Data Protection Policy

The mark of the conservation professional

Summary

The IHBC cares about the data we seek from you, and gathers, manages and protects data provided by you in line with official guidance on statutory duties and our charitable objectives to help conservation and it's practice.

For further explanation of why we seek the information we do, and more details of related to our policies, see our data protection guidance and our IHBC Quick Guidance below.

In line with these principles and our duty of data care, we:

Seek from you only the information we consider we need to effectively carry out our support for you as an IHBC member, including your professional interest in our work
Encourage you to complete as many optional data fields below as you feel comfortable with, to help us understand and advocate on behalf of the profession, the sector and, by extension, the professional and career interests of our members
Retain personal data in line with our LIA (link) to support that understanding and advocacy, in particular data relevant to professional practice issues, though you may have your personal data deleted on request
Delete sensitive data - such as financial details to enable fee payments - immediately on termination of membership
Offer 'opt out' options for key areas that, as a member, ordinarily give IHBC volunteers access to personal contact details AND that we consider would not seriously undermine the institute's capacity to support your career, such as excluding details from our annual Yearbook and declining to join a Branch. Where opt outs are not offered, these are areas we consider essential to supporting our charitable objects and corporate and service duties.

NB: Email is our primary way of communicating with you, including for important information regarding the IHBC, your membership, events and news via national office, volunteers and Branches.

If wider access to your personal email contact details is a concern, to maintain the full value of IHBC services, we recommend that you set up a dedicated 'personal' email account exclusively for IHBC related activities, which can be managed and, as needed, closed at your discretion.

You also have the option to exclude select personal details from wider IHBC communications, including by choosing 'No Branch' for your Branch option, and by excluding your name from the IHBC Yearbook directory by choosing the 'No Yearbook entry' option.

IHBC QuickGuide: IHBC’s data management and protection

In accordance with guidance on new data protection regulations IHBC Trustees and Directors have agreed the processes and principles summarised on this page

Following a 'Legitimate Interest Assessment’, the IHBC has specified and agreed its legitimate interest in requesting and holding data where it accords with our charitable objects, including to:
- Support built and historic environment conservation practice, as also informed by:
- Improve understanding of the nature, evolution and progress of that practice as a young, distinctive and environmentally aware activity that, through the IHBC, can develop its unique standing as an ‘inter-disciplinary’ discipline founded on national and international conservation standards and models
  http://ihbconline.co.uk/toolbox/recognised.html
The IHBC will not release the personal data of an individual without either their knowledge and agreement – such as through not availing of data ‘opt outs’ in select areas of legitimate interest for the IHBC, for example circulating contacts in the Yearbook and to Branch volunteers – or receiving permission from the individual concerned as appropriate

The IHBC will delete personal data on request, while also encouraging minimum impact on the IHBC’s legitimate interests

The IHBC deletes sensitive data – such as financial details used for membership renewal – at the point of membership termination or on request

Both at the time of joining, and at annual updates on data held, members the IHBC are offered options to update their preferences on the IHBC’s data holding and use

For more details see the link below.

For more background and details on GDPR and the IHBC click here

Privacy Notice

The IHBC, including constituent parts and interests such as our Branches and our trading arm, IHBC Enterprises, holds and manages personal and professional information in accordance with our ‘Legitimate Interests Assessment’ , which informs our statutory responsibilities as a ‘data controller’ and ‘data processor’.

The Legitimate Interests Assessment highlights the special relevance to our core duty – as a charity that supports the public interest in built and historic environment conservation practice – of our procedures for the gathering, management and protection of personal data.

Our support for specialist conservation practice ranges from membership services that include those offered through our voluntary Branches, as well as sector research and advocacy. These benefit from being informed, proportionately, by data relevant to evolving professional practices.

To help the IHBC in this work, the institute encourages members to:

Include relevant and appropriate details on registration
Keep those details current, including in annual update opportunities, and
Facilitate their use by the IHBC for the longer term in accordance with our Legitimate Interests Assessment

The ‘Right to be informed’ statement offers additional detail in line with current guidance.

IHBC: Our ‘Legitimate Interests Assessment’ (LIA) in processing information under General Data Protection Regulation (GDPR)
Based on the paper agreed by IHBC Trustees and Directors: 12 April 2018

Background
Under the General Data Protection Regulation (GDPR), the IHBC’s priority is both to maintain existing standards and duties as a data controller, as well as to respond to new duties, including as a ‘data processor’. This requires that, from 25 May 2018, the IHBC ‘must have a valid lawful basis in order to process personal data.’ Link

GDPR guidance notes that ‘legitimate interests, one of the ‘six available lawful bases for processing’, can be your own interests or the interests of third parties. They can include commercial interests, individual interests or broader societal benefits.’

There is wide range of guidance relating to these matters, both in place and under development, with essential background at:

Terms for the IHBC’s ‘Legitimate Interests Assessment’
Article 5 of the GDPR requires that personal data shall be… ‘processed lawfully, fairly and in a transparent manner in relation to individuals’ and ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes’. (emphasis by IHBC)

The Legitimate Interests Assessment (LIA) below responds directly to the above official guidance on GDPR and data processing, which also notes that:

‘There are six available lawful bases for processing. No single basis is ’better’ or more important than the others – which basis is most appropriate to use will depend on your purpose and relationship with the individual.

‘Most lawful bases require that processing is ‘necessary’. If you can reasonably achieve the same purpose without the processing, you won’t have a lawful basis.’

‘There are three elements to the legitimate interests basis. It helps to think of this as a three-part test. You need to:

identify a legitimate interest;
show that the processing is necessary to achieve it; and
balance it against the individual’s interests, rights and freedoms. [emphasis by IHBC]'

The IHBC recognises that the LIA is not ‘stand-alone’ data protection tool. It is supported by the ‘Privacy Notice’ that offers users and prospective users an accessible, explanation of the management processes adopted in accordance with our Legitimate Interests Assessment, as well as a statutory ‘Right to be Informed’ statement of personal rights to control the data held.

IHBC: Legitimate Interests Assessment (LIA)
The IHBC, including constituent parts and interests such as our Branches and our trading arm, IHBC Enterprises – though its Business Plan as adopted by IHBC Trustees on 08 September 2016 – addresses the above ‘three principles’ of ‘legitimate interests’ in processing data held by the institute as follows:

There is a ‘Legitimate Interest’ in the data:
- Built and historic environment conservation is a young, distinctive and environmentally aware activity that , through the IHBC, can develop its unique standing as an ‘inter-disciplinary’ discipline founded on national and international conservation standards and models. [See our website for details, including ]
Processing is necessary:
- The institute represents a rapidly evolving discipline with a unique profile, including diverse practitioner profile and standing, so service delivery and sector support can require options to access individual data subject to appropriate personal options and controls
Balance against the individual’s interests, rights and freedoms

FOR IHBC MEMBERS:
- Those signed up to IHBC membership, or membership of its predecessor, the Association of Conservation officers (ACO), have lodged support in principle for the discipline, including, where applicable, to work to our Code of Conduct which requires that they ‘take account of the legitimate concerns of those others involved in the conservation and preservation of the built heritage’.
FOR NON-MEMBERS OF THE IHBC
- Non-members may:
  - OPT IN on some sector-wide or ‘taster’ services, such as NewsBlogs and trial and partner benefits
  - • Be contacted, offered and/or elect to sign up to receive select services and benefits as part of our legitimate conservation-related educational, outreach and promotional operations. Typically, such non-members are approached via public contact details for corporate bodies or their heritage sector equivalents.
- Individual non-members may be contacted regarding prospective volunteering and related activities, typically through national and local networks.
- Personal contact data on non-members is deleted across all national office systems on request.

LIA: Data Protection Impact Assessment (DPIA)
Official UK guidance states that:

‘You must carry out a DPIA when:

using new technologies; and
the processing is likely to result in a high risk to the rights and freedoms of individuals.

Processing that is likely to result in a high risk includes (but is not limited to):

systematic and extensive processing activities, including profiling and where decisions that have legal effects – or similarly significant effects – on individuals.
large scale processing of special categories of data or personal data relation to criminal convictions or offences.’

IHBC data processing does not ‘result in a high risk to the rights and freedoms of individuals’. As such, The LIA does not identify risks that suggest a need to do a Data Protection Impact assessment (DPIA).

LIA ‘Right to be informed’ statement’ This is a statutory resource linked from the Privacy Notice
Based on the official UK guidance checklist LINK

ICO Guidance on what information must be supplied by IHBC	Data obtained directly from data subject
Identity and contact details of the controller (and where applicable, the controller’s representative) and the data protection officer (DPO)	Jo Evans (IHBC Secretary) (ex officio controller); Lydia Porter (representative). The IHBC does not carry out functions on a large enough scale to require a DPO. Contact for all is via admin@ihbc.org.uk.
Purpose of the processing and the lawful basis for the processing	Membership support and sector advocacy and understanding, as detailed in the LIA
The legitimate interests of the controller or third party, where applicable	Membership support and sector advocacy and understanding, as detailed in the LIA
Categories of personal data	General data could include - name, address, personal contact details, photo etc. Sensitive data could include - date of birth, bank details, employment and personal information Special data could include - racial or ethnic origin, disabilities, organisational membership, physical health etc.
Any recipient or categories of recipients of the personal data	Relevant Branches (contact details only) IHBC Enterprises Cathedral Communications, which delivers free publications relevant to the sector (contact details only)
Details of transfers to third country and safeguards	Membership database hosting takes place in the UK.
Retention period or criteria used to determine the retention period	Retention periods for core membership services and management data are for the duration of membership, with duration of relevant professional data determined for professional purposes through the LIA, with opt outs available.
The existence of each of data subject’s rights	Full information access and opt-outs offered on request, including opt outs on historic information offered on request in line with the privacy statement and LIA.
The right to withdraw consent at any time, where relevant	Withdrawal of consent is available on request at any time with opt outs on historic information offered on request in line with the privacy statement and LIA.
The right to lodge a complaint with a supervisory authority	Complainants have the right to lodge a complaint with a supervisory authority, and/or to submit a complaint to the IHBC Secretary (ihbcsecretary@ihbc.org.uk)
The source the personal data originates from and whether it came from publicly accessible sources	Data originates from service users.
Whether the provision of personal data is part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data	The provision of personal data is not necessarily part of a statutory or formal contractual requirement though subscribing to membership and related events does raise an obligation for the IHBC to provide services, including advocacy, in support of conservation, while failing to provide some core personal data may limit or preclude some support, benefits, services.
The existence of automated decision making, including profiling and information about how decisions are made, the significance and the consequences	The is no automated decision making, including profiling and information about how decisions are made, the significance and the consequences.
When should information be provided?	This information is provided on request within timescales considered reasonable for a small charity.

Legitimate Interests Assessment:
ICO ‘Checklist’ cross check for General Data Protection Regulations
Based on the official UK guidance checklist

We have checked that ‘legitimate interests’ is the most appropriate basis.
Addressed in the LIA

We understand our responsibility to protect the individual’s interests.
Addressed in the LIA

We have conducted a legitimate interests assessment (LIA) and kept a record of it, to ensure that we can justify our decision.
LIA agreed by IHBC trustees, and applied to IHBC trading arm, IHBC Enterprises

We have identified the relevant legitimate interests
Addressed in the LIA

We have checked that the processing is necessary and there is no less intrusive way to achieve the same result.
Addressed in the LIA

We have done a balancing test, and are confident that the individual’s interests do not override those legitimate interests.
Addressed in the LIA

We only use individuals’ data in ways they would reasonably expect, unless we have a very good reason.
Addressed in the LIA

We are not using people’s data in ways they would find intrusive or which could cause them harm, unless we have a very good reason.
Addressed in the LIA

If we process children’s data, we take extra care to make sure we protect their interests.
Not relevant

We have considered safeguards to reduce the impact where possible.
Addressed in the LIA

We have considered whether we can offer an opt out.
Addressed in the LIA

If our LIA identifies a significant privacy impact, we have considered whether we also need to conduct a DPIA.
No significant privacy impact, as addressed in the LIA

We keep our LIA under review, and repeat it if circumstances change.
Addressed in the LIA: Reviewed annually initially

We include information about our legitimate interests in our privacy notice.
Addressed in the LIA

© Copyright IHBC
Registered and Business Office: Jubilee House, High Street, Tisbury, Wiltshire SP3 6HA
Registered as a Charity No1061593. Company Limited by Guarantee. Registered in England No 3333780. Registered as a Charity in Scotland: No. SC041945.
Contact us