Privacy Policy

Last Updated: 19th April 2023

Definitions

Company
Water Jetting Association (WJA)

GDPR
Means the General Data Protection Regulation.

Responsible Person
Leanne Smith

Register of Systems
Means a register of all personal information held by the WJA.

1. Data Protection Principles

The Association is committed to processing data in accordance with its responsibilities under the GDPR. Article 5 of the GDPR requires that personal data shall be:

1. Processed lawfully, fairly and in a transparent manner in relation to individuals;
2. Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
3. Adequate, relevant and limited to what is necessary for the purposes for which the data is processed;
4. Accurate and, where necessary, kept up to date;
5. Kept in a form which permits identification of data subjects for no longer than is necessary; and
6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

2. General Provisions

1. This policy applies to all personal data processed by the Association.
2. The Responsible Person shall take responsibility for the Association’s ongoing compliance with this policy.
3. This policy shall be reviewed at least annually.

3. Lawful, Fair and Transparent Processing

1. To ensure that data processing is lawful, fair and transparent, the Association shall maintain a Register of Systems.
2. The Register of Systems shall be reviewed at least annually.
3. Individuals have the right to access their personal data. Requests made to the Association shall be dealt with in a timely manner.

4. Lawful Purposes

1. All data processed by the Association must be processed on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interests.
2. The Association shall record the appropriate lawful basis in the Register of Systems.
3. Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent shall be retained.
4. Where communications are sent based on consent, individuals shall have a clear option to withdraw that consent.

5. Data Minimisation

1. The Association shall ensure that personal data is adequate, relevant and limited to what is necessary for the purposes for which it is processed.
2. The Association shall pass only the minimum necessary data to enable registration of trainees onto the WJA register.

6. Accuracy

1. The Association shall take reasonable steps to ensure that personal data is accurate.
2. Where necessary, steps shall be taken to ensure that personal data is kept up to date.

7. Archiving and Removal

1. To ensure that personal data is kept for no longer than necessary, the Association shall maintain an archiving policy for each area in which personal data is processed.
2. The archiving policy shall consider what data should or must be retained, for how long, and why.
3. The archiving process shall be reviewed annually.

8. Security

1. The Association shall ensure that personal data is stored securely using modern software that is kept up to date.
2. Access to personal data shall be limited to personnel who need access.
3. Appropriate security measures shall be in place to prevent unauthorised sharing of information.
4. When personal data is deleted, this shall be done safely so that it is irrecoverable.
5. Appropriate backup and disaster-recovery solutions shall be maintained.

Breach

In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, the Association shall promptly assess the risk to people’s rights and freedoms and, where appropriate, report the breach to the Information Commissioner’s Office.

This policy statement is fully supported by the Council of the Association.

Leanne Smith
General Manager – WJA