Royal College of Organists | Privacy and Cookie Policy

Privacy & Data Protection

1. OVERVIEW

The Royal College of Organists, Registered address 116 Pall Mall, London SW1Y 5EA, Incorporated by Royal Charter, Registered charity number 312847 (‘The RCO’ or ‘The College’) needs to collect and use certain types of information about the Individuals and Organisations who come into contact with it in order to carry on its work. These can include members, employees, contractors, suppliers, volunteers, audiences and potential audiences, business contacts and other people with whom the group has a relationship, or regularly needs to contact.

This policy explains how this data should be collected, stored and used, whether on paper, stored in a computer database, or recorded on other material in order to meet The College’s data protection standards and, specifically, to comply with the law under the General Data Protection Regulation (GDPR 2018)

2. PURPOSE OF THIS POLICY

This policy ensures that The RCO:

• Protects the rights of its members, supporters, Board and Committee members, Trustees, Contractors and Suppliers
• Processes data lawfully, fairly and in a transparent manner
• Collects data that are specific and limited to legitimate purposes and not further processed in a manner that is incompatible with those purposes
• Complies with UK data protection law and follows good practice
• Is protected from the risks of a data breach
• Processes data in a manner that ensures the security of personal data and protects against unauthorised or unlawful processing and against accidental loss, destruction or damage

3. ROLES AND RESPONSIBILITIES

• This applies to all those handling data on behalf of The RCO, e.g.:
  Board and Committee members (e.g. Academic Board; Appointments and Awards Board)
• Employees
• Members
• Contractors/3rd-party suppliers.
• Trustees

It applies to all data that The RCO holds relating to individuals, including but not limited to:

• Names
• Email addresses
• Postal addresses
• Phone numbers
• Dates of birth
• Website access records and email preferences
• Qualifications and other relevant information
• Payment details and purchase history
• Any other relevant personal information held (e.g. financial)
  

The RCO is the Data Controller, which means that it determines for what purposes personal information is held and for what it will be used. For the purposes of this policy, the Administration Manager, Andrew Macintosh andrew.macintosh@rco.org.uk is the first point of contact for the Data Controller.

4. DATA PROTECTION PRINCIPLES

(i) We fairly & lawfully process personal data.

The RCO will only collect data where lawful and where necessary for legitimate purposes. In accordance with the GDPR, data will be processed on the lawful bases of Consent, Legitimate Interest, Necessary for contract or legal obligation.

Where consent is required, the College will ensure that individuals have given clear consent for the use of their personal data for a specific purpose that has been explained in clear, plain language that is easy to understand. The College will ensure that consent is given by positively opting in and can be withdrawn at any time, without detriment, by contacting the Data Controller. The College will keep a record of when and how it obtained consent from an individual and a record of exactly what it was told at the time.

Personal data will be processed under the lawful basis of Contract where it is necessary to do so for transactions related specifically to membership, including but not limited to, payment processing, subscription renewals, providing information regarding member services, event and course information, examination administration.

• The College may require personal data to be processed under the basis of Legitimate Interest. An assessment will be undertaken to ensure that this is necessary, would be reasonably expected by the data subject, will not create an adverse impact on the data subject, and that we have put safeguards in place to protect data subjects from any potential harm. Any related communication will state the purpose of the procedure and will ensure that consent can be withdrawn for a specific reason, without detriment, by contacting the Data Controller. 
• Members’ details will be collected when they first join and will be used as a form of Contract regarding membership services. Other data may subsequently be collected in relation to their membership, including payment history for subscriptions.
  Members’ details will be used to communicate promotional and fundraising activities of The RCO where there is a legitimate interest to do so. Where consent is required, this will be secured on an “opt in” basis, clearly explaining why the data are required and for what they will be used.
• The names and contact details of Trustees, Board and Committee members, employees and contractors will be collected when they take up a position and will be used solely to enable communication related to their role, unless prior consent is otherwise given by the data subject.
• Further information, including personal financial information and criminal records information may be collected in specific circumstances where lawful and necessary (e.g. in order to process payment to the person or in order to carry out a DBS check).
• The name, contact details and other details of an individual who is not a member of The RCO may be collected at any time, such as booking for an event or showing interest in the organisation. The College will communicate with the data subject about its related activities, and/or for Direct Marketing related to the College’s work with the subject’s consent as required.
• Whenever The RCO uses a 3rd party as a processor, a written contract is put in place.

(ii) We only collect and use data for specified and lawful purposes.

• When collecting data, The RCO will ensure the data subject is notified about what data are required and for what purposes they will be processed.
• We will never use data for any purpose other than that stated or that can be considered reasonably related to that purpose.

(iii) We ensure any data collected are relevant and not excessive.

• The RCO will not collect or store more data than the minimum required for the intended purpose.

(iv) We ensure data are accurate and up-to-date

• The RCO will ask members, volunteers and staff regularly to check and update their data. Any individual will be able to update their data at any point by contacting the Data Controller.

(v) We ensure data are not kept longer than necessary

• The RCO will keep data on individuals for no longer than 36 months after its involvement with the individual has ceased, unless there is a legal requirement to keep records, or for statistical and archival purposes.

(vi) We process data in accordance with individuals’ rights

The following requests can be made in writing to the Data Controller:

• Members and supporters can request to see any data stored on or about them. Any such request will be actioned within 30 days of the request being made.
• Members and supporters can request that any inaccurate data held on them are updated. Any such request will be actioned within 14 days of the request being made.
• Members and supporters can request to stop receiving any marketing communications. Any such request will be actioned within one month of the request being made.
• Members and supporters can object to any storage or use of data that might cause them substantial distress of damage, or any automated decisions made based on their data, including the right to erasure, subject to any legal reason that the RCO may have to retain the data. Any such objection will be considered by the Director and a decision communicated within 30 days of the request being made.

(vii) We keep personal data secure.

The RCO will ensure that:

• Data held by us are kept secure.
• Electronically-held data will be held within a password-protected and secure environment.
• Physically-held data (e.g. membership forms and examination entries) will be stored in a secure location.
• Access to data will only be given to relevant trustees, employees, members and contractors where it is clearly necessary for the College’s operation. The Data Controller will decide in what situations this is applicable and will keep a master list of who has access to relevant data.

Viii) We only share members’ data with other members with the subject’s prior consent

As a membership organisation The RCO encourages communication between its members. To facilitate this:

• Members’ details will be published in the annual Members’ directory, but each member will also have the option for their details to be excluded.
• Members can request the personal contact data of other members in writing via the Data Controller. These details will be given, as long as they are only for the purposes of contacting the subject (e.g. an email address, not financial or any other personal data) and the subject consents to their data being shared with other members in this way.
  

(ix) Direct Marketing

The RCO will regularly send information regarding events, areas of legitimate interest and fundraising activities to consenting members. This includes, but is not restricted to, contacting them to promote concerts and other events, updating them about College news, fundraising and other College interests.Whenever data is collected for this purpose, the College will provide:

• A clear and specific explanation of for what the data will be used
• A method for users to show their active consent to continue receiving these communications (e.g. a ‘tick box’)

Data thus collected will only ever be used in the way described and will never be used to market 3rd-party products unless prior explicit consent has been obtained.

Every marketing communication will contain a method through which a recipient can withdraw their consent from subsequent such communications (e.g. an ‘unsubscribe’ link in an email). Opt-out requests such as this will be processed within one month.

Cookies

The Royal College of Organists uses cookies and similar tools across this website to improve its performance and enhance your user experience. This policy explains how we do that.

What are cookies?

Cookies are small text files which a website may put on your computer or mobile device when you first visit a site or page. The cookie will help the website, or another website, to recognise your device the next time you visit. Web beacons or other similar files can also do the same thing. We use the term “cookies” in this policy to refer to all files that collect information in this way.

There are many functions cookies serve. For example, they can help us to remember your preferences, analyse how well our website is performing, or ensure that user functions such as examination bookings work properly.

Certain cookies relating to Member services necessarily contain personal information. However, most cookies don’t collect information that identifies you, and will instead collect more general information such as how users arrive at and use our websites, or a user’s general location.

What sort of cookies does the College use?

Generally, our cookies perform up to three different functions:

1. Essential cookies
Some cookies are essential for the operation of our website. For example, some cookies allow us to identify Members and ensure they can access the Member only pages. If a Member opts to disable these cookies, the Member will not be able to access all of the content that their Membership entitles them to.

2. Performance Cookies
We utilise other cookies to analyse how our visitors use our websites and to monitor website performance. This allows us to provide a high quality experience by customising our offering and quickly identifying and fixing any issues that arise. For example, we might use performance cookies to keep track of which pages are most popular, which method of linking between pages is most effective, and to determine why some pages are receiving error messages.

3. Functionality Cookies
We use functionality cookies to allow us to remember your preferences and to enable the delivery of specific services. For example, cookies help you access the Member only area, and to carry out certain functions such as booking examinations, downloading past papers, watching videos on iRCO, and so on.

Does anyone else use cookies on the RCO website?

We do not allow advertisers or other third parties to place cookies via the RCO website. The only exception is that like many companies, we use Google Analytics to help us monitor our website traffic and improve its performance over time so that we can improve the services it provides and its relevance for visitors.

Can a website user block cookies?

As we’ve explained above, cookies help you to get the most out of our websites. By continuing to access our site, you are consenting to our use of cookies.

However, if you do wish to disable our cookies then please follow the instructions for your browser at http://www.allaboutcookies.org/manage-cookies/

Please remember that if you do choose to disable cookies, you may find that certain sections of our website do not work properly

Do we track whether users open our emails?

Our emails, including our monthly e-News and e-Diary mailings, may contain a single, campaign-unique “web beacon pixel” to tell us whether our emails are opened and verify any clicks through to links within the email. We may use this information for determining which of our emails are more interesting to users in order to improve the content over time. The pixel will be deleted when you delete the email.

More Information

More detail on how businesses use cookies is available at www.allaboutcookies.org.