1. Definitions

• Personal data is information about a person which is identifiable as being about them. It can be stored electronically or on paper, and includes images and audio recordings as well as written information.
• Data protection is about how the choir as a group ensure we protect the rights and privacy of individuals and comply with the law when collecting, using, storing, amending, sharing, and destroying or deleting personal data.

2. Responsibility
   • Overall and final responsibility for data protection lies with the Choir Committee who are responsible for overseeing activities and ensuring this policy is upheld.
   • All choir members are responsible for observing this policy and related procedures in everything relating to the choir and choir activities.
3. Overall Policy Statement

• In order to operate effectively, The Wildflower Community Choir needs to obtain and use personal data about its members, supporters, suppliers, and others involved in choir activities.
• This is done in accordance with GDPR regulations and every effort is made to protect any personal data the Choir holds.
• Data will only be collected, stored and used for:
  • Purposes for which explicit consent has been given
  • Purposes which are in the group’s legitimate interests or part of group activities
  • To comply with legal obligations
  • To protect someone’s life
  • To perform public tasks
• Personal data will only be used for the purpose of which it was gathered.
• Personal data will be held only for as long as necessary, and only necessary data will be collected.
• Personal data will not be shared within or without the choir without explicit consent
• Any digital copies of data will be held on secure, GDPR-compliant password-secured third-party servers such as those provided by Microsoft OneDrive and/or local pass-word protected devices such as a PC or tablet. Any physical copies will be held in a secure location with only approved access by Choir officials.
• Any user has a right to request a copy of their data held by the choir. Requests must be submitted in writing. Data will be provided within one month of receiving the request. Users can request for their data to be amended or deleted and this shall be carried out within one month of receiving the request.

4. Examples of data collected are:

• Contact details for choir members, people interested in joining the choir, people interested in booking or working with the choir, and people making contact through the choir website.
• Basic data on website access which may include things such as IP addresses.
• Emergency contact information for choir members.
• Pertinent health information of choir members, such as allergies.
• Photos and video recordings of group activities such as concerts and rehearsals.

This policy will be reviewed every two years.

For any questions relating to the Choir’s data protection policy, please contact us.