The GDPR places an obligation on any organisation that stores personal data about natural living persons to ensure that they understand what data is being stored, why it is being stored and what is done with it. This document serves to inform Members, Guests and Subscribers of the nature of the data processing activities of the HBSA

The HBSA recognises the Information Commissioner’s office in the UK as its regulatory body. The HBSA is registered with the ICO as a data controller reg No: ZA257565.

For clarity the HBSA is the Data Controller of data belonging to Members, Guests and Subscribers (hereafter “you”, “your”), The HBSA ( hereafter “we”, “our”) may make use of third party service providers or Data Processors such as online membership systems, online forums, email management services, print and mailing houses and online backup/storage facilities.

The use of these processors may warrant the transfer your personal information outside of the UK or EU. Where this is necessary this may be to countries or territories around the world. We are required to ensure that when we need to do this we comply fully with all aspects of the GDPR to ensure your data is suitably protected.

We will undertake to store personal data securely in accordance with UK Law and EU data security principles.

By way of this document we will inform you what information is stored about you and for what purpose it shall be used. We will only process data for which we have a legitimate and proportional use.

Our legal bases for processing your data are:

1. Fulfilment of contract. By agreeing to be a member or subscriber you have entered into a contract with us. 
2. Legal Obligation. (in the case of members and shooting guests only) As a home office registered club we are bound by law to report to our controlling police force when an application to join is made. We are also obliged to report when a member leaves. We are also compelled to maintain records of your (including guests) attendance at firearms related events such as range days and also details of any firearms used.
3. Consent. You will be asked to consent to us using your images for use in publicity related material. You may withdraw this consent at any time but should be aware that if released in print your image will enter the public domain. This does not apply to membership card photographs.
   Subscribers have the option to inform us of date of birth to aid our content and distribution strategy. You may withdraw this consent at any time.
4. Legitimate interest. As an Historical Society we feel that a record of members of the HBSA has historical value (limited to title, name, dates of joining and leaving) As such we will maintain these infinitely however we recognise that you may still exercise your rights as detailed below.
   We may share your details with 3rd parties should we need to recover monies or goods etc or to defend any legal action.
   

Your rights:

You have the rights to the following:

• The right to be informed (this is the purpose of this document along with any consent you give) 
• The right of access (you may request a copy of your data. We will deliver this within 30 days unless your request is very complex. We will inform you if this is the case) 
• The right to rectification (you may ask us to correct your data at any time) 
• The right to erasure (where consent is the legal basis of processing) 
• The right to restrict processing (you may ask us not to process your data but not erase it) 
• The right to data portability (you may ask us for a copy of the data in an appropriate format) 
• The right to object (where data is not being processed for legal obligation or legitimate interests) 
• Rights in relation to automated decision making and profiling. (the HBSA does not engage in this) 

We will erase your data in a timely fashion subject to UK firearms legislation and guidance from the Home Office in respect of the operating of a Home Office Approved Club. These timings are given in the tables below

Contacting us:

We have appointed a data protection officer who will be the point of contact for data privacy related enquiries, who can be reached at dataprotection@hbsa-uk.org or by writing to us at BCM HBSA, Data Protection, London, WC1N 3XX. We may take steps to ensure your identity before responding to your request. We will respond within 30 days of receiving your request.

Normal updates and membership requests may still be directed to the membership registrar at membership@hbsa.uk.org

Your right to complain:

If we fail to comply with any of your requests within the prescribed time limits you may complain to the Information Commissioner’s office in the UK.

Sources of data:

The majority of the data we process is given by you but we may also record data such as range and event attendances as well as decisions made by us concerning your acceptance for or continued membership.

Minors:

We do accept minors into the HBSA as junior members, and in these circumstances a parent or guardian must give consent for us to hold their data. Due to other legal restrictions we do not permit direct access to any form of social media that we may use (such as the HBSA forum).

Who we share data with:

• Surrey Police: To comply with Home Office guidance on registered club status
• Other police forces: To confirm membership details for FAC renewals
• Other government agencies: In connection with the status of Home Office approved club
• Dropbox Inc: We use Dropbox to securely store all of our data and share between officers of the HBSA. Dropbox have no access to this data
• Zoho Corporation: – used to manage our emails to you. We receive performance information based on you opening or forwarding any emails sent via Zoho
• Adana Graphic Supplies Limited: – we use Adana to post our printed material to you
• Imail (UK Mail Limited): – we use Imail to send membership and subscription renewal notices by post
• Yahoo! (Oath): We use Yahoo services to host a private forum for our use only. You have to request access to this and can leave at any time. We also use yahoo groups and mail to provide email services for member use. You should familiarise yourself with Yahoo’s own privacy policy available from Yahoo
• Google Sites: We make use of a Google Site to host our website. You do not need credentials to make use of this. You should familiarise yourself with Google Sites privacy policy accessible from the site
• Paypal Inc: We offer the opportunity to pay for goods and services by paypal. We do not store any data in relation to this bar your email address and name
• Legal representatives and collections agencies: We may on occasion share specific and proportional data in order to pursue our legitimate interests
• NRA of the UK: If you request a shooter’s certificate of competency from us we will pass your details along with any assessment records to the NRA in order that they can issue a certificate

Should the officers and/or directors of the HBSA decide to make use of any new processor or change the way in which we use the data we will update this document and inform you by email and on our website. You may object by contacting the data protection officer.

Personal Data to be processed for all full members:

* At end of year on the year of resignation
** to be kept in perpetuity as part of the historical records of the HBSA, subject to your rights( see Legitimate Interests above)

Personal Data to be processed for corresponding subscribers  (including Institutional and Associated)

* At end of year on the year of resignation

Personal Data to be processed for Guests of the HBSA

* At end of year on the year attendance


V1.0 May 2018