Our Commitment:

Tytherton Village Hall is committed to the protection of all personal and special category/sensitive data for which it holds responsibility as the Data Controller and the handling of such data in line with the data protection principles and the UK GDPR and Data Protection Act 2018.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/

Changes to data protection legislation shall be monitored and implemented in order to remain compliant with all requirements.

The committee member responsible for data protection can be contacted at datacontroller@tythertonhall.co.uk

The charity is also committed to ensuring that its committee and volunteers are aware of data protection policies, legal requirements and adequate training is provided to them.

The requirements of this policy are mandatory for all committee members of the charity and any third party contracted to provide services within the charity.

Personal Data Breaches:

Any suspected or actual personal data breach shall be reported promptly to the committee member responsible for data protection.

Tytherton Village Hall shall assess the nature and seriousness of any breach, including whether it is likely to result in a risk to the rights and freedoms of individuals. Where required by law, the charity shall report the breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, Tytherton Village Hall shall also inform the individuals concerned without undue delay.

A record shall be kept of personal data breaches, the assessment made, any notifications given and any remedial action taken.

Personal and Special Category/Sensitive Data:

All data within the charity’s control shall be identified as personal, special category/sensitive, or both to ensure that it is handled in compliance with legal requirements and access to it does not breach the rights of the individuals to whom it relates.

The definitions of personal data and special category data shall be as those published by the ICO for guidance:

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/key-definitions/

The principles of the UK GDPR and Data Protection Act 2018 shall be applied to all data processed:

1. Processed lawfully, fairly and transparently

2. Obtained only for specified, explicit and legitimate purposes, and not further used in any manner incompatible with those original purposes

3. Accurate and, where necessary, kept up to date

4. Adequate, relevant and not excessive in relation to the purposes for which it is processed

5. Not kept for longer than is necessary for those purposes

6. Processed in accordance with the rights of data subjects under the UK GDPR and Data Protection Act 2018

7. Protected by appropriate technical and organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage

8. Not transferred outside the UK unless an adequate level of protection or appropriate safeguards are in place, or another lawful basis for the transfer applies.

Fair Processing / Privacy Notice:

We shall be transparent about the intended processing of data and communicate these intentions to individuals whose personal data we process, including hirers, volunteers, supporters, donors, contractors and other contacts, before or at the time their data is collected where practicable.

Notifications shall be in accordance with ICO guidance and, where relevant, be written in a form understandable by those defined as ‘Children’ under the legislation.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-to-be-informed/

The intention to share data relating to individuals with an organisation outside of our charity shall be clearly defined within privacy notices, together with the purpose and lawful basis for sharing. Data will only be shared where there is a lawful basis for doing so, including where sharing is necessary for the administration of the charity or hall bookings, where required by law, or where appropriate service providers process data on our behalf under suitable arrangements.

Privacy notices shall explain how individuals may raise concerns or make a data protection complaint to Tytherton Village Hall, and shall also refer to the right to complain to the ICO.

Any proposed change to the processing of individuals’ data shall first be notified to them.

Data Security:

In order to assure the protection of all data being processed and inform decisions on processing activities, we shall undertake an assessment of the associated risks of proposed processing and equally the impact on an individual’s privacy in holding data related to them.

Risk and impact assessments shall be conducted in accordance with guidance given by the ICO:

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments/

Security of data shall be achieved through the implementation of proportionate physical and technical measures. Nominated committee members shall be responsible for the effectiveness of the controls implemented and reporting of their performance.

The security arrangements of any organisation with which data is shared shall also be considered and these organisations shall provide evidence of appropriate security arrangements for shared data.

Data Access Requests (Subject Access Requests):

All individuals whose personal data is held by us have a legal right to request access to such data and to receive information about what is held. Requests may be made verbally or in writing, although written requests help us respond accurately. Requests should be made to: Data Controller, Tytherton Village Hall, East Tytherton SN15 4LX or datacontroller@tythertonhall.co.uk.

We shall respond to subject access requests without undue delay and within one month of receipt, unless the law permits an extension. We may ask for proof of identity, or evidence of authority where a request is made on behalf of another person.

In most circumstances no fee will be charged. A reasonable fee may be charged where permitted by law, for example if a request is manifestly unfounded or excessive, or where an individual requests further copies of their data.

When responding to a subject access request or other data subject rights request, we shall explain how the individual may raise a data protection complaint to Tytherton Village Hall and shall also refer to their right to complain to the ICO.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/

Data Protection Complaints:

Anyone who believes that Tytherton Village Hall has not handled their personal data in accordance with data protection law may make a data protection complaint. A complaint does not need to use legal terminology or refer expressly to data protection law if it is clear that it concerns the handling of personal data.

Complaints may be made by email to datacontroller@tythertonhall.co.uk or in writing to: Data Controller, Tytherton Village Hall, East Tytherton SN15 4LX. Tytherton Village Hall shall also accept data protection complaints received through other channels. Committee members and volunteers who receive a possible data protection complaint shall forward it promptly to the committee member responsible for data protection.

We shall acknowledge receipt of a data protection complaint within 30 days beginning with the day on which the complaint is received. We may ask for further information, proof of identity, or evidence of authority where someone is acting on behalf of another person.

We shall investigate the complaint without undue delay, keep the complainant informed at appropriate stages of the process where relevant, and communicate the outcome of the complaint without undue delay. The outcome shall explain, where appropriate, any action taken or why no further action is proposed.

We shall maintain a record of data protection complaints, including the date received, the date acknowledged, the issue raised, relevant evidence and decisions, the outcome, any action taken and the date the complaint was closed. Complaint records shall be kept securely and only for as long as necessary.

If the complainant remains dissatisfied, they may complain to the Information Commissioner’s Office.

https://ico.org.uk/make-a-complaint/

Data Disposal:

The charity recognises that the secure disposal of redundant data is an integral element to compliance with legal requirements and an area of increased risk.

All data held in any form of media (paper, tape, electronic) shall only be passed to a disposal partner with demonstrable competence in providing secure disposal services.

All data shall be destroyed or eradicated to agreed levels meeting recognised national standards, with confirmation at completion of the disposal process.

All lists that include personal data will be reviewed annually and any data that is no longer required will be securely destroyed.

Disposal of IT assets holding data shall be in compliance with ICO guidance:

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/it-asset-disposal-for-organisations/ 

Policy updated July 2026.