Privacy Policy

GENERAL INFORMATION

The Honourable Artillery Company or Armoury House, City Road, London EC1Y 2BQ (HAC) is committed to doing the right thing in how we collect, use and protect your personal data. The HAC is the ‘data controller’, referred to in this policy as ‘the HAC’ ‘we’ or ‘us’, This Privacy Policy:

  • Sets out what personal data we may collect from you
  • Explains why and how we use your personal data
  • Explains who your personal data might be shared with
  • Explains how long we might keep your data for
  • Explains how we keep your data safe
  • Explains your rights and choices in relation to your personal data

Contents

  1. When does this Policy apply to me?
  2. What data do we process?
  3. Why do we process your data?
  4. Your Rights
  5. Who do we share your data with?
  6. How long do we keep your data for?
  7. How do we keep your data secure?
  8. CCTV, photographs and security searches
  9. Website and Social Media
  10. Our Data Protection Officer
  11. Changes to this Policy

Definitions

‘Personal Data’: information capable of and used to identify an individual;
‘Data Processing’: any activity carried out using personal data (including storage);
‘Data Subject’: the individual to whom the personal data pertains;
‘Data Controller’: the organisation (or individual) who collects and processes your personal data;
‘Data Processor’: a third party individual or organisation that may carry out processing activities on behalf of the Data Controller.

1. When Does This Policy Apply To Me?

We may collect and process your data in a number of situations. Whenever we process your personal data, we will do so in accordance with this policy. This policy will apply to you when:

  • You apply to become and Member of the HAC or make an enquiry about Membership;
  • You become a Member of the HAC (and for the duration of your Membership);
  • You become a member of the Regiment (but not a Member of the HAC);
  • You become a member of the Special Constabulary or another of the HAC’s affiliated Units, Clubs or Societies (but not a Member of the HAC);
  • You are a tenant of the HAC in respect of the property owned by the organisation;
  • You use our Website or Social Media sites;
  • You visit Armoury House and Grounds and use our facilities during an event, conference or training, either as a Member, a Guest or a Corporate Guest or Client;
  • You visit Armoury House and Grounds for work (either for the HAC or for a third party) or to access the VirginOne gym on Bunhill Row;
  • You stay at Armoury House in our Member’s Guest Rooms;
  • You purchase HAC merchandise either in person, over the phone or online;

2. What Data Do We Process?

The HAC processes information relevant to the purposes described below. This may include:

When you are a Member we may process your:

  • personal identifying details, including your name, postal address, email addresses, phone number, date of birth and title;
  • marital status and family details;
  • lifestyle and social circumstances
  • information relating to your membership of any of the HAC Squadrons, Clubs or Societies;
  • employment and education details;
  • payment information;
  • military service details;
  • dietary requirements in relation to dining or taking refreshment at Armoury House;
  • CCTV footage captured of you when you visit Armoury House and Grounds.

Some or all of this may be Special Category Data, subject to additional regulation, which we process for the purpose of administering your membership.

When you are not a Member, but contact us or visit Armoury House and Grounds we may process:

  • your personal identifying information, including your name, postal address, email addresses, phone number, date of birth and title;
  • information relating to your employment including the name of your employer, your job title and your work contact details;
  • information relating to your membership of any club, society or organisation affiliated to the HAC or through whom your visit has been arranged;
  • information about your attendance at particular events at Armoury House or Grounds;
  • information relating to any dietary requirements you may have where you dine or take refreshments on the premises;
  • CCTV footage captured of you when you visit Armoury House and Grounds.

When you are a tenant of the HAC in any of the properties owned and/or managed by the HAC we may process:

  • your personal identifying information, including your name, postal address, email addresses, phone number, date of birth and title;
  • information relating to your employment including the name of your employer, your job title and your work contact details;
  • information relating to the payment of rent and other charges in connection with the use of the property;
  • information relating to tenancy or agency references and credit/background checks.

When you use our Website (www.hac.org.uk) or our social media sites we may process:

  • Information about your online browsing behaviour on our Website;
  • Information about any devices you may have used to access our Website or Social Media sites, including the make, model, operating systems, IP address, browser type and mobile device identifiers.

3. Why Do We Process It?

This section explains in detail how and why we use personal data. We use personal data to:

Administer your Membership
When you apply to become a Member of the HAC or make an enquiry to become a Member, we will need to process certain of your personal data in order to be able to provide you with information about the Membership and your eligibility to join.

When you are admitted as a Member, we will need to process your personal data in order to be able to:

  • Administer your Membership and process subscriptions;
  • To promote and enable communication with and between our Members;
  • To fulfil our Members’ role as advocates for Defence;
  • To fundraise for the Charity and its charitable causes and to encourage donations and legacies;
  • For the administration of Membership elections;
  • To communicate Company updates regarding the governance and administration of the HAC;
  • To communicate Company information regarding Membership events;
  • To administer gym membership;
  • For the administration of HAC Sports Clubs, Societies, Squadrons and other activities;
  • to distribute publications and administer our website (including the Membership secure pages);
  • to administer activities and the use of the property by members of the Regiment who are not members of the HAC;
  • to sell merchandise;
  • to assist the Regiment with the administration of their records for their purposes where appropriate for individual members;
  • to maintain our own accounts and records;
  • to archive permanently for purposes of the Company’s historical record and corporate memory and to answer historical enquiries from members of the public;
  • to support and manage our staff and volunteers;
  • to maintain security at Armoury House and grounds and at other such locations as may be used by the HAC in its official or ceremonial activities.

Administer your Membership of HAC Clubs and Societies
When you are a member of one of the HAC Sports Clubs, other clubs or Societies, it may be the case that you are not also a Member of the HAC. In that case we may need to process your personal data for the following reasons:

  • To administer your membership of the Club or Society you have joined;
  • To process subscriptions or other payments;
  • To communicate information about the activities of the Club or Society, to distribute publications and administer the relevant sections of the HAC website in connection with the Club or Society you have joined;
  • For the administration of the appointments or elections within the Club or Society you have joined;
  • To maintain our own accounts and records;
  • To support and manage our staff and volunteers;
  • To maintain security at Armoury House and grounds and at other such locations as may be used by the HAC in connection with the activities of the Club or Society that you have joined.

When you are a tenant of the HAC
When you are a tenant of the HAC we may need to process your personal data in order to be able to:

  • Enter into a tenancy agreement or licence to occupy with you (including taking up references and financial/credit checks);
  • Administer and maintain any such tenancy or licence you may have with us;
  • Fulfil our obligations in respect of Health, Safety, security and maintenance of any property that you may occupy under any such tenancy or licence you may have with us;
  • Process rental payments and/or other charges that may be due under the tenancy or licence you may have with us;
  • Communicate with you in relation to your tenancy or licence;
  • To maintain security on HAC property;
  • To recover any sums due to us or enforce any rights we may have under the tenancy or licence.
    When you visit Armoury House and Grounds
    When you are a Guest or Visitor at Armoury House and Grounds (whether attending at an event, conference or for work), we may need to process your personal data in order to be able to:
  • Grant you access to the site;
  • Meet our obligations to safeguard your health and safety whilst on site;
  • Enable you to access events, conferences, fairs or work events that you may have been invited to attend;
  • Maintain security at Armoury House and Grounds.

When you contact us or use our Website
When you contact us via email, telephone, post or in person, or when you use our HAC Website (www.hac.org.uk) we may need to process your personal data in order to be able to:

  • Communicate with you and deal with your enquiry;
  • Grant you access to our facilities and services;
  • Provide you with information about events, products or services that you may have indicated you are interested in;
  • Administer and maintain our Website and improve functionality and accessibility;
  • Detect potential online security threats that may be posed to our systems and those who access them;
  • To gather information about activity on our Website for statistical purposes;
  • To prevent inappropriate behaviour on and to protect our staff and other users of our Social Media applications and sites.

WE DO NOT USE AUTOMATED PROFILING OR DECISION MAKING IN RESPECT OF ANY PERSONAL DATA THAT WE PROCESS

4. Your Rights

Under Data Protection Legislation (including the General Data Protection Regulation 2018 and the Data Protection Act 2018), as a Data Subject you have a number of rights. We have listed an overview of your rights below:

Access to your personal data. You have the right to request a copy of the information that we hold about you. You are entitled to be given a description of what information we hold about you; what we use it for and who we might pass it on to. We are required to answer your request within one month of its receipt at the latest, and occasionally may then need to ask for an extension. We may need to carry out additional identity checks before we release your personal data to you. In most circumstances we will not charge a fee when you wish to access your information. If you would like a copy of the personal data we hold about you, please write to the Data Protection Officer, contact details as below.

Accuracy. We want to make sure that the personal information we process about you is accurate and up to date. You may ask us to correct or remove information that you think is inaccurate and in most circumstances we will correct inaccuracies within one month of you informing us. To help us in this, we would ask you please to keep us informed when your details change by writing to us at the address or email address given below.

Deleting personal data, restricting processing activity or objecting to the processing activity. You may ask us to delete the personal data that we hold about you in part or in full. This is sometimes called an ‘erasure request’ or your ‘right to be forgotten’. There are some circumstances in which we cannot delete all personal data (for example where we have a legal obligation to retain it or because we may need it to defend legal claims), but we will always consider such requests on a case by case basis and where we can comply, in most cases complete the deletion within one month of your request.

In addition, you may ask us to restrict or stop some types of processing activities with some or all of your personal data, or you may object to a particular processing activity. For example, if you are a Member you may wish use to stop sending you membership newsletters. You can do this by changing your communication preferences associated with your membership or by writing to us to outline what types of processing you wish us to restrict. Again, please use the address or email address below.

Ask us to transfer or ‘port’ a copy of your data.
This is your right to obtain and reuse your personal data that you have provided to us for your own purposes across different services. There are rules regarding data portability that may restrict us from complying with any request that we receive under this right. If you have any questions about how we can help you achieve data portability, please contact our Data Protection Office using the address or email address below.

Complain to the Information Commissioner
We’d like an opportunity to resolve any complaints that you may have about data processing by the HAC, which you may do by contacting our Data Protection Officer using the address or email address below. However, you also have the right to complain to the UK Data Protection Regulator (currently the Information Commissioner or ‘ICO’) about how we have used your personal data. The ICO website is the best way of finding out how to do this: www.ioc.org.uk

5. Sharing Your Data

Who has access to it?
We sometimes need to share the personal information we process with the individual themselves and also with other organisations or individuals within the associated Clubs, Squadrons or Societies within the HAC. Where this is necessary we are required to comply with all aspects of the General Data Protection Regulations (GDPR). What follows is a description of the types of people and organisations we may need to share some of the personal information we process.

Sharing data within the HAC.

When you are a Member of the HAC, a member of the Regiment, a member of the Special Constabulary or a member of one of our associated Squadrons, Clubs or Societies, it may be necessary for us to share your personal data with one or more of these groups in order to administer your membership, promote communication and in connection with the other processing purposes listed above. In some cases we may share data with these organisations or individuals who are acting as our ‘Data Processors’: carrying out processing activities on our behalf. In this case we only provide the personal data to our Data Processors necessary to carry out this function.

Examples of our associated Data Processors in this context are the Veteran Secretaries.
Sometimes we may share your data with these organisations or individuals who may be acting as ‘Data Controllers’ in their own right. In the latter case, you may have provided your personal data to us or to the other Data Controller, and any data that is shared between us is limited to that which is necessary to carry out the respective functions of the associated Data Controllers.

Examples of our associated or ‘joint controllers’ in this context are the Pikemen and Musketeers, Light Cavalry, Sports Clubs and others.

Sharing data with organisations or individuals outside the HAC.
As Member or a Guest, when using our services, using our website, contacting us or where you are visiting Armoury House and Grounds or using our Website or services, it may be necessary for us to share your personal data with our service providers (who are our data processors in this context) in order to deliver our services to you (such as the putting on and delivery of particular events), or in order to maintain security at Armoury House and Grounds. We will only provide the personal data to these service providers that enable them to provide their services.

Examples of our service providers/data controllers in this context are our onsite events and catering providers (Searcys), our onsite security providers and others.

Transferring information overseas

We may need to transfer personal data outside the United Kingdom for a number of reasons. This may be because the data processor or service providers that we use are based overseas or use data storage facilities (such as digital servers) overseas, or where you are a Member of the HAC and may be involved with or active in association with the Boston Association, or are involved with the visit to Vittorio Veneto, Sports Club tours and so on.

Where we share your data with our data processors or with other organisations that may involve a transfer of your personal data outside the United Kingdom or outside the European Economic Area, we will restrict the information that we transfer only to that which is necessary to the purpose, we will check the adequacy of the legislation and security of the territory which is the destination in accordance with current UK law, we will put appropriate safeguards in place where necessary or we may decide not to transfer. We will usually inform you separately where such a transfer is likely to happen or is necessary for the service provision that you have requested from us.

6. How Long Do We Keep Your Data For?

How long we keep or ‘retain’ your data for will depend on the reason for which we have collected and processed your data for. We have listed retention periods according the processing activity below. This is not an exhaustive list and if you have questions about data retention you should contact our Data Protection Officer (see below).

Processing Activity  Retention Period
Processing your application for Membership (Members and non-members)  For the duration of the application process and for one year thereafter if your application is not successful
Administering your Membership (Members)  For the duration of your Membership and for three years after your Membership ends and in respect of Membership payments, for six years after the end of your Membership
Maintaining our Membership Records  We will retain certain information about your Membership of the HAC permanently for our HAC archives
Payments other than subscriptions (Members and non-members)  For six years after the payment is made
Recovering debts  For six years after the debt (and associated costs) is settled in full
Processing gym membership (Members)  For the duration of your gym membership and for 3 years after the end of your gym membership
Processing your membership of a Sports Club or other Association/Society associated with the HAC (Members and non-members)  For the duration of your Membership of the HAC (Members), or for the duration of your membership of the Club/Society etc (non-members) and for 3 years after the end of your membership of the Club/Society etc.
Administration of an event or other occasion of your visit to Armoury House and Grounds where you are a guest (non-members)  For 12 months after your attendance onsite
Administration of a contract with you for the provision of an event or other occasion that you may have entered into with the HAC or our service providers  For the duration of the contract and for six years after the completion of the contract
CCTV recordings  We will keep recorded CCTV active and still images for six weeks after the images are captured, unless we are required by law or need to do so for the defence or pursuance of legal claims or to address security concerns
Photographs (security and access)  We will keep digital copies of photographs taken for the duration of your visit (non-members), for the duration of your Membership (Members and members of associated Clubs/Societies), or for a longer period where required by law or where we need to do so for the defence of legal claims or to address security concerns

  

7. How do we keep your data secure?

We use computer safeguards such as firewalls and data encryption, and we enforce physical access controls to our buildings and files to keep your personal data safe. We only authorise access to employees who need it to carry out their job responsibilities and issue guidance and rules to our Data Processors and other Controllers with whom we share your data in order to govern their processing of your data in compliance with our security requirements.

We enforce physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of personal data. We may occasionally ask for proof of identity before we share your personal data with you and we may refuse to share your data with third parties who approach us on your behalf until we have satisfied ourselves that there is a lawful purpose for doing so (including having your consent to do so).

Please note that whilst we take appropriate technical and organisational measures to safeguard your personal data, please note that we cannot guarantee the security of any personal data that you transfer over the internet to us using your own equipment and software.

8. CCTV and Photographs

CCTV
As a secure site, we operate CCTV cameras across Armoury House and the Grounds. We do this in order to monitor the safety and security of our site, detect crime and anti-social behaviour. This means that when you visit Armoury House and Grounds we may capture live or still images of you. Our employees and service providers monitor live images as they are captured on screens within secure locations in Armoury House and the gatehouse, and they may review them after recording. We may share these images with the police or other law enforcement agencies where we are required to do so or to protect you and other visitors to our site. We will retain these images in accordance with our retention policy (see above).

Photographic Identification
We may require you to provide us with photographic identification and may need to issue you with a security pass when you visit Armoury House and Grounds. To do this we may need to take your photograph, which will be stored along with your other personal data for the duration of your visit and then in accordance with our retention policy (see above). We may ask your consent to take your photograph in this way and you may refuse your consent, but this may affect our ability to grant you access to Armoury House and Grounds.

Security searches
As a secure site we may carry out searches of persons, property and belongings in order to monitor and maintain security across the site. We may ask you permission before we carry out a search, but refusing to allow us to do so will affect our ability to grant you access to the site or may result in your being asked to leave the site with immediate effect. We do not routinely record information regarding searches carried out, but we may record information if the search results in evidence that may be required for law enforcement or for the maintenance of security on site.

9. Website and Social Media

When you visit our Website (www.hac.org.uk) , either to browse or to access the secure Membership areas, you do so in accordance with our Website Terms and Conditions and we will process any personal data that we collect from your use of our Website according to this Policy. This is limited to the processing that we carry out once we have received your personal data, and not during or as a result of your transmission of that data from your own devices or software.

Our website contains links to other websites. This Policy only applies to our own Website, so when you link to other websites you should read their own privacy policies. We cannot guarantee the security of your personal data when you navigate away from our website to those of third parties.

When you interact with us via our Social Media applications and sites, you may be subject to the rules of usage operated by the service or application provider. If you transmit or provide personal data via Social Media applications or sites, we cannot guarantee the security of that data nor the compliance with Data Protection legislation by the service or application providers. You should check the privacy policy of each provider according to the software or social media that you choose to utilise. Please remember that anything that you ‘post’ on social media is essentially publicly available and we cannot control the access to those platforms that you may choose to use. How we process the data we receive via social media will be governed to an extent by this Policy, but only insofar as we process it for our own purposes. If third parties access your personal data via any of our social media then we are not responsible in law nor otherwise for their processing of your personal data.

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity. For further information visit www.aboutcookies.org You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However in a few cases some of our website features may not function as a result.

10. Our Data Protection Officer

We have appointed a Data Protection Officer to oversee our compliance with current UK Data Protection legislation and to be our main point of contact in relation to queries from individuals and with the Information Commissioner’s Office (ICO).

Our Data Protection Officer can be contacted by writing to ‘The Data Protection Officer’, Armoury House, City Road, London EC1Y 2BQ or by emailing: privacy@hac.org.uk

11. Changes to this Policy

We keep our Privacy Policy under regular review and we will place any updates on the Company website and notify members through the Newsletter and Regimental Fire. This Privacy Policy was last updated on 16th September 2019.