Donate
Book hallDonate

HomePoliciesPrivacy policy

Privacy policy

How we collect, use, store and protect personal data, and your rights.

Version 1.0. Approved by the trustees on 10 December 2025. Next review: December 2026.

Applies to: Trustees, volunteers, contractors, hirers and members of the public.

Fivehead Village Hall & Park is the working name of Fivehead Village Hall and Playing Field CIO, registered charity 1204704.

Purpose

This privacy policy explains how Fivehead Village Hall & Playing Field CIO ("the CIO") collects, processes, stores and protects personal data.

The CIO is committed to handling all personal data lawfully, fairly and transparently, in line with UK GDPR and the Data Protection Act 2018.

This policy applies to:

  • Hirers
  • Trustees
  • Volunteers
  • Contractors
  • Anyone contacting or using the CIO's services or premises

Who we are

Data controller: Fivehead Village Hall & Playing Field CIO, Fivehead Village Hall, Stowey Road, Fivehead, Taunton, Somerset TA3 6PP.

Data protection contact: [email protected], or by post to the address above.

What information we collect

We may collect and process:

Hirers and users

  • Name
  • Email
  • Phone number
  • Postal address
  • Booking details (dates, event type, facilities used)
  • Payment-related information (not card details)
  • CCTV footage

Trustees, volunteers and contractors

  • Contact details
  • Role information
  • Training records
  • Declarations (conflicts, eligibility, safeguarding)
  • Accident and incident reports

General enquiries

  • Contact information
  • Email correspondence
  • Website or form submissions

How we collect data

Personal data may be collected through:

  • The Hallmaster booking system (manual or online)
  • Email and telephone enquiries
  • The forms on our website
  • Online donations made through Zeffy, our donation platform
  • Microsoft Forms and Lists
  • Paper or digital hiring agreements
  • CCTV systems
  • Volunteer and trustee administrative documents
  • Incident reporting forms
  • Mailing list sign-ups

Our website

When you use fiveheadhall.org:

  • Our forms send your message to the trustees by email. A copy is also kept on our web server for as long as necessary, then removed. We use what you send only to reply to you and to deal with your enquiry or booking.
  • We use Google Analytics and Microsoft Clarity to understand how people use the website, but only if you agree. Nothing optional runs until you choose, and you can change your mind at any time with Cookie settings at the bottom of every page.
  • Google Maps, our Hallmaster booking calendar and the Zeffy donation form on the Play On page only load if you agree, because they come from other websites that can set their own cookies.
  • When you give online, Zeffy processes your donation and your payment. Zeffy shares your name, email address and gift with us so we can thank you and keep proper records.

Our cookies page lists every cookie and service the website uses.

Lawful basis for processing

We process personal data under the following lawful bases:

Contract

To manage bookings, agreements, invoices, and hall and field use.

Legal obligation

For:

  • Financial record-keeping
  • Reporting accidents and incidents
  • Safeguarding
  • Insurance compliance

Legitimate interests

To:

  • Ensure site security (including CCTV)
  • Manage bookings efficiently
  • Protect the CIO's property
  • Improve services

Consent

For email updates and mailing lists, and for optional cookies on our website. Consent may be withdrawn at any time.

How we use personal data

We use personal data to:

  • Process bookings and enquiries
  • Communicate with hirers, trustees and volunteers
  • Maintain accurate financial and operational records
  • Enable safe operation of the hall, field and play area
  • Send updates where consent has been given
  • Investigate incidents and fulfil legal requirements

We do not sell personal data.

CCTV

CCTV operates for security and crime prevention. Coverage includes:

  • Hall entrances and exterior
  • Car park and approach areas
  • Our CCTV system captures images of vehicles, including number plates
  • Playing field approach (where applicable)

Footage is kept for up to 30 days, unless it is needed for longer for an investigation.

How we store data

The CIO stores personal data securely using:

Microsoft 365 SharePoint (CIO account)

  • The main storage location for booking forms, agreements, incident reports and trustee records.
  • Access restricted to authorised trustees only.
  • Version-controlled documents.
  • Files are not stored on personal devices.

Microsoft 365 OneDrive (CIO account)

  • Temporary working files only.
  • Synced to the CIO cloud environment.
  • Not used for long-term record storage.

Hallmaster booking system

  • Used for entering and managing bookings.
  • Stores only the information needed for scheduling.
  • Financial data is transferred to Microsoft 365 for record-keeping.
  • Older bookings are archived or deleted by the CIO in line with our 7-year data retention requirements.

Email (Microsoft 365 CIO accounts)

  • Used for correspondence with hirers, volunteers and trustees.
  • Emails containing personal data may be moved to SharePoint for secure storage.

Paper records

  • Only used where necessary (for example, emergency contact sheets at events).
  • Digitised and stored in SharePoint where appropriate.
  • Paper copies destroyed securely once uploaded.

Security controls

  • Multi-factor authentication (MFA) enabled for all CIO email accounts.
  • Access permissions reviewed regularly.
  • No records are stored on personal computers or personal email accounts.

Who we share data with

We only share personal data where necessary and lawful, including with:

  • Insurers (for example, in case of a claim)
  • HMRC (financial compliance)
  • IT service providers (Microsoft 365, Hallmaster)
  • Zeffy, which processes our online donations
  • Website analytics providers (Google and Microsoft), only if you agree to analytics cookies
  • Law enforcement (crime or serious incident investigations)

We do not share data with third parties for marketing.

Data retention

We keep personal data only as long as necessary:

  • Booking records and financial data: 7 years
  • CCTV footage: up to 30 days
  • Accident and incident reports: as required by insurers or law
  • Volunteer and trustee records: reviewed annually
  • Mailing list data: until you unsubscribe

After that, data is securely deleted.

Your rights

Under UK GDPR, you have the right to:

  • Access your personal data
  • Ask us to correct inaccurate data
  • Ask us to erase your data (where lawful)
  • Restrict or object to processing
  • Withdraw consent (mailing list and optional cookies)
  • Complain to the Information Commissioner's Office (ICO)

ICO: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Contacting us

For data protection questions or to use your rights, email [email protected] or write to Fivehead Village Hall & Playing Field CIO, Fivehead Village Hall, Stowey Road, Fivehead, Taunton, Somerset TA3 6PP.

Data breach procedure

This section explains how the CIO identifies, reports, investigates and manages any personal data breach, in line with UK GDPR and the Data Protection Act 2018.

A personal data breach is any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data held by the CIO.

This procedure applies to trustees, volunteers, contractors and anyone handling CIO data across all systems, including SharePoint, Microsoft 365, Hallmaster, email and paper records.

What counts as a data breach

A data breach may include (but is not limited to):

  • Sending personal data to the wrong person
  • Loss or theft of paper documents
  • Unauthorised access to SharePoint or Microsoft 365
  • Accidental deletion of records that cannot be recovered
  • Release of CCTV footage to an unauthorised person
  • Publishing personal data online in error
  • Inappropriate sharing of hirer details or volunteer information

Immediate actions when a breach is discovered

Step 1: contain the breach. Take immediate steps to prevent further access or loss, such as revoking access permissions, retrieving documents, changing passwords or stopping further sharing.

Step 2: report it internally. Report immediately to the Data Protection Lead (the Secretary) or, if they are unavailable, the Chair.

Step 3: record the breach. Create an incident record that includes what happened, when it happened, whose data was involved, how many people were affected and the actions taken so far. Store this record securely in SharePoint.

Assessing the risk

The Data Protection Lead must assess:

  • What personal data was involved
  • Whether it was special category data (for example safeguarding, CCTV or health information)
  • Who accessed it
  • Whether the breach can be contained
  • The potential impact on the people affected
  • Whether reporting to the ICO is required

If needed, advice may be sought from the ICO helpline (0303 123 1113).

Notifying the ICO

The CIO must notify the Information Commissioner's Office if the breach is likely to result in a risk to people's rights or freedoms. Examples include:

  • Exposure of safeguarding-related information
  • Unauthorised disclosure of CCTV
  • Loss of contact details for several hirers or volunteers
  • Personal data accessed by an unknown third party

The ICO must be told within 72 hours of the CIO becoming aware of the breach. The Data Protection Lead is responsible for the submission.

Informing the people affected

People must be told without undue delay if the breach is likely to result in:

  • Distress
  • Identity risk
  • Harm or danger
  • Damage to their reputation
  • Disclosure of safeguarding or sensitive information

Notifications must include what happened, what data was involved, the likely consequences, what the CIO is doing to contain it, what the person should do, and contact details for follow-up. Notifications must be approved by the Chair or the Secretary.

Putting things right

Actions may include:

  • Revoking or changing access permissions
  • Resetting passwords
  • Restoring data from backups
  • Improving SharePoint or Hallmaster configuration
  • Updating policies and procedures
  • Providing additional training to trustees and volunteers

All actions must be logged in SharePoint.

Recording the breach

The CIO keeps a confidential Data Breach Log in SharePoint, restricted to authorised trustees, recording the nature of the breach, when it was discovered, the people affected, the actions taken, decisions on notification, remedial measures and the final outcome.

Prevention

To reduce the likelihood of breaches:

  • All CIO email and Microsoft 365 accounts use MFA
  • Access to SharePoint is permission-controlled and regularly reviewed
  • Personal data is not stored on personal devices
  • Trustees and volunteers receive basic data protection guidance
  • Paper copies are kept to a minimum and destroyed securely after digitisation
  • Data is stored only in approved systems (SharePoint, Hallmaster)
  • CCTV access is restricted