General Data Protection Regulation (GDPR) 2018 General Responsibility The organising committee will appoint a named member of the group to be responsible for ensuring compliance with GDPR. This individual will be elected at the Annual General Meeting and recorded in the minutes thereof. They will be responsible for maintaining this policy statement in accordance with any future guidance or changes to the Regulation. They will also advise the Committee of their roles and responsibilities to ensure that any personal data held in conjunction with the organisation of the event is adequately safeguarded from accidental loss or unauthorised access. Personal Data The scope of personal data to be retained in conjunction with the organisation of the event will be limited to basic contact details: i.e. Name, Postal Address, Telephone Number(s) and E-Mail Address. The Committee may also retain digital images and videos taken at the event, by the organisers or their agents, for use on the shows website and Social Media page for promotional purposes. The Committee will not obtain or retain any sensitive personal data (e.g. race, religion or gender). Other data retained will also include theNames and contact details of committee members, the names, contact details and other information required to undertake normal business with show sponsors, advertisers and suppliers. Data Storage The majority of personal data held relates to show entrants, this will be recorded on a spreadsheet (or similar document) maintained by the responsible committee member, (currently the Chairperson) on a stand-alone computer. The responsible person will ensure that this computer is adequately protected from unauthorised use or cyber attack by the use of passwords and recognised firewall/antivirus software. Any spreadsheets or such documents containing personal data must also be password protected. Personal data may be legitimately shared among committee members in conjunction with the organisation of the event. It is the responsibility of individual committee members to ensure any electronically transmitted data (e.g. e-mail) is securely stored to prevent unauthorised access. Data shared by means of portable storage media will be encrypted/password protected. It is the responsibility of the individual to ensure such devices are adequately protected from loss, theft or unauthorised use. Specific portable storage devices will be provided for the exclusive use of data relating to the organisation of the event. All data should be periodically backed up and securely stored, preferably on a separate storage device. Virtual or “cloud” storage devices will not be used for back up purposes. Data Sharing The committee will not share personal data with other organisations other than the limited information required to produce the show programme and other advertising material, Digital images and videos may be published on the show website and social media page. All show entrants, by accepting the terms and conditions of entry, agree to the use of this data for the purposes of the show in which they are participating. (New Terms and Conditions to be included in 2024 entry forms.) Retention of Personal Data In order to comply with GDPR all current contacts (as of 25th May 2018) have been asked to give their consent to retain personal data. Any request for removal of data will be undertaken within 10 working days. Data relating to previous show entrants, sponsors, advertisers and suppliers will be retained for a period of 3 years after which, if we have had no further contact, personal data will be automatically removed from the data base. The Terms and Conditions attached to all show entry forms (2024 version) will seek permission to retain personal data for this period. Individuals will be given the opportunity to have their details removed from the data base within 10 working days following the date of the show in which they are participating. Personal data relating to committee members will be kept up to date and shared only with those committee members. Changes to personnel should be amended within 10 working days and members instructed to remove the relevant data from their files. Legitimate Reasons for Retention of Data Data related to the ordinary business of the show, it’s sponsors, advertisers and suppliers may be kept indefinitely. Certain personal data associated with the Sleaford Classic Car and Motorcycle Show is considered to be of historic social value and may be retained indefinitely. Such data includes but not exclusively, digital images and videos, names of trophy winners and names and dates of former committee members. The committee will consider the removal of this data on request. A decision on removal will be made and recorded at the first committee meeting following the date of request. The applicant will be informed of this decision within 10 working days of the meeting.