Swing Dance Cumbria Data Protection and GDPR Policy

1. Purpose
Swing Dance Cumbria is a community-led organisation that runs social dance classes, workshops, and events across Cumbria. In the course of our activities, we collect and process limited personal data from members, participants, and subscribers. This policy sets out how we handle that information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Scope
This policy applies to all committee members, volunteers, teachers, and anyone who has access to personal data held by Swing Dance Cumbria. It covers data collected electronically (for example, through Mailchimp or booking systems) and data held in paper form.

3. Data Controller
The data controller is Swing Dance Cumbria (an unincorporated community group). The group is registered with the Information Commissioner’s Office (ICO) as a small not-for-profit organisation.

The committee appoints one or more Data Leads to oversee compliance. The current data leads are:

  • Ella Smith

  • Chris January

4. Principles of Data Processing
Swing Dance Cumbria is committed to the following principles:

  • Lawfulness, fairness, and transparency: We only collect data for clear and legitimate purposes and are open about how it is used.

  • Purpose limitation: Data is used only for the purpose it was collected (for example, communicating about classes and events).

  • Data minimisation: We collect only what is necessary; typically name, email, and optional date of birth (day and month).

  • Accuracy: We keep data up to date and correct errors promptly.

  • Storage limitation: Data is retained only while a person remains subscribed or actively involved.

  • Integrity and confidentiality: Data is stored securely and accessed only by authorised committee members.

5. What Data We Collect
We collect and process personal information including:

  • Name and email address (for communication purposes);

  • Optional date of birth (to include members in birthday jam celebrations if they would like this);

  • Optional phone number or emergency contact details for event administration or safety purposes.

6. How We Use Personal Data
We use personal data solely for:

  • Sending updates about the group, classes, events, and workshops;

  • Administering bookings and payments;

  • Managing membership and volunteer records;

  • Fulfilling any legal or safeguarding obligations.

We never share personal data with third parties or use it for commercial purposes.

7. Consent and Lawful Basis

  • Data is collected through explicit consent (via Mailchimp sign-up or equivalent forms).

  • Individuals can withdraw consent or unsubscribe at any time, and their data will then be deleted.

  • For some limited administrative purposes (such as booking records), processing may also occur under legitimate interest to manage events safely and efficiently.

8. Data Storage and Security

  • Mailing list data is stored within Mailchimp, which is GDPR-compliant.

  • Booking and payment data are stored securely using password-protected systems.

  • Access is restricted to authorised committee members who need the data for legitimate purposes.

  • Personal data will not be shared via personal email accounts or social media.

9. Rights of Individuals
All data subjects have the right to:

  • Access the personal data held about them;

  • Request correction or deletion of their data;

  • Withdraw consent at any time;

  • Complain to the ICO if they believe their data is being mishandled.

Requests should be directed to the Data Lead at swingdancecumbria@gmail.com

10. Data Retention
Data will be reviewed annually and deleted if:

  • An individual unsubscribes from communications;

  • Membership lapses or participation ends;

  • Retention is no longer necessary for the purpose it was collected.

11. Breach Management
Any data breach or suspected breach must be reported immediately to the Data Lead.
The Data Lead will assess and record the incident and, where necessary, report it to the ICO within 72 hours in line with statutory guidance.

12. Policy Review
This policy will be reviewed annually or sooner if data protection law or group activities change.

Approved by the Swing Dance Cumbria Committee
Date: 27/10/2025
Review Date: 26/11/2026