1 Introduction
Lymington u3a will comply with data protection legislaton in managing the data of their members.
The most recent legislaton is the Data Protection Act 2018 which incorporates the requirements of
the General Data Protection Regulation (GDPR).

Lymington u3a treats members’ privacy rights seriously, particularly personal information that could
identify, or is related to the identity of an individual member.

Lymington u3a has adopted legitimate interest as our lawful basis for processing membership data.
(see Annex A)

2 Collection of personal information
Lymington u3a collects personal data about our members from membership application forms and contact forms. This includes the information needed for membership purposes such as:

• A member's name
• Postal address,
• Telephone number(s),
• Email address,
• Gift aid information.
• Standing Order information (this relates to existing Standing Orders, no new ones are
• accepted),
• Emergency contact name and Telephone number.
  
  3 Use and sharing of personal information will be to:
• Provide Lymington u3a activities and services to members,
• Communicate with members about their Group activities,
• Monitor, develop and improve the provision of Lymington u3a activities,
• Deliver ‘Third Age Matters’ magazine if members have individually given consent to this,
• Send messages by e-mail, post, other digital methods and telephone to advise members of u3a
  activities,
• Meet any statutory duty to disclose it for legal and/or regulatory reasons.
  
  4 Retention and Storage of Personal information
  Member information will be retained securely using the Beacon database system that is provided by
  the Third Age Trust. This is a password-protected database that is accessed by a limited number of
  Committee Members and helpers only on a need-to-know basis.
  In most instances, membership information will not be stored for longer than 12 months after a
  member leaves Lymington u3a. The exceptions to this are instances where there may be financial,
  legal or insurance circumstances that require information to be held for longer; for example, Gift
  Aid declarations.
  
  5 Photographs
  The Lymington u3a application form includes an opt in of photographs option. Where group
  photographs are being taken the photographer should ask members of the group who don't wish to
  be in the photograph to move out of shot.
  News from Groups and Newsletters containing photographs that are published on Lymington u3a
  website will be deleted after not more than two years. Personal photograph are not used on the
  website without specific individual consent.
  
  6 Personal information used in conjunction with Groups
  Lymington u3a needs to keep track of Groups, so that new applicants can be advised whether
  Groups are able to accept new members. This involves group leaders letting the Interest Groups
  Coordinator know who belongs to their Group.
  The Group Co-ordinator will inform all Group Leaders of their responsibilities in respect of data
  protection, including the deletion or return of all information when they relinquish their role as a
  Group Leader.
  
  7 Operating and Reviewing this Policy
  The Secretary will keep under review who has access to full or partial member information and who
  needs access.
  The Lymington u3a Committee will assume joint responsibility for how data is processed and
  managed.
  Lymington u3a will Induct new committee members and group leaders in the principles of GDPR and
  member privacy , and how they apply in practice.
  Lymington u3a committee members will be guided the Third Age Trust document* concerning Data
  Protection within u3a organisa5ons. (*Data Protection u3a-KMS-DOC-053. 18/11/2021)
  This consolidated policy updates and replace the previous Lymington u3a Data Protection Policy and
  the Privacy Policy.
  
  ANNEX A
  Legitimate Interest Assessment - Lymington u3a Membership Information
  
  1 Introduction
  This legitimate interest assessment has been compiled in order to set out the
  reasons why Lymington u3a processes and holds membership information.
  
  2 Purpose Test
• Lymington u3a requests personal data to be able to register
  individuals for membership of Lymington u3a.
• The personal data provided will also be used to communicate with members
  regarding the activities of Lymington u3a and to keep members informed
  regarding any Groups or activities that they undertake with Lymington u3a.
• Member information is shared with a third party processor for the supply of the
  u3a Trust publication – Third Age Matters (TAM). Each member has a choice as to
  whether they opt to receive this publication. Other than this Lymington u3a
  does not share membership information outside of the u3a.
• Membership information is securely held and access is restricted to those who
  need to process data for membership purposes. Storage and processing of
  membership data is done in line with General Data Protec5on Regulation
  (GDPR) and safeguarding requirements.
• Lymington u3a has taken advice from the relevant Third Age Trust documents
  
  3 Necessity Test
• This information is proportionate to the requirements of the u3a fulfilling its
  responsibilities in relation to being able to communicate effectively with its
  membership. Lymington u3a would not be able to register members or
  process applica5ons without the provision of a certain amount of membership
  information.
• Lymington u3a has a duty of care to its membership and needs to retain a
  certain amount of personal information in order to know who its members are
  and which members are paid up members of the u3a. This is necessary for
  meeting the requirements of the insurance provision for u3a members.
  
  4 Balancing Test
• The personal data requested is that which is needed for registering and
  processing individuals as members of Lymington u3a. The data requested is the
  minimal personal data and that is needed for communicating with
  members.
• All data gathered is from individuals who provide the informa5on as part of
  their application to join Lymington u3a.
• Membership is for a 12 month period at the end of which members have
  the option whether or not to renew.
• Members may at any time contact the Secretary to make a ‘subject access request’ to view the
  data held about them or to have their personal details updated.
• The reason for collecting personal information is explained to new members when they join
• Lymington u3a's Privacy and Data Protec5on Policy is available to all members and is published
  on the Lymington u3a website.
• Lymington u3a holds information securely and it will only be accessed by
  those who need to see it.
• Membership data will not be processed for any purpose other than in
  connection with an individual’s membership.
• Communications sent will be relevant and targeted to the individual’s
  membership activities. U3a members will not be sent irrelevant marketing
  materials or informa5on.
• Lymington u3a Group Leaders will be informed of the importance of
  restrictng their communica5ons with members to that which is needed for
  organisation of the Group.
• All those who process membership information for the u3a will receive an
  induction into the requirements of GDPR and the restrictions around data
  processing. Volunteers will be informed of the need to keep data
  secure and restricted to those who need access to it.
  Lymington u3a considers that this assessment demonstrates the charity’s
  legitimate interest to collect, hold and process membership information.
  This assessment will be periodically reviewed together with its parent policy document in order
  to ensure that legitimate interest remains the most appropriate lawful basis for gathering
  membership informaon.
  
  Adopted: 4th June 2025