Data Protection Policy

The Supreme Council 33° of the Ancient and Accepted Rite
For England and Wales and its Districts and Chapters Overseas

DISTRICT OF HAMPSHIRE & ISLE OF WIGHT WESSEX

This data protection policy regulates how the District of Wessex processes and stores personal data of its members. It applies to all officers, members, volunteers and (if any) employees of the District. Its purpose is to ensure that the District complies with the law and with high data protection standards.

In this policy ‘personal data’ means any recorded information which identifies a living individual.

  1. Purposes
    As a membership organisation the District processes, retains and shares personal data of members for the purposes set out in the Data Protection Notice. Where the District employs or contracts with a member it may also process, retain and share personal data of that member for all lawful purposes related to that employment or contractual relationship. The District shall not collect or store personal data of members for any other purposes.
  2. Appointment of a Data Protection Officer
    The District shall appoint a Data Protection Officer who will oversee compliance with data protection law and will act as a point of contact for members and the Information Commissioner’s Office (‘the ico’). The Data Protection Officer shall normally be the District Recorder. The Data Protection Officer will have a direct line of communication with the Inspector General and shall have or shall undergo training to ensure that he has knowledge of data protection law and practices.
  3. Members’ data rights
    A member may request that the Data Protection Officer:

    1. provide him with a copy of all personal data that the District holds about him. The Data Protection Officer shall promptly provide a copy of all information required to be disclosed by law.
    2. rectify any incorrect personal data held by the District about him. The Data Protection Officer shall promptly consider such a request and respond to it in accordance with the law.
    3. stop the District from some or all of its processing of his personal data. The Data Protection Officer shall promptly consider such an objection and respond to it in accordance with the law.
  4. Deletion of personal data
    A member may resign from all Chapters in a District at any time. After it has processed such resignation(s) the District shall delete personal data that it holds about that member as set out in the Data Protection Notice.
  5. Sharing data with third parties
    As a membership organisation the District shares:

    1. personal data of its members with the Supreme Council for England & Wales; and
    2. personal data of members of each Chapter in the District with that Chapter.
    3. as required by the Rules of the Supreme Council for England & Wales (‘the Rules’) or the bodies it sanctions from time to time.

    It will not share personal data of members for any other reason unless it has the consent of the relevant member.

  6. Data Protection Notice
    The District shall publish a Data Protection Notice so that it is available to members. The Notice shall comply with the requirements of data protection law and among other things shall inform members how their personal data will be used by the District and how they may contact the District’s Data Protection Officer.
  7. Data security
    The District shall periodically review the security of its records and processing activities and shall take appropriate steps to ensure the confidentiality, integrity and availability of personal data that it holds.
  8. Registration with ICO
    The District shall, if it think fit, maintain its annual registration with the ICO.
  9. Reporting breaches to the Data Protection Officer
    Actual or potential breaches of this policy, or of data protection law by the District, shall be reported immediately to the Data Protection Officer. Breaches shall be reported if required by the Data Protection Officer to the ICO or to the member(s) whose data is affected. Normally the Data Protection Officer shall not report breaches without prior consultation with the Inspector General and, where appropriate, the Grand Secretary General.

Date policy adopted: 9th May 2018