Privacy Policy
This page explains what personal data the KHAS Museum Steward Rota holds, why, who can see it, and what rights you have over it, in line with UK GDPR.
Who we are
The data controller for this site is the Kenilworth History and Archaeology Society (KHAS). Questions about your data, or requests to access, correct or delete it, can be sent to contact@khas.co.uk.
What we collect, and why
We hold the following about each volunteer:
- Name and email address - so we can contact you about shifts and confirm who is on the rota.
- Phone number (optional) - entirely up to you. Add one from My Account if you're happy for us to call you occasionally about shifts, and remove it again whenever you like.
- Display name - a name of your choosing, shown to other volunteers instead of your full name.
- Shift history - which sessions you've volunteered for, so we can plan future rotas and track steward experience.
- Sign-in activity - we use passwordless "magic link" sign-in, so we briefly record login attempts and your last sign-in time to keep the site secure.
- An audit log and email log of account and rota changes (e.g. who was added to a shift, or that a reminder email was sent), so we can investigate problems and keep an accurate record.
We collect only what's needed to run the volunteer rota. Our lawful basis for this is legitimate interests - organising an unpaid museum volunteer rota fairly and safely couldn't reasonably be done without it.
Who can see your details
On the Rota page, other volunteers only ever see your display name - never your email address or phone number. This is true no matter what you set your display name to, including if you leave it as the suggested "first name and surname initial".
KHAS administrators can always see your full name, email address and phone number (if you've provided one), regardless of your chosen display name, so that shifts can be run smoothly and volunteers can be contacted if needed. If you'd rather not be identifiable to other volunteers at all, choose a display name that doesn't include any part of your real name.
If you add a shift to your own calendar app using "Add to calendar", the calendar file includes your display name and email address. That file is only ever generated for your own shifts, and from then on it's held by your calendar app or provider, not by KHAS.
We never share your details with third parties, and we don't use them for marketing.
How long we keep it
We keep your details for as long as you're an active volunteer, and for a period afterwards so we can maintain accurate shift records. If you stop volunteering and would like your contact details removed sooner, contact contact@khas.co.uk and we'll deactivate your account and delete the personal details we don't need to keep for record-keeping.
Your rights
Under UK GDPR, you have the right to:
- see what personal data we hold about you;
- ask us to correct anything that's wrong (or just update it yourself from My Account);
- ask us to delete your data, subject to what we need to keep for record-keeping as above;
- object to how we use your data.
To exercise any of these, contact contact@khas.co.uk. If you're not satisfied with how we've handled your data, you can complain to the Information Commissioner's Office (ICO).
Keeping your data secure
There are no passwords to steal - sign-in uses a one-time secure link sent to your registered email address. Access to full names, email addresses and phone numbers is restricted to KHAS administrators, and there's no advertising or tracking on this site.