This webpage outlines how Bethany Houseparty processes and manages personal data. It:
1) identifies our data controller;
2) provides our lawful basis for processing personal data;
3) outlines the scope of personal data we hold and process;
4) outlines the scope of the special category personal data we hold and process;
5) outlines who has access to the data
6) describes and justifies our data retention policy;
7) shows how we intend to respond to Subject Access Requests; and
8) contains a copy of our privacy notice.
Data Controller
We do not have a data controller as we are exempt as a small no-for-profit organisation. We do not have to register with the ICO. The data holder for houseparty is Frances Tomlinson-Mynors.
Lawful basis for processing
Most of our data is stored under the lawful basis of legitimate interest
We may also have an opt-in mailing list for campers and leaders to be kept in touch with the houseparty during the year. This would be under the lawful basis of consent.
We undertake to always act within the reasonable expectations of attendees at houseparty, and their parents/guardians, and any other individuals about whom we hold personal data.
Data we hold
As of March 2025, we hold information on campers and their parents, and leaders. All of the children attended houseparty last year or are booked to come this year. We also hold information about our trustees. We will also hold data on people who have donated and agreed for us to claim Gift Aid on their donations. Personal data is stored electronically and securely on our computer systems, and is only accessed only accessed by Trustees, administrators or appropriately trained leaders.
This information predominantly includes but is not limited to:
▪ Titles, Names, addresses, ages, dates of birth, and email addresses.
▪ Telephone numbers.
▪ Records of monetary donations
▪ Special category data, outlined below.
Mailing lists
We may also maintain a mailing list for a Houseparty newsletter. These subscribers receive a newsletter about houseparty. This data is stored by brevo, who are based in the USA and have certified to the Privacy Shield regime for transfers of data between the EU and United States. Personal data we hold in this regard includes:
▪ Names and email addresses.
Special category Data we hold
We hold special category data for a number of our data subjects. This may include
▪ Religious beliefs
▪ Details of criminal offences (leaders only for safeguarding purposes)
▪ Physical and mental health including detailed medical information
Access to the Data
Campers’ data
It is necessary to share some personal data we hold about campers with the leadership team. This may include special category data such as health information. This is to ensure the wellbeing of the young people in our care. Depending on the need of the young person, this may be limited to: just the medical personnel on site, or extended to the whole leadership team. (eg A child with a severe allergy will be made known to the entire team, so they know what to do in case of emergency). Names and ages of campers will be shared with the entire team, as necessary for the running of the houseparty. At houseparty, the full paper data on campers will be stored securely. Only the senior leadership team will have access to this. Health forms will be stored securely, and only medical personnel will have access to this. Electronic data will be password protected. Personal data will be printed on yellow paper, ad all leaders must return this to Frances Tomlinson-Mynors at the end of camp, or destroy securely.
Leaders’ data
Leaders’ data will be held securely on site at houseparty as for the campers. In the same way, any medical information will be made known to the medical personnel only as necessary.
Leaders’ email address and phone numbers will be shared with the entire leadership team where the leader has given their explicit consent for this to happen. Leaders will also explicitly agree not to share this data outside the leadership team.
Gift Aid Claim data
Your information will be kept electronically, and only accessed by administrators, or appropriately trained leaders. The data will be held for the legitimate use in-line with HMRC guidance. The data will not be shared or sold to any third party for marketing purposes. If you have gift aided your donation, your data will be shared with HMRC to enable the gift aid to be processed.
Data retention policy
Details of attendees at houseparty will be kept indefinitely for safeguarding reasons. This data will include the name, date of birth and address of attendees. Other data will be kept only for as necessary to carry out our work or comply with legal and insurance requirements. Medical data will be kept for 7 years, and then destroyed, unless needed for legal or safeguarding reasons. All safeguarding records and complaints records will be kept indefinitely.
Records of donations (name and amount given) are retained in perpetuity. Your contact details (address, email address, and telephone number) and bank details are retained for 6 years after the end of the financial year in which the donation was made. Gift Aid declarations: we are legally required to hold some personal information to fulfil statutory obligations, for example the collection of Gift Aid or to support certain financial transactions for six years following the financial year the Gift Aid declaration was made.
Data held under consent will be held for as long as the person stays subscribed to the mailing list. A data subject may opt out of this mailing list at any time, and there will be an opt out option on every email sent.
Subject Access Requests
We will comply with Subject Access Requests in line with the guidance given by the Information Commissioners Office (ICO).
i. We will respond as quickly as possible, within 30 calendar days.
ii. We will request verification of the identity of any individual making a request, and ask for further clarification and details if needed.
iii. Data subjects have the right to the following:
To be told whether any personal data is being processed
To be given a description of the personal data, the reasons it is being processed and whether it will be given to another organisation or people.
To be given a copy of the information comprising the data, and given details of the source of the data where this is available.
Privacy notice
We will undertake to ensure all data subjects sharing their personal data can have the opportunity to read our privacy notice. It will be published on our website and all camper and their parents, and leaders and trustees will have access to it.
Privacy Notice
This privacy notice relates to the personal data processed by Bethany Houseparty.
Who is the Data Controller?
We are exempt from having a data controller for the houseparty. The data holder for houseparty is Frances Tomlinson-Mynors
What do we do?
We store data in order to run an annual holiday for young people.
How do we process data?
We process data under the lawful basis of legitimate interest. We may also process data under the lawful basis of consent, for our emailed newsletter.
We are committed to ensuring that the information we collect and use is appropriate for this purpose, and does not constitute an invasion of your privacy.
Will we share your data with anyone else?
We will not share your data with anyone unless require by legislation, or for safeguarding purposes. We share Gift Aid data with HMRC as required.
For how long will you keep my personal data?
Details of attendees at houseparty will be kept indefinitely for safeguarding reasons. This data will include the name, date of birth and address of attendees. Other data will be kept only for as necessary to carry out our work or comply with legal and insurance requirements. Medical data will be kept for 7 years, and then destroyed, unless needed for legal or safeguarding reasons. Gift Aid data will be kept for six years following the financial year the Gift Aid declaration was made.
All safeguarding records will be kept indefinitely.
What rights do I have to my personal data?
At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:
- Right of access – you have the right to request a copy of the information that we hold about you.
- Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
- Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
- Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
- Right of portability – you have the right to have the data we hold about you transferred to another organisation.
- Right to object – you have the right to object to certain types of processing, such as direct marketing.
- Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
- Right to judicial review: if our office refuses your request under rights of access, we will provide you with a reason why. You have the right to complain.
How can I contact somebody about my privacy?
You can get in touch with us by letter or email using the details at the foot of this page.
Please note that we will ask for identification should you choose to exercise any of the above rights in relation to personal data we hold.
If you are unhappy with the way that we have processed or handled your data then you have a right to complain to the Information Commissioner’s Office (ICO). The ICO is the supervisory body authorised by the Data Protection Act 2018 to regulate the handling of personal data within the United Kingdom. The contact details for the ICO are:
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
- Telephone: 0303 123 1113
- Website: https://ico.org.uk/concerns/
You can contact us via email: bethanyhouseparty@outlook.com
Policy agreed by trustees