Data Protection and Privacy Policy

This policy applies to the work of Edenbridge u3a and sets out the requirements that the u3a must gather personal information for membership purposes. The policy details how personal information will be gathered, stored and managed in line with data protection principles and the UK General Data Protection Regulation (UK GDPR), brought into effect on 1st January 2021 following the UK’s withdrawal from the EU.. The policy was adopted and approved at the Executive Committee Meeting on 27 March 2018, last reviewed on 28 October 2026, and is reviewed on an ongoing basis by the Committee Members to ensure that the u3a is compliant.

The policy can be viewed in pdf format or online below.

ABOUT THIS POLICY

This policy applies to the work of Edenbridge u3a (referred to as ‘the u3a’). It sets out the requirements that the u3a must gather personal information for membership purposes. The policy details how personal information will be gathered, stored and managed in line with data protection principles outlined in Article 5 of the UK General Data Protection Regulation (UK GDPR), brought into effect on 1st January 2021 following the UK’s withdrawal from the EU. The policy is reviewed on an ongoing basis by the u3a Committee Members to ensure that the u3a is compliant.

The Policy is in three parts as follows: -

· 1. General Data Protection and Privacy
This part is for those who would like an overview in relatively straight-forward terms about the way we collect, store and share data within the u3a.

· 2. Privacy Advice
This is accessible to all and contains advice for all members and Group Contacts relating to keeping our data as secure as we possibly can.

· 3. General Principles and Advice for Committee Members and Group Contacts
This part is open to all and gives advice on the implementation of the policy by the Committee and others such as Group Contacts.

1. General Data Protection and Privacy

WHY THIS POLICY EXISTS

This policy ensures that the u3a:

· Complies with data protection law and follows good practice.

· Protects the rights of members, the Committee, Speakers, Partners and Neighbouring u3as with whom we have an agreement.

· Is open about how it stores and processes members’ data.

· Protects itself from the risks of a data breach.

Edenbridge u3a treats your privacy rights seriously. This policy sets out how we will deal with your ‘personal information’, that is, information that could identify, or is related to, the identity of an individual.

WHAT PERSONAL INFORMATION DO WE COLLECT?

When you express an interest in becoming a member of the u3a you will be asked to provide certain information. This includes:

· Name

· Home address

· Email address (if you have one)

· Telephone numbers (home and mobile as appropriate)

· Your group preferences

HOW DO WE COLLECT THIS PERSONAL INFORMATION?

All the information collected is obtained directly from you. This is usually at the point of your initial registration. The information will be collected via the membership application forms and renewal forms. At the point that you provide your personal information for membership purposes, we will also request that you provide consent for us to store and use your data. Your consent is required to ensure our compliance with data protection legislation. See Appendix One.

HOW DO WE USE YOUR PERSONAL INFORMATION?

We use your personal information:

· To provide our u3a activities and services to you.

· For administration, planning and management of our u3a.

· To liaise with u3a Head Office for the distribution of the u3a Magazine.

· To communicate with you about your group activities.

· To monitor, develop and improve the provision of our u3a activities.

· To keep you fully informed of activities via the monthly email newsletter and any other electronic or standard communication.

We may send you, as required, messages by email, other digital methods, telephone and post to advise you of u3a activities.

WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?

We may disclose information about you, including your personal information: -

· Internally - to Committee Members and Group Contacts as required to facilitate your participation in our u3a activities.

· Externally – with your consent for services such as direct mailing for the Trust magazine (u3a Matters) and / or if we have a statutory duty to disclose it for other legal and regulatory reasons.

Where we need to share your information outside of the u3a we will seek your permission (usually on initial membership and renewal documents).

HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

We need to keep your information so that we can provide our services to you. In most instances, information about your membership will not be stored for longer than 12 months after you have left the u3a with the exception of the email newsletter from which we ask you to “Unsubscribe” when you no longer wish to receive it. Further exceptions to this are instances where there may be legal or insurance circumstances that require information to be held for longer whilst this is investigated or resolved. Where this is the case then the member(s) will be informed as to how long the information will be held for and when it is deleted.

HOW YOUR INFORMATION CAN BE UPDATED OR CORRECTED

To ensure the information we hold is accurate and up to date, members need to inform the u3a as to any changes to their personal information. You can do this by contacting the Membership Secretary at any time at [email protected]  . Details are on the website in the “Contact Us” section accessed via the menu bar found on the homepage and throughout the website.

On an annual basis you will have the opportunity to update your information, as required, via the membership renewal form. u3a members are entitled to request access to the information that is held by the u3a (a Subject Access Request). The request needs to be received in the form of a written request to the Membership Secretary of the u3a – [email protected] and copied to [email protected] . It would be of great help if any such request includes “Subject Access Request” in the title.  There may be certain circumstances where we are not able to comply with this request. This would include where the information may contain references to another individual or for legal, investigative or security reasons. Otherwise, we will usually respond within 14 days of the request being made.

HOW DO WE STORE YOUR PERSONAL INFORMATION?

Your membership information is held in the following ways: -

· On your original application form and renewal forms which are held securely by the Membership Secretary.

· In spreadsheets accessed by Committee Members only.

· Group Contacts who may apply to a Committee Member for contact details about an individual member.

· Group Contacts who may hold contact details about members of their group supplied by the members themselves. This in turn may be shared with other members of the same group.

· The Treasurer will hold information on a spreadsheet about payment of subscriptions.

SECURITY ON THE EDENBRIDGE u3a WEBSITE

No information about individual members is collected or stored on the Edenbridge u3a Website as members do not currently need to register or login to any online services. If this situation were to change, secure log-in and data storage safeguards would be put into place. The only exception to this is the display of contact details for the Committee Members and Group Contacts and the following safeguards are in place: -

· All email addresses on the website (Committee and Group Contacts) are displayed in the format of "forwarding" email addresses which forward to personal email addresses. E.g. [email protected] or [email protected]  . These are to be found generally on the “Contact Us” Page, individual group pages and the Interest Group Contact List. These emails are used only to forward to personal emails and have the advantage of not revealing personal addresses which should cut down on unwanted Spam emails. This is only available for Group Contacts and the Committee and the forwarding ceases if they do not carry on the role. It should be noted, however, that this is only a forwarding address and the personal email will be revealed once a reply is made. Replies can be made as normal by pressing “Reply”.

· We have in place the security safeguard Secure Socket Layer (SSL) encryption, which creates a secure connection with your browser when you visit the website.

When you visit the website, you will see: -

Please note the “s” on https://, which stands for “secure” (provided by our domain provider), and / or the padlock symbol.

· Cookies on the Website: - A cookie is a small text file that is downloaded onto a computer, tablet or smartphone when the user accesses a website. It allows the website to recognise that user’s device and store some information about the user’s preferences or past actions. Edenbridge u3a uses cookies on its website (www.edenbridgeu3a.co.uk) to monitor and record the number of visitors and page views of the website. This gives us a useful insight into how users are engaging with the website. We have placed a pop-up box on the website that will activate each new time a user visits the website. This will allow them to click to consent (or not) to continuing with cookies enabled, or to ignore the message and continue browsing (i.e. giving their implied consent).

· External Links: - Whilst we take great care to verify the security of any external links in the best interest of our members, please be aware that if these are accessed you will no longer be within the Edenbridge u3a domain and this policy will no longer be applicable.

· Photographs / video on the website: - To make our website as interesting and informative as possible, we include photographs taken by members which may include other members. Should any member object to a photograph being included on the website, please contact the website administrator at [email protected] and it will be removed immediately and without question.

· Copyright Notice: - We make every effort on our website to ensure that we only use our own images or copyright-free images and clipart. Where members have sent photographs which they have taken themselves for inclusion on the website, it is assumed that they give permission for them to be uploaded. Should anyone become aware of our unintentional infringement of copyright, please contact us at [email protected] and the item will be removed immediately and without question.

AVAILABILITY AND CHANGES TO THIS POLICY

This policy is available: -

· On the Edenbridge u3a website under “Data Protection and Privacy Policy” from the Policies page, accessed via menu bars on the homepage and throughout the website.

· In a downloadable PDF format from the same page on the website.

· By request in writing or email from the Membership Secretary [email protected] .

· This policy may change from time to time. If we make any material changes, we will make members aware of this via the Monthly Email Newsletter and the Monthly Members' Meetings.

CONTACT

If you have any queries about this policy, need it in an alternative format, or have any complaints about our privacy practices, please contact us: -
Email: [email protected]

Policy review date: October 2026

2. Privacy Advice

The internet is a wonderful resource for sharing information, finding things out and indeed learning. At Edenbridge u3a, we work hard to keep you informed of what is going on, what has happened and what is in the pipeline for future events. All of this is done through our website.

www.edenbridgeu3a.co.uk

The internet, however, can also create some issues of privacy and we would prefer that you are not affected by these. We have put together some advice to try to help you with this so that you can maintain your privacy.

Emails

· Keeping Emails Private: Most of our communication is done by email. We send you an email once or twice a month if you are on our email list, informing you of future events, distributing the Newsletter, and other information that we think you would want to know about. Group contacts send emails to people in their groups. It’s the fastest way of communicating to a few people and provides a record of what has been said. However, if we do not take adequate precautions, the email addresses of those we send to can be seen by others. You may not want this. In most cases this is not a problem as you trust the people you receive from. When we send the Monthly Newsletter emails to our members, we do not reveal the email addresses of anyone other than your own.

· Monthly Newsletter Emails: If you receive our emails regularly and no longer wish to do so, simply send us an email with UNSUBSCRIBE in the Subject Line and we will remove your address. If you are not receiving emails and wish to do so, please contact [email protected]

· Reply to all: In most cases, small groups opt to share email addresses, and everyone is happy with this as you may wish to contact individuals for whatever reason. However, you should consider when you reply to an email whether everyone needs to know what you are saying, especially in large groups. If, for example, you are given information about an event and the Group Contact asks you to reply to say whether you are going or not, ask yourself if everyone needs to know. It’s better in this case that you just “Reply” to the sender who will note your response rather than using “Reply to All” and everyone in the group receiving unnecessary emails.

· Dedicated Email Addresses: You can, of course, unclutter your personal email inbox by having a dedicated email address just for u3a and/or other hobbies etc. However, we would ask you not to include Edenbridge u3a in its title (except for Group Contacts) as this may be confused with our official emails. This is particularly useful for Group Contacts of large groups who may receive a lot of emails and want to keep them separate from their personal account. One or two of our Contacts have done this e.g. [email protected]

· Email addresses on the website: The only email addresses on the website are those of the Committee and Group Contacts. You will notice that all the Committee and all Group Contacts have an “@edenbridgeu3a.co.uk” email address. This is simply a forwarding address to personal accounts but does not reveal the personal accounts which we wish to keep private. This is only available for Group Contacts and the Committee and the forwarding ceases if they do not remain in the role. It should be noted, however, that this is only a forwarding address and the Committee member or Group Contact’s personal email will be revealed once they reply. You can then reply as normal to them by pressing “Reply”.

· What happens if you don’t use email: We understand that not everyone wishes or is able to use email. This is your choice. However, as the u3a grows, it is becoming increasingly difficult for us to telephone everyone who does not use email about future events. We will try but we are all volunteers. You can help us by trying to agree an “email partner” (a friend or another member who uses email) – to keep you informed about what is going on. Perhaps you can give them a ring from time to time to remind them.

Telephone

· Telephoning others: We ask you to be considerate about the time you telephone others

· Telephone numbers on the website: We discourage this as much as possible to avoid nuisance calls although these are very rare. It is no less safe than being in a directory which is accessible to all, but we know that some people prefer to be ex-directory. If you choose to have your telephone number on the website, it is done so entirely at your own risk. This is particularly important for those who do not use email. If you are a Group Contact, please keep the Groups Coordinator informed of your preference in this area. [email protected]

· Messaging apps using mobile telephone numbers: Group Contacts may make use of end-to-end encrypted messaging apps such as WhatsApp to organise group meetings and events. An advantage they have over email is that they avoid long and complex email chains when discussing, for example, attendance at the next meeting. We recognise that not all members use such apps, and this should not be a barrier to their involvement. We will work with members to find a suitable alternative where necessary.

If you feel you need to contact anyone about any of the above, please email the Website Administrator at [email protected]

Policy review date: October 2026

3. General Principles and Advice for Committee Members and Group Contacts

GUIDELINES FOR COMMITTEE MEMBERS AND GROUP CONTACTS

· The only people able to access data covered by this policy should be those who need to communicate with or provide a service to the members of the u3a.

· Data should not be shared informally or outside of the u3a.

· Committee Members and Group Contacts should keep all data secure, by taking sensible precautions and following the guidelines below.

· Strong passwords must be used, and they should never be shared.

· Personal data should not be shared outside of the u3a unless with prior written consent and/or for specific and agreed reasons.

· Member information should be reviewed and consent refreshed periodically via the membership renewal process or when policy is changed.

DATA PROTECTION PRINCIPLES

Article 5(1) of the UK General Data Protection Regulation (UK GDPR) identifies six data protection principles, and Article 5(2) a seventh:

Principle 1(a) - Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

Principle 1(b) - Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes (‘purpose limitation’);

Principle 1(c) – Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’).

Principle 1(d) – Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

Principle 1(e) – Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals (‘storage limitation’);

Principle 1(f) - Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

Principle (2) - The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

How the u3a implements these principles is detailed in the following paragraphs.

5(1a) Lawfulness, fairness and transparency

The u3a requests personal information from potential members and members for the purpose of sending communications about their involvement with the u3a. The forms used to request personal information will contain a privacy statement informing potential members and members as to why the information is being requested and what the information will be used for. Members will be asked to provide consent for their data to be held and a record of this consent along with member information will be securely held. u3a members will be informed that they can, at any time, remove their consent and will be informed as to who to contact should they wish to do so. Once a u3a member requests not to receive certain communications this will be acted upon promptly and the member will be informed as to when the action has been taken. See Appendix One below.

u3a members are entitled to request access to the information that is held by the u3a (a Subject Access Request). The request needs to be received in the form of a written request to the Membership Secretary of the u3a – [email protected] and copied to [email protected] . It would be of great help if any such request includes “Subject Access Request” in the title.  On receipt of the request, the request will be formally acknowledged and dealt with within 14 days unless there are exceptional circumstances as to why the request cannot be granted. The u3a will provide a written response detailing all information held on the member. A record shall be kept of the date of the request and the date of the response.

5(1b) Purpose limitation

Members will be informed as to how their information will be used and the Committee of the u3a will seek to ensure that member information is not used inappropriately. Appropriate use of information provided by members will include:

· Communicating with members about the u3a’s events and activities.

· Group Contacts communicating with their group members about specific group activities.

· Adding members’ details to the direct mailing information for the Third Age Trust magazine (u3a Matters).

· Sending members’ information about Third Age Trust events and activities.

· Communicating with members about their membership and/or renewal of their membership.

· Communicating with members about specific issues that may have arisen during their membership.

The u3a will ensure that Group Contacts are made aware of what would be considered appropriate and inappropriate communication. Inappropriate communication would include sending u3a members marketing and/or promotional materials from external service providers.

The u3a will ensure that members' information is managed in such a way as to not infringe an individual members’ rights which include:

· The right to be informed.

· The right of access.

· The right to rectification.

· The right to erasure.

· The right to restrict processing.

· The right to data portability.

· The right to object.

· Rights related to automated decision-making including profiling.

5(1c) Data minimisation

Members of the u3a will only be asked to provide information that is relevant for membership purposes. This will include: -

· Name

· Home address

· Email address (if you have one)

· Telephone numbers (home and mobile as appropriate)

· Your group preferences

Where additional information may be required, such as health-related information, this will be obtained with the specific consent of the member who will be informed as to why this information is required and the purpose that it will be used for.

Where the u3a organises a trip that requires emergency contact information to be provided, the u3a will require the member to gain consent from the identified contact. The consent will provide permission for the information to be held for the purpose of supporting and safeguarding the member in question. Were this information to be needed as a one off for a particular trip or event then the information will be deleted once that event or trip has taken place unless it was to be required – with agreement – for a longer purpose. The same would apply to carers who may attend either a one-off event or on an ongoing basis to support a u3a member with the agreement of the u3a.

There may be occasional instances where a member’s data needs to be shared with a third party due to an accident or incident involving statutory authorities. Where it is in the best interests of the member or the u3a in these instances where the u3a has a substantiated concern, then consent does not have to be sought from the member.

5(1d) Accuracy

The u3a has a responsibility to ensure members' information is kept up to date. Members will be informed to let the Membership Secretary know if any of their personal information changes. In addition, on an annual basis the membership renewal form will provide an opportunity for members to resubmit their personal information.

5(1e) Storage limitation

In general, u3a will not store members’ information for longer than 12 months after they have left the u3a.  However, we ask members to “Unsubscribe” from the email Newsletter when they no longer wish to receive it. Where there may be legal or insurance circumstances that require information to be held for longer whilst investigated or resolved, member(s) will be informed as to how long the information will be held for, and when it is deleted.

5(1f) Integrity and confidentiality

The Committee Members of the u3a have a responsibility to ensure that data are both securely held and processed. This will include:

· Committee Members using strong passwords.

· Committee Members not sharing passwords.

· Restricting access of sharing member information to those on the Committee who need to communicate with members on a regular basis.

· Using password protection on laptops and PCs that contain or access personal information.

· Using password protection or secure cloud systems when sharing data between Committee Members and/or group contacts.

· Paying for firewall security to be put onto Committee Members' laptops or other devices where the device is for the sole use of the u3a.

Should a data breach occur action shall be taken to minimise the harm by ensuring all Committee Members are aware that a breach has taken place and how the breach occurred. The Committee shall then seek to rectify the cause of the breach as soon as possible to prevent any further breaches. The Chair of the u3a shall contact National Office within 24 hours of the breach occurring to notify of the breach. A discussion would take place between the Chair and National Office as to the seriousness of the breach, action to be taken and, where necessary, the Information Commissioner's Office would be notified. The Committee shall also contact the relevant u3a members to inform them of the data breach and actions taken to resolve the breach.

If a u3a member contacts the u3a to say that they feel that there has been a breach by the u3a, a Committee Member will ask the member to provide an outline of their concerns. If the initial contact is by telephone, the Committee Member will ask the u3a member to follow this up with an email or a letter detailing their concern. The concern will then be investigated by members of the Committee who are not in any way implicated in the breach. Where the Committee needs support or if the breach is serious, they should notify National Office. The u3a member should also be informed that they can report their concerns to National Office if they don't feel satisfied with the response from the u3a. Breach matters will be subject to a full investigation, records will be kept, and all those involved notified of the outcome.

5(2) Accountability

The u3a Committee is responsible for ensuring that the u3a remains compliant with Data Protection requirements and can evidence that it has. For this purpose, those from whom data is required will be asked to provide written consent. The evidence of this consent will then be securely held as evidence of compliance. Committee Members shall stay up to date with guidance and practice within the u3a movement and shall seek additional input from the Third Age Trust National Office should any uncertainties arise. The Committee will review data protection and who has access to information on a regular basis as well as reviewing what data is held.

Policy review date: October 2026

Appendix One

PRIVACY STATEMENT INCLUDED IN APPLICATION FORM Edenbridge u3a

Edenbridge u3a Data Protection Agreement

You are being asked to complete this form in order that Edenbridge u3a complies with the law as outlined in the UK General Data Protection Regulation (UK GDPR). If for any reason you feel unable to tick any of the boxes below, please cross out the area with which you do not agree. It is advisable that, prior to making the decision to delete an area, you read the Data Protection and Privacy Policy on the Edenbridge u3a website and / or discuss the matter with a member of the Committee so that you will be fully informed of the implications of your choice.

______________________________________________________________________________________________

Name ______________________________________

Please tick the box below to give us permission to use the information you have supplied in the following ways:

· To store it securely for membership purposes.

· To communicate with you as a u3a member.

· To share with group leaders for those groups that you are a member of.

· To send you general information about the Third Age Trust (the national organisation to which u3as are affiliated).

¨  I consent to my data being used for membership purposes as detailed above.

Are you happy to be added to the direct mailing list for the Third Age Trust magazine (u3a Matters)? If so, please tick the box below:

¨  I consent to my data being shared with the company who oversee the distribution of the Trust Magazine.

¨  I am aware that there are full details of the Data Protection and Privacy Policy on the website and it is available in writing from the Membership Secretary [email protected]

¨  I consent to being included in photographs / video being taken and used on the Edenbridge u3a website and understand that if I wish any such photograph / video of myself to be removed, it will be deleted without question by contacting the Website Administrator on [email protected] (please see section on “SECURITY ON THE EDENBRIDGE u3a WEBSITE” in the Data Protection and Privacy Policy for further details.)

Please be advised that you can request for your data not to be used for any of these purposes at any time by contacting us:

Email: [email protected]

Signed ____________________________________________   Date ___________________________

The Edenbridge u3a Privacy and Data Protection Policy was approved and adopted by the Committee on 27th March 2018, and last updated by the Committee on 28th October 2026.