Data Protection Policy
1 Policy Statement
1.1 Waterlooville Area Community Association Charitable Incorporated Organisation (within this document “WACA”) is committed to protecting personal data and respecting the privacy of our members, volunteers, staff, donors, and visitors. This policy explains how we collect, use, store, and protect personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1.2 This policy applies to all data related to our activities at the premises we manage.
2 What Personal Data We Collect
We may collect the following types of personal data:
• Names, addresses, email addresses, phone numbers
• Emergency contact details
• Volunteer or staff records
• Attendance registers
• Donation and Gift Aid information
• CCTV images
• Any other information required to run our services safely and effectively
We only collect data that is necessary.
3 How We Use Personal Data
We use personal data to:
• Manage bookings and activities
• Communicate with hirers, users, staff, volunteers, suppliers and other parties
• Safeguard children and vulnerable adults
• Manage staff and volunteers
• Process donations and Gift Aid
• Comply with legal and regulatory requirements
4 Lawful Bases for Processing
We process personal data under one or more of the following lawful bases:
• Consent
• Contract
• Legal obligation
• Legitimate interests
• Vital interests (e.g. emergencies)
5 Special Category Data
Where we collect sensitive information (such as health or safeguarding information), we:
• Only collect what is necessary
• Store it securely
• Limit access
• Use it only for specific, lawful purposes
6 How We Store and Protect Data
We keep personal data:
• In locked cabinets or secure digital systems
• Password-protected where stored electronically
• Accessible only to authorised staff or volunteers
We take reasonable steps to prevent loss, misuse, unauthorised access, or disclosure.
7 How Long We Keep Data
We only keep personal data for as long as necessary.
Our retention schedule is provided at Annex 2.
8 Sharing Personal Data
We do not sell personal data. We may share data:
• Where legally required
• With service providers who support our operations (e.g. payroll, IT)
• For safeguarding purposes
All third parties are required to keep data secure.
9 Individual Rights
Under UK GDPR, individuals have the right to:
• Access their personal data
• Correct inaccurate data
• Request deletion (where applicable)
• Restrict or object to processing
• Data portability
• Withdraw consent
Requests should be made in writing to the Data Protection Lead: the Centre Manager (of Waterlooville Community Centre).
10 Data Breaches
Any data breaches or suspected breaches must be reported immediately to the Data Protection Lead. We will assess and report serious breaches to the Information Commissioner’s Office (ICO) within 72 hours where required.
11 Closed Circuit Television (Applicable to Waterlooville Community Centre only)
Closed-circuit television (commonly referred to as “CCTV”) is used:
• Clear signage is displayed
• Footage is used for safety and security only
• Recordings are kept for no longer than necessary
12 Data Protection Impact Assessment
Where processing is likely to result in a high risk to individuals’ rights and freedoms, the Charity will carry out a Data Protection Impact Assessment (DPIA). This includes, but is not limited to, the operation of CCTV systems. The Charity maintains a DPIA covering CCTV operations, which is reviewed periodically.
13 Children and Vulnerable Adults
We take extra care when handling data relating to children and vulnerable adults and follow safeguarding best practice at all times.
14 Complaints
14.1 If you are unhappy with how we handle your data, please contact us first. Any complaint received will be dealt with consistent with our Complaints Policy.
14.2 You also have the right to complain to:
The Information Commissioner’s Office (ICO) who can be contacted at www.ico.org.uk.
15 Data Protection Roles & Responsibilities
The Roles and Responsibilities under this policy are summarised at Annex 3.
16 Revision History of Policy Subject
The revision history of this Policy subject is recorded at Annex 1.
17 Review of Policy
This Policy will be reviewed every year or whenever there are changes to relevant legislation.
18 Authorisation and Effectivity
This Policy is effective as of the date authorised below.
Approved by the Board of Trustees
Date: 18 February 2026
Subject to Further Review: 18 February 2027
The annexes of the policy have been removed from this version of the document being uploaded to the WACA website.