Data Protection Policy

1. What is this Data Protection Policy?

This Data Protection Policy describes the categories of personal data processed by Deepings Lancaster Scouts and for what purposes. We are committed to collecting and using data fairly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

This policy applies to members, parents/guardians of youth members, adult volunteers, and users accessing our event management web portal.

2. Who We Are

Deepings Lancaster Scouts operates as part of the Stamford & Bourne District Scout Council, which is a Registered Charity in England & Wales (Charity Number: 522366).

Under UK Data Protection law, local Scout Groups and Districts act as Data Controllers for the personal data they process. The Data Controller is the Trustee Board, who are Charity Trustees appointed at the Annual General Meeting.

3. The Data We Collect & Process

Most personal information is provided directly by parents/guardians or adult volunteers verbally, on paper, or via digital forms. Through our section web app and section administration, we collect and process:

• Parent/Carer Email Addresses — for identity verification, sign-in, and transactional event notifications
• Scout Names & Section Details — to display appropriate event options for your child and deliver section activities
• Event Participation Details — to plan activity logistics, manage safety, and communicate costs
• Payment Records — to track contributions, payments made to the group, and financial management
• Optional Information (e.g. kit/clothing sizes) — submitted voluntarily to assist with event and equipment planning
• System Logs — captured automatically by our web infrastructure for application security and login auditing

4. Lawful Basis for Processing

Lawful basis	Examples
Legitimate Interests	Operating secure user authentication, delivering local section activities, and protecting application security
Contract / Pre-contractual Steps	Managing event registrations, activity attendance, and fee tracking
Legal Obligation	Retaining financial transactions and accounting records in compliance with charity regulations
Consent	Collecting optional information such as clothing sizes (which can be withdrawn at any time)

5. Primary Systems & Third-Party Processors

We use standard core Scouting membership databases and secure web infrastructure acting as Data Processors:

• Online Scout Manager (OSM) — run by Online Youth Manager Ltd. Our primary membership database for youth and adult member details, health/medical forms, badge tracking, and core communications. See the OSM Privacy Policy for their full terms.
• Cloudflare — hosts and secures our Parent Information Portal application, providing protection against cyber threats and maintaining system security logs.
• Resend — delivers transactional emails (login codes and event notifications) to registered parent/carer email addresses.

We never sell, rent, or trade your personal data to third parties for marketing purposes.

6. Data Retention

• Section Membership Data — retained for as long as your young person is an active member, and securely deleted when they leave the section or group
• Event Data — retained until the event and associated administrative and financial wrap-ups are complete
• Financial Data — payment summaries and transaction records are retained for 6 tax years to comply with UK charity accounting rules
• Technical Logs — held in line with standard Cloudflare and Resend retention schedules for system security

7. Your Rights

Under UK Data Protection law, you have the following rights regarding your data:

• Right to be informed about how your data is used
• Right of access (Subject Access Request) to ask for copies of the data we hold about you
• Right to rectification to correct inaccurate or missing data
• Right to erasure to request deletion of personal data where legal obligations do not require us to keep it
• Right to withdraw consent for optional items at any time
• Right to object or restrict processing under certain conditions

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Under UK data protection rules for grassroots Scouting, local Scout units and districts fall under the umbrella structure and specific processing exemptions for non-profit administration, meaning separate paid ICO registration is not required for standard Scouting activities. See the Scouts GDPR Toolkit for further guidance.

8. Contact Us

For any questions regarding this Data Protection Policy or to exercise your rights, please contact the District leadership team:

For the Scout Association's wider data protection policy visit scouts.org.uk/about-us/policy/data-protection-policy.