the UK, other member states of the European Union and some other countries ensure a high standard of data protection law, some parts of the world may not provide the same level of legal protection in relation to personal data. As a result, when we do send personal data overseas, we will make sure that suitable safeguards are in place to protect the information. For example, these safeguards might include:

Putting in place a contract with the recipient containing terms which have been approved by the authorities as providing a suitable level of protection.
Sending the information to an organisation which is a member of a scheme which has been approved by the authorities as providing a suitable level of protection.

If your information has been sent overseas like this, you can obtain further information about the safeguards used by:

referring to the privacy notice relevant to the particular service provider as we make known to you; or
contacting us using the details set out in section 1 above.

9. IS THE PERSONAL DATA USED TO MAKE DECISIONS ABOUT YOU OR TO PROFILE YOU?

Decision-making

We do not use personal data to make automated decisions that have significant effects for you. However, some of our service providers (for examples, the bank or any parties offering funds) may do so as part of their own processes but that is only expected to apply to members of the Executive Committee of CAM.

Profiling

We do not perform profiling activities using your personal data.[2]

10. THIRD PARTY LINKS

Our website may contain links to other websites provided by third parties not under our control. When following a link and providing information to a third-party website, please be aware that we are not responsible for the data provided to that third party. This Privacy Notice only applies to our own website listed in section 3, so when you visit other websites, even when you click on a link posted on our website, you should read their own privacy policies.

11. WHAT ARE YOUR RIGHTS IN RELATION TO THE PERSONAL DATA THAT WE HOLD ABOUT YOU?

You have several different rights in relation to the personal data that we hold about you. These are briefly described below. To enquire about exercising these rights, please refer to the contact details in section 1.

Access: You have a right to find out what personal data we hold about you, and certain other information such as how we are using it.
Rectification: If the information that we hold about you is inaccurate or out of date, you have a right to ask us to correct it.
Objection to direct marketing: You have the right to object to us using your personal data for direct marketing purposes. If you do this we will stop using it for those purposes.
Objection to legitimate interests: If you disagree with us relying on the legitimate interests grounds for using your personal data (see section 6 above), you can object to us doing so. We will then reassess the extent to which we can continue to use the data in light of your particular circumstances.
Withdrawal of consent: When we rely on your consent to use your data (see section 6 above), you have the right to withdraw that consent at any time.
Erasure: In certain circumstances you can ask us to delete your personal data from our systems. However, this usually won’t apply to all of your data because we might have good reason for needing to keep some of it. For example, if you object to us using your data for direct marketing purposes we will need to keep a record of that objection so that we do not subsequently begin direct marketing activities in relation to you if we receive your data again.
Restriction: In some circumstances you can ask us to restrict the ways in which we use your personal data.
Portability: In some circumstances you have the right to receive some limited kinds of information in a portable format.

12. WHO CAN YOU COMPLAIN TO IF YOU ARE UNHAPPY ABOUT THE USE OF YOUR PERSONAL DATA?

We try to ensure that we deliver the best levels of data stewardship but if you are not happy you should make contact so that we can investigate your concerns. Please contact us using these details:

Email: info@climateactionmenston.org.uk

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), which is the body that regulates the handling of personal data in the United Kingdom. You can do this online through the ICO’s website at www.ico.org.uk, by telephone on 0303 123 1113, or by writing to them at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

[1] This would only apply to some members of the Executive Committee.

[2] When we refer to profiling, we mean using personal data to make predictions about you, or to categorise you into particular groups.