{"alias":"contentPage","byline":null,"standfirst":null,"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"gridType":"RichTextBlock","content":"\u003Cdiv class=\u0022page\u0022\u003E\n\u003Cdiv class=\u0022layoutArea\u0022\u003E\n\u003Ch3\u003EIntroduction\u003C/h3\u003E\n\u003Cp\u003EThe Scout Association\u2019s commitment to protecting privacy and data forms a key policy for Scouting. This policy underpins both this Data Protection Policy and other associated policies used by The Scout Association, local Scouting and its membership.\u003C/p\u003E\n\u003Cp\u003EEach Local Scout Group, District and County are their own distinct data controllers for much of their data processing, separate to The Scout Association (TSA) and are separate legal entities. This means they are directly responsible for any personal data they process and must ensure that they are aware of their responsibilities under the law. We provide general guidance and signposting to local Scouting, including online resources such as our \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/\u0022 title=\u0022GDPR Toolkit\u0022\u003EScout Unit Data Protection Toolkit\u003C/a\u003E.\u003C/p\u003E\n\u003C/div\u003E\n\u003C/div\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":true,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EThis policy sets out The Scout Association\u2019s approach to protecting personal data and explains individuals\u2019 rights in relation to how we process personal data. We provide more detail in respect of how we process and protect personal data below, particularly in section 5.\u0026nbsp;\u003C/p\u003E\n\u003Cp\u003EThe Scout Association (\u201CWe\u201D in this document) is registered with the Information Commissioner\u2019s Office at the following address: Gilwell Park, Chingford, London E4 7QW. If you have any queries about anything set out in this policy or about your own rights, please write to the Data Protection Officer (Black Penny Consulting) at the above address or via email at \u003Ca href=\u0022mailto:Enquiries.dpo@scouts.org.uk\u0022\u003EEnquiries.dpo@scouts.org.uk\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EWe may from time to time make minor changes to this policy. We will notify our members when we make any substantial or significant changes to the policy.\u003C/p\u003E","label":"1. Purpose of this Data Protection policy and what it covers"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003E\u003Cstrong\u003E\u2018We\u2019 \u003C/strong\u003Emeans The Scout Association and The Scout Association Trust Corporation.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E\u2018ICO\u2019\u003C/strong\u003E is the Information Commissioner\u2019s Office, the body responsible for enforcing data protection legislation within the UK and the regulatory authority for the purposes of the GDPR.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E\u2018Local Scouting\u2019\u003C/strong\u003E and \u003Cstrong\u003E\u2018Scout unit\u2019 \u003C/strong\u003Emean Scout Groups, Districts, Counties, Areas (Wales), Regions (Scotland) or Countries.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E\u0027Personal Data\u0027 \u003C/strong\u003Eis defined in section 3.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E\u2018Processing\u2019 \u003C/strong\u003Emeans all aspects of handling personal data, for example collecting, recording, keeping, storing, sharing, archiving, deleting and destroying it.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E\u2018Data Controller\u2019\u003C/strong\u003E means anyone (a person, people, public authority, agency or any other body) which, on its own or with others, decides the purposes and methods of processing personal data. We are a data controller insofar as we process personal data in the ways described in this policy.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E\u2018Data processor\u2019 \u003C/strong\u003Emeans anyone who processes personal data under the data controller\u2019s\u00A0instructions, for example a service provider. We act as a data processor in certain circumstances.\u003Cstrong\u003E\u003Cbr\u003E\u003C/strong\u003E\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E\u2018Subject Access Request\u2019 \u003C/strong\u003Eis a request for personal data that an organisation may hold about an\u00A0individual. This request can be extended to include the deletion, rectification and restriction\u00A0of processing.\u003Cstrong\u003E\u003Cbr\u003E\u003C/strong\u003E\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E\u2018Membership System\u2019\u003C/strong\u003E This refers to the Microsoft Dynamics based system we use to store membership information. This database is used both by The Scout Association as well as local Scouting. It integrates with our Learning Management System.\u00A0\u003C/p\u003E","label":"2. Some Important Definitions"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EPersonal data means any information about an identified or identifiable person. For example, an individual\u2019s home address, personal (home and mobile) phone numbers and email addresses, occupation, and so on can all be defined as personal data.\u003C/p\u003E\n\u003Cp\u003ESome categories of personal data are recognised as being particularly sensitive (\u201Cspecial category data\u201D). These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic and biometric information, and data concerning a person\u2019s sex life or sexual orientation.\u003C/p\u003E","label":"3. What is personal data?"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EData protection legislation applies to all data controllers regardless of whether they are charities or small organisations. It applies to local Scouting in the same way as it does to other organisations. Scout units are created and run as independent charities and insofar as they collect and store personal data about members and young people, they are data controllers and must adhere to the law.\u003C/p\u003E\n\u003Cp\u003EFor the purpose of our Membership System both The Scout Association and local Scout units act as independent data controllers. This relates to:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EMaintenance of local Scouting\u2019s primary records, such as name, address and leadership details of the local Group, District, County, Area (Wales), Region (Scotland) or Country.\u003C/li\u003E\n\u003Cli\u003ELocal Scouting roles, such as creation, management and deletion of role and any reasons for leaving local Scouting. This includes ID checking.\u003C/li\u003E\n\u003Cli\u003EDirect messaging in the platform.\u003C/li\u003E\n\u003Cli\u003ETraining, learning and permit management.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EEach Scout unit will have its own data protection policy. In case of any doubt or questions you are advised to contact the Scout unit directly or to write to our Data Protection Officer at the above address who may be able to help.\u003C/p\u003E","label":"4. How does data protection apply to local Scouting?"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cdiv class=\u0022page\u0022\u003E\n\u003Cdiv class=\u0022layoutArea\u0022\u003E\n\u003Cdiv class=\u0022column\u0022\u003E\n\u003Ch4\u003E5.1 Members and volunteers\u003C/h4\u003E\n\u003C/div\u003E\n\u003C/div\u003E\n\u003C/div\u003E\n\u003Cdiv class=\u0022page\u0022\u003E\n\u003Cdiv class=\u0022layoutArea\u0022\u003E\n\u003Cdiv class=\u0022column\u0022\u003E\n\u003Cp\u003EWe benefit from the service of a large number of members giving their time to Scouting at both UKHQ and local Scouting levels. We hold personal data (including special category data) about adult members and volunteers on our membership database. We believe it is important to be open and transparent about how we use personal data. Information we hold about members may include the following:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003Ename and contact details\u003C/li\u003E\n\u003Cli\u003Elength and periods of membership and volunteer service (and absence from membership and volunteer service)\u003C/li\u003E\n\u003Cli\u003Edetails of training received\u003C/li\u003E\n\u003Cli\u003Edetails of experience, qualifications, occupation, skills and awards received\u003C/li\u003E\n\u003Cli\u003Edetails of Scouting events and activities members have taken part in\u003C/li\u003E\n\u003Cli\u003Edetails of next of kin\u003C/li\u003E\n\u003Cli\u003Eage/date of birth\u003C/li\u003E\n\u003Cli\u003Elegal sex\u003C/li\u003E\n\u003Cli\u003Edetails of any health conditions\u003C/li\u003E\n\u003Cli\u003Edetails of disclosure checks\u003C/li\u003E\n\u003Cli\u003Eany complaints we have received about the member\u003C/li\u003E\n\u003Cli\u003Edetails of any safeguarding concerns raised about or by the member\u003C/li\u003E\n\u003Cli\u003Edetails about role(s) in Scouting\u003C/li\u003E\n\u003Cli\u003Edetails about membership status\u003C/li\u003E\n\u003Cli\u003Ediversity and inclusion data (including nationality, ethnicity, religion / belief, health information, gender, and sexual orientation)\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWe need this information to communicate with members and to carry out any necessary checks to make sure that members can work with young people. The diversity and inclusion information is collected to help us understand the diversity of Scouts and the growing needs of our movement.\u0026nbsp;\u003C/p\u003E\n\u003Cp\u003EMuch of this information is collected from the member joining forms or is input directly into the system by members themselves.\u003C/p\u003E\n\u003Ch4\u003E5.2 Young People\u003C/h4\u003E\n\u003Cp\u003EWe do not centrally hold a youth membership database. The responsibility for managing youth membership sits locally. However, we do process some personal data about Young People.\u003C/p\u003E\n\u003Cp\u003EFor Young People, we hold information where there has been a safeguarding or safety case raised, this may include basic personal identifiers along with the details of the case. We may capture information on Young People who attend events managed by The Scout Association; this may include details on dietary and accessibility requirements. We process data about Young People where they have been put forward for an award, entered a competition run by TSA or partaken in research undertaken by TSA. We also process data on Young People where they are part of a legal claim, the data we capture may include the detail of the claim itself.\u003C/p\u003E\n\u003Ch4\u003E5.3 Trustees and members of the governance structure\u003C/h4\u003E\n\u003Cp\u003EFor the members of The Scout Association\u2019s Board of Trustees and its subcommittees, other\u0026nbsp;committees and working groups, we may hold the type of information as set out in 5.1 and including the following:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ECVs\u003C/li\u003E\n\u003Cli\u003ERelated party information\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch4\u003E5.4 Donors\u003C/h4\u003E\n\u003Cp\u003EWe benefit from donations from members of the public who support our work. We hold personal data about these donors so that we can process donations and tell donors about our work, campaigns and how they can support us further. This may include details of donors that wish to leave a legacy in their will.\u0026nbsp;\u003C/p\u003E\n\u003Cp\u003EWe hold the following types of information:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003Ename and contact details\u003C/li\u003E\n\u003Cli\u003Eaddress\u003C/li\u003E\n\u003Cli\u003Edetails of donations and interactions, such as communications and events\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhere The Scout Association have assessed individuals as a major donor (based on donations of \u00A310,000 and above), we may hold publicly available details that assist us in assessing:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003Ecapacity to give\u003C/li\u003E\n\u003Cli\u003Epropensity to give\u003C/li\u003E\n\u003Cli\u003Ecloseness to the Scouts\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch4\u003E5.5 Customers and visitors\u003C/h4\u003E\n\u003Cp\u003EWe also hold personal data for visitors to our sites. This can include guests, suppliers, tradespeople and contractors. We may hold the type of information as set out in 5.1.\u0026nbsp;Much of this information is taken from online registration forms, and sign in mechanisms.\u0026nbsp;\u003C/p\u003E\n\u003C/div\u003E\n\u003C/div\u003E\n\u003C/div\u003E\n\u003Cdiv class=\u0022page\u0022\u003E\n\u003Cdiv class=\u0022layoutArea\u0022\u003E\n\u003Cdiv class=\u0022column\u0022\u003E\n\u003Ch4\u003E5.6 Employees and contractors (past, present and future)\u003C/h4\u003E\n\u003C/div\u003E\n\u003C/div\u003E\n\u003Cdiv class=\u0022layoutArea\u0022\u003E\n\u003Cdiv class=\u0022column\u0022\u003E\n\u003Cp\u003EAs an employer, we need to keep information relating to each member of staff and contractors who have a contract with us. This will include the pre-employment stage, references, and records relating to the time they worked for us including probationary, appraisal and disciplinary information.\u003C/p\u003E\n\u003Cp\u003EWe have a separate \u003Ca href=\u0022/about-us/policy/employee-privacy-notice/\u0022 title=\u0022Employee Privacy Notice\u0022\u003EEmployee Privacy Notice\u003C/a\u003E which provides more detail to staff members about how we process their data.\u0026nbsp;\u003C/p\u003E\n\u003Ch4\u003E5.7 CCTV\u003C/h4\u003E\n\u003Cp\u003EOur sites operate CCTV networks to help prevent and detect crime and to safeguard (protect) Young People and others. If an individual can be identified from a CCTV image, that image must be treated as personal data and processed accordingly. This is governed by our CCTV Policy.\u003C/p\u003E\n\u003Ch4\u003E5.8 Scout Association Trust Corporation (SATC)\u003C/h4\u003E\n\u003Cp\u003EThe Scout Association Trust Corporation (SATC) hold title deeds to property on behalf of Scout units. As part of the services that SATC provides, we are required to receive and send both hard copy and electronic documents. In many cases, we need limited personal information typically a name and contact details, including a postal address to deliver these services. We may also use contact information held in the membership system to manage SATC related matters. \u0026nbsp;\u003C/p\u003E\n\u003C/div\u003E\n\u003C/div\u003E\n\u003C/div\u003E","label":"5. What type of personal data do we collect and why?"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cdiv class=\u0022page\u0022\u003E\n\u003Cdiv class=\u0022layoutArea\u0022\u003E\n\u003Cdiv class=\u0022column\u0022\u003E\n\u003Ch4\u003E6.1 Keeping to the law\u003C/h4\u003E\n\u003C/div\u003E\n\u003C/div\u003E\n\u003C/div\u003E\n\u003Cdiv class=\u0022page\u0022\u003E\n\u003Cdiv class=\u0022layoutArea\u0022\u003E\n\u003Cdiv class=\u0022column\u0022\u003E\n\u003Cp\u003EWe must comply with the law when processing personal data. To do this, we must meet at least one of the following conditions:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EConsent\u003C/strong\u003E - to give (or have given) permission for us to use their information for one or more specific purposes.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EPerformance of a contract\u003C/strong\u003E - we need to process the information to meet the terms of any contract we have entered into (for example, when we process personal data as part of a volunteer\u2019s membership application or to provide goods or services, they have purchased).\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ELegal obligation\u003C/strong\u003E - processing the information is necessary for us to comply with our legal obligations as a data controller.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EVital interests\u003C/strong\u003E - processing the information is necessary to protect someone\u2019 life.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EPublic task\u003C/strong\u003E - processing the information is necessary for us to carry out a task in the public interest or to exercise official authority as a data controller.\u00A0\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ELegitimate interests\u003C/strong\u003E - processing the information is necessary for our legitimate interests as an organisation (see below examples).\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ctable border=\u00221\u0022 cellpadding=\u00225\u0022 width=\u0022100%\u0022\u003E\n\u003Ctbody\u003E\n\u003Ctr\u003E\n\u003Ctd\u003E\n\u003Cp\u003ELawful basis\u003C/p\u003E\n\u003C/td\u003E\n\u003Ctd\u003E\n\u003Cp\u003EData processing examples\u003C/p\u003E\n\u003C/td\u003E\n\u003C/tr\u003E\n\u003Ctr\u003E\n\u003Ctd\u003E\n\u003Cp\u003EConsent\u003C/p\u003E\n\u003C/td\u003E\n\u003Ctd\u003E\n\u003Cul\u003E\n\u003Cli\u003ESending marketing information not deemed part of legitimate interest\u003C/li\u003E\n\u003Cli\u003EThe use of photography captured by UKHQ\u003C/li\u003E\n\u003Cli\u003EManaging TSA HQ grant applications and provisions\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/td\u003E\n\u003C/tr\u003E\n\u003Ctr\u003E\n\u003Ctd\u003E\n\u003Cp\u003EPerformance of a contract\u003C/p\u003E\n\u003C/td\u003E\n\u003Ctd\u003E\n\u003Cul\u003E\n\u003Cli\u003EVolunteer membership application\u003C/li\u003E\n\u003Cli\u003ESupply of goods or services purchased\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/td\u003E\n\u003C/tr\u003E\n\u003Ctr\u003E\n\u003Ctd\u003E\n\u003Cp\u003ELegal obligation\u003C/p\u003E\n\u003C/td\u003E\n\u003Ctd\u003E\n\u003Cul\u003E\n\u003Cli\u003EDisclosure and Barring Service referral\u003C/li\u003E\n\u003Cli\u003EInsurance underwriting referrals\u003C/li\u003E\n\u003Cli\u003ESubmitting tax records to HMRC\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/td\u003E\n\u003C/tr\u003E\n\u003Ctr\u003E\n\u003Ctd\u003E\n\u003Cp\u003EVital interests\u003C/p\u003E\n\u003C/td\u003E\n\u003Ctd\u003E\n\u003Cul\u003E\n\u003Cli\u003EMedical history disclosure to a medical professional to protect the health of the data subject\u00A0\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/td\u003E\n\u003C/tr\u003E\n\u003Ctr\u003E\n\u003Ctd\u003E\n\u003Cp\u003EPublic task\u003C/p\u003E\n\u003C/td\u003E\n\u003Ctd\u003E\n\u003Cul\u003E\n\u003Cli\u003ESharing information with statutory bodies such as the Police (including the Hydrant Programme) or Local Authorities\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/td\u003E\n\u003C/tr\u003E\n\u003Ctr\u003E\n\u003Ctd\u003E\n\u003Cp\u003ELegitimate interest\u003C/p\u003E\n\u003C/td\u003E\n\u003Ctd\u003E\n\u003Cul\u003E\n\u003Cli\u003EPhotography at UKHQ organised events where consent is not appropriate (could include the publishing of the photography in TSA media channels including printed format)\u003C/li\u003E\n\u003Cli\u003EThe passing of personal data to local Scout Groups as part of the \u2018Find a local group\u2019 service online.\u003C/li\u003E\n\u003Cli\u003EDisplaying the contact details of local leaders as part of the \u2018Find a local group\u2019 service online\u003C/li\u003E\n\u003Cli\u003ENominations for Meritorious Conduct \u0026amp; Gallantry Awards, The Cornwell Scout Badge, Chief Scout\u2019s Personal Awards and Good Service Awards Informational/operational communications directly to volunteers\u003C/li\u003E\n\u003Cli\u003EInformational/operational communications directly to volunteers.\u003C/li\u003E\n\u003Cli\u003EThe use of membership data for the recruitment of HQ roles\u003C/li\u003E\n\u003Cli\u003EThe passing of volunteer and Young Person data to TSA\u2019s outside legal counsel in defence of cases\u003C/li\u003E\n\u003Cli\u003EScout Stories that are submitted to Scouts HQ and may be published online\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/td\u003E\n\u003C/tr\u003E\n\u003C/tbody\u003E\n\u003C/table\u003E\n\u003Cp\u003EAlso, information must be:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003Eprocessed fairly, lawfully and in a transparent manner\u003C/li\u003E\n\u003Cli\u003Ecollected for specified, clear and legitimate purposes\u003C/li\u003E\n\u003Cli\u003Eadequate, relevant and limited to what is necessary\u003C/li\u003E\n\u003Cli\u003Eaccurate and, where necessary, kept up to date\u003C/li\u003E\n\u003Cli\u003Ekept for no longer than is necessary\u003C/li\u003E\n\u003Cli\u003Eprocessed securely\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch4\u003E\u003Cspan\u003E\u003C/span\u003E6.2 Information that we share\u003C/h4\u003E\n\u003Cp\u003EWe may need to share personal data within appropriate levels of the Association and with local Scouting, provided this is necessary and directly related to a member\u2019s role within Scouting. This is subject to data sharing agreements entered into with each Trustee Board.\u00A0\u003C/p\u003E\n\u003Cp\u003ETSA may also share personal data with its partners, companies and organisations and individuals who help us to fund, organise and operate events, projects, programmes and other activities. Our legal basis for this is the pursuit of our legitimate interest in working collaboratively with other organisations to operate and administer the event, project, programme or activity.\u00A0\u003C/p\u003E\n\u003Cp\u003ESome of these organisations may process information in countries outside the UK / EEA, such as the United States, where data protection laws differ from those in the UK / EEA. TSA ensures that any such transfers are subject to appropriate security measures to safeguard personal data. Where transfers are necessary to countries where data protection has not yet been declared to be adequate, we rely on appropriate safeguards, as defined in the UK GDPR for these transfers.\u003C/p\u003E\n\u003Cp\u003ETSA may also share information within the TSA group of companies for the purposes of managing particular events, projects, programmes, or other activities. TSA currently provides support and services to its subsidiary companies. Therefore, our legal basis for sharing information is to pursue the legitimate interests of shared resources and management reporting between the companies within the group.\u00A0\u003C/p\u003E\n\u003Cp\u003EWe do not share personal data with companies, organisations or people outside the Association unless we have a lawful basis for doing so and one of the following applies:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EWe have entered into a data sharing or data processing agreement with them\u003C/li\u003E\n\u003Cli\u003EWe are legally required to share the information\u003C/li\u003E\n\u003Cli\u003ESharing the information helps safeguard Young People\u00A0\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EYou can view a list of\u00A0\u003Ca href=\u0022/about-us/policy/data-protection-policy/third-parties/\u0022 title=\u0022Third parties\u0022\u003Ethe most common third parties we share personal data with\u003C/a\u003E. This is not exhaustive and acts as an example. Where appropriate we ensure that where data processing may include a third party, the data subject is informed. This is usually at the point data is captured. \u00A0\u003C/p\u003E\n\u003C/div\u003E\n\u003C/div\u003E\n\u003C/div\u003E","label":"6. Conditions for collecting personal data"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EWe use technical and organisational safeguards to protect your data and prevent the loss, misuse or alteration of your personal information. Everyone who handles personal data makes sure it is held securely to protect against unlawful or unauthorised processing and accidental loss or damage. We take appropriate steps to make sure we keep all personal data secure, and we make all our staff aware of these steps, including keeping to our internal information and computing technology (ICT) policy framework.\u003C/p\u003E\n\u003Cp\u003EAll staff undertake regular training to ensure that they are aware of the above rules, and work to our agreed \u003Ca href=\u0022/about-us/policy/acceptable-usage-policy/\u0022 title=\u0022Acceptable Usage Policy\u0022\u003EAcceptable Usage Policy\u003C/a\u003E when using our equipment or systems.\u003C/p\u003E\n\u003Cp\u003EThe Scout Association holds ISO27001 accreditation. \u00A0\u003C/p\u003E","label":"7. Keeping personal data secure"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EWe expect our staff, managers, trustees, volunteers, members and any providers we use to adhere to data protection legislation. More details are set out below.\u00A0\u003C/p\u003E\n\u003Ch4\u003E8.1 Board of Trustees\u003C/h4\u003E\n\u003Cp\u003EOur Board of Trustees holds overall responsibility for the governance of the Association, including ensuring compliance with all \u00A0 legal and regulatory obligations, this includes adherence to data protection legislation. Operational responsibility for implementing and maintaining compliance across UK Headquarters rests with our CEO and Senior Leadership Team, who are accountable for ensuring that appropriate systems, processes, and controls are in place and effectively managed. \u00A0\u00A0\u003C/p\u003E\n\u003Ch4\u003E8.2 Data protection officer (DPO) or equivalent role holder\u003C/h4\u003E\n\u003Cp\u003ETSA has externally appointed a DPO to ensure the organisation is monitoring compliance with Data Protection legislations and our data protection policies. The Data Protection Officer is responsible for:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003Emaking sure that this data protection policy is up to date\u003C/li\u003E\n\u003Cli\u003Eadvising on data protection issues\u003C/li\u003E\n\u003Cli\u003Edealing with complaints about how we use personal and sensitive personal data\u003C/li\u003E\n\u003Cli\u003Ereporting to the ICO if we do not keep to any regulations or legislation\u003C/li\u003E\n\u003Cli\u003Eraising awareness of data protection and training\u003C/li\u003E\n\u003Cli\u003Eundertaking internal audits\u003C/li\u003E\n\u003C/ul\u003E\n\u003Ch4\u003E8.3 Staff\u003C/h4\u003E\n\u003Cp\u003EAll staff have a responsibility to keep to the requirements of this data protection policy and our related procedures and processes, including our Internal Data Protection Compliance Framework. Managers are responsible for making sure that staff within their teams are aware of and keep to this.\u003C/p\u003E\n\u003Cp\u003EIf staff do not adhere to this data protection policy and its associated policies and procedures, we may take disciplinary action against them.\u003C/p\u003E\n\u003Ch4\u003E8.4 Volunteers, members and local Scouting\u003C/h4\u003E\n\u003Cp\u003EWe expect all volunteers to keep to data protection legislation and to follow the relevant rules set out in our Policy, Organisation and Rules (POR). We provide general guidance and signposting to local Scouting, including online resources such as our \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/\u0022 title=\u0022GDPR Toolkit\u0022\u003EScout Unit Data Protection Toolkit\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EThe local Trustee Boards (trustees of local Groups, Districts, Areas, Counties, Countries and so on) have overall responsibility for adhering to data protection legislation.\u003C/p\u003E","label":"8. Responsibilities"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EWe may keep information for different periods of time for different purposes as required by law or business requirements. Individual departments include these time periods in their processes.\u003C/p\u003E\n\u003Cp\u003EAs far as membership information is concerned, to make sure of continuity (for example if someone leaves and then re-joins) and to carry out our legal responsibilities relating to safeguarding Young People, we keep membership information after it ends, and we make sure we store it securely. Only those staff who need membership information to carry out their role have access to that information.\u003C/p\u003E\n\u003Cp\u003EFor more information see our \u003Ca href=\u0022/about-us/policy/data-retention-policy/\u0022 title=\u0022Data Retention Policy\u0022\u003EData Retention Policy\u003C/a\u003E.\u003C/p\u003E","label":"9. Data Retention"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EUnder data protection law, individuals have a number of rights in relation to their personal data.\u003C/p\u003E\n\u003Col style=\u0022list-style-type: lower-alpha;\u0022\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to information:\u003C/strong\u003E As a data controller, we must give you a certain amount of information about how we collect and process information about you. This information needs to be concise, transparent, understandable and accessible.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right of subject access:\u003C/strong\u003E If you want a copy of the personal data we hold about you, you have the right to make a Subject Access Request (SAR) and get a copy of that information\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to rectification:\u003C/strong\u003E You have the right to ask us, as data controller, to correct mistakes in the personal data we hold about you.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to erasure (right to be forgotten): \u003C/strong\u003EYou can ask us to delete your personal data if it is no longer needed for its original purpose, or if you have given us permission to process it and you withdraw that permission (or where there is no other lawful basis for processing it).\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to restrict processing:\u003C/strong\u003E In certain circumstances where, for lawful or legitimate purposes, we cannot delete your relevant personal information or if you do not want us to delete it, we can continue to store it for restricted purposes. This is an absolute right unless we have a lawful purpose to have it that overwrites your rights.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe obligation to notify relevant third parties: \u003C/strong\u003EIf we have shared information with other people or organisations, and you then ask us to do either (c), (d) or (e) above, as data controller we must tell the other person or organisation (unless this is impossible or involves effort that is out of proportion to the matter).\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to data portability:\u003C/strong\u003E This allows you to transfer your personal data from one data controller to another.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to object: \u003C/strong\u003EYou have a right to object to us processing your personal data for certain\u0026nbsp;reasons, as well as the right to object to processing carried out for profiling or direct marketing.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to not be evaluated on the basis of automatic processing: \u003C/strong\u003EYou have the right not to be affected by decisions based only on automated processing which may significantly affect you.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EThe right to bring class actions:\u003C/strong\u003E You have the right to be collectively represented by not-for-profit organisations.\u003C/li\u003E\n\u003C/ol\u003E\n\u003Cp\u003EIf you wish to exercise any of your data subject rights, you should contact UKHQ legal department at \u003Ca rel=\u0022noopener\u0022 href=\u0022mailto:DSARS@scouts.org.uk\u0022 target=\u0022_blank\u0022 title=\u0022UKHQ legal department email\u0022\u003EDSARS@scouts.org.uk\u003C/a\u003E or by writing to:\u003C/p\u003E\n\u003Cp\u003EThe Scout Association\u003Cbr\u003ELegal Services\u003Cbr\u003EGilwell Park\u003Cbr\u003EChingford\u003Cbr\u003ELondon\u003Cbr\u003EE4 7QW\u003C/p\u003E\n\u003Cp\u003EPlease note, subject rights requests for data held by Local Scouting should be made directly to the relevant Scout unit as each Scout unit operates as a separate charity and each is a Data Controller in its own right.\u003C/p\u003E\n\u003Cp\u003EThe most commonly exercised data subject right is the right to access. More information is provided on this below.\u0026nbsp;\u003C/p\u003E","label":"10. Data Subject Rights"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EYou are entitled to ask us, in writing, for a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). In line with legislation, we will not charge a fee for this information and will respond to your request within one calendar month, though if the request is deemed to be complex, we may take up to three months. If the request is deemed excessive, we will contact you within the month of making the SAR to state the reason and discuss how we will proceed which may include making a charge.\u00A0\u003C/p\u003E\n\u003Cp\u003EOur members or anyone else can also ask for information from local Scouting. The relevant Scout unit, as data controller in their own right, must answer these requests. UKHQ is not legally responsible for these local SARs but we advise Scout units to respond to them in line with the law, and we provide guidance at \u003Ca href=\u0022/volunteers/running-things-locally/subject-access-requests/\u0022 title=\u0022Subject Access Requests\u0022\u003ESubject Access Requests\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EWhen making a request we recommend that you are as specific as possible in relation to what you are looking for. This will help us ensure we provide you with what you want.\u00A0\u003C/p\u003E","label":"11. Subject Access Requests"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EIf you are unhappy with the way your data has been processed, you have the right to raise a complaint with us. Complaints will be investigated by our Information Governance Team and will be responded to within one month. If the matter is deemed to be complex, we may take up to three months but will acknowledge the complaint within the first month.\u003C/p\u003E\n\u003Cp\u003ETo raise a complaint, you should email \u003Ca rel=\u0022noopener\u0022 href=\u0022mailto:Enquiries.dpo@scouts.org.uk\u0022 target=\u0022_blank\u0022 title=\u0022Data enquiries email address\u0022\u003EEnquiries.dpo@scouts.org.uk\u003C/a\u003E\u003C/p\u003E\n\u003Cp\u003EIn situations where you feel The Scout Association has not handled your personal data complaint appropriately you have the right to raise the matter with the Information Commissioners Office, though you may contact them at any time.\u003C/p\u003E\n\u003Cp\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u2019s Office website\u0022\u003EContact the Information Commissioner\u2019s Office\u003C/a\u003E.\u003C/p\u003E","label":"12. Complaints"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EData Protection Officer contact details:\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022mailto:Enquiries.dpo@scouts.org.uk\u0022 target=\u0022_blank\u0022 title=\u0022Data Protection Officer email address\u0022\u003EEnquiries.dpo@scouts.org.uk\u003C/a\u003E\u003C/p\u003E","label":"13. Further information and contacts"}]}]}],"config":null}]},"searchDescription":"The Scout Association\u2019s commitment to protecting privacy and data forms a key policy for Scouting.","pageType":null,"location":null,"browserTitle":"","versionDate":"14 July 2023","reviewDate":"08/04/2022","redirectUrl":"","id":39665,"nodeName":"Data Protection Policy","title":"Data Protection Policy","type":"contentPage","image":{"url":"/media/10478/scouts-logo.jpg?width=800\u0026height=450\u0026v=1db789232a4a190","caption":"Scouts Logo","type":"jpg","size":30784,"width":800,"height":450,"altText":"The Scouts logo"},"assets":null,"headerOptions":{"headerTitle":"Data Protection Policy","headerSubTitle":"July 2025","headerCta":"","headerCtaText":"","headerCtaLink":"","headerBackgroundColour":"","showSEOImage":false,"headerBackgroundImage":null,"quickLinks":[]},"subHeader":"The Scout Association\u2019s commitment to protecting privacy and data forms a key policy for Scouting.","silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC8zOTY2NSJ9","canonicalUrl":"https://www.scouts.org.uk/about-us/policy/data-protection-policy/"}