Privacy Policy

1. Introduction

The Shaftesbury & District Chamber of Commerce (“we”, “our”, “us”) is committed to protecting your privacy. We are managed by a board of voluntary trustees. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Treasurer is our designated Data Controller.

This policy explains how we collect, use, store, and protect your personal data.

2. Data We Collect

We may collect and process the following information:

• Contact details: Name, business name, email address, telephone number, and postal address.
• Membership data: Job title, industry type, and membership start date.
• Financial data: Payment histories and billing details.
• Event data: Attendance records, booking names, and dietary or accessibility requirements.

3. How We Collect Your Data

We collect data directly from you when you interact with us. This happens when you apply for membership, register for an event, or contact us through our website. We do not publish a public member directory, meaning your membership details are kept strictly internal.

We may also receive data from 3^rd parties that manage local events for which we are responsible, such as the Shaftesbury Food Festival.

We may publish details about your business on our web site – with your written (or emailed) consent.

4. Legal Basis for Processing

Under the UK GDPR, we rely on the following legal bases to process your data:

• Contractual Necessity: To manage and administer your Chamber membership.
• Legitimate Interests: To send you updates, event invitations, and newsletters relevant to your business community.
• Legal Obligation: To maintain accurate financial and tax records for HMRC.
• Event Administration: To process your payments and manage your participation in events for which we are responsible.

5. Third-Party Service Providers

We do not run a centralized IT system, but we use trusted third-party cloud services to run the Chamber. Your data will be processed by:

• Mailchimp: To send newsletters and email updates.
• Eventbrite: To manage event bookings and registrations.
• Stripe: To process membership fees and event payments securely. We do not store your credit card details on our own systems.
• Google Drive: Master membership spreadsheets and financial logs are stored securely on a dedicated Google Drive account linked to our official Chamber domain email address.

6. Data Storage and Decentralised Security

Because our trustees are volunteers, individual trustees use their own personal computers to complete work when required.

To ensure compliance with UK data protection laws, we enforce strict security protocols:

• Centralised Storage: The master copy of all membership and financial data is held exclusively on the Treasurer’s secure Google Drive account.
• Password Protection: All volunteer devices, spreadsheets, and third-party accounts holding personal data are protected by strong passwords.
• Local Storage Limits: Volunteers are prohibited from keeping permanent copies of personal data on their local hard drives. Data downloaded for administrative tasks must be immediately and permanently deleted once the task is complete.
• Access Control: Access to data within Mailchimp, Eventbrite, Stripe, and Google Drive is restricted solely to the specific trustees who require it to perform their voluntary duties.

7. International Data Transfers

Some of our third-party providers (such as Mailchimp, Eventbrite, Stripe, and Google) are hosted in the United States. We ensure that these providers offer adequate safeguards for your data, such as the UK Extension to the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (SCCs) approved for use in the UK.

8. Data Retention

We keep your personal data only as long as you remain a member of the Chamber. If you cancel your membership, we will delete your records from our mailing lists and cloud storage, except for financial transactions which we are legally required to keep for 6 years plus the current financial year to comply with HMRC guidelines.

9. Your Rights

Under UK data protection law, you have the following rights:

• Access: You can request a copy of the personal data we hold about you.
  • Email data_copy@shaftesburychamber.co.uk to request this
• Correction: You can ask us to fix any inaccurate or incomplete information.
  • Email data_correction@shaftesburychamber.co.uk to request this
• Erasure: You can request that we delete your data (subject to our statutory HMRC retention rules).
  • Email data_delete@shaftesburychamber.co.uk to request this.
• Object/Restrict: You can opt out of our marketing and newsletter emails at any time by clicking the “unsubscribe” link at the bottom of any Mailchimp email.
• Complaints: You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk).

• Data (Use and Access) Act 2025: If you believe that your data has been mishandled by us, please email data_complaint@shaftesburychamber.co.uk with the details, or write to the postal address provided in 10 Contact Us

Please provide your name, a contact address for our responses, and any specifics that you can (e.g. where  such data has appeared, when seen, and where possible, a copy, such as a screen-shot).

10. Contact Us

If you have any questions about this policy or wish to exercise your rights, please contact our Data Controller:

• Role: The Treasurer
• Email: (Please refer to Your Rights section above)
• Postal Address: The Treasurer,  Shaftesbury Chamber of Commerce CIC, C/O Hub Accountants, Innovation House, Wincombe Lane, Shaftesbury, England SP7 8FG