GDPR
Effective from: May 2026
Next review date: May 2027
Policy lead: Chair
1. Who we are
Kilsyth Civic Week SC054136
Brief summary of organisation
We are a data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Our contact details for Data Protection Purposes:
Lynda Jones
133 Balmalloch Road
Kilsyth
G65 9PH
email: kilsythcivicweek@yahoo.co.uk
2. What personal data we collect and why
We collect and process different categories of personal data depending on your relationship with Kilsyth Civic Week SC054136
Relationship / Activity
Examples of personal data
Purpose of processing
Lawful basis*
Volunteers
Name, contact details, date of birth, emergency contacts, relevant health info
To manage volunteering opportunities, provide support, and ensure safety
Consent / Contract / Legitimate Interests
Trustees
Name, contact details, background checks
To manage governance and meet legal obligations
Legal Obligation
Event attendees
Name, contact details, accessibility or dietary requirements
To run events and provide follow-up information
Consent / Legitimate Interests
Mailing list subscribers
Name, email address, organisation
To send news, updates, and opportunities
Consent
Partnership contacts
Name, contact details, role
To coordinate joint activities and communications
Legitimate Interests
Where we process special category data (e.g., health information, ethnicity, disability), we will do so only where an additional lawful basis under Article 9 UK GDPR applies, and appropriate safeguards are in place.
*Lawful bases are as defined in Section 6 of Kilsyth Civic Week SC054136 Data Protection Policy, including: consent, contractual necessity, legal obligation, vital interests, legitimate interests, public task, and recognised legitimate interest (Data (Use and Access) Act 2025).
3. How we collect your data
We may collect your personal data:
Directly from you (e.g., through forms, phone calls, meetings, events)
From your organisation (if you act on its behalf)
From publicly available sources (e.g., OSCR, Companies House)
From partner organisations (where lawful and necessary)
4. Who we share your data with
We will only share your personal data where there is a lawful basis, and it is necessary and proportionate to do so. Examples include:
Partner organisations involved in delivering a service or project
Funders, for reporting purposes
Regulatory bodies (e.g., OSCR, HMRC)
Service providers acting as data processors for Kilsyth Civic Week SC054136 (e.g., IT support, mailing list software)
All processors handling personal data on behalf of Kilsyth Civic Week SC054136 must have a Data Processing Agreement in place.
We do not transfer personal data outside the UK.
5. How long we keep your data
We keep personal data only for as long as necessary to fulfil the purpose it was collected for, in line with our Data Retention and Disposal Procedure and Section 11 of our Data Protection Policy.
Examples:
Volunteer records: 3 years after service ends
Financial records: 6 years from end of financial year
Service user/client records: 6 years after last contact (unless safeguarding or legal requirements dictate otherwise)
Safeguarding records: up to 75 years (per statutory guidance)
Data no longer required will be securely disposed of by shredding, pulping, or secure digital erasure.
6. Your data protection rights
Under the UK GDPR, you have the right to:
Be informed about how we use your data
Access your personal data
Have inaccurate data corrected
Have your data erased (in certain circumstances)
Restrict processing of your data
Object to processing
Request data portability
Not be subject to automated decision-making and profiling
Requests will be handled in accordance with our Data Subject Rights Procedure and within statutory timescales. We may need to verify your identity before fulfilling your request.
7. How we keep your data safe
We use appropriate technical and organisational measures to protect your personal data, including:
Role-based access controls
Strong password policies
Encryption of portable devices and sensitive files
Regular backups
Secure storage and disposal of paper records
Physical building security measures
Specific controls for remote working, including secure VPN access and encrypted devices
Staff and volunteer training on data protection
Full details of our information security measures are set out in our Information Security Policy, Acceptable Use Policy, and Clear Desk and Clear Screen Policy.
8. How to complain
If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue:
Lynda Jones
133 Balmalloch Road
Kilsyth
G65 9PH
email: kilsythcivicweek@yahoo.co.uk
If you are still unhappy, you can contact the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Helpline: 0303 123 1113
9. Changes to this notice
We review this notice annually or sooner if our processing activities change. The latest version will always be available on our website.
Kilsyth Civic Week SC054136
Effective from: May 2026
Next review date: May 2027
Policy lead: Chair
1. Who we are
Kilsyth Civic Week SC054136
Brief summary of organisation
We are a data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. The purpose of this notice
This notice explains how Kilsyth Civic Week SC054136 collects, uses, stores, and shares personal data relating to:
Volunteers
Trustees in a voluntary capacity
It should be read alongside Kilsyth Civic Week SC054136 Data Protection Policy and related procedures.
3. What personal data we collect
The personal data we collect and process may include:
Volunteers:
Name, address, contact details, date of birth
Emergency contact details
Relevant skills, qualifications, and experience
References and recruitment records
Relevant health or support needs (where necessary for your role)
Photographs (for ID or promotional purposes)
4. How we collect your data
We collect personal data:
Directly from you (e.g., through application forms, onboarding documents, meetings)
From referees, previous employers, or volunteer coordinators
From publicly available sources (where relevant)
From third parties where lawful (e.g., Disclosure Scotland for PVG checks)
5. Why we process your data and our lawful bases
We process your personal data to:
Recruit and onboard volunteers
Manage our working or volunteering relationship with you
Reimburse expenses
Provide training, supervision, and support
Comply with legal and regulatory obligations
Protect health, safety, and welfare
Promote Kilsyth Civic Week SC054136 work (where you have agreed to this)
Our lawful bases for processing include:
Legal obligation (e.g., tax, safeguarding requirements)
Legitimate interests (e.g., internal communications, recognising contributions)
Consent (e.g., for use of photographs in publicity)
Recognised legitimate interest under the Data (Use and Access) Act 2025 (where applicable)
Vital interests (in emergencies)
Where we process special category data (e.g., health information, ethnicity, PVG results), we will do so only where an additional lawful basis under Article 9 UK GDPR applies, and with appropriate safeguards in place.
6. Who we share your data with
We may share your personal data with:
Training providers (for agreed courses)
Funders (where necessary for grant compliance)
Regulators (e.g., OSCR, Disclosure Scotland)
IT service providers and other contractors acting as our data processors
We do not transfer personal data outside the UK.
7. How long we keep your data
We keep personal data only as long as necessary, in line with our Data Retention and Disposal Procedure
After this time, data is securely disposed of (shredding, pulping, or secure digital erasure).
8. Your data protection rights
You have the right to:
Be informed about how we use your data
Access your personal data
Have incorrect data corrected
Have your data erased (in certain circumstances)
Restrict processing of your data
Object to processing
Request data portability
Not be subject to automated decision-making and profiling
Requests will be handled in line with our Data Subject Rights Procedure and within statutory timescales. We may need to verify your identity before responding.
9. How we keep your data safe
We use a range of technical and organisational measures, including:
Role-based access controls
Strong password policies
Encryption of portable devices and sensitive files
Regular system backups and disaster recovery measures
Secure storage and disposal of paper records
Physical building security
Specific controls for remote working (secure VPN access, encrypted devices)
Full details are in Kilsyth Civic Week SC054136 Information Security Policy, Acceptable Use Policy, and Clear Desk and Clear Screen Policy.
10. How to raise a concern
If you have concerns about how your personal data is handled, contact:
Lynda Jones
133 Balmalloch Road
Kilsyth
G65 9PH
email: kilsythcivicweek@yahoo.co.uk
If you are still unhappy, you can contact the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Helpline: 0303 123 1113
11. Review
We review this notice annually or sooner if our processing changes. The most up-to-date version will be available from the Chair.
Kilsyth Civic Week SC054136 Website Privacy Notice
Who we are
This website is operated by Kilsyth Civic Week SC054136
Website: https://www.kilsythcivicweek.org/
We are committed to protecting your privacy and handling your personal data responsibly, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What personal data we collect and why
Contact Forms
When you use the contact form on our website, we collect the following information:
· First name
· Last name
· Email address
· Message subject
· Message content
We collect this information so we can respond to your enquiry and provide relevant support or information. Your submission will be sent to our (email) mailbox and may be stored there as part of our correspondence records.
We do not use the information you submit for marketing purposes unless you explicitly request or consent to this.
Please do not include sensitive personal information (e.g. health details, financial data, or anything confidential) unless it is necessary for your enquiry.
We retain messages for as long as necessary to respond to your request and in accordance with our data retention policies. If you would like us to delete your message or personal details at any time, you can contact us at the above address.
Cookies
Our website uses cookies to:
· Improve user experience
· Collect anonymous usage data via Google Analytics
You can control or disable cookies via your browser settings. Blocking some types of cookies may affect your experience of the site.
Google Analytics
We use Google Analytics to understand how visitors interact with our website. This helps us improve our content and functionality. Google Analytics collects anonymous data such as:
· Pages visited
· Time spent on the site
· Browser and device information
· General geographic location (not precise)
Google may store this data on servers located outside the UK.
You can read their privacy policy here: https://policies.google.com/privacy
You can opt out of Google Analytics tracking using the following tool:
https://tools.google.com/dlpage/gaoptout
Embedded content from other websites
Articles on our site may include embedded content (e.g. videos, images, or articles). Embedded content behaves in the same way as if you visited the original website directly.
These third-party websites may collect data about you, use cookies, and track your interactions, especially if you’re logged into those sites.
Who we share your data with
· We share anonymous data with Google Analytics for reason listed above
We do not sell or share your personal data with third parties for marketing purposes.
How long we retain your data
· Google Analytics data is retained for a maximum period of 14 months in line with Google Analytics user level data retention policies
· We retain contact form submissions for up to 18 months, unless they relate to an ongoing matter or are required for legal or safeguarding purposes.
Your rights under UK GDPR
You have the right to:
· Access the personal data we hold about you
· Request correction or deletion of your data
· Object to certain types of data processing
· Request data portability (in some circumstances)
· Withdraw consent at any time, if processing is based on consent
To exercise these rights, please contact us using the details below.
How to contact us
If you have any questions or concerns about this privacy notice or how your data is handled, please contact:
Lynda Jones
133 Balmalloch Road
Kilsyth
G65 9PH
email: kilsythcivicweek@yahoo.co.uk