Wales Air Ambulance Privacy Policy
Last updated: 25/05/2018
This policy sets out our commitment to repay the trust you have shown by sharing your personal data with the Wales Air Ambulance Charity.
Who we are
In this policy, whenever you see the words ‘We’, ‘Us’ or ‘Our’, it refers to the Wales Air Ambulance Charity (WAAC).
Wales Air Ambulance Charity is a working name of the Welsh Air Ambulance Charitable Trust. Registered office: Tŷ Elusen, Ffordd Angel, Llanelli Gate, Dafen, Llanelli. SA14 8LQ. A company limited by guarantee in England and Wales (4036600) and a charity registered in England and Wales (1083645).
Telephone: 0300 0152 999. Email: enquiries@walesairambulance.com. Website: www.walesairambulance.com.
Privacy statement
Wales Air Ambulance is committed to protecting your privacy and complies with the principles of the relevant data protection regulations. The terms of this statement may change, so please check it from time to time. If we make any significant changes in the way we treat your personal information, we will make this clear on the Wales Air Ambulance website or by contacting you directly.
This privacy policy explains how and why we collect your personal data and how it is used. We have a legal duty to protect any information we collect from you. We use appropriate technologies to safeguard your details, maintain strict security standards and we regularly audit how we collect, store and use personal data.
We respect your privacy and the trust you have shown by sharing your personal data with us. We will never sell your personal data on to third parties.
This policy applies to all websites we operate and our communications with you. It covers what we collect and why, what we do and don’t do with the information, our security and your data, and your rights to access and control your data.
Please note that Wales Air Ambulance is not a ‘public authority’ as defined under the Freedom of Information Act and therefore we will not respond to requests for information made under this Act; using funds generously donated to us by supporters for such activities is not in accordance with our charitable purposes.
What is personal data?
Personal data is information that can be used to help identify an individual. This can include, but is not limited to, a name, address, phone number, email address or location data from electronic devices (such as mobile phones and IP addresses).
A summary of our privacy policy
It is important that you read and understand our full privacy policy, but here is a quick summary to help you understand the basics:
- We collect, use and store personal data in order to administer your relationship with us. This data may be collected in a number of ways, depending on how you have chosen to engage with us.
- We will keep your information only for as long as we need it to undertake the administration of your relationship with us and we dispose of expired data securely.
- Personal information may be processed and stored on our secure server system or through external service providers, such as cloud-based systems. Service providers that we use may be situated inside or outside the EU. Any service provider we use must comply with the data protection regulations of the UK.
- The security of your personal data is important to us and we follow strict procedures to comply with the law and protect this data as much as possible.
- We never sell your personal data onto third parties. We will only share your information if we are legally required to do so, to protect or defend our rights, or if we are working with service providers who operate on our behalf.
- Our website uses cookies and you have the right to manage your cookie preferences, which can be done through your web browser.
- We do not knowingly collect personal information from children aged 16 or under without the consent of a parent or guardian and will delete any data if we have reason to believe we hold such data.
- Under UK data protection law, you have rights over the personal information that we hold about you. You can contact us any time to exercise your data rights or change your preferences, by emailing enquiries@walesairambulance.com or by writing to: Data Protection, Wales Air Ambulance, Tŷ Elusen, Ffordd Angel, Llanelli Gate, Dafen. SA14 8LQ.
Personal data we collect and how we use it
Personal data may be collected in a number of ways, depending on how you choose to engage with us. This can include enquiries we receive from you, orders and donations you make, subscription to our Lifesaving Lottery, signing up to a newsletter, fundraising or publicity activity you undertake, or applying for a job or voluntary role.
The personal data we collect may include: name, address, telephone number, email address, financial information and customer history. Customer history is a log of your activity with us, such as donations we have received from you.
We may store and use your personal information for the purposes of administration; events participation; organisation records; volunteer records; recruitment; fulfilling and recording enquiries, orders, donations and subscriptions; and marketing, if you have chosen to opt-in to receive news and information from us.
Enquiries we receive from you
We use information from web forms, emails, mail, telephone and social media platforms to send you information or materials that you have requested. The information you have provided is used to contact you to fulfil the enquiry.
Orders and donations
Any orders or donations you make will require personal and financial information. We collect your contact information (such as name, telephone or email address) and your payment details (such as a credit card or Direct Debit instructions).
Contact information and financial information are used to fulfil the order or donation. Financial information that is collected is held securely and deleted on an ongoing basis (credit card details are not stored by us). Your contact information may be used to get in touch with you in order to fulfil the order or donation.
When you make an order or donation to us, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates.
Lifesaving Lottery subscriptions
In subscribing to our Lifesaving Lottery membership, we will require personal and financial information. We collect your contact information (such as name, telephone or email address) and your payment details (such as a credit card or Direct Debit instructions).
Contact information and financial information are used to fulfil the subscription process. Financial information that is collected is held securely and deleted on an ongoing basis (credit card details are not stored by us). Your contact information may be used to get in touch with you in order to fulfil the subscription and any enquiries you may have.
From time to time, we may use your information to contact you about your subscription. This includes if you have won a prize or if there is an issue with your subscription.
When you become a Lifesaving Lottery member, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates.
Signing up to a newsletter or updates
We will collect and store your name, address and/or email address if you choose to provide this information in signing up to a newsletter or updates from Wales Air Ambulance.
Fundraising
We are grateful for any fundraising activities you choose to undertake in aid of Wales Air Ambulance, and we will use the contact information you provide to offer and coordinate any support, requests or enquiries you have during your fundraising with us.
When you fundraise for us, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates.
Publicity
An important part of what we do is raising awareness of our charitable activity in the public domain, to generate interest and support for Wales Air Ambulance. This may include stories shared on social media, in the press or in literature we produce.
We are always grateful to supporters who approach us to share their story. If you contact us to share your story, we will use the information gathered from you (from web forms, emails, mail, telephone and social media, for example) to generate publicity with your permission. We will seek your consent to store your personal information so that we may keep in touch with you, if appropriate.
If we are already in contact with you regarding a donation, lottery subscription, fundraising or voluntary activity, we may use this information to ask you if you would be interested in sharing your story. Your preferences will be recorded so we know if we can or cannot contact you about publicity opportunities in future.
Social media
We operate a number of social media platforms including, but not limited to, Facebook, Twitter, YouTube and Instagram. Depending on your settings or the privacy policies for each social media site or messaging service, you might give us permission to access personal information from those services. For example, when you send us a message or tag us in an event photo.
Although this policy covers how we will use any data collected from these social media sites, it does not cover how the providers of social media websites will use your information. Please ensure you read the privacy policy of social media sites before sharing data and make use of their privacy settings and reporting mechanisms to control how your data is used.
Applying for a job or voluntary role
We will collect personal data about you, such as your name and contact details. We will also collect sensitive personal data, such as information on your CV or application form. This personal data and sensitive personal data will be stored, processed, used and disclosed by us in the following ways:
- To facilitate the recruitment process and enable you to apply for jobs or a voluntary role.
- To answer your questions and enquiries.
- To third parties when necessary for reference checking, or through recruitment services we may use.
- To use your information on an anonymised basis to monitor compliance with our equal opportunities policy.
Profiling
Wales Air Ambulance does not use personal information to undertake automated individual decision-making (making decisions solely by automated means without human involvement) or profiling (automated processing of personal data to evaluate certain things about an individual).
Patient confidentiality
Wales Air Ambulance is an independent charity and, while we work closely with our NHS partners, the charity is not part of the National Health Service. This means we do not collect, store or have access to medical records, mission data that identifies patients, or any other personal data held on NHS servers.
Clinical data for the missions we undertake is carefully regulated by NHS Wales. We will only collect, use and store anonymised data, or the personal information of patients who have consented to share their details for publicity purposes.
For advice and information regarding medical records, please email abm.emrtsrecords@wales.nhs.uk or write to: Confidential – FAO EMRTS Cymru, Tŷ Elusen, Ffordd Angel, Llanelli Gate, Dafen. SA14 8LQ.
Storing and erasing your information
Any personal information we collect is stored by us on secure computers, servers or paper files located in the UK. We may transfer the information we hold to any of our offices in the UK, store it on our secure server system, or use cloud-based services or database systems supplied by external providers. These providers may be situated inside or outside the European Union. Any provider we use for storing or processing personal information must comply with the data protection regulations of the UK and we carry out checks on these companies for compliance.
We will keep your information only for as long as we need it to undertake the following: provide you with the goods, services or information you have required; administer your relationship with us; to inform you of our news and charitable activities, if you have consented to this; to comply with the law; or to ensure we do not communicate with people that have asked us not to. When we no longer need information, we will always dispose of it securely, using specialist companies if necessary to do this work for us.
Security
We are committed to ensuring that your personal data is secure. In order to prevent unauthorised access or disclosure, we have put in place physical and electronic procedures to protect against the loss, misuse and alteration of personal data under our control. While we cannot guarantee that loss, misuse or alteration of data will not occur under our control, we follow strict procedures and comply with the law in order to protect data as much as possible.
Unfortunately, the transmission of data across the internet is not always completely secure. While we do our best to protect the security of your information, please take your own steps to ensure your antivirus software is up-to-date, passwords are kept confidential and you follow safe practices online. We cannot guarantee that loss, misuse or alteration of data will not occur when data is transferred to us; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
Sharing your information
We will never sell your personal data on to third parties.
We will only share your personal data if:
- We are legally required to do so, and then only with the express authority of the Chief Executive. For example, by a law enforcement agency legitimately exercising a power, or if compelled by an order of the court.
- We believe it is necessary to protect or defend our rights, property, or the personal safety of our people or visitors to our premises or websites.
- We are working with carefully-selected service providers who carry out work on our behalf. This can include our website and IT providers; mailing, marketing or PR agencies (if you have provided consent); and payment or online form processors. We will only use service providers we can trust and who provide evidence that they comply with UK data protection regulation.
Your personal data may also be shared with us by third parties, whom you have provided information to. For example: independent event organisers, such as JustGiving or VirginMoneyGiving; recruitment and volunteering websites or agencies; and service providers who are acting on our behalf, such as lottery canvassers and online shop platforms.
Your data and your rights
Under UK data protection law, you have rights over the personal information that we hold about you. We have summarised these below.
If you would like to contact us about your data and your rights, please email enquiries@walesairambulance.com or write to: Data Protection, Wales Air Ambulance, Tŷ Elusen, Ffordd Angel, Llanelli Gate, Dafen. SA14 8LQ.
Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s data protection regulator, the Information Commissioner’s Office (ICO) – external link.
Right to access your personal information
You have the right to request access to the personal data that we hold about you. You also have the right to request a copy of the information we hold about you, and we provide you with this unless legal exceptions apply.
If you want to access your information, please send a description of the information you want to see via email or post using our Data Protection contact details above.
Right to have your inaccurate personal information corrected
You have the right to have inaccurate or incomplete information we hold about you corrected. If you believe the information we hold about you is inaccurate or incomplete, please provide us with details and we will investigate and, where applicable, correct any inaccuracies.
Right to restrict the use of your personal information
You have the right to ask us to restrict the processing of some or all of your personal information in the following situations: if some information we hold on you is not right; we are not lawfully allowed to use it; you need us to retain your information in order for you to establish, exercise or defend a legal claim; or you believe your privacy rights outweigh our legitimate interests to use your information for a particular purpose and you have objected to us doing so.
Right to erasure of your personal information
You may ask us to delete some or all of your personal information and in certain cases, and subject to certain exceptions, you have the right for this to be done.
Right for your personal information to be portable
In certain circumstances, if we are processing your personal information you may ask us to provide it to you or another service provider in a machine-readable format. This includes data that is processed based on your consent, or in order to enter into or carry out a contract with you, and the processing is being done by automated means.
Right to object to the use of your personal information
If we are processing your personal information based on our legitimate interests, you have the right to object to our use of your data.
If we are processing your data for direct marketing purposes and you wish to object, we will stop processing your information for these purposes as soon as reasonable possible.
You can exercise your right to object by emailing or writing to us using our Data Protection contact details above. We may be required to ask for further information and/or evidence of identity. We will endeavor to respond fully to all requests within one month of receipt of your request; however, if we are unable to do so we will contact you with reasons for the delay.
Use of cookies
What are cookies?
Cookies are small text files which are placed on your computer by websites that you visit. They are widely used to make websites work, or work better, as well as to provide information to the owners of a website. For example, they can help to make sure images appear correctly on your device by storing information about the size of your browser, or tell a website operator how well a webpage is performing.
A cookie contains an ‘identifier’ (a string of letters and numbers). Cookies may be either ‘persistent’ cookies or ‘session’ cookies. A persistent cookie will be stored by a web browser and will remain valid until its set expiry date or it is deleted by the user before the expiry date. A session cookie will expire at the end of the user session, when the web browser is closed.
Cookies do not typically contain any information that personally identifies a user, but they can be linked to other personal information stored about you.
How we use cookies and your rights
Wales Air Ambulance uses cookies on its website. These cookies are used to enhance the experience of our visitors and to better understand how our website is used and how our advertisements perform. For example, cookies may tell us whether you have visited our site before or if you are a new visitor. Our cookies do not store financial information or information which is capable of directly identifying you (such as your name and address).
You have the right to choose whether to accept these cookies. You can exercise this right by amending or setting the controls on your browser to reflect your cookie preferences. However, please note that if you choose to refuse cookies you may not be able to use the full functionality of our website.
For more information on cookies and guidance on managing your cookies, please visit the Information Commissioner’s Office website (external link).
Cookies that we use
The following cookies are used on our website, as set by our website service provider. These cookies may be stored on your computer when you visit our website.
We use Google Analytics to analyse the use of our website. Google Analytics gathers information about website use by means of cookies. This data may be stored outside the EU, under an EU-US Privacy Shield agreement. The information gathered relating to our website is used to create reports about the use of our website. Google’s privacy policy is available at: https://www.google.com/policies/privacy.
| Cookie Name | Used by | Description | Expiration |
| __utma | Google Analytics | Stores the amount of visits of a user, the time of their first visit, the previous visit, and the current visit. It does not contain any personal information and is used only for analytical purposes. | 2 years from set/update |
| __utmz | Google Analytics | This performance cookie stores where a user came from (eg. search engine, search keyword, link). | 6 months from set/update |
| _ga and _gid | Google Analytics | Used to distinguish between website users in Google Analytics. | 2 years and 2 hours |
| _gat_UA-XXXXXXXX-X (where the Xs are replaced by the Google Analytics ID number) | Google Analytics | Used to moderate calls to the Google Analytics service. | 1 minute |
| __unam | ShareThis | Set as part of the ShareThis service and monitors "click-stream" activity, e.g. web pages viewed, navigation from page to page, time spent on each page etc. The ShareThis service only identifies a user if they have separately signed up with ShareThis for a ShareThis account and given them consent. Checks how long you stay on a site: when a visit starts, and ends. It does not contain any personal information and is used only for analytical purposes. | 14 months |
| cc_cookie_accept | Website | Stores whether the user has accepted the cookie message or not. | 365 days |
| ASP.NET_SessionId | Website | Used for authenticating a user's session after logging in. Closes when you exit the browser. | End of session |
| ARRAffinity | Website | Tells our infrastructure which server to handle the request. | End of session |
| MemberLoggedIn | Website | A binary flag which stores whether a user is logged in or not. | End of session |
| ai_session and ai_user | Website | Tracks users as they navigate the website predominately for infrastructure performance insights. | 1 day |
| DisplayName | Website | Keeps track of a donors preference to show their name during a Direct Debit. | End of session |
| IDE, DSID, _ct_rmm | Doubleclick.net | These cookies are managed by DoubleClick, an advertising platform we use to display adverts. They help us identify which visitors to our website have seen or clicked one of our adverts. | 2 years from set/update |
| __cfduid | CloudFlare | Identify individual clients behind a shared IP address and apply security settings on a per-client basis | 365 days |
Cookies set by third parties
If you go on to a page on our website which contains embedded content, you may be sent cookies from these websites. For example, clicking on YouTube videos, or using ‘share’ buttons which enable users to easily share webpage content through popular networks such as Facebook and Twitter. These sites may set a cookie when you are logged into their service.
We do not control the setting of these cookies, so we suggest you check the third party website for more information about their cookies and how to manage them.
Links to websites
Our website includes hyperlinks to, and details of, third party websites. We have no control over, and are not responsible for, the privacy policies and practices of third parties.
Personal data of children
We do not knowingly collect or solicit personal information from anyone aged 16 or under, or knowingly allow such persons to provide us with their personal information without parent or guardian consent. If you are aged 16 or under, please get the permission of your parent or guardian before using our website.
If we have reason to believe that we hold personal data of a person aged 16 or under without the consent of a parent or guardian, we will delete that data.
If you believe that we might have information from or about anyone aged 16 or under without the consent of a parent or guardian, please email enquiries@walesairambulance.com or write to: Data Protection, Wales Air Ambulance, Tŷ Elusen, Ffordd Angel, Llanelli Gate, Dafen. SA14 8LQ.
Changes to this policy
We may change this privacy policy from time to time. If we make any significant changes in the way we treat your personal information, we will make this clear on the Wales Air Ambulance website or by contacting you directly.
Please ensure you read and understand this privacy policy in full from time to time. Regularly reviewing how your personal information is used helps to ensure you are aware and in control of your data.
Enquiries and complaints – contact us
If you have any questions, comments or suggestions, or would like to exercise your data rights, please let us know by emailing enquiries@walesairambulance.com or by writing to: Data Protection, Wales Air Ambulance, Tŷ Elusen, Ffordd Angel, Llanelli Gate, Dafen. SA14 8LQ.
You can change your mind about how we use your personal data at any time by contacting us on the above email or postal address.
If you are unhappy with any aspect of how we are using your personal information, we would like to hear about it. We appreciate the opportunity that this feedback gives us to learn and improve. You can read our full complaints policy on our website here.
You also have the right to lodge a complaint about any use of your personal data with the UK’s data protection regulator, the Information Commissioner’s Office (external link); or with the Charity Commission (external link). Our registered charity number is 1083645.
