Privacy notice

Derwentside Scout District is committed to protecting personal data, respecting privacy and being transparent about how personal information is used.

This Privacy Notice explains how Derwentside Scout District collects, uses, stores, shares and protects personal data in accordance with:

• the UK General Data Protection Regulation (UK GDPR)

• the Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025

• the Privacy and Electronic Communications Regulations

• The Scout Association’s Policy, Organisation and Rules

• The Scout Association’s safeguarding and data-protection policies and guidance

This notice applies to personal data processed through:

• our website and online forms

• email and other communications

• District digital systems

• events and activities

• governance and operational activities

• CCTV operated at our Leadgate premises

1. Who we are

Derwentside Scout District is part of The Scout Association and operates within its federated charity structure.

Each Scout Group within the District is a separate independent charity with its own trustees and responsibilities. Derwentside Scout District is a separate charity responsible for supporting, enabling, assuring and coordinating Scouting across the District.

For data-protection purposes, Derwentside Scout District is the Data Controller for personal data that it processes at District level.

Derwentside District Scout Council is a Registered Charity 1016535 and is registered with the Information Commissioner’s Office - ZC251860.

2. Contact details

Data Protection Contact

Email: data@derwentsidescouts.org.uk

Please use this address if you:

• have a question about this notice or our use of personal data

• wish to exercise a data-protection right

• want to request CCTV footage in which you appear

• wish to make a data-protection complaint

3. Personal data we collect

We only collect personal data that is necessary, proportionate and relevant to our Scouting, governance, safeguarding, safety and operational responsibilities.

a) Contact and identity information

This may include:

• name

• postal address where necessary

• email address

• telephone number

• date of birth or age range

• emergency contact information

• information needed to confirm identity

b) Volunteering and membership information

This may include:

• Scout role and appointment details

• membership status

• training and qualification records

• permit or accreditation information

• compliance and vetting status where required

• trustee or governance role information

c) Safeguarding, health and welfare information

Where necessary and lawful, we may process information concerning:

• safeguarding concerns or allegations

• incidents and accidents

• health or accessibility needs

• reasonable adjustments

• welfare concerns

• other information necessary to support safe participation

Some of this information may be special-category personal data or criminal-offence data. It is handled with enhanced confidentiality and restricted access.

d) Website and communications information

This may include:

• information submitted through website forms

• email and other correspondence

• event registrations or enquiries

• limited technical information, such as IP addresses or server logs, needed for website security and functionality

e) Photography and media

Photographs or video recordings may be taken during Scout activities and events for purposes including:

• operational records

• celebrating achievements

• newsletters

• websites and social media

• historical archives

• promoting Scouting

Photography and media are managed in accordance with safeguarding requirements, The Scout Association’s guidance and relevant permissions or preferences. Particular care is taken with images of young people and vulnerable individuals.

f) CCTV and video surveillance

We operate a fixed CCTV camera covering the entrance and immediate frontage of our Leadgate premises.

The system may record:

• images of people entering, leaving or passing the premises

• images of vehicles

• the date and time of recordings

• activity within the camera’s configured field of view, which may include a limited part of the area immediately outside the premises

CCTV footage is stored locally on secure recording equipment. It is not stored in cloud-based storage.

The CCTV system does not use facial recognition, biometric identification, automatic number-plate recognition or automated decision-making. Audio recording is disabled.

CCTV is separate from photography or video taken at Scout activities for publicity or similar purposes.

4. How we obtain personal data

We may receive personal data:

• directly from the person concerned

• from a parent, carer or representative

• from volunteers, Scout Groups, Durham Scouts or The Scout Association

• through national Scout membership and volunteering systems;

• from activity or event providers

• from statutory bodies or emergency services where appropriate

• automatically through our website, digital systems or CCTV

5. How we use personal data

We use personal data where necessary to:

• support and enable safe, high-quality Scouting

• communicate with volunteers, parents, carers, young people and partners

• manage volunteering, membership, training and permits

• coordinate events and activities

• manage governance, trustee and assurance responsibilities

• support safeguarding, welfare, health and safety

• manage District premises, resources and systems

• meet legal and regulatory responsibilities

• investigate incidents, concerns or complaints

• protect the safety and wellbeing of young people and adults

CCTV purposes

We use CCTV to:

• help protect young people, volunteers, visitors and other people using or passing the premises

• protect the building and other District property

• deter, prevent and detect crime, vandalism and antisocial behaviour

• investigate security, safety or safeguarding incidents

• provide relevant footage to the police, insurers or other authorised bodies where necessary and lawful

CCTV is not used for advertising, facial recognition or routine monitoring of volunteer attendance, conduct or performance.

6. Our lawful bases

Depending on the circumstances, we rely on one or more of the following lawful bases under Article 6 of the UK GDPR:

• Legitimate interests: operating and supporting Scouting, managing volunteers and resources, protecting people and property, maintaining security, administering activities and investigating concerns

• Legal obligation: meeting charity, safeguarding, health and safety, financial, regulatory or other legal responsibilities

• Contract: administering arrangements connected with an event, activity, service or agreement;

• Vital interests: responding to an emergency or protecting someone’s life

• Consent: where consent is the most appropriate basis and can be freely given and withdrawn

CCTV lawful basis

Our lawful basis for operating CCTV is our legitimate interests under Article 6(1)(f) of the UK GDPR. These interests are protecting people, securing the premises and property, and preventing, detecting and investigating unlawful activity.

We balance these interests against the privacy rights of people who may be recorded. The camera is positioned and configured so that it does not capture more information than is necessary for these purposes.

We do not rely on consent for CCTV because it would not be practicable to obtain consent from everyone entering or passing the camera’s field of view.

Where footage is retained or used in connection with an alleged offence, safeguarding concern or legal claim, we will only process it where this is authorised under the Data Protection Act 2018 and other applicable law.

Special-category and criminal-offence data

Where we process special-category or criminal-offence data, we identify an additional lawful condition under the UK GDPR and Data Protection Act 2018.

Depending on the circumstances, this may include safeguarding children or individuals at risk, protecting vital interests, establishing or defending legal claims, preventing or detecting unlawful acts, or explicit consent where appropriate.

7. Who we share personal data with

We only share personal data where this is necessary, proportionate and lawful.

Recipients may include:

• The Scout Association and its national systems or teams

• Durham Scouts

• relevant Scout Groups or authorised District volunteers

• safeguarding teams

• statutory agencies and emergency services

• police and other law-enforcement bodies

• insurers, professional advisers and courts

• regulators or legal authorities

• trusted IT, security or other service providers acting on our instructions

CCTV footage is not routinely shared or made publicly available. It may be disclosed where necessary to investigate an incident, respond to a lawful request, protect someone’s safety, establish or defend a legal claim, or assist the police or another authorised body.

We record and control disclosures of CCTV footage. Where footage includes other identifiable people, it may need to be redacted before disclosure.

We do not sell personal data or share it for commercial gain.

8. Service providers and international transfers

Some of our digital and IT service providers may process personal data on our behalf. Where a supplier acts as our processor, it must handle information only on our documented instructions and provide appropriate security and confidentiality.

CCTV footage from the Leadgate premises is stored locally and is not transferred to cloud-based storage.

Where other personal data is transferred outside the United Kingdom, we use an applicable lawful transfer mechanism and appropriate safeguards as required by the UK GDPR.

9. How long we keep personal data

We keep personal data only for as long as it is needed for the purpose for which it was collected. We take account of legal, safeguarding, insurance, governance and operational requirements and The Scout Association’s retention guidance.

Typical approaches include:

• Financial records: normally retained for at least six years

• Safeguarding records: retained in accordance with safeguarding policy and legal requirements

• Governance and trustee records: retained as required for charity governance and accountability

• Training and permit records: retained while relevant to the person’s role or compliance requirements

• Website enquiries: deleted when no longer operationally required

• CCTV recordings: normally retained for no more than 30 days and then automatically overwritten or securely deleted

Relevant CCTV footage may be retained for longer where it is reasonably required for:

• a reported incident

• a safeguarding or safety concern

• a data-protection request or complaint

• a police or other lawful investigation

• an insurance matter

• the establishment, exercise or defence of a legal claim

Footage retained for one of these purposes will be securely deleted when it is no longer needed.

10. Your data-protection rights

Depending on the circumstances, individuals may have the right to:

• request access to their personal data

• request correction of inaccurate or incomplete information

• request deletion of personal data

• request restriction of processing

• object to processing based on legitimate interests

• withdraw consent where consent is relied upon

• request transfer of information where data portability applies

• complain about our handling of personal data

These rights are not absolute and may be subject to lawful exemptions.

Requests for CCTV footage

A person may request access to CCTV footage in which they are identifiable. To help us locate the footage, we may ask for information such as:

• the date and approximate time

• the location

• a description of the person or their clothing

• proof of identity where reasonably required

We may need to obscure other identifiable people before releasing footage. In some circumstances, we may be unable to provide footage if doing so would adversely affect another person’s rights or prejudice an investigation.

We will respond to information-rights requests without undue delay and normally within one calendar month.

11. Data-protection complaints

A data-protection complaint can be made using the contact details in section 2. Complaints can also be raised through another reasonable contact route within the District.

We will:

• acknowledge a data-protection complaint within 30 days

• investigate it fairly and without undue delay

• keep the complainant informed where the investigation takes time

• explain the outcome and any action taken without undue delay

We may ask for information needed to understand the complaint or reasonably confirm the identity or authority of the person making it.

Individuals also have the right to complain to the Information Commissioner’s Office at any time:

Information Commissioner’s Office

Website: www.ico.org.uk/make-a-complaint

Telephone: 0303 123 1113

12. Children’s personal data

Scouting involves working with children and young people. We recognise that children merit particular protection and may be less aware of the risks involved in the use of their information and of their data-protection rights.

We use clear information where possible and apply additional care, safeguarding consideration and access controls when handling children’s personal data.

CCTV signage is displayed at the Leadgate premises so that young people, parents, carers, volunteers and visitors are aware that recording takes place.

13. Security

We use appropriate technical and organisational measures to protect personal data. These include:

• controlled and role-based access

• secure District-managed systems

• appropriate password and account security

• restricted access to CCTV footage

• secure storage, transfer and disposal

• contracts and security requirements for service providers

• volunteer guidance and training

• recording relevant CCTV disclosures

• periodic reviews of our information-handling and CCTV arrangements

CCTV recordings are held on secure local equipment at the Leadgate premises. Physical and electronic access to the equipment and footage is restricted to authorised individuals.

14. CCTV transparency and review

Clear signage is displayed before people enter the camera’s field of view. The signage identifies:

• that CCTV recording is taking place

• the purposes of the recording

• Derwentside Scout District as the Data Controller

• how to obtain further privacy information or contact us

We periodically review whether CCTV remains necessary and proportionate, whether the camera’s field of view remains appropriate, and whether the security, access and retention arrangements remain effective.

15. Cookies and website use

Our website uses only minimal cookies needed for website functionality, security and basic operational performance.

We do not use advertising, profiling or behavioural-tracking cookies. If analytics or additional cookies are introduced, this notice and any required cookie controls will be updated.

16. Changes to this notice

We may update this Privacy Notice to reflect changes in law, Scout policy, safeguarding guidance, operational practice or digital and security systems.

The latest version will be published on the District website.