Data Protection

The D Word Data Protection Policy

The D Word is a Community Interest Company (FK2 0BT) and is registered as a Data processor with the Information Commissioners Office (ICO). Registration number: ZC161973.

This policy applies to Directors of The D Word and to all Celebrants who deliver The D Word to schools and community groups, and covers our commitment to meeting our requirements to protect personal data under the Data Protection Act 2018 (also known as the UK GDPR) and the General Data Protection Regulation (GDPR).

“Personal data” means any information relating to an identified or identifiable living individual.

Principles of Data ProtectionThe D Word will ensure that all personal data that it holds will be:

  • processed lawfully, fairly and in a transparent manner;
  • collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (purpose limitation).
  • adequate, relevant and limited to what is necessary (data minimisation).
  • accurate and kept up to date (data accuracy).
  • kept in a form which permits identification of data subjects for no longer than is necessary (storage limitation).
  • processed in a manner that ensures appropriate security of the personal data, including protection against accidental or unauthorised access to, or destruction, loss, use, modification, or disclosure of personal data (integrity and confidentiality).

Lawful, fair and transparency

Data used by Celebrants delivering The D Word will be limited to Email addresses and contact phone numbers. These will be professional/work-based. Any personal contact details will be deleted as soon as they are not required, i.e. when delivery of The D Word sessions has ended.

The D Word will not keep and maintain Data Audits, but each Celebrant will confirm, by email, copied to the three Directors, that any personal data has been deleted.

The three Directors are:

Gillian Robertson gillian@rememberlove.co.uk
Laura Throssell laurahthrossell@hotmail.co.uk
Aileen Palmer aileenpalmercelebrant@gmail.com

The D Word is fully committed to meeting the data protection principle of lawfulness, fairness and transparency.

Data minimisation

We will make sure that the personal data we are processing is:

  • adequate – sufficient to properly fulfil our stated purpose;
  • relevant – has a rational link to that purpose; and
  • limited to what is necessary – we do not hold more than we need for that purpose.

Data accuracy

The D Word will take all reasonable steps to ensure the personal data we hold is not incorrect or misleading as to any matter of fact.

We may need to keep the personal data updated, although this will depend on what we are using it for.

If we discover that personal data is incorrect or misleading, we will take reasonable steps to correct or erase it as soon as possible.

Storage limitation

The D Word will not keep personal data for longer than we need it.

Integrity and confidentiality

The D Word takes the security of personal data extremely seriously. We do this in a variety of technical and organisational security measures, including but not limited to:

  • a named Data Protection Officer (DPO) to provide advice, support, training, resources, and updates on all aspects of Data Protection. Our DPO is Gillian Robertson.

Rights of individuals

Individuals have the right to access their personal data and any such requests made to The D Word shall be dealt with in line with legal requirements, with some limited exceptions.

The UK GDPR provides the following rights for individuals in relation to their personal data:

  • the right to access their own data – any subject access requests must be notified to our Data Protection Officer (DPO) who will co-ordinate a full search all of our systems before responding to the individual within 30 days, as required by law.
  • rectification – we will quickly update any personal data which has been identified as inaccurate or incorrect.
  • erasure – we will remove any personal data if an individual request this.

Data breach

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

All trustees, staff and volunteers must be able to identify a suspected personal data breach.

A breach could include:

  • access by an unauthorised third party to personal data;
  • deliberate or accidental action (or inaction);
  • sending personal data to an incorrect recipient;
  • computing devices containing personal data being lost or stolen;
  • alteration of personal data without permission; and
  • loss of availability of personal data.
  • leaving a file on a train.

Where a D Word Celebrant discovers or suspects a personal data breach, this should be reported to the DPO as soon as possible.

Where there is a likely risk to individuals’ rights and freedoms, the DPO will report the personal data breach to the ICO within 72 hours of The D Word being aware of the breach.

Where there is also a likely high risk to individuals’ rights and freedoms, we will inform those individuals without undue delay.

The DPO will keep a record of all personal data breaches reported and follow up with appropriate measures and improvements to reduce the risk of re-occurrence.