%20(500%20x%20220%20px).png)
Page Title
Data & Privacy Policy
Last updated (May 2024)
We are Ashendon Community Pub Society Limited – referred to as The Society. As the controller of your data, The Society will comply with Data Protection laws in the United Kingdom and UK General Data Protection Regulation (GDPR). As a not-for-profit organization, it is exempt from registration with the Information Commissioner Office.
This Privacy Policy details how we process your personal data. We keep our Privacy Policy under regular review and we will circulate the policy to those we hold data for if we make any changes.
​
Personal data collected, used, stored and transferred by us may include:
​
Types of Personal Information
Description
Identity
​
Contact
​
Financial
​
Contractual
​
​
Social Relationships
​
​
​
Marketing & Communication
​
​
Public Record
​
​
Names used to identify who you are.
​
Correspondence address, email address and telephone numbers.
​
Share Pledges value and Share Purchases value.
​
Details about the Society relevant to your Shareholding.
​
Information about your family such as dependents and marital status where these are disclosed by you during the course of Share Purchase.
​
Details about your preferences in receiving marketing from us and your communication preferences.
​
Details about you available in the public domain like the Companies House Register and information about you that is openly available on the internet.
​
Personal data is collected by us using the following methods:
-
Direct interactions with us by post, phone, email, or otherwise when sourcing and applying for Share Purchase, processing Identity, Contact and Financial categories of personal data.
-
Third parties used by The Society or publicly available sources (processing Identity, Contact and Financial categories of personal data) such as:
-
Marketing Company with whom you may be interacting, always with the ability to opt-out;
-
How do we use your personal data?
We use your personal data in the following circumstances and relying on the following lawful basis for processing:
Purpose/ Activity
Types of Data May Include
Lawful Basis for Processing
When you make an enquiry with us about anything The Society offers.
To manage, run and administer the Society.
​
​
​
Identity, Contact, Financial.
​
Identity, Contact, Financial, Marketing & Comms.
​
​
Legitimate interests - To initially engage with you when you interact with us.
Legitimate interests - To keep you informed about the Society and your interest on it, e.g. sending you an update on the performance of the Society.
To process any purchase or sales of shares in The Society.
​
To process any transaction between you and a third party.
​
Identity, Contact, Financial, Marketing & Comms.
​
Identity, Contact, Financial, Marketing & Comms.
​
Performance of a contract - We are processing your personal information to facilitate your requests or instructions to us.
Performance of a contract - We are processing your personal information to facilitate your requests or instructions to us.
Notifying you about changes to The Society or to communicate updates to terms or policies.
To invite participation in research and ask you for your opinions and feedback.
​
​
​
Identity, Contact.
​
​
Identity, Contact, Marketing & Comms.
​
​
​
​
Performance of a contract - To re-engage with you or to maintain and improve standards.
Legitimate Interests - To invite you to participate in marketing research. We use this to produce reports and insights that help us understand your point of view, so that we can improve the way we work as a Society.
To communicate with Members regarding Society events or news about the Society’s asset (the pub).
To understand which residents have become members by purchasing shares.
Identity, Contact, Financial, Marketing & Comms.
Identity, Contact
​
​
Legitimate Interests – Communication with Members about meetings, events and news about the Society or the pub.
Legitimate Interests – For the Fundraising Team to avoid unnecessary fundraising communication with Members.
To recognise (by agreement) Members’ support on-site at the pub.
To make the Register of Members available to all Members.
​
​
​
Identity.
​
​
Identity, Contact.
​
​
​
​
Performance of a Contract – Display names of Members on-site at the pub, in gratitude of their support. Following separate and individual agreement in writing by Members who wish to participate.
Legitimate Interests - Performance of a Contract - Members have the right to call an emergency meeting of Members and thus will be able to inspect the list of members upon request in writing to The Society.
Change of Purpose
Personal data will be used for the purpose of maintaining a register of Members as required by the Rules of The Society, and for communicating with Members. We will only use your personal data for the purposes stated unless we reasonably consider that we need to use it for another reason and it is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Marketing Communications
We can only use your personal information to send you marketing messages if we have either your consent or we have a 'legitimate interest', such as a commercial reason to use your information which does not conflict unfairly with your own interests. We may contact you to take part in market research. If you take part, we will use any feedback you give us to improve the way we communicate with you and the service we offer. You can opt-out of receiving these types of communications at any time by following the instructions in any marketing email communications you receive from us to unsubscribe.
Data Security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also limit access to your personal data. Identity data is accessed and processed only by Officers of The Society (Chair, Treasurer, Membership Secretary and Company Secretary) appointed representatives, advisers, business partners and suppliers who have a business need to know. They are also subject to a duty of confidentiality. Financial information, such as amounts invested, loans and donations, and interest paid will be treated as strictly confidential and only processed by Officers of The Society appointed representatives, advisers, business partners and suppliers who have a business need to know. They are also subject to a duty of confidentiality and will not be shared except as necessary for statutory purposes and managing The Society (e.g. when making decisions about whether withdrawal requests can be funded).
Your personal data may be shared with third parties for the following purposes:
Type of Recipient
Reasons
Auditors and other professional advisers.
​
​
​
​
We engage auditors and professional advisers to perform specific work that helps us meet our legal, regulatory and statutory responsibilities. Any auditors or professional advisers that we use will have contractual arrangements and security mechanisms in place to protect data and to comply with our data protection, confidentiality and security standards.
Law enforcement or other government and regulatory agencies.
​
​
​
Sharing of information may be necessary to verify your identity and comply with Anti Money Laundering legislation. We may disclose your personal information if we are asked to do so by the police or any other regulatory or Government authority.
Others.
​
​
Third parties to whom we choose to sell, transfer, or merge parts of our business or our assets. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
These companies are required to ensure appropriate security measures are in place and maintain the confidentiality of your personal data, and to use your personal data only in the course of providing such services and in accordance with our instructions.
How long is your personal data retained?
We will keep your personal information securely stored for as long as it necessary and we need it to provide you with what you have requested from us. We also keep it to comply with our legal and regulatory obligations. We will regularly reassess whether we need to hold your personal information and securely dispose of any information that we no longer need.
Once there is no other on-going relationship with us your personal data will either be securely deleted or anonymised so that it can be used for statistical purposes but without any method of identifying you individually.
Managing, reviewing, and updating your information
To ensure we conform to GDPR's principle of data accuracy, if there is a change required or an error in any of the personal information you have provided us, you may be able to amend your details by notifying us, and we will update your records. Where we have introduced you to another organisation, we are unable to update your details with them and you will need to contact them personally to notify them of these changes.
Your legal rights regarding your personal data
You have the right to:
-
Request access to your personal data.
-
Request correction of the personal data.
-
Request erasure of your personal data.
-
Object to processing of your personal data
-
Request restriction of processing of your personal data.
-
Request the transfer of your personal data to you or to a third party.
-
Withdraw consent at any time where we are relying on consent to process your personal data.
Questions
If you have any questions or complaints relating to how we use your personal data, or if you wish to exercise any of your rights regarding your personal data, please contact:
In writing: The Secretary, Ashendon Community Pub Society Limited. Ashendon Farm, Ashendon, HP18 0HB
Email: ACPSLcommittee@gmail.com
We will respond to you as soon as is possible. The length of time will depend on the type and complexity of the request, but you will receive a response no later than one month from the initial request.
