Guidelines for Retention and Disposal of Data

What the GDPR requires ART to do

ART is required, under Article 30 of the GDPR, to have a retention schedule for its personal data. This should follow the principle of “storage limitation”, that is that the data should be kept for no longer than is necessary for the purposes for which the data are collected and processed.

Records of Achievement

One of the key functions of ART’s training schemes for both ringers and teachers is to record the achievements of the users of those schemes. The validity and currency of those achievements at present lasts for the lifetime of the user. ART therefore must keep a record of that achievement throughout the user’s life. However, a distinction also needs to be made between those who are active users of ART’s services and those who have become inactive for whatever reason or deceased. The records of non-active users who have gained achievements under ART training schemes will be archived out of normal use, but retained indefinitely or until ART is notified of the death of the user.

How long does ART keep its records? A Retention Schedule

Active users

Active users are:

  • Course delegates who are within the time limit for completion (irrespective of the level of their online activity)
  • Accredited teachers with 3 months’ trial membership
  • Paid up members of the Association
  • Ringers who have logged on in the last three years or who have gained an achievement in that time
  • Ringers who have not logged on in the last three years or who have not gained an achievement in that time

All data should be retained while the user remains active and ART communication continued.

Lapsed and Resigned users

This category includes:

  • ART Members who have not paid their subscription for more than two consecutive years
  • ART Members who have resigned
  • Delegates who have not taken up the offer of membership after two years from accreditation

Users with achievements: ART communication should cease and their personal data should be archived.

Users with no achievements: their personal data should be permanently deleted.

Suspended users and Terminated users

After two years from the date of suspension or termination all ART communication should cease and the personal data should be archived including a note of the reasons for their suspension or termination.

Deceased users

Where ART is notified of the death of a user their personal data should be deleted and all ART communication should cease.

Users who request deletion of their data

Users who lapse or resign may approach ART to ask that their personal data is deleted. In normal circumstances the username in their personal record will be changed to a pseudonymised username and email address. Their actual contact details will be deleted from the record, but the Data Protection Adviser will hold an off-line record of the pseudonym used and the original name and contact email of the requester (data subject). This will ensure that ART is able to meet any legal requirements pertaining to its relationship with the data subject and is in a position to respond to any subsequent enquiry by that data subject. The ART Administrator will keep a record of the request and the action taken to meet it.

Guideline History

Last Modified: October 2019

Last Reviewed: October 2019

Contact

If you have any questions about this policy or data protection you are invited to contact the Association at:

dataprotection@bellringing.org