LCWO privacy notice and data protection policy, April 2018

1. Low Carbon West Oxford (LCWO) is committed to ensuring anyone can be clear about:

• What personal data it holds
• Why it holds personal data
• How it uses personal data
• How it keeps personal data safe
• How long it keeps personal data
• How it responds to subject access requests
• With whom and in what circumstances it shares personal data.

2. LCWO will comply with British data protection law, which for the time being includes complying with the European Union’s General Data Protection Regulation.
3. LCWO will publish this policy on its website and will make it available on paper on request to anyone who does not have access to the website.
4. LCWO has decided to register with the Information Commissioner’s Office (ICO) rather than rely on the “not for profit” exemption which only allows an organisation to use data in very limited ways.
5. LCWO collects and uses personal data for three distinct purposes which affect what we hold, how we use it and how long we keep it. These are explained below.

A. Membership and Governance

6. LCWO is required by its Memorandum and Articles of Association to maintain an up-to-date register of its members. It is a condition of membership for individuals that they live in West Oxford.
7. When a person asks to become a member of LCWO, they must understand that LCWO will ask them for their address and will contact them at least every two years to check they continue to live in West Oxford
8. LCWO will also ask members how they wish to receive the communications it is required to send them, such as notices of meetings. A member may change at any time their preference as to whether they are contacted by email or by post. If a member asks LCWO to change communications from email to post, LCWO will amend their details accordingly.
9. LCWO will keep a member’s name, address and their current, preferred contact details for as long, but only for as long, as they remain a member. When a person ceases to be a member of LCWO, it will immediately delete their personal data from its membership records.
10. When a person becomes a Trustee of LCWO, they must understand that LCWO will have by law to give certain personal data about them to the Registrar of Companies and the Charity Commission which they will publish. Anyone wishing to become a Trustee must accept that LCWO will have to collect and pass on that personal data.
11. LCWO will not use for any other purpose personal data which it collects for governance purposes without first obtaining specific consent from each individual concerned.

For more information regarding LCWO membership, including geographical boundaries for eligibility, please see our membership page.

B. Campaigning and Communication

12. LCWO collects contact details for people who wish to be informed of its activities. LCWO will give people a choice over the kinds of communications they receive and will inform people they can withdraw their consent at any time.
13. LCWO will give West Oxford residents a choice as to whether they receive communications by post or email. West Oxford residents may change at any time their preference as to whether LCWO contacts them by email or by post.
14. LCWO will ask people for separate and specific consents to send them:
• Additional communications other than its newsletter and
• Information from partner organisations in West Oxford and beyond.
15. LCWO will keep a person’s current, preferred contact details for as long, but only for as long, as they wish. LCWO will keep its circulation lists up to date and will ensure a person is asked to renew their consent within two years of last giving or amending their consent.
16. If a person no longer wishes to receive all or certain communications from LCWO, or if a person fails to renew their consent when asked, LCWO will remove their contact details immediately from all or the relevant circulation lists.

C. Activities and Projects

17. LCWO will from time to time organise specific activities in pursuit of its charitable aims. People who take part in these activities do so from choice. LCWO will explain to them:
• What personal data it will need to collect and use for a specific activity
• How it will use their personal data, and
• How long it will keep their personal data.

D. Data security

18. LCWO aims to keep personal data safe. Personal data is generally processed by an LCWO employee on portable computer equipment which will be encrypted to protect any personal data it stores.
19. LCWO keeps its email circulation lists in the Mailchimp system. This means personal data is processed outside the European Economic Area. This is currently possible under a temporary Privacy Shield agreement between the EU and the USA.
20. LCWO also keeps some data on SurveyMonkey (used for surveys) and Eventbrite (used for event sign ups). Again, this means personal data is processed outside the European Economic Area. This is currently possible under a temporary Privacy Shield agreement between the EU and the USA.
21. LCWO will keep under review whether continued use of Mailchimp is lawful.
22. Any person given access to personal data held by LCWO by virtue of being a Trustee, an employee, a volunteer or a project convenor will be made aware of this policy and their obligations.

E. Individuals’ rights

23. Anyone has the right to:
• Ask what personal data LCWO holds about them
• Ask how LCWO uses any personal data it holds about them
• Ask LCWO to correct personal data it holds about them
• Withdraw their consent to LCWO holding any data it holds about them which it processes only by virtue of their consent and ask for that data to be deleted.
24. If withdrawing your consent to LCWO processing your personal data means you may be unable to continue to be part of a project or take part in an activity, LCWO will explain this to you and ensure you understand this before we stop processing your personal data.
25. If you want to make a Subject Access Request, find out more about the processing of your personal data or make a complaint about the way LCWO processes your personal data, please either:
• email info@lcwo.org, or
• write to LCWO at its registered address, which is 22 Oatlands Road, OXFORD, OX2 0ET.
26. There is generally no fee for dealing with a Subject Access Request and the information will generally be provided within one month of receiving the request.
27. If a request is manifestly unfounded or excessive, particularly if it is repetitive, LCWO may:
• Charge a fee based on the administrative cost of providing the information, or
• Refuse to respond.
28. LCWO may also charge a fee, calculated on the same basis, to comply with requests for further copies of the same information.
29. If requests are complex and numerous, LCWO may inform the person within one month of making the request why it will only be able to respond within three months.
30. If you are not satisfied with the way LCWO handles a request or a complaint, you have the right to appeal to the Information Commissioner’s Office (ICO). There is no charge for making an appeal. The contact details of the ICO are as follows:
The Information Commissioner’s Office
Wycliffe House
Water Lane
WILMSLOW
Cheshire
SK9 5AF
 0303 123 1113 (local rate)
Email: casework@ico.gov.uk

F. Breaches of data protection

31. If LCWO is aware of a possible breach, it will be the responsibility of the Trustees to investigate and, if necessary, to report it to the ICO.
32. The Trustees shall designate one of their number to be responsible for data protection. In the absence of that Trustee, the Chair of the Trustees shall ensure another Trustee deals with the alleged breach within the timescales required by the ICO.

This policy was approved by LCWO’s Co-ordinating Committee on Monday 23rd April 2018

If you would like to download a copy of the policy, you can do so here: LCWO Privacy & data protection policy April 2018.