Version of 10 May 2018
GDPR compliance: lawful, fair and transparent
Who we are
For the purposes of this Policy, ‘we’ and ‘us’ means the Facilitator and Manager of Survivors With Biros, also the ‘Controller’. Please check this page for updates of the Policy as time passes, or contact us at email@example.com for an up-to-date copy.
Collecting and processing your personal data
We may collect or obtain personal data about you: directly from you (e.g. where you contact us); in the course of our relationship with you (e.g. if you submit writing for publication); when you make your personal data public (e.g. if you make a post about us on social media); when you register to use any of our services such as Survivors With Biros writing workshops or newsletter. We may also receive personal data about you from third parties (e.g. law enforcement authorities), though this should happen rarely.
Your data processed and use of your data
We may process: your personal details (e.g., your name, social media name); demographic data (e.g., your age, location); your contact details (e.g., your address, email address, telephone number, WhatsApp or Facebook messenger contact); records of your consent/membership of Survivors With Biros; details of your participation in our workshops or of titles of your writing submitted for publication; payment details where applicable for our services and any views or opinions or other personal information you provide to us which may include sensitive information (for which, see below).
We may use personal data to provide services to you: providing information on writing workshops, the workshops themselves, and other writing facilitation and publication services including our site and newsletter; for our website, Facebook group and newsletter: operating and managing our website, Facebook group and newsletter and notifying you of changes to any of these; communications with you of information in which you may be interested once you have provided opt-in consent; IT operations and financial management; obtaining feedback from you on our services; investigations, legal proceedings and legal defence where required or helpful by law; improving our services.
Processing is adequate, relevant and limited to what is necessary for these purposes.
Lawful bases for processing
The lawful basis for our processing shall be:
Consent: we may Process your Personal Data where we have obtained your prior, express consent to the Processing by means of opt-in consent; and/or
Legitimate interests: we may Process your Personal Data where we have a legitimate interest in carrying out the processing for the purpose of managing, operating or promoting Survivors With Biros, and that legitimate interest is not overridden by your interests, fundamental rights, or freedoms; and/or
Processing is necessary for the performance of a task carried out in the public interest, namely enabling self-expression by survivors and enabling survivors voices to be heard.
Your sensitive data
Given that we facilitate services for survivors of sexual abuse and rape, the data processed may concern health or data concerning your sex life or sexual orientation. This is classified under the GDPR, Article 9, as sensitive data. Such processing can take place on the following grounds:
With reference to GDPR, Article 9(d):
where processing is carried out in the course of our legitimate activities - providing writing workshops to survivors of sexual abuse and rape who have opted-in to these services which enable them to voice their personal stories,
with appropriate safeguards by us including anonymisation (no author names) where writing is published, password-protection of computers and files and backup facilities where such data is collected, processed and stored,
as a group with the political aim of enabling self-expression by survivors and enabling survivors voices to be heard,
on condition that the processing relates solely to our members or former members or to persons who have regular contact with it by means of opt-in consent.
With reference to GDPR, Article 9(e),
where processing relates to personal data which is manifestly made public by the data subject: this applies e.g. where you consent to our publication of your writing, or make public comments disclosing sensitive data in connection with our services. Note that writing for publication is published in anonymized format (no author names).
Processing of sensitive data may also be carried out for historical research purposes to improve provision of our services, in this case appropriate safeguards are used such as password-protection of computers and files and backup facilities.
Storing your personal data/appropriate measures and safeguards
Personal data may then be stored for historical research and statistical purposes, for Survivors With Biros to evaluate and assess levels of participation by individuals of a particular age, location, health status, etc. or to identify groups of participants of Survivors With Biros by personal features disclosed in order to be able to offer Survivors With Biros services to similar or different groups.
Accuracy or your data and your rights
Every effort will be made by Survivors With Biros to ensure the accuracy of the data provided and to make sure it is kept up to date. Therefore, Survivors With Biros will take care when transcribing data for filing systems and will update or amend your personal data as quickly as possible once notified by you of a necessary update or amendment.
You may have a number of rights in relation to data processing:
the right not to provide your Personal Data to us or to object, on legitimate grounds, to processing of your personal data,
the right to request access to, or copies of, your Personal Data, together with information regarding the nature, Processing and disclosure of the Personal Data;
the right to request rectification of any inaccuracies in your Personal Data;
the right to request, on legitimate grounds: deletion of your Personal Data; or restriction of Processing of your Personal Data;
the right to withdraw your consent to data processing (this does not affect processing until consent is withdrawn); and
the right to lodge complaints with a Data Protection Authority.
To exercise these rights, please contact us at firstname.lastname@example.org and we may require proof of your identity before we can give effect to these rights.
The timescales with which we will comply in relation to the above are set out in the GDPR.
Key terms in the text above have the definition given to them in Article 4 of the GDPR, accessible here.