Privacy Policy

Region 9 of Overeaters Anonymous upholds our 12th Tradition of anonymity, and is committed to protecting the privacy of everyone who shares their personal information with us.

Scope of this policy

Region 9 will process personal data of OA members and non-members. Individuals may subscribe to the mailing list, members may attend Region 9 meetings, and may act as Officers, Trustee Liaison, Committee Chairs, Committee members, or Service Coordinators for Region 9. Registers will be kept of meetings, and contact details saved to email accounts. If members arrange events or workshops and produce publicity material then this will be distributed and published to the website. Region 9 oversees an annual Assembly which is hosted by the national OA fellowship of the country where the Assembly takes place.

Region 9 is committed to upholding the privacy of individuals whose personal information is being processed, and this policy describes how this commitment will be met. It applies to Region 9 officers, representatives, and OA members who deal with personal data on behalf of Region 9 or in connection with Region 9 (including service bodies which host Region 9 events) or the OA Region 9 Charitable Incorporated Organisation.

This policy should be read in conjunction with the Data Protection Policy and the Information

Security Policy, and other such policies that may be created.

General principles

Region 9 takes appropriate precautions when processing personal information while conducting Region 9 business. Privacy will be protected, and personal information never disclosed unless required by law, or where this is to an external (non-OA) data processor such as Google, or our website hosts. We will only use personal data for the purpose which it was disclosed, and securely delete or destroy it once it is no longer required.

Region 9 Officers, Trustee Liaison, Committee Chairs, Committee members, Service Coordinators and Representatives

OA members giving service to Region 9 in any of these positions will supply their contact details to Region 9 so that they can be contacted in order to fulfil their role within OA. If their contact details change they should notify the Chair of Region 9 (chair@oaregion9.org) so that the records can be updated.

The details of the Officers, Trustee Liaison, Committee Chairs, Committee members, Service Coordinators and representatives will be held on record for the period stated in the table below. If they have signed a register of attendance at meetings then this record will be kept as below. Details may be shared with authorised third parties and information will be held in the Region 9 Google Drive.

If any officer or representative would like to object to the processing of their data, or request that processing be restricted, they should do so in writing to the Chair of Region 9.

Sponsor lists, Translation Lists

Region 9 maintains lists of individuals who have agreed to act as sponsors / provide 12 step outreach or provide translation of documents. Other similar lists may be generated at times. Consent will be obtained from people named on the list, who may have their information removed at any time; Consent will be obtained from those seeking sponsorship to be matched with available sponsors Those seeking a sponsor consent to their information being processed in this way and for this purpose only; we do not retain this information longer than for the purpose of matching potential sponsors to sponsees. All individuals involved are aware of our privacy notice when sharing information with Region 9.

Assembly / Convention attendees

Individuals are required to register in advance of attending the Region 9 Assembly and/or Convention.  When registering  they will be provided with a privacy notice which explains who will hold their data and how it will be processed. The period for which data will be retained is set out in the table below. 

Group representatives (information received from World Service Office)

OA World Service Organisation holds a register for OA meetings globally. Local groups and service bodies are required to provide contact details to this register. This data is then shared by World Service Office to Region 9 so that Region 9 can reach out to representatives within the area covered by the Region. This may include full names (if given to World Service Office), home address, email address and telephone number. If any individual wishes to be removed from the list held by World Service Office then they will need to contact World Service Office directly. They can contact Region 9 to have their details deleted from the Region 9 records.

Events flyers

OA members may choose to  supply their contact details in flyers and promotional material for events and workshops. The flyers supplied to Region 9 for this purpose will be published on the website with the personal data that has been provided. A record will be kept of what information is provided. Once the event has passed then the flyer will be removed from the website.

If the OA member wishes to have the flyer removed prior to the event then they should contact the Chair of Region 9 who will inform the Digital Officer and Digital Committee to ensure that the flyer is removed.

Data subject rights

Under the GDPR, data subjects (people whose data is being processed), have several rights:

a. The right to know what data has been collected about them, and how such data has been processed

b.The right to make changes to inaccurate data

c. The right to withdraw consent to data processing

d. The right to ask for data to be deleted

e. The right to object to data processing, or for it to be restricted

f. The right to data portability (this only applies to automated processing, which does not happen in the context of Region 9)

g. The right to complain to the Information Commissioners Office

If you would like to exercise any of these rights, please contact the Chair of Region 9.

Consent to share information outside the European Union (EU)

Region 9 covers a wide geographical area, extending beyond the EU to include countries and territories in Africa, the Middle East and Western Asia. This means that Region 9 officers and service bodies based outside the EU may receive personal data via Region 9. Some may have data protection policies akin to the General Data Protection Regulations (GDPR) and others may not. In these circumstances the GDPR requires specific consent to be obtained from data subjects in order to permit their personal data to be processed. Such consent will be sought.

Right to access information

Individuals have the right to access any personal data that relates to them which Region 9 holds, and to be given the following information:

• The reason why the data is held
• The source of the data (if not directly from the individual themselves)
• Whether it has been disclosed to anyone else, and if so, who
• How long it will be stored
• The right to request that the data be updated, or deleted, or processing restricted in any way
• The right to lodge a complaint to the Information Commissioners Office
• Whether any automated decision-making was used to process the data
• Whether the information has been shared outside the EU and if so the mechanisms in place to protect data

This is called a ‘Data Subject Access Request (DSAR)’. Any person who wishes to exercise this right should contact the Chair of Region 9 via email (chair@oaregion9.org). The information should be provided within 30 days, without charge. The Chair will always verify the identity of anyone making a subject access request before handing over any information.

Process for Data Subject Access Requests

Any Data Subject Access Requests should be forwarded to the Chair of Region 9, who should record them in the DSAR template.

The individual making the request should be contacted and their identity confirmed, if necessary by a telephone conversation, or other appropriate means, and they may be required to supply written evidence of their identity.

The Chair should collaborate with other Officers to identify all information which is held concerning the subject. OA does not collect a great deal of personal data, and so it is likely that the information will be limited to their inclusion on a list, register of attendance at meetings, and their subscription to the mailing list. However, if the person has been an Region 9 Officer, Trustee Liaison, Committee Chair, Committee member, Service Coordinator or Assembly Representative then there may be more information, including emails from them and concerning them.

All material should be reviewed and an assessment made of whether it can be immediately disclosed, or whether disclosure may adversely affect the rights and freedoms of another individual. Information about a third party should not be disclosed, and this can be edited out of documents.

Nothing should be disclosed that might prejudice a legal investigation, or where disclosure would breach some other legal duty. Specialist advice should be sought if there is any concern about whether disclosure should not be made.

The general rule is that material should be disclosed within 30 days of the request being made, and the subject may request an update during this time, If it will take longer to prepare the disclosure, then the subject should be contacted within 30 days, and informed of the delay including  likely timescale for disclosure. Disclosure must be made within 90 days of the request.

If no information is held about the data subject then they should be informed.

If information is held but no disclosure is made then the data subject should be informed that no action will be taken on their request, and that they have the right to complain to the Information Commissioners  Office.

A brief description of the disclosure should be recorded in the DSAR template, together with the timing of any disclosure, and any non-disclosed material, with reasons given for non-disclosure.

Archiving and retention

Personal data should only be stored for the minimum period necessary, consistent with the purpose for which it was processed. Once the retention period has elapsed it is the responsibility of the person controlling the data to delete it. Officers, Trustee Liaisons, Committee Chairs, Committee members and Service Coordinators are responsible for managing their own Google Drive and email accounts, and Region 9 representatives responsible for their group’s email addresses.

Version

This policy was drafted on 5th May 2020, and approved by the Region 9 Assembly in October 2020.

The policy was revised and approved on 16th January 2026.
Any questions about this policy or any queries concerning data protection matters should be raised with the Chair of Region 9 (chair@oaregion9.org)