top of page

Data Protection Policy

​

During the course of the activities of SWIG, it will collect, store and process personal data about its members, suppliers and other third parties (“data subjects”). This policy sets out the basis on which SWIG will process any personal data it collects from data subjects, or that is provided to us by data subjects or other sources. 

 

The Data Controller is the Membership Secretary of SWIG who is responsible for ensuring compliance with the relevant data protection legislation and with this policy.  Any questions about the operation of this policy or any concerns that the policy has not been followed should be referred in the first instance to the Chairman using swigchair@aol.com

 

Processing Personal Data

All personal data should be processed in accordance with relevant data protection legislation and this policy.   

 

Processing includes obtaining, holding, maintaining, storing, erasing, blocking and destroying data.   

 

Personal data is data relating to a living individual.  It will not include data relating to a company or organisation, although any data relating to individuals within companies or organisations may be covered.  Personal data can be factual (for example a name, address or date of birth) or it can be an opinion about that person, their actions and behaviour. 

 

Examples of personal data are names and addresses and other information relating to individuals, including both members of SWIG, suppliers and other third parties.

 

Compliance with data protection legislation

Anyone who has responsibility for processing personal data must ensure that they comply with the data protection principles set out in current data protection legislation.  These state that personal data must: 

 

  • Be obtained and used fairly and lawfully;  

  • Be obtained for specified lawful purposes and used only for those purposes; 

  • Be adequate, relevant and not excessive for those purposes; 

  • Be accurate and kept up to date; 

  • Not be kept for any longer than required for those purposes; 

  • Be used in a way which complies with the individual’s rights (this includes rights to prevent the use of personal data which will cause them damage or distress, to prevent use of personal data for direct marketing, and to have inaccurate information deleted or corrected); 

  • Be protected by appropriate technical or organisational measures against unauthorised access, processing or accidental loss or destruction; and

  • Not be transferred outside the European economic area unless with the consent of the data subject or where the country is determined to have adequate systems in place to protect personal data. 

 

Handling Personal Data and Data Security 

Anyone who has responsibility for processing personal data should take appropriate technical and organisational steps to guard against unauthorised or unlawful processing.  Manual records relating to members or others should be kept secure. Computer access should be password protected. 

 

SWIG will take particular care of sensitive data and security measures will reflect the importance of keeping sensitive data secure (definition of sensitive data is set out below). 

 

SWIG’s data security procedures will be regularly monitored and reviewed to ensure data is being kept secure. 

Where personal data needs to be deleted or destroyed, adequate measures will be taken to ensure data is properly and securely disposed of. This will include destruction of files and back up files and physical destruction of manual files.  

 

All data will be stored in a secure location and precautions will be taken to avoid data being accidentally disclosed.  

 

The Rights of Individuals

Individuals have certain rights to know what data is held about them and what it is used for.  In principle everyone has the right to see copies of all personal data held about them. There is also a right to have any inaccuracies in data corrected or erased.  Data subjects also have the right to prevent the processing of their data for direct marketing purposes. 

 

Any request for access to data under data protection legislation should be made to the Membership Secretary in writing.  SWIG will ensure that written requests for access to personal data are complied with within 30 days of receipt of a valid request.   

 

When a written data subject access request is received the data subject will be given a description of a) the personal data, b) the purposes for which it is being processed, c) those people and organisations to whom the data may be disclosed, d) be provided with a copy of the information in an intelligible form. 

 

Sensitive Data

SWIG will not normally request sensitive data, but in the event that such data is obtained, we will strive to ensure that sensitive data is accurately identified on collection so that proper safeguards can be put in place. Sensitive data means data consisting of information relating to an individual’s:

 

  • Racial or ethnic origin; 

  • Political opinions;

  • Religious beliefs;

  • Trade union membership;

  • Physical or mental health;

  • Sexual life; and

  • Criminal offences.

 

Changes to this Policy

SWIG reserves the right to change this policy at any time.

bottom of page