1.Purpose 

This policy explains how the Club collects, uses, stores, and protects personal data of members, guests, staff, and volunteers. It ensures compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Scope

This policy applies to:
- Club members
- Event participants
- Employees and volunteers
- Any individual whose personal data is processed by the Club

3. Data We Collect

The Club may collect:
- Contact details (name, address, phone, email)
- Membership information (join date, payment records)
- Event participation records
- Photographs or videos taken at club events
- Financial details for membership fees or event payments.

4. Lawful Basis for Processing

We process personal data under the following lawful bases:
- Contractual necessity (e.g., managing membership)
- Legal obligations (e.g., financial record keeping)
- Legitimate interests (e.g., promoting club activities)
- Consent (e.g., use of photographs in publicity materials)

5. How We Use Data

Personal data is used to:
- Administer membership and renewals
- Communicate about events, activities, and club news
- Maintain financial records
- Promote the club through newsletters, posters, and social media
- Ensure safety and security at event

6. Data Sharing

We do not sell or share personal data with third parties, except:
- Service providers (e.g., accountants, IT support) under strict confidentiality
- Legal authorities when required by law

7. Data Retention

- Membership records: retained for 6 years after membership ends
- Financial records: retained for 7 years (per HMRC requirements)
- Photographs/videos: reviewed annually and deleted after 3 years unless still relevant for publicity

8. Data Security

We protect data through:
- Secure digital storage with password protection
- Locked filing cabinets for paper records
- Restricted access to authorised committee members only (e.g., Secretary, Treasurer)

9. Rights of Individuals

Members and individuals have the right to:
- Access their personal data
- Request correction of inaccurate data
- Request deletion of data (where legally possible)
- Lodge a complaint with the Information Commissioner’s Office (ICO)

10. Photography & Publicity

- Consent is obtained via membership or event sign-in sheets for using identifiable images in posters, social media, or newsletters from the concert room.
- Individuals who do not agree to be photographed should use the small bar, which has been designated a photography-free area.
- For under-18s, parental or guardian consent is required before photographs or videos are taken.

11. Data Breach Procedure

In the event of a personal data breach, the Club will:
- Assess the risk and impact
- Notify the ICO within 72 hours if required
- Inform affected individuals where necessary

12. Contact

For any queries or requests regarding personal data, please contact the Club Secretary at secretary@awwmc.co.uk

13. Policy Review

This policy will be reviewed annually by the Club Committee to ensure compliance and relevance.