Version 1.0 - 27/07/2026

Wolds & Coast District Scout Council

Data Protection and Privacy Policy

1. What is this policy?

This Data Protection and Privacy Policy explains how Wolds & Coast District Scout Council collects, uses, stores, shares and protects personal information.

Wolds & Coast District Scout Council is committed to processing personal information lawfully, fairly and transparently, in accordance with UK data protection law, including the UK General Data Protection Regulation, the Data Protection Act 2018 and subsequent amendments to UK data protection legislation.

This policy applies to personal information we process about:

• young people;
• parents and guardians;
• adult volunteers;
• prospective volunteers;
• event participants;
• supporters and donors;
• suppliers and contractors; and
• members of the public who contact or interact with the District.

This policy covers information processed by Wolds & Coast District Scout Council.

Each Scout Group within the District is a separate data controller and is responsible for the personal information it processes locally. Each Group should maintain and publish its own appropriate data protection and data retention information.

2. Who we are

Wolds & Coast District Scout Council is an unincorporated charity within Scouts’ federation of charities.

Wolds & Coast District Scout Council is the data controller for personal information where it decides why and how that information will be processed.

Accountability for data protection rests with the Wolds & Coast District Trustee Board.

The District Trustee Board is responsible for ensuring that the District:

• appoints or identifies a Data Lead;
• publishes and maintains this policy;
• publishes and maintains a separate Data Retention Policy;
• keeps appropriate records to demonstrate compliance;
• protects the personal information it processes; and
• responds appropriately to data protection requests, complaints and incidents.

Data protection enquiries should be sent to:

Email: dlv@woldsandcoastscouts.org.uk

From this point onwards, Wolds & Coast District Scout Council is referred to as “we”, “us” or “the District”.

3. Other data controllers within Scouts

The Scout Association, also referred to as Scouts UK Headquarters, and Wolds & Coast District Scout Council act as independent data controllers for personal information held on the Scouts Membership System.

Each organisation remains responsible for the personal information it processes and for complying with UK data protection law.

Personal information may also be shared with Humberside County Scout Council or local Scout Groups where there is an appropriate purpose and lawful basis for doing so.

These organisations are separate data controllers for the information they process.

4. How we obtain personal information

Most personal information is provided directly by:

• adult volunteers;
• young people;
• parents or guardians;
• supporters;
• donors;
• event participants; or
• people contacting the District.

Information may be provided verbally, on paper, through email, through an online form or through an approved membership or event-management system.

Information about younger members will normally be provided by their parent or guardian.

Young people may also provide information directly where this is appropriate to their age, understanding and the purpose for which the information is required.

Information about adult volunteers may also be received from:

• Scouts UK Headquarters;
• Humberside County Scout Council;
• local Scout Groups;
• the Disclosure and Barring Service;
• Atlantic Data; or
• other organisations involved in volunteer vetting, safeguarding, learning or appointment processes.

5. Personal information we may process

Depending on how an individual is involved with the District, we may process:

• names, titles, addresses, email addresses and telephone numbers;
• dates of birth and ages;
• gender information where relevant;
• emergency and next-of-kin contact details;
• parent or guardian details;
• membership numbers;
• volunteering roles and team information;
• records of learning, qualifications, accreditations, permits and awards;
• event, activity and attendance information;
• dietary, accessibility and additional support requirements;
• health, medical and disability information;
• religious or cultural information relevant to activities, food or events;
• equality, diversity and inclusion information;
• photographs, video and audio recordings;
• financial information needed to process payments, donations, expenses or Gift Aid;
• bank account details where needed to make payments or reimburse expenses;
• identity information required as part of volunteer criminal-record checking;
• criminal-record-check status and relevant vetting information;
• correspondence, enquiries and complaints;
• safeguarding or safety information where it is necessary and lawful for us to process it;
• information about accidents, incidents, near misses or insurance claims; and
• information required to demonstrate suitability for a volunteering role.

We will only collect information that is reasonably necessary for a clearly identified purpose.

6. Why we process personal information

We may process personal information to:

• administer District membership and volunteering arrangements;
• support and manage adult volunteers;
• provide information about meetings, activities, events and learning;
• organise and administer District events and activities;
• support local Scout Groups and Explorer Scout provision;
• administer expressions of interest and waiting lists managed by the District;
• ensure that volunteers have suitable learning, qualifications, checks, permits and accreditations;
• protect the health, welfare and safety of young people, volunteers and event participants;
• make reasonable adjustments and suitable arrangements for individual needs;
• communicate with parents, guardians, volunteers, supporters and members of the public;
• contact someone in an emergency;
• maintain financial, accounting and Gift Aid records;
• process payments, expenses, donations and grants;
• fundraise and promote the interests of Scouts;
• administer awards, permits and Duke of Edinburgh’s Award participation;
• nominate people for local or national awards;
• respond to enquiries, concerns, complaints and data-protection requests;
• comply with legal, regulatory, safeguarding, safety, insurance and governance requirements; and
• establish, exercise or defend legal claims.

7. Our lawful bases

We will only process personal information where an appropriate lawful basis applies.

Depending on the purpose, our lawful bases may include:

• our legitimate interests in operating and supporting Scouts locally;
• taking steps connected with, or performing, an agreement or contract;
• complying with a legal obligation;
• protecting someone’s vital interests;
• carrying out a task in the public interest where applicable; or
• consent.

Where we process special-category information, such as health, disability, ethnicity, religion or sexual orientation, we will also identify an additional condition permitted by UK data protection law.

This may include:

• the legitimate activities of a not-for-profit association;
• protecting someone’s vital interests;
• establishing, exercising or defending a legal claim;
• substantial public interest conditions where applicable; or
• explicit consent.

Information relating to criminal convictions, offences and criminal-record checks will only be processed where permitted by law and in accordance with Scouts’ vetting and safeguarding procedures.

8. Photographs and recordings

We will normally obtain consent before using a photograph or recording where an identifiable young person or adult is the principal focus, particularly where it will be used publicly or on social media.

At larger events, it may not be practical to obtain individual consent from everyone who could appear incidentally in general photographs or recordings.

In these circumstances, we may rely on legitimate interests.

Where this applies, we will:

• tell people that photography or recording will take place;
• explain how images may be used;
• provide a reasonable way for someone to raise concerns or object; and
• take particular care where a safeguarding, privacy or security concern has been identified.

9. Sharing personal information

We will only share personal information where there is an appropriate purpose and lawful basis.

Depending on the circumstances, information may be shared with:

• authorised District volunteers who need the information to carry out their responsibilities;
• local Scout Groups;
• Humberside County Scout Council;
• The Scout Association and Scouts UK Headquarters;
• Online Scout Manager and other approved membership or event systems;
• activity providers, instructors, venues, accommodation providers or transport providers;
• Duke of Edinburgh’s Award;
• Unity Insurance Services and other insurers;
• professional advisers, including accountants, auditors, independent examiners or legal advisers;
• HM Revenue and Customs;
• emergency services;
• local authorities;
• regulators;
• law-enforcement organisations;
• safeguarding organisations or statutory services; and
• other organisations where the person has agreed or where sharing is otherwise permitted or required by law.

Only the minimum information reasonably required for the purpose will be shared.

We will not sell personal information.

Where personal information is shared with another organisation, we will take reasonable steps to ensure it is handled securely and in accordance with data protection law.

10. Systems and service providers

We may use the following systems to process and store personal information.

Scouts Membership System and scouts.org.uk

These systems are used to manage adult volunteer membership, roles, learning, accreditations, permits, communications and related records.

Atlantic Data

Atlantic Data is used as part of the Disclosure and Barring Service criminal-record-checking process in England and Wales.

Online Scout Manager

Online Scout Manager is operated by Online Youth Manager Ltd.

It may be used for:

• young-person membership information;
• adult volunteer contact information;
• waiting lists;
• event administration;
• activity administration;
• programmes;
• attendance;
• badges;
• payments; and
• communications.

Microsoft 365

Microsoft 365 may be used for:

• District email;
• documents and spreadsheets;
• online forms;
• workflow automation;
• calendars;
• meeting administration; and
• secure file storage.

eDofE

eDofE may be used where applicable to administer participation in the Duke of Edinburgh’s Award.

District website and online forms

The District website and online forms may be used to:

• provide information;
• receive enquiries;
• collect expressions of interest;
• administer waiting lists;
• recruit volunteers;
• administer events and activities; and
• collect information required for the operation of the District.

We will assess third-party systems before using them to process personal information.

We will take reasonable steps to ensure that appropriate contractual, security and data-protection arrangements are in place.

Volunteers must only use systems and storage arrangements authorised by the District.

Personal information must not be retained on personal devices, personal email accounts or unapproved spreadsheets for longer than necessary.

11. Paper records and information used at events

Paper records may sometimes be required where internet or digital access is unavailable or where paper records are more practical for safety reasons.

Examples include:

• emergency contact information;
• medical or health information;
• event registration details;
• attendance records;
• Gift Aid administration;
• incident or accident forms; and
• information required by an event organiser.

We will minimise the amount of personal information held on paper.

Paper records will be:

• limited to what is necessary;
• kept secure;
• accessible only to appropriate volunteers;
• returned to secure storage where required; and
• securely destroyed when no longer needed.

12. International data transfers

Some service providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate legal mechanism and safeguards are in place as required by UK data protection law.

13. How we protect personal information

We use appropriate organisational and technical measures to protect personal information.

These may include:

• limiting access to people who need the information;
• using individual user accounts;
• applying appropriate access permissions;
• using secure passwords;
• using multi-factor authentication where available;
• maintaining secure cloud storage;
• keeping devices and software updated;
• securely disposing of paper and electronic records;
• reviewing access when volunteers change or leave their roles;
• avoiding the unnecessary duplication of personal information;
• providing volunteers with appropriate data-protection guidance; and
• responding promptly to suspected data breaches.

14. How long we retain information

We will not keep personal information for longer than is reasonably necessary.

Different categories of information will be retained for different periods depending on:

• why the information was collected;
• legal, financial, insurance or safeguarding requirements;
• Scouts policies and guidance;
• whether a complaint or legal claim could arise; and
• whether the information is still required to support membership or volunteering.

Detailed retention periods are contained in the Wolds & Coast District Scout Council Data Retention Policy.

Data Retention Policy:

A copy may also be requested by emailing:

dlv@woldsandcoastscouts.org.uk

Where information is no longer required, it will be securely deleted, destroyed or anonymised.

The Scout Association maintains separate national Data Protection and Data Retention Policies covering information it processes.

15. Your rights

Depending on the circumstances, individuals have rights including:

• the right to be informed about how their information is used;
• the right to request access to their personal information;
• the right to have inaccurate information corrected;
• the right to request erasure of information;
• the right to request restriction of processing;
• the right to object to certain processing;
• the right to data portability where it applies; and
• rights relating to automated decision-making and profiling.

These rights are not absolute and exemptions may apply.

Requests should be sent to:

Email: dlv@woldsandcoastscouts.org.uk

We may need to confirm the identity of the person making the request before providing information.

We do not currently make decisions about individuals which have legal or similarly significant effects using solely automated processing.

16. Subject access requests

Individuals may ask for a copy of the personal information the District holds about them.

A request does not need to use any particular wording or form.

Subject access requests should be sent to:

Email: dlv@woldsandcoastscouts.org.uk

We will respond within the timescales required by law.

Where permitted by law, we may ask for:

• information needed to confirm the requester’s identity;
• clarification about the information being requested; or
• additional time where a request is particularly complex or numerous.

Information relating to other people may be withheld or redacted where it would not be appropriate or lawful to disclose it.

17. Data-protection complaints

Anyone who is unhappy with how we have used their personal information may make a data-protection complaint.

Complaints should be sent to:

Email: dlv@woldsandcoastscouts.org.uk

We will:

• provide a clear way for the complaint to be raised;
• acknowledge the complaint within 30 days of receiving it;
• take appropriate steps to investigate it without undue delay;
• keep the complainant appropriately informed; and
• tell the complainant the outcome.

Individuals also have the right to raise a concern with the Information Commissioner’s Office.

Information about how to contact the Information Commissioner’s Office is available at:

www.ico.org.uk

18. Personal-data breaches

A personal-data breach may include personal information being:

• lost;
• stolen;
• accidentally deleted;
• sent to the wrong person;
• accessed without permission;
• disclosed inappropriately;
• altered without permission; or
• made unavailable.

Any volunteer who believes a personal-data breach may have occurred must report it immediately to:

Email: dlv@woldsandcoastscouts.org.uk

The District will assess and manage the incident in accordance with its data-breach procedures.

Where legally required, the District will notify:

• the Information Commissioner’s Office;
• affected individuals;
• Scouts UK Headquarters;
• Humberside County Scout Council; or
• other relevant organisations.

19. Cookies and website information

The Wolds & Coast Scouts website may use cookies and similar technology.

Cookies may be used to:

• allow the website to operate correctly;
• remember information entered into forms;
• maintain website security;
• understand how the website is being used; or
• support services provided by trusted third parties.

Information about the cookies actually used by the website should be provided in a separate Cookie Notice.

Consent will be requested for non-essential cookies where required by law.

20. Further processing

If we intend to use personal information for a new purpose, we will consider whether that purpose is compatible with the reason the information was originally collected.

Where required, we will provide additional privacy information before beginning the new processing.

Where consent is required, we will request consent before beginning the new processing.

21. Children and young people

We recognise that children and young people may require particular protection when their personal information is processed.

Information about young people will be handled in a way that reflects:

• their age;
• their level of understanding;
• their rights;
• their safety and welfare;
• the responsibilities of their parent or guardian; and
• the purpose for which the information is required.

Privacy information will be explained in clear and appropriate language where information is collected directly from a young person.

22. Contacting us

Questions about this policy, the use of personal information, data-protection requests, subject access requests, data breaches or complaints should be sent to:

Wolds & Coast District Scout Council
Email: dlv@woldsandcoastscouts.org.uk
Website: woldsandcoastscouts.org.uk

23. Policy approval and review

Version: Draft 1.0

Prepared: 27 July 2026

Approved by the District Trustee Board:

Next review: 27 July 2027

This policy will be reviewed earlier if there are significant changes to:

• data protection legislation;
• Scouts policies or procedures;
• District systems;
• the services used by the District; or
• the ways in which personal information is processed.