Privacy notice · version 1.0
How we use your data
Draft — not yet adopted
This notice, the lawful bases and the retention periods below are drafted defaults. The
committee needs to review and adopt them, and take its own advice, before the Society relies
on them for real member information.
Fareham Musical Society holds information about its members so it can run rehearsals, put on shows, collect subscriptions and keep everybody safe — particularly members under 18.
The table below sets out everything we hold, why we hold it and how long we keep it. It is generated from the software itself, so it cannot drift out of date.
You can ask us for a copy of your information, ask us to correct it, or ask us to delete it. Where we rely on your consent — photographs and medical information — you can withdraw it at any time without giving a reason, and without it affecting your membership.
Youth members are shown to other members by first name and surname initial only.
To exercise any of these rights, use the "Your data" page when you are signed in, or email the secretary. We will respond within one month.
DRAFT — this notice needs the committee's approval before the Society relies on it.
In force since 1 July 2026
What we hold and why
| What it is for | What we hold | Why we are allowed to | How long |
|---|---|---|---|
| Running the society and its rehearsals | Name, email address, which company you are in, your role, rehearsal attendance. | Our membership agreement Art 6(1)(b) — membership is a contract, and we cannot administer it without your details. |
While you are a member, then two years after your last activity. |
| Subscriptions and accounts | Subscription status, payment dates and amounts. | A legal obligation Art 6(1)(c) for the financial record, and Art 6(1)(b) for collecting what is owed. |
Six years plus the current financial year. |
| Keeping members safe | Emergency contacts, verified parent and carer links, DBS check status for helpers, incident records. | A legal obligation Art 6(1)(c) and Art 6(1)(f) — our safeguarding duty towards members under 18. |
Until the member turns 25, then reviewed rather than deleted automatically. |
| First aid and medical needs Special category |
Allergies, medical conditions, medication a member may need during a rehearsal. | Your consent Art 6(1)(a), and Art 9(2)(a) explicit consent because this is health information. Art 9(2)(a) explicit consent. In a genuine emergency we would rely on Art 9(2)(c) vital interests. |
While you are a member, then one year. |
| Photographs and video for publicity |
Photographs and video from rehearsals and performances. | Your consent Art 6(1)(a) consent. Separate from membership, and you can withdraw it at any time without affecting anything else. |
Until consent is withdrawn. Withdrawal stops future use; material already printed in a programme cannot be recalled. |
| The public part of this website | Committee role names and a society contact address. | Our legitimate interests Art 6(1)(f) — telling people about our shows. Only committee role-holders are named. |
While the person holds the role. |
| Notifications to your device |
A device subscription token. No message content is stored on our side beyond the notice itself. | Your consent Art 6(1)(a) consent, and PECR consent for storing anything on your device. |
Until you unsubscribe, or six months of inactivity. |
| Our security and access log | Who signed in, who viewed or changed a member record, and when. | A legal obligation Art 6(1)(c) with Art 5(2) — we have to be able to show who accessed what. |
Two years. |
How long we keep things
| Data | Kept for | Because |
|---|---|---|
| Membership record (adult) | While a member, then 2 years after last activity | Re-joining and subscription queries |
| Membership record (youth) | While a member, then until the member turns 25 | Aligns with safeguarding practice for records about children |
| Subscription and financial records | 6 years plus the current financial year | Limitation Act 1980; HMRC record-keeping requirements |
| Consent records, given and withdrawn | Duration of the consent, then 6 years | Art 7(1) — we must be able to demonstrate consent was given and that withdrawal was honoured |
| First aid and medical information | While a member, then 1 year | No purpose is served by keeping health data beyond participation |
| Safeguarding incident records | Until the subject turns 25 at minimum, then documented review | Child protection practice. The review cycle is what makes long retention lawful |
| Messages involving a member under 18 | Until the youngest participant turns 25 | Safeguarding oversight, bounded so it does not become indefinite storage |
| Audit log | 2 years | Security investigation and Art 5(2) accountability |
| Web push subscriptions | Until unsubscribed, or 6 months of inactivity | A stale device token serves no purpose |
| Unsuccessful membership enquiries | 12 months | An enquirer may come back for the next season |