Policy statement
Club AUsome processes personal information in accordance with the United Kingdom General Data Protection Regulation and the Data Protection Act 2018. We apply data protection principles to paper records, digital systems, photographs, recordings, communications and information shared with service providers.
Data protection principles
We process data lawfully, fairly and transparently; collect it for specified purposes; limit collection to what is necessary; keep it accurate; retain it no longer than needed; protect it with appropriate security; and remain accountable for compliance.
Lawful bases
Depending on the activity, we may rely on consent, contract, legal obligation, vital interests, legitimate interests or public-task provisions where applicable. Special-category data, including health information, is only processed where an additional legal condition is met and suitable safeguards are in place.
Children and additional-needs information
We may need information about health, disability, communication, allergies, emergency contacts or reasonable adjustments to deliver activities safely and inclusively. Access is limited to people who need the information for their role.
Individual rights
People may have rights to access, correct, erase, restrict or object to processing, and in some situations to data portability. Consent can be withdrawn where consent is the lawful basis. Requests should be sent to hello@clubausome.co.uk and will be handled within the legal time limits.
Security
We use access controls, strong authentication, secure storage, appropriate device security, supplier checks and staff or volunteer training. Sensitive records are not shared through unapproved channels.
Retention
Retention periods are set according to legal, safeguarding, insurance, financial and operational needs. Safeguarding information may need to be retained for substantially longer than routine enquiries. Records are securely deleted or anonymised when retention is no longer justified.
Data breaches
Suspected personal-data breaches must be reported immediately to the charity’s Data Protection Lead. We will contain and assess the incident, document decisions and notify the Information Commissioner’s Office and affected individuals where required by law.
Suppliers and international transfers
Processors are selected with regard to security and privacy. Contracts define processing responsibilities. Where information is transferred outside the United Kingdom, an approved transfer mechanism and appropriate safeguards will be used where required.
Contact and complaints
Data protection enquiries can be sent to hello@clubausome.co.uk. Individuals also have the right to complain to the Information Commissioner’s Office.