Privacy Policy
Data Protection and privacy Policy
TMG are committed to being transparent about how we collect and use personal data of our Course Participants and those who communicate with us, and to meeting our data protection obligations. This policy has been updated in line with the General Data Protection Regulations 2018.
Section 1 refers to Principles upon which this policy is based whilst Section 2 deals with practical applications of this policy regarding the business of TMG.
SECTION 1
Status of the policy
This policy sets out our rules on data protection and the legal conditions that must be satisfied in relation to the obtaining, handling, processing, storage, transportation and destruction of personal information.
If you consider that our provisions for complying with the Act have not been followed in respect of personal data about yourself or others you should raise the matter with the Data Controller currently Dr Neil Pillai Chair TMG.
Definition of data protection terms
Data is information which is stored electronically, on a computer, or in certain paper-based filing systems.
Data subjects for the purpose of this policy include all living individuals about whom we hold personal data. A data subject need not be a UK national or resident. All data subjects have legal rights in relation to their personal data.
Personal data means data relating to a living individual who can be identified from that data (or from that data and other information in our possession). Personal data can be factual (such as a name, address or date of birth) or it can be an opinion (such as course feedback).
Data controllers are the people who or organisations which determine the purposes for which, and the manner in which, any personal data is processed. They have a responsibility to establish practices and policies in line with the Act.
Data users include employees whose work involves using personal data. Data users have a duty to protect the information they handle by following our data protection and security policies at all times.
​
Data processors include any person who processes personal data on behalf of a data controller.
Processing is any activity that involves use of the data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring personal data to third parties.
Sensitive personal data includes information about a person's racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health or condition, bio metric data or sexual life, or about the commission of, or proceedings for, any offence committed or alleged to have been committed by that person, the disposal of such proceedings or the sentence of any court in such proceedings. Sensitive personal data can only be processed under strict conditions, and will usually require the express consent of the person concerned.
Data protection principles
Anyone processing personal data must comply with the eight enforceable principles of good practice. These provide that they must:
-
Process personal data lawfully, fairly and in a transparent manner.
-
Collect personal data only for specified, explicit and legitimate purposes.
-
Process personal data only where it is adequate, relevant and limited to what is necessary for the purposes of processing.
-
Keep accurate personal data and take all reasonable steps to ensure that inaccurate personal data is rectified or deleted without delay.
-
Keep personal data only for the period necessary for processing.
-
Adopt appropriate measures to make sure that personal data is secure, and protected against unauthorised or unlawful processing, and accidental loss, destruction or damage.
-
Processed in line with data subjects' rights.
-
Not transferred to people or organisations situated in countries without adequate protection.
Fair and lawful processing
The Act is intended not to prevent the processing of personal data, but to ensure that it is done fairly and without adversely affecting the rights of the data subject. The data subject must be told who the data controller is the purpose for which the data is to be processed by us, and the identities of anyone to whom the data may be disclosed or transferred.
For personal data to be processed lawfully, certain conditions have to be met. These may include, among other things, requirements that the data subject has consented to the processing, or that the processing is necessary for the legitimate interest of the data controller or the party to whom the data is disclosed. When sensitive personal data is being processed, more than one condition must be met. In most cases the data subject's explicit consent to the processing of such data will be required.
Processing for limited purposes
Personal data may only be processed for the specific purposes notified to the data subject when the data was first collected or for any other purposes specifically permitted by the Act. This means that personal data must not be collected for one purpose and then used for another. If it becomes necessary to change the purpose for which the data is processed, the data subject must be informed of the new purpose before any processing occurs.
Adequate, relevant and non-excessive processing
Personal data should only be collected to the extent that it is required for the specific purpose notified to the data subject. Any data which is not necessary for that purpose should not be collected in the first place.
Accurate data
Personal data must be accurate and kept up to date. Information which is incorrect or misleading is not accurate and steps should therefore be taken to check the accuracy of any personal data at the point of collection and at regular intervals afterwards. Inaccurate or out-of-date data should be destroyed.
Timely processing
Personal data should not be kept longer than is necessary for the purpose. This means that data should be destroyed or erased from our systems when it is no longer required.
Processing in line with data subject's rights
Data must be processed in line with data subjects' rights. Data subjects have a right to:
-
Request access to any data held about them by a data controller.
-
Prevent the processing of their data for direct-marketing purposes.
-
Ask to have inaccurate data amended.
-
Prevent processing that is likely to cause damage or distress to themselves or anyone else.
Data security
We must ensure that appropriate security measures are taken against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data. Data subjects may apply to the courts for compensation if they have suffered damage from such a loss.
The Act requires us to put in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. Personal data may only be transferred to a third-party data processor if he agrees to comply with those procedures and policies, or if he puts in place adequate measures himself.
Maintaining data security means guaranteeing the confidentiality, integrity and availability of the personal data, defined as follows:
-
Confidentiality means that only people who are authorised to use the data can access it.
-
Integrity means that personal data should be accurate and suitable for the purpose for which it is processed.
-
Availability means that authorised users should be able to access the data if they need it for authorised purposes. Personal data should therefore be stored on secure centralised computer system instead of individual PCs.
SECTION 2
Tenterden Mindfulness Group (“TMG”, “we” or “us”) is committed to protecting and respecting your privacy in connection with your use of our website, www.tenterdenmindfulnessgroup.co.uk (“Website”), and your maintenance on our email database list currently managed by Mailchimp.
Please read the following carefully to understand our practices regarding your personal information and how we will collect, use and disclose your personal information.
The current Data Controller for TMG is DR Neil Pillai.
Changes
Our privacy policy is regularly reviewed to make sure that we continue to serve your privacy interests. We reserve the right to modify or otherwise update this privacy policy and these changes will be posted on our website. We encourage you to visit this page from time to time to ensure that you are aware of any changes we may have made.
Information We May Collect From You
We may collect and process the following information about you:
-
Personal information including, for example, your name, e-mail address, telephone, credit or debit card or other payment information and information about your usage of the website that may identify you as an individual or allow online or offline contact with you as an individual.
-
Device Information such as operating system version, device type, and system performance information. The information we collect via this website may also include your IP address (this is your device’s individual identification number that is assigned to it when connected to the Internet) which is automatically logged by our web server.
-
We also collect completed Mindfulness course or event application forms.
In order to save you re-entering information, this website collects data which allows us to recognise you, your preferences and how you use this website. This information is collected by ‘session cookies’ and ‘persistent cookies’. We also have a cookie for Google Analytics. Cookies are small strings of data stored in your device’s temporary memory when you navigate around our website. Session cookies are deleted when you close your browser but persistent cookies are not. Our cookies do not store your email address or other personal information.
What We Do With Your Information
We collect your personal information to allow us to communicate information to you regarding services such as Courses, Sitting Groups and events all designed to comply with our charitable objectives to support wellbeing through Mindfulness practice locally.
We also process paper or electronic based Course application forms which may contain sensitive personal information. Such information is required to ensure suitability of the applicant for the specified course or event and is only viewed by accredited Mindfulness teachers affiliated to TMG or by employed staff who are required to process this information, via password-protected IT devices in the case of electronic application forms.
Informed consent is required to allow paper application forms to be scanned and sent by secure email to the Mindfulness teacher who is delivering the course. Paper application forms are then shredded. Within a month of course completion all electronic application forms are destroyed by TMG and/or the affiliated Mindfulness teacher.
By signing up to our mailing list you agree to us contacting you. We will continue to hold, store and contact you on the basis of a ‘Legitimate interest’ under the new GDPR regulations, (General Data Protection Regulation).
We do not pass your personal details on to any other third party, unless we have specific permission from you to do so. You have the right to ask to see what personal information we hold about you and also you have the right to ask us to remove your personal information from our systems.
Statistical Analysis
The data we collect for statistical analysis to evaluate our service does not include personal data. This data is anonymous and aggregated and is used to maintain and improve the quality of our service and may be used in reports for our Trustees.
Security & Confidentiality
The security of your personal information is important to us. We follow the most recent regulatory EU and NHS standards and comply with the Data Protection Act and GDPR to protect all information submitted to us, both during transmission and once it is received.
If you have any questions about the security of your personal information, you can contact our Data Controller Dr Neil Pillai at contact@tenterdenmindfulness.co.uk
We do not share your personal information with any third party (with the exception of Mindfulness teachers teaching the course applied for).
Law Enforcement
We reserve the right to cooperate with law enforcement officials in the investigation of alleged unlawful activities of our website users or relating to our website users. We will have no legal liability for such disclosures of your personal information.
Unless we suspect fraud, we do not use your IP address to identify you personally.
Where We Store Your Personal Information
Our website is hosted on the Wix.com platform. Wix.com provides us with the online platform that allows us to offer our services to you. Your data may be stored through Wix.com’s data storage, databases and the general Wix.com applications. They store your data on secure servers behind a firewall.
Emails sent via our website or email address are managed on the password protected Gmail platform and are viewed securely only by approved TMG staff through password-protected IT devices.
Other websites
This Privacy Policy only covers personal data collected via this website. While we carefully select the websites to which we may link, we are not responsible for the privacy practices or the content of these websites.
Your Rights
Access
You have the right to request a copy of certain personal information we hold about you and you also have a right to request for any personal data we hold to be removed. To do this, simply email Dr Neil Pillai, Data Controller at contact@tenterdenmindfulness.co.uk
More information
Detailed information about your rights under UK Data Protection legislation can be found on the website of the United Kingdom Information Commissioner, which is (as at the date of this privacy policy) https://ico.org.uk/
UPDATED 26/5/18