ScoutBase: agreement with each Group (data processing)
A Group accepts this when it sets up ScoutBase, and its Group Lead Volunteer accepts it for the Group, on behalf of its Trustee Board. UK GDPR (Article 28) requires a written agreement like this whenever someone handles personal data for an organisation.
Between: the Scout Group named when it set up ScoutBase (the Group), and Ben Colley, who runs ScoutBase (ScoutBase).
1. Who's responsible
1.1 The Group is the controller of the personal data it puts into ScoutBase or connects from OSM. ScoutBase is its processor.
1.2 The Group decides what personal data goes into ScoutBase, has a lawful basis for it, and tells its members, for example by pointing to the ScoutBase privacy notice.
2. What ScoutBase does with the data
2.1 ScoutBase only uses the Group's data to provide ScoutBase to the Group, following the Group's instructions. The Group gives those instructions by how it uses ScoutBase and in writing.
2.2 The data covers:
- volunteers' names, membership numbers, emails, roles, learning and DBS check status
- trustees' declarations of interest
- young people's first names and last initials, estimated dates of birth, sections, moving-up dates and waiting-list notes
- users' sign-in details
The Group shouldn't put health, medical or other special category details into free-text notes.
2.3 ScoutBase never sells the data, never uses it for advertising or to train AI, and never uses it for anything except running ScoutBase.
3. Keeping it safe
ScoutBase:
3.1 keeps the data in the UK (London) wherever it can, encrypts the most sensitive details, and limits what each person sees by their role;
3.2 only accesses the data itself when needed to run, support or fix ScoutBase, and keeps everyone who can access it under a duty of confidentiality;
3.3 keeps an activity log of important changes;
3.4 tells the Group without undue delay, and within 48 hours of finding out, if there's a breach affecting its data, with what's known and what's being done.
4. Other companies
4.1 ScoutBase uses these companies to run the service: Supabase (database and sign-in, London), Vercel (website hosting) and Purelymail (sign-in emails). The Group agrees to these.
4.2 ScoutBase will give at least 30 days' notice before adding or changing one, so the Group can object or stop using ScoutBase. Each company is bound by data protection terms at least as strict as these. Where data leaves the UK, UK-approved safeguards apply.
5. Helping the Group
ScoutBase will help the Group:
5.1 respond to people using their rights (access, correction, deletion and so on), for example by exporting or deleting a person's information on request;
5.2 meet its own data protection duties, such as breach reporting or a data protection impact assessment, as far as is reasonable.
6. Ending
6.1 The Group can stop using ScoutBase at any time by emailing privacy@scoutbase.co.uk.
6.2 ScoutBase deletes all the Group's data within 30 days of the Group leaving, and any backups within 7 days after that. Before that, the Group can ask for a copy in a common format. ScoutBase only keeps something if the law requires it.
7. Checks
7.1 ScoutBase will answer the Group's reasonable questions about how its data is protected, and share what's needed to show it's meeting this agreement.
8. The service
8.1 ScoutBase is provided free by a volunteer, as it is. ScoutBase takes care to keep it working and the data safe, but can't promise it will always be available. The Group should keep OSM and the Scouts membership system as its main records.
8.2 These terms may be updated. ScoutBase will give 30 days' notice of any change that matters.
Accepted for [Group name] by [name], [role], on [date].