Find membership options and join us today.
1. General
1.1 The Buckinghamshire Gardens Trust (BGT) takes the privacy of your information very seriously. Our Data Protection Policy is designed to tell you, the user of our services (together referred to as the “Service”) about our practices regarding the collection, use and disclosure of personal and other information about you that may be provided via our website (the “Site”), its associated mobile applications (the “Apps”) and any other digital product we provide, or collected through other means such as an online forms, email, telephone communications or hard copy paper such as subscriptions, event forms, book orders.
1.2 This policy applies to information provided by our users, whether they are a member or otherwise.
1.3 This policy is governed by the EU General Data Protection Regulation (the“GDPR”) from 25 May 2018 and the Data Protection Act 1998.
1.4 Under the GDPR we do not have a statutory requirement to a Data Protection Officer. The person who is responsible for ensuring BGT discharges its obligations under the GDPR is the Chair, Rosemary Jury, email. The Chair is responsible for maintaining a log of data breaches and notifying the Information Commissioner’s Office (ICO) and any members affected as necessary, in accordance with our legal obligations. Compliance with the relevant laws
1.5 The Trust is registered with the Information Commisioner’s Office (ICO) under Buckinghamshire Gardens Trust, reference: ZA878559. To view this please visit ico.org.uk/register. which also gives details about the Trusts responsibilities as a data controller.
2. Basis on which we process personal data
2.1 Personal data we hold about you will be processed either because:
2.1.1 you have consented to the processing for the specific purposes described in this policy;
2.1.2 the processing is necessary in order for us to comply with our obligations under a contract between you and us, including our contract of membership with you; or
2.1.3 the processing is necessary in pursuit of a “legitimate interest”; a legitimate interest in this context means a valid interest we have or a third party has in processing your personal data which is not overridden by your interests in data privacy and security.
3. Ways that we may collect your personal data
3.1 We may collect and process the following personal data (information that can be uniquely identified with you) about you:
3.1.1 information provided to sign up to our Service, by becoming a member or otherwise;
3.1.2 your name, residential address, contact telephone and mobile numbers, email address and content you may have created or provided through your use of the Service;
3.1.3 payment information we may use to collect payment (if applicable);
3.1.4 a record of any correspondence between you and us;
3.1.5 replies to any surveys or questionnaires that we may use for research purposes;
3.1.6 details of your visits to the Site, the resources and pages that you access and any searches you make;
3.1.7 any information we may require from you when you report a problem or complaint;
3.1.8 the number of communications you make with us.
3.2 We only collect such information when you choose to supply it to us but please note there may be instances where we process your personal data which has been provided to us by a third party.
3.3 If we do obtain your personal data from a third party your privacy rights under this notice are not affected and you are still able to exercise the rights contained within this notice.
3.4 You do not have to supply any personal information to us but our Service may not be operable in practice without providing data to us. You may withdraw our authority to process your personal data (or request that we restrict our processing – see clause 8.1) at any time (but our Service may not be fully operable to you should you do so).
4. Cookies
4.1 A cookie is a piece of data stored locally on your computer and contains information about your activities on the Internet. The information in a cookie does not contain any personally identifiable information you submit to our Site.
4.2 On our Site, we use cookies to track users’ progress through the Site, allowing us to make improvements based on usage data. We also use cookies if you log in to one of our online services to enable you to remain logged in to that service. A cookie helps you get the best out of the Site and helps us to provide you with a more customised service.
4.3 Once you close your browser, our access to the cookie terminates. You have the ability to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. To change your browse settings you should go to your advanced preferences.
4.4 We are required to obtain your consent to use cookies. If you continue to use the Site having seen the notice on the Site then we assume you are happy for us to use cookies.
4.5 If you choose not to accept the cookies, this will not affect your access to the majority of information available on our Site. However, you will not be able to make full use of our online services.
4.6 An Internet Protocol (IP) address is a number assigned to your computer by your Internet Service Provider (ISP), so you can access the Internet. We may use your IP address to diagnose problems with our server, report aggregate information, and determine the fastest route for your computer to use in connecting to our Site, and to administer and improve the Site.
5. Reasons why we process your personal data
5.1 We will use your information to:
5.1.1 ensure that the content of the Site is presented in the most effective manner for you and for your device;
5.1.2 provide Newsletter and e-news to members and others;
5.1.3 provide information about events and provide booking for events, including events and other activities related to specialised or particular interests.
5.1.4 assist in making general improvements to our services;
5.1.5 carry out and administer any obligations arising from any agreements entered into between you and us;
5.1.6 contact you and notify you about changes to our services or the services we offer, subject to the Privacy and Electronic Communications Regulations (except where you have asked us not to do this);
5.1.7 administer our Service and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.
6. Data Retention
6.1 Our current data retention policy is to delete or destroy (to the extent we are able to) the personal data we hold about you in accordance with the following:
|
Category of personal data |
Length of retention |
|
Personal data processed in relation to a contract between you and us to administer membership, events, communicate with you & to meet our legal obligations.
|
3 years. We keep members’ personal data for up to one year after a member dies or resigns or their membership lapses. If requested by a former member or their next of kin we will immediately delete a former member’s personal data. |
| Personal data necessary for the purpose of its legitimate interests as a membership organisation & related to financial matters. | 7 years, as legally required for financial matters, the basis is for collection, retention and processing to comply with legal obligations as required by the Charity Commission and HM Revenue & Customs. |
| Payment information. We collect some payment information which is communicated to us by our Bank. Cheques/cash from members subscriptions, donations, outings and other events and activities are processed by us, we do not collect or retain details of member’s bank accounts. | Details of member’s bank accounts not kept. Financial records are kept for 7 years (see above). |
6.2 For any category of personal data not specifically defined in this Policy, and unless otherwise specified by applicable law, the required retention period for any personal data will be deemed to be 7 years from the date of receipt by us of that data.
6.3 The retention periods stated in this Policy can be prolonged or shortened as may be required (for example, in the event that legal proceedings apply to the data or if there is an on-going investigation into the data).
6.4 We review the personal data (and the categories of personal data) we are holding on a regular basis to ensure the data we are holding is still relevant to our business and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take reasonable steps to correct or delete this data as may be required.
6.5 If you wish to request that data we hold about you is amended or deleted, please refer to clause 8 below, which explains your privacy rights.
7. Sharing your information
7.1 We do not disclose any information you provide to any third parties other than as follows:
7.1.1 where you have opted to share any of your content with any other user of the Service or third party, you authorise us to deliver that content via email, SMS or other electronic messaging or communication system;
7.1.2 members of the BGT Council have access, or will be given access, to members’ data as is necessary for them to carry out their legitimate tasks for the organisation but are not permitted to pass such information on to any other organisation or third parties unless it is to comply with legal obligations;
7.1.3 if we are under a duty to disclose or share your personal data in order to comply with any legal obligation (for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime);
7.1.4 to protect our rights, property and safety, or the rights, property and safety of our users or any other third parties. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
7.2 Other than as set out above, we shall not disclose any of your personal information unless you give us permission to do so. If we do supply your personal information to a third party we will take steps to ensure that your privacy rights are protected and that third party complies with the terms of this notice.
8. Security
8.1 We will take all reasonable steps to ensure that appropriate technical and organisational measures are carried out in order to safeguard the information we collect from you and protect against unlawful access and accidental loss or damage. These measures may include (as necessary):
8.1.1 protecting our personal computers and mobile devices by both hardware and software firewalls;
8.1.2 taking appropriate technical and organisational precautions to secure your personal data and to prevent misuse or unauthorised alteration of your personal data;
8.1.3 when necessary, disposing of or deleting your data so it is done so securely;
8.1.4 regularly backing up and encrypting all data we hold.
8.2 We will ensure that Council Members are aware of their privacy and data security obligations. We will take reasonable steps to ensure that the employees of third parties working on our behalf are aware of their privacy and data security obligations.
8.3 This notice and our procedures for handling personal data will be reviewed as necessary.
8.4 Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to the Site; any transmission is at your own risk. Once we have received your information, we will use the strict procedures and security features referred to in this clause to try to prevent unauthorised access.
9. Your privacy rights
9.1 The GDPR gives you the following rights in respect of personal data we hold about you:
|
The right to be informed |
You have a right to know about our personal data protection and data processing activities, details of which are contained in this notice. |
| The right of access | You can make what is known as a Subject Access Request (“SAR”) to request information about the personal data we hold about you (free of charge, save for reasonable expenses for repeat requests). If you wish to make a SAR please contact us as described below. |
| The right to correction | Please inform us if information we hold about you is incomplete or inaccurate in any way and we will update our records as soon as possible, but in any event within one month.We will take reasonable steps to communicate the change to any third parties to whom we have passed the same information. |
|
The right to erasure
|
Please notify us if you no longer wish us to hold personal data about you (although in practice it is not possible to provide our Service without holding your personal data). Unless we have reasonable grounds to refuse the erasure, on receipt of such a request we will securely delete the personal data in question within one month. The data may continue to exist in certain backup, but we will take steps to ensure that it will not be accessible. We will communicate the erasure to any third parties to whom we have passed the same information. |
|
The right to restrict |
You can request that we no longer process your personal data in certain ways, whilst not requiring us to the delete the same data. |
|
The right to data |
You have right to receive copies of personal data we hold about you in a commonly used and easily storable format (please let us know a format which suits you).You may also request that we transfer your personal data directly to third party (where technically possible). |
| The right to object | Unless we have overriding legitimate grounds for such processing, you may object to us using your personal data for direct marketing purposes (including profiling) or for research or statistical purposes. Please notify your objection to us and we will gladly cease such processing. |
| Right to withdraw consent | If we are relying on your consent as the basis on which we are processing your personal data, you have the right to withdraw your consent at any time. Even if you have not expressly given your consent to our processing, you also have the right to object (see above). |
9.2 All SARs and other requests or notifications in respect of your above rights must be sent to us in writing to: The Chair, Rosemary Jury, The Buckinghamshire Gardens Trust Office, c/o Vine Cottage, Thame Road, Longwick, Princes Risborough, Bucks. HP27 9TA by email enquiries@bucksgardenstrust.org.uk
9.3 We will endeavour to comply with such requests as soon as possible but in any event we will comply within one month of receipt (unless a longer period of time to respond is reasonable by virtue of the complexity or number of your requests).
10. Data Breaches
10.1 If personal data we hold about you is subject to a breach or unauthorised disclosure or access, we will report this to the Information Commissioner’s Office (ICO). (see above 1.5)
10.2 If a breach is likely to result in a risk to your data rights and freedoms, we will notify you as soon as possible.
11. Policy towards children
The Service is not intended for and should not be accessed by individuals under 16. Our policy is not to intentionally or knowingly collect, process, maintain or use personal information from any individual under the age of 16.
12. Photography and images
12.1 Bucks GT uses photography in publications and on the website to illustrate the work of the Trust.
12.2 Event Photography. Where an event is organised by the Trust, we will ask those taking part for their consent to use any photographs taken where they are the focus of the image. Permission will be requested either prior, during or after the event.
12.3 Where the photograph does not focus on the individual, e.g. when they appear in the background of the photograph or as one of a number of people in a group shot, it is not normally necessary to ask permission. We will ensure the terms and conditions of the event tell you if there will be photographers present.
12.4 If someone does not want their photograph taken, they will be asked to either tell the photographer at the time, the organiser of the event, if it is convenient to do so, or contact the Trust after the event.
12.5 Where the event is organised by a third party, we will use photography from the event under our legitimate interests. We will be clear in our terms and conditions of entry if this is the case. Those taking part will be reminded to tell the photographer at the time, if it is convenient to do so, or contact the Trust after the event.
12.6 You have a number of rights available to you and these can be found under Section 7 Security and Section 9 Your Privacy Rights of this Data Protection Policy
12.7 Research and Recording Photography. Permission will be sought by the Research and Recording volunteers from the property and landowners prior to visits. The R & R administrator will also seek permission prior to research work beginning.
13. Contact us
If at any time you would like to contact us with your views about our privacy practices, or with any enquiry or complaint relating to your personal information or how it is handled, you can do so via the following address: The Chair, Claire de Carle, The Buckinghamshire Gardens Trust Office,( Companies House to be advised) c/o 4, Pearce Courtyard, Oakley, Aylesbury. HP18 9WY by email enquiries@bucksgardenstrust.org.uk
If we are unable to resolve any issues you may have or you would like to make a further complaint, you can contact the Information Commissioner’s Office for further assistance.
Reviewed November 2021.
References:
Information Commissioners Office. Registration self-assessment.
The Gardens Trust Privacy Notice.
Google Analytics Privacy Policy
February 2021
