This notice explains what data we hold about you, our customers, and your rights under the General Data Protection Regulation (GDPR).
All purchasers of artwork at exhibitions are required to provide their names and contact details for the purpose related to the purchase and collection of art work. This data is collected on paper and is then stored in a secure password protected digital cloud service. We will hold your purchasing history and where you have given us details: name, title, address, phone number and email address.
ACCESS TO AND RETENTION & USE OF PERSONAL DATA
ACCESS will be restricted to the Honorary Treasurer, the Exhibition Secretary and the Honorary Secretary. Your details will be sent to the Artist whose work you have purchased.
We sometimes need to download your data to a personal computer for example to print labels for posting CAS information to you, but it will only held as long as necessary.
RETENTION of your data is managed as follows:
 We maintain the data as accurately and up-to-date as possible.
 We delete the data when no longer required. Data is retained for a period of four years from the last purchase date and is managed by the Honorary Treasurer.
We USE YOUR PERSONAL DATA for the following purposes:
 To contact you regarding purchases, for example if you fail to collect your purchase.
 To answer any queries you raise with us.
 To send you details of our future exhibitions and other relevant CAS events.
We have two legal bases for holding your data:
 Contract: You enter into a contract with us when you purchase exhibits at our exhibitions.
 Consent: We send you details of our future exhibitions, only if you have consented.
Third parties who have access to your data:
 The Auditor of our accounts.
 Our bank that processes your cheque or electronic payments.
 Google who provide our email service and cloud storage. https://cloud.google.com/security/gdpr/
We do not share your data with any other party.
YOUR RIGHTS UNDER THE GDPR
You have the following rights with regard to your personal data:
 To request a copy of the data we hold about you.
 To request that we correct data that is inaccurate or out of date.
 To request your data is erased when it is no longer necessary for us to retain it.
 To withdraw your consent to receive mailshots.
 To lodge a complaint with the Information Commissioners Office (ICO).
Croydon Art Society (CAS) can be contacted as follows: By email: croydonartsociety@gmail.com By post: The Chairman, c/o 50 Northampton Road, CROYDON, CR0 7HT
The ICO (see https://ico.org.uk/for-the-public/) can be contacted as follows:
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113 By website form or email: https://ico.org.uk/global/contact-us/email/