1. Introduction: This policy sets out how Brancaster Staithe and Deepdale Village Hall (the "Hall"), Registered Charity No. 303913, managed by a Board of Trustees, registered with ICO No. ZA259106, complies with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. The Hall is committed to protecting the personal data of all individuals, including hirers, volunteers, trustees, employees and visitors. This policy explains how personal data is collected, used, stored, and protected.

2. Data Controller: The Data Controller is the Board of Trustees of the Hall. The Trustees are responsible for ensuring compliance with data protection legislation.

3. Data Collected: The Hall may collect and process the following categories of personal data:

Booking Information: Names, addresses, phone numbers, and email addresses of individuals or organisations making bookings.
Committee/Trustee Information: Names and contact details of trustees and committee members, including records of meeting attendance and minutes.
Financial Records: Bank details (if required for payments), invoices, and receipts.
CCTV Images: Recordings of individuals on or around the premises for security and safety purposes.
Correspondence: Emails, letters, or phone call records relating to bookings or Hall management.

4. Legal Basis for Processing: The Hall processes personal data under the following lawful bases:

Contract: To manage bookings and hire agreements.
Legal Obligation: To comply with charity law, financial reporting, and regulatory requirements.
Legitimate Interest: To ensure the security of the premises (via CCTV) and to manage the effective running of the hall.
Consent: For optional communications such as newsletters or promotional materials.

5. How Data Is Used: Personal data is used only for the purposes for which it was collected to:

Manage hall bookings and hire agreements.
Maintain records of trustees and committee meetings.
Comply with charity governance and legal obligations.
Safeguard the hall through CCTV monitoring.
Communicate with hirers, trustees, and volunteers.

6. Data Sharing: The Hall will not sell or share personal data with third parties for marketing purposes. Data may be shared only when required by:

Regulatory authorities (e.g., the Charity Commission, HMRC).
Service providers (e.g., accountants, IT support) under a confidentiality agreement.
Law enforcement, where legally required.

7. Data Retention Booking records: Retained for up to 7 years for financial and legal purposes.

Trustee/committee records and minutes: Retained permanently as part of the charity’s governance records.
CCTV recordings: Retained for no longer than 30 days, unless required for investigation.
Correspondence: Retained for up to 2 years, unless required longer for legal reasons.

8. Data Security: The Hall takes appropriate technical and organisational measures to keep personal data secure:

Paper Records stored in locked cabinets.
Electronic Data protected by password-protected devices and / or secure cloud storage.
CCTV Recordings stored securely and accessible only by authorised trustees.
Personal Data access limited to trustees and authorised volunteers.

9. Data Subject Rights: Under GDPR individuals have the following rights:

Access to Their Personal Data.
Rectification of Inaccurate Data.
Erasure (where applicable).
Restrict or Object to processing.
Data Portability (where applicable).

Requests should be made in writing to the Chair of Trustees, who will respond within one month.

10. CCTV Usage: CCTV is in operation to protect the hall, its users and property. Signage is displayed to inform visitors. Recordings are used only for security purposes and, if required, may be shared with law enforcement.

11. Breach Procedure: Any personal data breach (loss, theft, or unauthorised access) must be reported immediately to the Board of Trustees. Serious breaches will be reported to the Information Commissioner’s Office (ICO) within 72 hours.

12. Review: This policy will be reviewed annually by the Board of Trustees or sooner if legislation changes.

13. Contact: For any questions regarding this policy or personal data, please contact: Secretary, Brancaster Staithe and Deepdale Village Hall BSDVH Secretary.