Hitchin Spiritualist Church

The Spiritualists’ National Union (SNU) needs to keep certain information on its employees, volunteers, members, service users and trustees to carry out its day-to-day operations, to meet its objectives and to comply with legal obligations. The organisation is committed to ensuring that any personal data will be dealt with in line with the Data Protection Act 2018. To comply with the law, personal information will be collected and used fairly, stored safely and not disclosed to any other person unlawfully. The aim of this policy is to ensure that everyone handling personal data is fully aware of the requirements and acts in accordance with data protection procedures. This document also highlights key data protection procedures within the organisation.

​

This policy covers employees, volunteers, members, service users and trustees. In line with the Data Protection Act 2018 principles, the SNU will ensure that personal data will:

• be obtained fairly and lawfully and shall not be processed unless certain conditions are met;

• be obtained for a specific and lawful purpose;

• be adequate, relevant but not excessive;

• be accurate and kept up to date;

• not be held longer than necessary;

• be processed in accordance with the rights of data subjects;

• be subject to appropriate security measures;

​

Transferring Personal Data to a country outside the EEA

The SNU may from time to time transfer (‘transfer’ includes making available remotely) personal data to countries outside of the EEA. The transfer of personal data to a country outside of the EEA shall take place only if one or more of the following applies:

  1.1.1 the transfer is to a country, territory, or one or more specific sectors in that country (or an international organisation), that the          European Commission has determined ensures an adequate level of protection for personal data;

  

  1.1.2 the transfer is to a country (or international organisation) which provides appropriate safeguards in the form of a legally binding      agreement between public authorities or bodies; binding corporate rules; standard data protection clauses adopted by the European      Commission; compliance with an approved code of conduct approved by a supervisory authority (e.g. the Information Commissioner’s    Office); certification under an approved certification mechanism (as provided for in the GDPR); contractual clauses agreed and              authorised by the competent supervisory authority; or provisions inserted into administrative arrangements between public authorities    or bodies authorised by the competent supervisory authority;

​

  1.1.3 the transfer is necessary for the performance of a contract between the data subject and the Company (or for pre-contractual        steps taken at the request of the data subject);

​

  1.1.4 the transfer is necessary for important public interest reasons;

​

  1.1.5 the transfer is necessary for the conduct of legal claims

​

  1.1.6 the transfer is necessary to protect the vital interests of the data subject or other individuals where the data subject is physically    or legally unable to give their consent; or

​

  1.1.7 the transfer is made from a register that, under UK or EU law, is intended to provide information to the public and which is open    for access by the public in general or otherwise to those who are able to show a legitimate interest in accessing the register.                  Spiritualists’ National Union Data Protection Policy 2 The definition of ‘processing’ is obtaining, using, holding, amending, disclosing,      destroying and deleting personal data. This includes some paper-based personal data as well as that kept on computer.

​

The Personal Data Guardianship Code suggests five key principles of good data governance on which best practice is based. The organisation will seek to abide by this code in relation to all the personal data it processes, i.e.

​

  • Accountability: Those handling personal data follow publicised data principles to help gain public trust and safeguard personal data.

  • Visibility: Data subjects should have access to the information about themselves that an organisation holds. This includes the right to    have incorrect personal data corrected and to know who has had access to this data.

  • Consent: The collection and use of personal data must be fair and lawful and in accordance with the DPA’s eight data protection          principles. Personal data should only be used for the purposes agreed by the data subject. If personal data is to be shared with a third    party or used for another purpose, the data subject’s consent should be explicitly obtained.

  • Access: Everyone should have the right to know the roles and groups of people within an organisation who have access to their            personal data and who has used this data.

  • Stewardship: Those collecting personal data have a duty of care to protect this data throughout the data lifespan.

​

The SNU processes the following personal information:

Information will be kept re employee applications and references, including contact details, payroll and bank details and supervision and appraisal notes. Membership applications (Church and Individual), including contact details, applications for SNU educational services and events, bank account details as appropriate. Non-member applications for services and events, including contact and bank account details as appropriate.

​

Personal information is kept in the following forms: paper and computer-based systems

​

Groups of people within the organisation who will process personal information are:

SNU paid staff, volunteer elected members of District Councils and Churches, volunteer members of the various SNU Committees, Branches and Trustees. The needs we have for processing personal data are recorded on the public register maintained by the Information Commissioner. We notify and renew our notification on an annual basis as the law requires. If there are any interim changes, these will be notified to the Information Commissioner within 28 days.

​

Under the Data Protection Guardianship Code, overall responsibility for personal data in a not-for-profit organisation rests with the governing body. In the case of the SNU this is the National Executive Committee (NEC). The governing body delegates tasks to the Data Protection Officer.

​

The Data Protection Officer is responsible for:

• understanding and communicating obligations under the Act;

• identifying potential problem areas or risks;

• producing clear and effective procedures;

• notifying and annually renewing notification to the Information Commissioner, plus notifying of any relevant interim changes.

​

All SNU paid staff, volunteer elected members of District Councils and Churches, appointed volunteer members of the various SNU Committees, Branches and Trustees who process personal information must ensure that they not only understand but also act in line with this policy and the data protection principles. Breach of this policy will result in disciplinary proceedings for paid staff and removal from office of volunteers elected to Church or District Councils and SNU-appointed Committee & Branch members and Trustees.

​

To meet our SNU data protection policy, paid staff, volunteer elected members of District Councils and Churches, and appointed volunteer members of the various SNU Committees and Branches will:

• ensure that any personal data is collected in a fair and lawful way;

• explain why it is needed at the start;

• ensure that only the minimum amount of information needed is collected and used;

• ensure that the information used is up to date and accurate;

• review the length of time information is held;

• ensure that it is kept safely;

• ensure that the rights people have in relation to their personal data can be exercised.

 

We will ensure that:

• everyone managing and handling personal information is trained to do so;

• anyone wanting to make enquiries about handling personal information, whether a member of staff, volunteer, service user or Trustee, knows what to do;

• any disclosure of personal data will be in line with our procedures;

• queries about handling personal information will be dealt with swiftly and politely

​

Our churches and District Councils will be asked to ensure that data they hold is removed immediately on personal request or twelve months after lapse of membership. (This is in line with the twelve months’ period of grace allowed for membership fees to be paid.)

​

Personal sensitive information will not be used apart from the exact purpose for which permission was given. The organisation will take steps to ensure that personal data is kept secure at all times against unauthorised or unlawful loss or disclosure. The following measures will be taken: lockable filing systems for paper records, password protection for computer-based records. Passwords will be changed at least annually. Removal of information ‘off site’ will only be with the authority of two of the four Officers of the SNU. Any unauthorised disclosure of personal data to a third party by an employee may result in disciplinary action or, in the case of elected volunteers or appointed Committee & Branch members or Trustees, removal from office.

​

All unauthorised disclosures will be recorded in the ledger for this purpose held at Head Office and supervised by the General Manager.

​

Anyone whose personal information we process has the right to know:

• what information we hold and process on them;

• how to gain access to this information;

• how to keep it up to date;

• what we are doing to comply with the Act.

​

They also have the right to prevent processing of their personal data in some circumstances and the right to correct, rectify, block or erase information regarded as wrong. Individuals have a right under the Act to access certain personal data being kept about them on computer and certain files.

​

​