1. About us
The British Association of Dermatologists was established in 1920 by Sir Archibald Gray, the Editor of the British Journal of Dermatology which had been founded in 1888. Todaythe British Association of Dermatologists (BAD) is a registered charity (no 258474) funded by the activities of its members. Its charitable objects are the practice, teaching, training and research of dermatology.
The BAD is registered with the Information Commissioner’s Office – ZA150524
The Information Commissioner’s Office (ICO) is the independent supervisory authority set up to promote and oversee compliance with data protection legislation in the UK. On 25 May 2018, a new data protection regime will come into force, through the General Data Protection Regulation (GDPR) and the Data Protection (Charges and Information) Regulations 2018 (the 2018 Regulations).
There are 6 lawful bases for processing and the BAD has identified (a) Consent and (b) Contract to be its lawful bases for processing personal data and will demonstrate compliance in line with Articles 5(2) and 24. As a not-for-profit association the BAD is entitled to process data “for the purposes of establishing or maintaining membership or support for a body or association not established or conducted for profit, or providing or administering activities for individuals who are members of the body or association or have regular contact with it”
2. Your Personal Data
We collect “personal data”, which is information that identifies a living person, or which can be identified as relating to a living person.
3. Personal data we hold
3.1. Personal data you provide
We collect your data either when you register on the BAD website as a contact, apply for membership for the BAD or a Special Interest Group (see section 5) online, register for an event via our website or contact the BAD via email or telephone. By agreeing to become a member with the BAD you are entering a legitimate interest basis for data processing. We collect the following:
3.2. Personal data generated by your involvement with the BAD
3.3. BAD is joint controller of the BADBIR study data with the University of Manchester. For linkage to NHS Digital, legal basis for processing are confirmed as GDPR articles 6 (1) (e) and 9 (2) (j). Please note data resides at the University of Manchester.
4. How we use your personal data
4.1. General use and administration
We process your personal data to enable us to run our operations and manage our relationship with you effectively, lawfully and appropriately. We may use your information to:
5. Disclosing and sharing your personal data
We do not sell your information to third parties
We do not share your information with third parties for marketing purposes.
5.1. Provide services
We do have third party service providers working on our behalf. For the purposes of completing tasks and providing services to you we may pass on your information to our third-party providers such as our direct debit providers, BACS, Newsletter printers and journal providers. When we disclose your information to these providers we ensure that only the necessary information needed to complete the service they are carrying out is disclosed. We have a contract with each third party that means they must keep your information secure.
5.2. Information for general public
All consultant members (Ordinary and Honorary Working categories) have the option to be added to our service ‘Find a dermatologist’. This is a service featured on our website which allows members of the public to search for consultant dermatologists within a radius of a postcode search. To opt in or out of this service, please visit the ‘My Details’ section on the self-service web portal to manage your preferences. Your name and main NHS hospital will be listed as standard. Should you want to add more details about yourself including links to up to three private practices you can do so by logging in to the BAD web portal and updating your preferences in the ‘My Details’ section.
5.3 Information for affiliated groups
6. Data security
We employ a variety of physical and technical measures to protect information we hold and to prevent unauthorised access to, or use or disclosure of your personal data.
Electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means). Staff receive data protection training and we maintain a set of data protection procedures which our staff are required to follow when handling personal data.
6.2. Payment security
All electronic forms that ask you for your financial data will use the Secure Sockets Layer (SSL) protocol to encrypt the data between your browser and our servers.
If you use a payment card to pay for membership or to purchase something from us on-line, we will pass your payment card details securely to our payment provider. We comply with the payment card industry data security standard (PCI-DSS) published by the PCI Security Standards Council.
7. Storing your personal data
7.1. Where we store data
We are wholly based in the UK and store data within the European Economic Area.
7.2. Retention of your personal data
We will only retain your personal data for as long as it is required for the purposes for which we collected it (e.g. we have a genuine and legitimate reason and we’re not harming any of your rights and interests). We continually review what information we hold and will delete personal data which is no longer required.
8. Control of your personal data
8.1. Your rights
We want to ensure you remain in control of your personal data and that you understand your legal rights, which are:
• the right to know whether we hold your personal data and, if we do so, to be sent a copy of the personal data that we hold about you (a “subject access request”) within one month;
• the right to have your personal data erased (though this will not apply where it is necessary for us to continue to use the data for a lawful reason);
• the right to have inaccurate personal data rectified;
• (where technically feasible) the right to be given a copy of personal data that you have provided to us (and which we process automatically on the basis of your consent or the performance of a contract) in a common electronic format for your re-use.
You can choose to universally unsubscribe from all of our mass membership communications, but there may be cases when we need to contact you individually to conduct the business of the Association or to supply you with your annual renewal notice and other documents we are legally required to send you.
There are some exceptions to the rights above and, although we will always try to respond to any instructions you may give us about our handling of your personal information, there may be situations where we are unable to meet your requirements in full.
Should you have a complaint about how we have used (‘processed’) your personal data, you can complain to us directly by contacting our Data Protection Officer in the first instance.
If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office which regulates and enforces data protection law in the UK. Details of how to do this can be found at www.ico.org.uk
Our websites use local storage (such as cookies) in order to provide you with the best possible experience and to allow you to make use of certain functionality (such as being able to shop online). Further information can be found in our Cookies Policy at /cookies
9.1 Links to other sites