Cullen Community Allotment Association
Scottish Registered Charity No. SC043932
Home About Documents Calendar Contacts

Data protection and privacy policy

The Cullen Community Allotment Association (the Association) Data Protection and Privacy Policy (including any other documents referred to in it) sets out the basis on which the Association processes any personal data collected from you, or about you, that you provide or that is received from other sources. Processing means the collection, use, storage, deletion or other manipulation or access of the personal data.

The information you are asked to provide, information from which you can be identified, including as a result of using this website, will be used in accordance with this privacy policy, as it is varied from time to time. Please read this policy carefully to understand the Association's practices regarding your personal data and how the Association will treat it. It is recommended that, from time to time, you re-visit this website to review this policy to stay up to date with any changes to it.

The Association's data protection obligations
The Association is required to process your personal data in accordance with the law. The Data Protection Act 1998 (DPA) implements the EU Data Protection Directive 1995 (EU Directive 95/46/EC). From 25 May 2018, the General Data Protection Regulation 2018 EU Regulation 2016/679) will come into force; it replaces the DPA. This privacy policy complies with the Data Protection Act 2018 (DPA 2018).

Personal data
To manage the Association's membership, the Association will process personal data about its members, the data including: full name, postal address, e-mail address, and landline and/or mobile phone numbers. If relevant, the Association may also collect and hold details about plot and/or polytunnel rentals, other payments made (such as for mesh) and refunds paid out. Where refunds are paid by electronic funds transfer, bank account details of the recipient will be available to the Treasurer and, where appropriate, one other countersignature of the Association cheques who also has Internet access to the the Association bank account.

Collection of personal data
Personal data is acquired when an a lease is signed and when a leasee corresponds with the Association. This personal data could relate to applications for membership, requests to rent a plot or polytunnel, or any other communications relating to your membership of the the Association.

The Association web site (currently at ) will log the activity of visitors including: the number of visitors to the web site, where visitors have come to the site from (IP address), the pages visited, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, the full Uniform Resource Locators (URL), page response times, and length of visits to certain pages.

To meet requirements of the GDPR, the Association will:

The Association processes personal information for a number of reasons, including:

The Association will not use personal information:

Disclosure of personal information
the Association may disclose personal data as might be required by law, including compliance with any court order or legal obligation.

Your rights
The GDPR provides you with a number of rights in relation to your personal data. These include rights to the rectification or erasure of your personal data, and to restrict or object to its processing.

If you find that any of the personal data that the the Association holds about you is inaccurate, incomplete or contains errors, notify the Association in writing and the Association shall undertake to make the appropriate corrections at the earliest opportunity.

Should you wish to have some or all of your personal data erased, the Association will endeavour to do so although there may be instances where legitimate interests or the performance of the Association's statutory obligations prevents the Association from doing so.

If you wish to object to or restrict how your personal data is processed by the Association, you can do so by writing to the Association. However, be aware that such requests could result in an inability to provide you with some or all of the Association's services.

You may request that Association provides the personal data that the Association holds about you to another data controller in a structured, commonly used and machine-readable format.

You may request to be told whether or not personal data about you is being processed by the Association. If your personal data is being processed, you are entitled to receive a response from the Association that provides you with a description of that personal data, the purpose for which it is processed, the recipients or category of recipients to whom that data is disclosed (including any recipients located outside the EEA), the source of the personal data, and information about its retention and storage. A copy of the personal data that is undergoing processing shall be provided to you. To make such requests, e-mail the Association.

Changes to this policy
If in the future the Association make any changes to its privacy policy, the latest version of the privacy policy will be posted on the Association web pages.

Version date: 30 May 2018