Privacy Policy

1. Introduction
This Policy sets out the obligations of The League of St Bartholomew’s Nurses regarding data protection and the rights of its members (data subjects) in respect of their personal data under EU Regulation 2016/679 General Data Protection Regulation (GDPR). GDPR defines “personal data” as any information relating to an identified or identifiable person (a data subject).

This Policy sets out the League’s obligations regarding the collection, processing, transfer, storage, and disposal of personal data. The procedures and principles set out herein must be followed at all times by the League, its officers, agents, or other parties working on behalf of the League. The League places high importance on the correct, lawful, and fair handling of all personal data, respecting the legal rights, privacy, and trust of all individuals with whom it deals.

2. The Data Protection Principles
This Policy is designed to ensure compliance with GDPR and The Charities Commission. GDPR sets out the following principles with which any organisation handling personal data must comply.
All personal data must be:

1. Processed lawfully, fairly, and in a transparent manner in relation to the data subject.

2. Collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

3. Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is obtained.

4. Accurate and, where necessary, kept up to date. Every reasonable step will be taken to ensure that personal data that is inaccurate is erased or rectified in a timely fashion.

5. Kept in a form that permits identification of data subjects for no longer than is necessary. Personal data may be stored for longer periods solely for archiving purposes, subject to implementation of the appropriate technical and organisational measures required by GDPR.

6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.

3. The Rights of data subjects (members and or those using or viewing our website)
GDPR sets out the following rights applicable to data subjects:

3.1 The right to be informed
Where personal data is collected directly from members they will be informed of its purpose at the time of collection, by reference to this policy.

Where personal data is obtained from a third party, (e.g. Gift membership) the relevant data subjects will be informed of its purpose as soon as reasonably possible, by email or post, by reference to this policy.
The following information shall be provided to all members:

1. Details of the League Data Compliance Manager

2. The purpose(s) for which the personal data is being collected and will be processed

3. Where the personal data is to be transferred to a third party, details of that 3rd party.

4. Details of how data will be retained; the data subject’s rights under GDPR; their right to withdraw their consent to the League’s processing of their personal data at any time; and their right to complain to the Information Commissioner’s Office (the “supervisory authority” under GDPR).

3.2 The right to Data Subject Access

1. Members may make subject access requests (SARs) at any time to ask about the personal data which the League holds about them, what it is doing with that personal data, and why.

2. Members wishing to make a SAR must do so in writing. The SAR should be addressed to the League’s Data Compliance Manager. Responses to SARs will be made as soon as reasonably practicable and where possible within 2 months. If additional time is required, the data subject shall be informed.

3. The League does not charge a fee for the handling of normal SARs. The League reserves the right to charge reasonable fees for additional copies of information that has already been supplied to a data subject, and for requests that are manifestly unfounded or excessive, particularly where such requests are repetitive.

3.3 The right to Rectification of Personal Data

1. Data subjects have the right to require the League to rectify any of their personal data that is inaccurate or incomplete.

2. The League shall rectify the personal data in question, as soon as reasonably practicable and where possible within 2 months. If additional time is required, the data subject shall be informed.

3.4 The right to deletion of personal data
Members have the right to request that the League erases the personal data it holds about them in the following circumstances:

1. When it is no longer necessary for the League to hold that personal data with respect to the purpose(s) for which it was originally collected or processed

2. If the member wishes to withdraw their consent to the League holding and processing their personal data. All requests for erasure will be complied with.

3. If the personal data has been processed unlawfully

4. If the personal data needs to be erased in order for the League to comply with a legal obligation

4. Lawful, Fair, and Transparent Data Processing
GDPR seeks to ensure that personal data is processed lawfully, fairly, and transparently, without adversely affecting the rights of the data subject. GDPR states that processing of personal data shall deemed be lawful if the data subject (member) has given consent to the processing of their personal data for one or more specific purposes. The League obtains consent from all members to allow use of their personal data for the purposes stated in paragraph 9.4 below.

5. Specified, Explicit, and Legitimate Purposes
League members are kept informed at all times of the purpose or purposes for which the League uses their personal data. Paragraph 3.1 details ways in which members are informed.

6. Adequate, Relevant, and Limited Data Processing
The League only collects and processes personal data for the specific purpose or purposes of which data subjects have been informed.

7. Accuracy of Data and Keeping Data Up-to-Date

1. The League takes all reasonable steps to ensure that personal data collected, processed, and held is accurate and up-to-date.

2. The accuracy of personal data is checked when it is first collected and through reminders in the League News thereafter. If any personal data is found to be inaccurate or out-of-date, all reasonable steps will be taken without delay to amend or erase that data, as appropriate.

8. Data Retention
The League does not retain personal data for any longer than is necessary for the purpose for which it was originally collected, held, and processed. When personal data is no longer required, all reasonable steps will be taken to erase or otherwise dispose of it without delay. Details of the League’s approach to data retention, including retention periods for specific personal data types is detailed in section 9 below.

9. Secure Processing
The League uses the following procedures to ensure that all personal data collected, held, and processed is kept secure and protected against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

9.1 Transferring Personal Data and Communications
All communications containing personal data are transmitted using a secure service such as McLean Reid’s Client Zone, or an encrypted service and marked ‘confidential’.

9.2 Storage
The following measures are taken to ensure safe and secure storage of personal data:

1. Electronic copies of personal data are stored securely and password-protected

2. All hardcopies of personal data, along with any electronic copies stored on physical, removable media is stored securely in a locked drawer, cabinet, or similar

3. All personal data stored electronically is backed up and stored on the EU-based Cloud, which is password protected.

4. Where mobile devices are used to store personal data both the device and the appropriate files will be password protected.

9.3 Disposal
When any personal data is to be erased or otherwise disposed of for any reason (including where copies have been made and are no longer needed) it will be securely disposed of and deleted.

9.4 Use of Personal Data

9.4.1 Personal data will only be used to carry out the aims and functions of the League, including but not exclusively the following:

1. To send the annual copy of the League News

2. To compile a list of current members and monitor payment of subscriptions

3. To contact new members to welcome them and provide further information about the League

4. To send Christmas cards to members who qualified as a nurse 60 years or more ago

5. To send Birthday cards to members on their 80th, 90th or 100th birthday

6. To send regular e-newsletters to those with email addresses (you may unsubscribe at any time)

7. To correspond with members who qualified as a nurse 60 years ago to make them aware of the Benevolent Fund

8. To invite members to participate in League events

9. To respond to members’ requests to attend League events

10. To compile a list of names of deceased members for inclusion in the League news (NB no addresses will be included) and to correspond with the relatives of deceased members

11. To compile a list of new members for inclusion in the League News

12. To invite members to serve on the League committees and working groups

9.4.2 The League shall ensure that the following measures are taken with respect to the use of personal data:

1. No personal data will be shared informally and if a member or other party working on behalf of the League requires access to any personal data, such access should be formally requested from Data Compliance Manager

2. Personal data will be handled with care at all times and will not be left unattended or on view to unauthorised parties at any time

3. Personal data will never be shared with 3rd parties without the consent of members. As agreed annually by members attending the AGM, Personal data is shared with McLean Reid Chartered Accountants, for purposes of maintaining the membership database, and L and T Press, for printing and distributing the League News.

9.4.3 The League will use (process) personal data as follows:

1. What information do we collect about you?
When you use the website – the membership, events or planned reunions pages – or you purchase from the online shopping pages, we collect your name and email address. We may also collect data to allow up to provide goods and services to you such as a delivery address and some payment details, but when you pay for goods on the online site you will be directed to a third- party payment processor and we do not store your financial information ourselves. We also use cookies on the site to enable the use of the basket and checkout facilities in our online shop.

2. How will we use this information?
We collect the information to be used solely for the purpose of enabling League members and non-League nursing colleagues to make contact with each other. We also use this data to deliver goods or services to you that you have purchased through the website. Your personal data is never used for any other purpose.

3. Access to your information and correction
You have the right to request a copy of the information that we hold about you. If you would like a copy of some or all of your personal information, please email or write to the League Data Compliance Manager.

4. We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.

5. Other websites
Our website contains links to other websites. This privacy policy only applies to this website so when you link to other websites you should read their own privacy policies.

9.5 IT Security and Cookies
9.5.1 The League will take the following measures to ensure IT and information security:

1. All files containing personal data will be password-protected and transferred using a secure, encrypted service (see 9.1 above)

2. Personal data transferred to the publisher for inclusion in the League News will be transferred from the data processors (McLean Reid) using their password-protected service (Client Zone)

3. The publisher (L and T Press) will keep all personal data securely during the publication process.

4. All members handling League data must have up to date anti – virus software on their IT equipment which is used for League purposes.

9.5.2 Cookies
Cookies are small text files that are placed on your computer’s hard drive by your web browser when you visit any website. They allow information gathered on one web page to be stored until it is needed for use on another, allowing a website to provide you with a personalised experience and the website owner with statistics about how you use the website so that it can be improved.
Some cookies may last for a defined period of time, such as one day or until you close your browser. Others last indefinitely.
Your web browser should allow you to delete any you choose. It also should allow you to prevent or limit their use.

Our website uses cookies. They are placed by software that operates on our servers, and by software operated by third parties whose services we use.

When you first visit our website, we ask you whether you wish us to use cookies. If you choose not to accept them, we shall not use them for your visit except to record that you have not consented to their use for any other purpose.

If choose not to use cookies or you prevent their use through your browser settings, you will not be able to use all the functionality of our website.

We use cookies in the following ways:

• to track how you use our website
• to record whether you have seen specific messages we display on our website
• to keep you signed in our site
  for the purchasing functions on the online shop pages of our website
• to record your answers to surveys and questionnaires on our site while you complete them

We provide more information about the cookies we use in our cookie pop up on the website.

9.5.3 Personal identifiers from your browsing activity
Requests by your web browser to our servers for web pages and other content on our website are recorded.

We record information such as your geographical location, your Internet service provider and your IP address. We also record information about the software you are using to browse our website, such as the type of computer or device and the screen resolution.

We use this information in aggregate to assess the popularity of the webpages on our website and how we perform in providing content to you.

If combined with other information we know about you from previous visits, the data possibly could be used to identify you personally, even if you are not signed into our website.

10. Accountability and Record-Keeping

1. The League’s Data Compliance Manager [DCM] is appointed by the Executive Committee. [Currently the DCM is the Assistant Editor of the League News]

2. The League shall keep written internal records of all personal data collection, holding, and processing, which shall incorporate the following: The name and details of the League, its Data Compliance Manager; an up-to-date Data Information Audit; details of personal data retention by the League (see para 8 above); descriptions of the technical and organisational measures taken by the League to ensure the security of personal data (see section 9 above).

11. Data Information Audit
The League shall carry out a Data Information Audit for any new projects or new uses of personal data.

12. Organisational Measures
The League shall ensure that the following measures are taken with respect to the collection, holding, and processing of personal data:

1. All members or other parties working on behalf of the League shall be appropriately trained/supervised, made fully aware of both their individual responsibilities and the League’s responsibilities under GDPR and under this Policy, and shall be provided with a copy of this Policy

2. Access to personal data held by the League will only be given to members or other parties working on behalf of the League that require access in order to carry out their assigned duties

3. All members or other parties working on behalf of the League handling personal data shall be required and encouraged to exercise care, caution, and discretion when discussing work-related matters that concern personal data

4. Methods of collecting, holding, and processing personal data shall be reviewed annually

5. All personal data held by the League shall be reviewed annually

6. Other parties working on behalf of the League handling personal data must ensure that any and all of their employees who are involved in the processing of personal data are held to the same conditions as those relevant members of the League arising out of this Policy and GDPR; and

7. Where any agent, contractor or other party working on behalf of the League handling personal data fails in their obligations under this Policy, that party shall indemnify and hold harmless the League against any costs, liability, damages, loss, claims or proceedings which may arise out of that failure.

13. Data Breach Notification

1. Any personal data breach must be reported immediately to the League’s Data Compliance Manager.

2. If the personal data breach is likely to result in a high risk to the rights and freedoms of data subjects (e.g. financial loss, breach of confidentiality or other significant social or economic damage) the Data Compliance Manager will inform affected data subjects and the Information Commissioner’s Office of the breach as soon as reasonably practicable, where possible within 72 hours of having become aware of it.

3. Data breach reporting will include details of the measures taken, or proposed to be taken, by the League to address the breach including, where appropriate, measures to mitigate its possible adverse effects.

14. Implementation of Policy
This Policy is effective as of 25th May 2018. No part of this Policy shall have retroactive effect and shall thus apply only to matters occurring on or after this date.

This Policy has been approved and authorised by:
Name: Elizabeth Wood-Dow OBE and the League Executive Committee
Position: President

Changes to our privacy policy
We keep our privacy policy under regular review, and we will place any updates on this web page. This privacy statement was last updated in September 2022.

How to contact us
Please contact us if you have any questions about our privacy policy or information we hold about you by email or by post to:
League Data Compliance Manager,
The League of St Bartholomew’s Nurses,
The Post Room,
St Bartholomew’s Hospital,
West Smithfield,
London EC1A 7BE.
info@bartsleagueofnurses.org

Review by Executive Committee September 2023.