DATA PROTECTION NOTICE UNDER THE CAYMAN ISLANDS DATA PROTECTION LAW, 2017
This is only intended to be a summary of the key points in the Data Protection Law, 2017 which take effect from September 30, 2019. If you need further information, please contact the Cayman Islands Red Cross (CIRC) by e-mailing [email protected]
The purpose of this notice is to explain how and why the Cayman Islands Red Cross (“CIRC”) and employees of the CIRC may use, store, share and otherwise process your personal data. Personal Data covers any type of information that can be used to identify and individual. This may be an individual's name, address, email address, date of birth, passport details or other national identifier, driving licence number, employment information, account numbers, credit card details, donation amounts and dates, volunteer information such as availability and areas of interest, history of involvement with CIRC, police clearance certificate, economic information such as your work permit information, and information required to maintain an employment relationship with CIRC. It also includes data which, when looked at with other data, enables an individual to be identified, such as an IP address.
Personal information does not include information that cannot be tracked back to you personally. This Notice is subject to change due to changes in organizational practices or legal and regulatory requirements. You are encouraged to periodically check the website for updates to this Notice.
What role does the CIRC perform in relation to your Personal Data?
The CIRC both controls the Personal Data which it receives and processes the Personal Data. The CIRC will decide: (i) how to use, store, and process your Personal Data; (ii) with whom to share your Personal Data; (iii) when to change or delete your Personal Data; and, (iv) who may process your Personal Data.
How does the CIRC we obtain your Personal Data?
The CIRC collects your Personal Data a number of ways. These include: from any forms you complete which have been provided to you by the CIRC, examples include attendance forms at general meeting, application to act as a volunteer, as a consequence of your employment with CIRC, through the delivery of first aid services and programs, disaster response, fundraising events and through training and awareness programs, when conducting and facilitating donor appeals, when you provide your Personal Data in correspondence and conversations (including by email).
Why is your Personal Data processed?
The principal reason why Personal Data is processed is to assist the CIRC to carry out its functions. For example; employing staff, arranging training, opening bank accounts, managing events and volunteers, acknowledging donors and receipts for donations, or recording those who receive goods or services from the CIRC. Further it may be necessary in order for the CIRC to comply with applicable legal or regulatory obligations, including but not limited to undertaking due diligence checks on relevant donors, staff and volunteers i.e. police clearance certificates, carrying out anti-money laundering and counter-terrorist financing checks, complying with requests from regulatory, governmental, tax and law enforcement authorities, maintaining statutory registers, initiating controls to prevent and detect fraud, sending updates, information and notices or otherwise corresponding with you in connection with your involvement with the CIRC, investigating any complaints, or pursuing or defending any claims, proceedings or disputes, managing operations, complying with audit requirements, ensuring internal compliance with the CIRC’s policies and procedures; but in all cases only where it is considered that the processing is necessary and, on balance, the legitimate interests of the CIRC do not override your legitimate interests, rights or freedoms.
When requested for a legitimate purpose, as set out above your Personal Data may be shared with parties outside of the CIRC. In exceptional circumstances, your Personal Data may be shared with regulatory, prosecuting and other governmental agencies or departments. Your Personal Data will not be sold, rented or traded.
Do you have to provide this Personal Data?
When an individual chooses to become an employee, a volunteer, a donor or a recipient of the CIRC, they are consenting to the collection, use and disclosure of the individual’s Personal Date in accordance with this Privacy Notice. The CIRC may seek additional consent where required by law or in situations where it is considered that further consent to be necessary or appropriate.
An individual is free to refuse or withdraw their consent to the collection, use or disclosure of their Personal Data at any time upon reasonable notice in writing to the CIRC. An employee, a volunteer, a donor or a recipient of the CIRC may decline to provide to the CIRC with their Personal Data but, in some circumstances, this decision may hinder the CIRC in its ability to employ, engage as a volunteer, provide services to or process a donation.
How long is Personal Data retained
The CIRC will keep your Personal Data for as long as it is required for legitimate business purposes, to perform contractual obligations, or where required by law or regulation. The CIRC will generally retain your Personal Data throughout the lifecycle of the relationship. Some Personal Data will be retained after your relationship ends. The CIRC expects to delete your Personal Data (at the latest) once there is no longer any legal or regulatory requirement or legitimate business purpose for retaining your Personal Data.
What are your rights in respect to your Personal Data
You have certain data protection rights, including: (i) the right to be informed about the purposes for which your Personal Data are processed; (ii) the right to access your Personal Data; (iii) the right to stop direct marketing; (iv) the right to restrict the processing of your Personal Data; (v) the right to have incomplete or inaccurate Personal Data corrected; (vi) the right to ask the CIRC to stop processing your Personal Data; (vii) the right to be informed of a Personal Data breach (unless the breach is unlikely to be prejudicial to you); (viii) the right to complain to the Data Protection Ombudsman; and, (ix) the right to require the CIRC to delete your Personal Data in some limited circumstances.
Contact us
The CIRC are committed to processing your Personal Data lawfully and to respecting your data protection rights. Please contact the CIRC if you have any questions about this notice or the Personal Data held about you. Contact the Executive Director at [email protected]
