Purpose
WMBC collects and uses personal data to manage membership, communicate with supporters, organise activities, and run the Club effectively.

We are committed to handling all personal data lawfully, fairly, and securely, in line with UK data protection law (UK GDPR and the Data Protection Act 2018).

This policy applies to all volunteers, officers, and anyone handling data on behalf of WMBC.

What is Personal Data?
Personal data is any information that can identify a living person, such as:

• Name

• Address

• Email or phone number

• Membership records

• Photographs

 

Some data is more sensitive (“special category data”), such as health or beliefs, and requires extra
care.

Key Principles
WMBC follows these core principles:

• Lawful, fair, transparent – people know how their data is used

• Purpose-limited – only used for clear, legitimate reasons

• Data minimisation – only collect what we need

• Accurate – kept up to date

• Storage limitation – not kept longer than necessary

• Secure – protected from loss, misuse, or unauthorised access

Lawful Basis for Using Data
We only process personal data where we have a valid reason. The main ones we use are:

• Consent – e.g. mailing lists

• Contract – managing membership

• Legal obligation – complying with the law

• Legitimate interests – running the Club effectively (balanced against individual rights)

These are explained in our Privacy Policy.

Special Category Data
We rarely collect sensitive data. If we do, we will:

• Clearly justify why it is needed

• Apply additional safeguards

• Record the legal basis for using it

6. Individuals’ Rights
People have the right to:

• Know how their data is used

• Access their data

• Correct inaccurate data

• Request deletion (where appropriate)

• Restrict or object to processing

• Receive their data in a portable format (in some cases)

 

Requests should be handled promptly and referred to the WMBC Treasurer (or designated data
lead).

7. Responsibilities
All volunteers must:

• Only collect data needed for Club purposes

• Keep data secure (password protection, locked storage, etc.)

• Keep data accurate and up to date

• Not share personal data without permission or proper safeguards

• Use approved systems where possible

• Report concerns or breaches immediately

 

8. Data Security
WMBC takes appropriate steps to protect data, including:

• Password-protected files and devices

• Secure storage of paper records

• Limited access to those who need it

• Use of trusted service providers

Personal data must not be:

• Shared informally (e.g. personal email without safeguards)

• Left unsecured

• Disclosed to third parties without checks

 

Data Sharing
We only share personal data when:

• It is necessary for Club activities

• A proper agreement is in place (where required)

• Individuals would reasonably expect it

• It is lawfully required

 

We do not sell or misuse personal data.
 

Data Retention
Personal data is only kept as long as necessary.

WMBC maintains a simple retention approach, for example:

• Membership records: while active + limited period after

• Financial records: as required by law
   

Data Breaches
A data breach includes loss, theft, or unauthorised access to personal data.

All breaches must be reported immediately to the WMBC Treasurer (or data lead).

Serious breaches may need to be reported to the Information Commissioner’s Office (ICO) within
72 hours.

Training and Awareness
WMBC ensures that:

• Volunteers understand basic data protection responsibilities

• Guidance is simple and practical

• Data protection is considered in new activities (“data protection by design”)

 

Transparency
WMBC provides a clear Privacy Policy explaining:

• What data we collect

• How we use it

• Individual's rights

​​

This is available on our website.

​

Compliance
Failure to follow this policy may:

• Put individuals’ data at risk

• Damage the Club’s reputation

• Lead to disciplinary action

 

This policy will be reviewed at appropriate intervals (not more than three years).

​