Data Protection and Privacy Policies

Data Protection and Privacy Policies of the War Studies Club

This document sets out the data protection and privacy policies of the War Studies Club (‘the Club’) in compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Data Protection Act 2018. The purpose of these policies is to ensure that the Club handles personal data lawfully, transparently, and securely in relation to members, alumni, and other individuals whose data is collected or processed by the Club.

1. Scope

1.1 This policy applies to all personal data collected, stored, or processed by the War Studies Club.
1.2 It covers data collected from alumni, students, and affiliates of the Department of War Studies, King's College London (KCL), who voluntarily submit their information via the Club’s membership form or related platforms.
1.3 The policy applies to all members of the Club Board, officers, volunteers, and appointed representatives who have access to personal data.

2. Personal Data Collected

2.1 The Club collects the following personal data for membership purposes:
    a) Full name
    b) Email address
    c) Country and city of residence
    d) Graduation year
    e) Degree obtained from the Department of War Studies, King’s College London
    f) KCL alumni number
2.2 This data is collected only from individuals who voluntarily complete and submit the membership form.

3. Purpose of Processing Personal Data

3.1 The Club processes personal data for the following purposes:
    a) Managing membership records and communications
    b) Organising and promoting alumni events, networking, and engagement activities
    c) Verifying alumni status with King’s College London (via the King’s Connect or Alumni Office)
    d) Maintaining historical and statistical records of membership demographics
    e) Ensuring compliance with Club governance and university collaboration policies.

4. Lawful Basis for Processing

4.1 The lawful basis for processing personal data under Article 6 of the UK GDPR and EU GDPR includes:
    a) Consent – Members voluntarily provide their data by completing the membership form.
    b) Legitimate Interests – The Club has a legitimate interest in maintaining records and facilitating alumni engagement activities.
    c) Legal Obligation – In cases where data must be shared with King's College London for verification purposes.

5. Data Sharing and Disclosure

5.1 Personal data shall only be shared with authorised individuals or bodies where necessary and appropriate.
5.2 The Club may share limited data (name, graduation year, degree) with the King’s College London Alumni Team for verification purposes.
5.3 Personal data will not be shared with third parties for marketing or commercial purposes.
5.4 Any data sharing with external parties shall be governed by appropriate data-sharing agreements where applicable.

6. Data Retention

6.1 Personal data will be retained for as long as necessary to fulfil the purposes outlined in this policy.
6.2 Members may request deletion of their personal data at any time by contacting the Club Secretary or Data Protection Officer.
6.3 Upon cessation of membership or dissolution of the Club, all personal data will be securely deleted unless required for legal or archival purposes.

7. Data Security

7.1 The Club shall implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, or misuse.
7.2 Access to personal data is restricted to authorised Board members and appointed representatives who require such access for their roles.
7.3 Electronic data shall be stored securely using password-protected systems, and physical records (if any) shall be kept in locked storage.

8. Data Subject Rights

8.1 Under GDPR, individuals have the following rights regarding their personal data:
    a) Right to access – to request a copy of their personal data.
    b) Right to rectification – to correct inaccurate or incomplete data.
    c) Right to erasure – to request deletion of their personal data (‘right to be forgotten’).
    d) Right to restrict processing – to limit how their data is used.
    e) Right to data portability – to receive their data in a structured, commonly used format.
    f) Right to object – to object to processing based on legitimate interests.
8.2 Requests to exercise these rights should be directed to the Club Secretary or Data Protection Officer.

9. Consent and Withdrawal

9.1 Consent to process personal data is obtained when individuals submit their details via the membership form.
9.2 Members may withdraw their consent at any time by contacting the Club Secretary.
9.3 Withdrawal of consent will result in the removal of personal data from the Club’s records, except where retention is required by law.

10. Data Breach Procedure

10.1 In the event of a personal data breach, the Club shall assess the severity and impact of the breach.
10.2 Where required, affected individuals and the Information Commissioner’s Office (ICO) shall be notified within 72 hours.
10.3 A record of all data breaches shall be maintained, including remedial actions taken.

11. Data Protection Officer

11.1 The Club shall appoint a Data Protection Officer (DPO) or designate an officer responsible for ensuring compliance with this policy.
11.2 The DPO shall act as the contact point for data protection matters, oversee implementation, and manage data requests and breach notifications.

12. Policy Review and Updates

12.1 This policy shall be reviewed annually by the Board to ensure ongoing compliance with data protection regulations.
12.2 Updates to this policy shall be approved by the Board and communicated to all members.