How we will use your personal data, the legal bases we will rely upon, how long we will keep your personal data and other details will depend upon who you are and why we need your personal data in the first place.

In this section, we provide specific privacy information relating to the different categories of individuals that this privacy notice applies to.


    Enquiries we receive from you

    Purpose and lawful basis for processing

    When you contact us to make an enquiry, we collect information, including your personal data, so that we can respond to it and fulfil your request.

    The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon for responding to your enquiry are:

    • Our legitimate interest in assisting you with your enquiry.
    • Our legitimate interest in improving our business and training our staff.

    If your enquiry involves providing us with any special category personal data such as health, religious or ethnic information, we will only process that information if it is necessary for reasons of substantial public interest under article 9(2)(g) GDPR or where you have given your express consent – article 9(2)(a) GDPR.

     

    What we need and why and how long is it kept

    We need enough information from you to answer your enquiry. We use information from web forms, emails, mail, telephone and social media platforms to send you information or materials that you have requested. We will usually need to take your name and contact details from you, and we may make notes to provide you with a further service as required. If you contact us via email or post, we will need a return address for a response. We may record telephone calls (see section 3.2 on call recordings).

    General enquiries are kept for up to 1 year after the case is closed. Complaints are kept for up to 3 years after the case is closed. For enquiries and complaints relating to fundraising, lottery and donation records, these may be kept for longer. Please refer to the relevant sections below for more information.

     


    Call and meeting recordings

    Calls to our 0300 number

    Purpose and lawful basis for processing

    WAAC operates call recording technology, which is used to record inbound calls to our telephone number, 0300 0152 999.

    The lawful basis we rely on to process call recordings is article 6(1)(f) of the GDPR, which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon to record inbound calls is to provide an exact record for the following purposes:

    1. a. Staff training, to help us improve the quality of our customer service and ensure the information we provide is consistent and accurate.
    2. Establishing the facts in the event of a complaint by a caller, member of staff or volunteer, or suspected criminal or fraudulent activity, and used as evidence during any associated investigation.
    3. Protecting our supporters in line with our Ethical Gift Donor Policy and those who may be at particular economic risk.

     

    What we need and why and how long it is kept

    Inbound telephone calls to our number 0300 0152 999 are recorded automatically by protected software managed by our IT provider. Calls which are transferred between our office extension numbers are not recorded; this includes inbounds calls which are then transferred to another department. Outbound calls made from our offices to an external number are also not recorded.

    We comply with Payment Card Industry Security Standards (PCI DSS) by transferring inbound calls to another secure internal line before taking credit/debit payments and bank details.  

    We also make every reasonable effort to ensure other sensitive information and special category data is not recorded, which includes playing an automated message at the start of each inbound call informing you of the recording and your data rights.  

    Call recordings are stored on a secure server by our IT provider and retained for up to 12 months. Recordings which are being used as part of an investigation as described in section 3.2.1(b) above may be retained for longer subject to the issue being resolved.

    Teleconference and virtual meeting/event recordings

    Purpose and lawful basis for processing

    From time to time WAAC may wish to record teleconference calls and virtual meetings/events using the software and cloud-based systems available on our devices. This will be for one of the following purposes:

    • To provide an exact record of a scheduled teleconference or virtual meeting/event in order to accurately transcribe minutes.
    • To publish a webinar as part of WAAC publicity.

    The lawful basis we rely on to process your personal data for teleconference and virtual meeting/event recordings is article 6(1)(a) of the GDPR which allows us to process personal data where you have given your consent to the processing.

    What we need and why and how long it is kept

     

    We will collect your name, email address and/or telephone number and your explicit consent before the call or meeting begins. Consent will be requested in writing, either via the contact details you have provided or via a tick-box declaration at the start of a virtual meeting/event. The recording of a call or meeting will not proceed if we do not have explicit consent from all participants. In the case of a promoted webinar in which we provide advance notice that we intend to publish the event, you may not be granted access to the event if you do not consent to the recording.   

    You can withdraw your consent at any time. However, this will not affect the validity of consent previously provided for any recordings already made.

    Any participation by you within the teleconference or virtual meeting/event will be recorded for the duration of the activity. This can include your username, audio and video input and document and screen-sharing from your device.

    Please also ensure you read the privacy policy of virtual meeting sites before sharing data and make use of their privacy settings and reporting mechanisms to control how your data is used.

    Recordings for transcription purposes are retained for up to 6 months from the date of the recording. Webinars which are published by WAAC are retained indefinitely.

     


    Donations

    Purpose and lawful basis for processing

    When you make a donation to us, whether online, over the phone, by post or via social media like Facebook, as a one-off donation or regular giving membership, we collect information, including your personal data, so that we can process your donation and reclaim tax via Gift Aid.

    The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon to process your donation and to obtain any tax reimbursements is that it is in our legitimate interests to maximise the donations received to be able to fulfil our charitable purposes.

     

    What we need and why and how long is it kept

     

    Any donations you make will require personal and financial information. We collect your contact information (such as name, telephone or email address) and your payment details (such as a credit card or Direct Debit instructions). We may also collect details about your tax status. 

    Contact information, financial information and tax status are used to process the donation and reclaim tax through Gift Aid. Financial information that is collected is held securely and deleted on an ongoing basis (credit and debit card details are not stored by us). Your contact information may be used to get in touch with you in order to process the donation and to check if we can reclaim Gift Aid. Gift Aid and donation records are kept for up to 7 years from the last action.

    When you make a donation to us, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates. 


    Lifesaving Lottery subscriptions

    Purpose and lawful basis for processing

    In subscribing to our Lifesaving Lottery membership, we will require personal and financial information in order to fulfil the subscription process, administer your membership and contact you if you have won a prize or there is an issue with your subscription.

    The lawful basis we rely on to process your personal data is article 6(1)(b) of the GDPR which allows us to process personal data when this is necessary for the performance of a contract.

     

    What we need and why and how long is it kept

     

    We collect your contact information (such as name, telephone or email address) and your payment details (such as a debit card or Direct Debit instructions). These are used to fulfil the subscription process and process payment. Your contact details are also used to administer your membership and notify you if you have won a prize.

    Financial information that is collected is held securely and deleted on an ongoing basis (debit card details are not stored by us). Your contact information may be used to get in touch with you in order to fulfil the subscription, discuss your membership and respond to any enquiries you may have. Lottery membership records are kept for up to 7 years from the last action.

    When you become a Lifesaving Lottery member, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates. 


    Ordering goods online

    Purpose and lawful basis for processing

    When making your purchase online, you will be required to provide us with your personal data so that we can process the order, take payment and deliver the products you have purchased.

    The lawful basis we rely on to process your personal data is article 6(1)(b) of the GDPR which allows us to process personal data when this is necessary for the performance of a contract.

     

    What we need and why and how long is it kept

    We collect your contact information (such as name, postal address, telephone or email address) and your payment details (such as a credit card).

    Your card details are required to enable us to take payment. This information is held securely and deleted on an ongoing basis (credit and debit card details are not stored by us). Your contact information may be used to get in touch with you in order to fulfil your order or if there any queries with your order. Your address is required in order to deliver the products you have purchased. Records of online orders are kept for up to 7 years from the last action.

    When you order goods online from us, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates. 


    Delivery and collections service

    Purpose and lawful basis for processing

    When you contact us to arrange a collection of unwanted goods for our charity shops, or when you use our delivery service for furniture and other large items bought in our shops, we will collect your personal data so that we can fulfil the service you have requested. 

    If you sign up to our Gift Aid scheme through the sale of your unwanted goods, we will also process your personal data to reclaim tax via Gift Aid. 

    The lawful basis we rely on to process your personal data for collections and Gift Aid is article 6(1)(f) of the GDPR, which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon are:

    • Our interests in raising money for the charity by facilitating donations of goods for our shops,
    • Maximising the sale of donated goods through Gift Aid, where possible.

    The lawful basis we rely on to process your personal data for our delivery service is article 6(1)(b) of the GDPR which allows us to process personal data when this is necessary for the performance of a contract.

     

    What we need and why and how long is it kept

    We collect your name, address and telephone number so we can locate your premises and contact you if we need to regarding your delivery or collection. Payment for the delivery service is taken in our shops when purchasing the goods. We may also collect details about your tax status.

    When you use our delivery or collection service, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates.  

    Gift Aid records are kept for up to 7 years from the last action. Personal data used for our delivery and collection service is kept for up to 2 years from the last action.


    Fundraising

    Purpose and lawful basis for processing

    We are grateful for any fundraising activities you choose to undertake in aid of Wales Air Ambulance. When you contact us for information on how to fundraise, we will ask for your name and contact details to enable us to provide you with information, answer your queries and for general support with your fundraising activity.  

    Sometimes when you sign up to take part in specific fundraising events, we will also require emergency contact details.

    When paying in the money you have raised we may, depending on the method you use, need to process your bank or credit card details to take payment of the monies raised. Should you use a sponsor form to keep a record of the monies raised, we will also process names, contact details and the tax status of your sponsors in order to process payments and reclaim tax through Gift Aid on eligible donations.

    The lawful basis we rely on to process your personal data and that of people who sponsor you is article 6(1)(f) of the GDPR which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon are:

    • our interests in raising money for the charity by facilitating fundraising activities, and
    • processing donations and maximising donations through Gift Aid, where applicable.

     If your enquiry involves providing us with any special category personal data such as health, religious or ethnic information, we will only process that information where you have given your express consent.

     

    What we need and why and how long is it kept

    We collect your name, telephone number, email address and postal address in order to offer and coordinate any support, requests or enquiries you have during your fundraising with us and to send you any materials that may assist with your fundraising activity.

    When we ask for emergency contact details, we need this information for health and safety purposes. We do not ask for information relating to health conditions or assess your suitability to take part in an event.

    When using a sponsorship form we need the names, addresses and tax status of the sponsors to be able to reclaim tax via Gift Aid.

    When using a bank transfer or a credit/debit card to pay the monies you have raised to us, we will need your bank or card details in order to process the payment. This information is held securely and deleted on an ongoing basis (credit and debit card details are not stored by us). 

    Personal data for fundraising activities and events is held for up to 7 years from the last action.

    There are a variety of different ways you can donate to us and if you decide to do so via JustGiving, Facebook or any other online giving platforms, any personal data processed will be done under the terms of the relevant online giving or social media platform. Other people, not us, control these platforms and you should therefore review the terms and conditions and privacy policies of these other organisations. That way, you will understand how they will use your information, what information relating to you they will place in the public domain and what you can do if you are unhappy about it.

    When you fundraise for us, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates. 


    Grant fundraising: Trusts and Foundations

    Purpose and lawful basis for processing

    Wales Air Ambulance researches grant funding opportunities relevant to us, which may include sourcing the names and contact information (including publicly available information) of Trustees, grant officers, secretaries or other persons actively involved in the Trust or Foundation. This personal data will be used so we can contact you with our enquiries regarding a grant and the application process.

    We do not undertake wealth screening or profiling of high net worth individuals. 

    The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon are our interests in raising money for the charity by facilitating grant funding we may be eligible for.

    What we need and why and how long is it kept

    We collect the contact details of the relevant person(s) involved in the Trust or Foundation, so we can contact you about the grant. This includes name(s), email address(es), a postal address and telephone number(s).

    This information is held either indefinitely if the details remain accurate and we continue to have contact with you about grant opportunities, or for 7 years since the last action.


    Publicity – Fundraising or patient stories

    Purpose and lawful basis for processing

    An important part of what we do is raising awareness of our charitable activity in the public domain, to generate interest and support for Wales Air Ambulance. This may include stories shared on social media, on our website, in the press or in literature we produce. 

    We are always grateful to supporters who approach us or agree to share their story. If you agree to share your story, we will use the information gathered from you (from web forms, emails, mail, telephone and social media, for example) to generate publicity and raise awareness of our work with your permission.

    The lawful basis we rely on to process your personal data is Article 6(1)(a) of the GDPR which allows us to process personal data where you have given your consent to the processing. If your story involves providing us with any special category personal data such as health, religious or ethnic information, we will only process that information where you have given your explicit consent.

    Where the information provided is in relation to a child under the age of 18, we will request the consent of a person with parental responsibility for the child. Parents/guardians and individuals who are 18 or over will be asked to complete a consent form or provide another form of written consent to process the information.

    If we are already in contact with you regarding a donation, lottery subscription, fundraising or voluntary activity, we may use this information to ask you if you would be interested in sharing your story. Your preferences will be recorded so we know if we can or cannot contact you about publicity opportunities in future.  

    What we need and why and how long is it kept

    We need your name and contact details to liaise with you regarding your story and details of your activity, or the incident which occurred when you required our assistance, together with information about your experience of the service we provide and any other relevant information. 

    You can withdraw your consent at any time. However, this will not affect the validity of consent previously provided for publications already made.

    We will keep your personal data until you inform us that you no longer wish us to use the information for publicity purposes, or if the case study has not been actively used for more than 5 years. If your records also relate to donations, lottery subscriptions or voluntary activity we may keep some of your details for longer (see the relevant sections herein). An index of the deleted record, a redacted consent form and the original press release are retained indefinitely. The withdrawal process will include asking individuals if they wish for digital testimonials within WAAC’s control to be erased; for example, on our website.


    Applying for a job or voluntary role

    Purpose and lawful basis for processing

    Our purpose for processing this information is to assess your suitability for a role you have applied for and to help us develop and improve our recruitment process.

    The lawful basis we rely on for processing your personal data is article 6(1)(b) of the GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract.

    If you provide us with any information about reasonable adjustments you require under the Equality Act 2010, the lawful basis we rely on for processing this information is article 6(1)(c) to comply with our legal obligations under the Act.

    The lawful basis we rely on to process any information you provide as part of your application which is special category data, such as health, religious or ethnicity information is article 9(2)(b) of the GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights.

    We process information about applicant criminal convictions and offences. The lawful basis we rely on to process this data is Article 6(1)(c) to comply with a legal obligation. In addition, we rely on the processing condition under Article 9(2)(b) where the processing is necessary for complying with employment, social security and social protection law and/or Article 9(2)(g) where the processing is necessary for reasons of substantial public interest, namely, preventing or detecting unlawful acts, safeguarding, protecting the public against dishonesty, preventing fraud or suspicion of terrorism or money laundering.

     

    What we need and why and how long is it kept

    We will use all the information you provide during the recruitment process to progress your application with a view to offering you an employment contract or a volunteering role with us, or to fulfil legal or regulatory requirements if necessary. We will use your name and contact details to correspond with you as part of the process. 

    If you provide us with any information about reasonable adjustments you require, we will use this information to make any reasonable adjustments required.

    We will not share any of the information you provide with any third parties for marketing purposes.

    We will use the contact details you give us to contact you to progress your application. We may also contact you to request your feedback about our recruitment process. We will use the other information you provide to assess your suitability for the role.

    We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions as part of the recruitment process.

    To make sure we meet our legal data protection and privacy obligations, we only hold on to your information for as long as we actually need it for the purposes we acquired it in the first place.

    In most cases, this means that information gathered as part of the recruitment exercise will usually be retained for up to 6 months after the recruitment exercise has been completed. In the case of a successful applicant, information which is relevant to the ongoing employment or volunteering relationship will be transferred to the employee’s/volunteer’s personnel record and retained in accordance with the periods applicable for employees and volunteers.


    CCTV

    Purpose and lawful basis for processing

    We use Closed-circuit television (CCTV) footage outside or inside our buildings. The purpose for processing this information is for security and safety reasons.

    The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests. Our legitimate interests are to ensure the safety of our property, staff and visitors.

    What we need and why and how long it is kept

    We process CCTV images to prevent crime and protect buildings and assets from damage, for the personal safety of staff, visitors and other members of the public. 

    CCTV recordings are usually deleted after approximately 28 days unless an incident has occurred and the CCTV footage is required to be retained for a longer period to assist with the incident.


    Website

    Purpose and lawful basis for processing

    When you use our website, some personal data will be obtained about you and used in order to maintain and monitor the performance of our website and to enable us to continually improve our website.

    The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests. Our legitimate interests are ensuring that our website is up to date, efficient and user friendly.

    Our website includes hyperlinks to, and details of, third party websites. We have no control over, and are not responsible for, the privacy policies and practices of third parties.

     

    What we need and why and how long is it kept

    We collect technical information about your visit, including the full Uniform Resource Locators (“URL”), clickstream to, through and from our website (including date and time), page response times, download errors, length of visit to certain pages, and methods used to browse away from the page.

    Some of the information is collected by us each time you use our website through our use of cookies. Further information about the cookies we use and the purposes for which we use them can be found in the Use of Cookies section below.

    When you send us personal data through the website, for example when joining our lottery, making a donation or ordering goods, your personal data is processed via our website content management system (CMS) and retained for up to 7 years in line with the relevant sections above. Please refer to the relevant area of Section 3 on the personal data we collect, and Section 6 on sharing your information with service providers.

     


    Social media

    We operate a number of social media platforms including, but not limited to, Facebook, Twitter, YouTube and Instagram. Depending on your settings or the privacy policies for each social media site or messaging service, you might give us permission to access personal data from those services. For example, when you send us a message, tag us in an event photo or make a donation.

    Although this policy covers how we will use any data collected from these social media sites, it does not cover how the providers of social media websites will use your information. Please ensure you read the privacy policy of social media sites before sharing data and make use of their privacy settings and reporting mechanisms to control how your data is used.


    Profiling your interests

    Purpose and lawful basis for processing

    Wales Air Ambulance does not use personal data to undertake automated individual decision-making (making decisions solely by automated means without human involvement). We do not use personal data to undertake wealth screening or data matching. We do not buy or sell personal data.

    In limited circumstances, we may use the personal data of some supporters to undertake a type of profiling (processing of personal data to evaluate certain things about an individual) for direct marketing purposes. For example, we may use the personal data of supporters who have taken part in a running event to send information on a future running event being held, which they may be interested in. We will only send you news and updates if you have provided consent for us to do so.

    We do not use special category data (such as health, religious or political beliefs, racial or ethnic origin) in profiling. We do not undertake profiling using the personal data of anyone under the age of 18. We do not use publicly available information about you, professional consumer profiling agencies or online databases: we will only record information you have given us directly.

    The lawful basis we rely on to process your personal data for interests-based profiling is Article 6(1)(f) of the GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests. Our legitimate interests are to raise money for the charity by facilitating fundraising activities through tailored events and communications, which specific supporters have requested updates on. Additionally, interests-based profiling will only be undertaken on records for which we have explicit consent to receive news and updates from us. We rely on the lawful basis of consent for this, which is covered in the direct marketing section 3.15.

     

    What we need and why and how long is it kept

    When you engage in an activity such as fundraising for us, the type of activity is recorded alongside your other personal data (name, contact details and information you share with us about your support for Wales Air Ambulance). We will record if the activity relates to a tailored news topic that we provide, such as upcoming running events, and if we have your consent to receive news and updates from us. Only when the above criteria are met will we consider using your personal data to generate interests-based profiling for tailored news and updates.

    Fundraising records are kept for up to 7 years from the last action. For more information please see the sections on fundraising and direct marketing within Section 3.

     


    Signing up to a newsletter or updates (direct marketing)

    Purpose and lawful basis for processing

    If you sign up to receive newsletters or updates from us, we will ask you to provide your name and contact details in order to send you the newsletters or updates you have requested. 

    The lawful basis we rely on to process your personal data is Article 6(1)(a) of the GDPR which allows us to process personal data where you have given your consent to the processing.

    What we need and why and how long is it kept

    Direct marketing preferences are recorded in a ‘granular’ way. This means we keep a record of the methods you have specifically consented to us using to send news and updates (for example, email only).

    We collect your name, email address and/or postal address and/or telephone number, and your preferences as to how you want to be communicated with, in order to process your request and to send you the newsletters or updates you have requested. We may also keep a record of certain topics you may be interested in, such as running events, and use this information to make decisions about the type of news and updates we send you (please refer to the Profiling section 3.14).

    We will keep your personal data until you inform us that you no longer wish to receive newsletters or updates from us. If your personal data forms part of a fundraising or donation record, we may keep your personal data for longer but consent to receive news and updates will be removed from the record.


    Direct marketing suppressions (record of objection)

    Purpose and lawful basis for processing

    You can object to direct marketing from us at any time. When you object to direct marketing, the personal data we receive from you or an agency on your behalf (such as the Fundraising Preference Service or Telephone Preference Service) is called a Suppression Record.

    The lawful basis we rely on to process your personal data suppression is Article 6(1)(f) of the GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests. Our legitimate interests are ensuring we do not send you marketing communications such as news and updates when you have exercised your right to object to direct marketing.

    What we need and why and how long is it kept

    Suppression records are held indefinitely to ensure we do not send you direct marketing communications. We need to hold enough personal data to be able to correctly identify your suppression record. This includes your name, email address and/or postal address and/or telephone number.


    Visitor, Health and safety and safeguarding records

    Purpose and lawful basis for processing 

    Wales Air Ambulance will keep a record of visitors to its premises. Visitors’ names, company name, car registration and date and time of visit are recorded in a visitor’s book.

    We also keep a record of any accidents or incidents you report to us while on any of our premises. This includes personal data you provide us with when reporting the incident, such as your name, contact details and incident information. This is collected so that we can:

    • Follow Health & Safety reporting procedures including the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (‘RIDDOR’),
    • Comply with our legal obligations under the Health and Safety at Work Act 1974, the Management of Health and Safety regulations 1999 and any other relevant Health and Safety Laws,
    • Learn from and improve our health and safety practices (reports are anonymised for Quality purposes),
    • Keep accurate records for the establishment, exercise or defence of legal claims.

    The lawful basis we rely on to process your personal data is Article 6(1)(c) of the GDPR to comply with a legal obligation. 

    The lawful basis we rely on to process any information you provide which is special category data, such as health, religious or ethnicity information is either Article 9(2)(b) of the GDPR, that the processing is necessary in the field of employment and social security and social protection law, or Article 9(2)(f), which relates to processing for the establishment, exercise or defence of legal claims.

    Safeguarding means protecting peoples' health, wellbeing and human rights, and enabling them to live free from harm, abuse and neglect, which includes children, young people and at-risk adults,  from  harm  that  arises  from  coming  into  contact  with  our employees,  volunteers, trustees or other individuals associated with Wales Air Ambulance. It is our responsibility to implement stringent procedures and ensure records and the reporting of safeguarding matters are handled appropriately and in line with the Children Act 1989, the Safeguarding Vulnerable Groups Act 2006 and any other relevant Safeguarding legislation, guidance and policies.  

    The lawful basis we rely on to process your personal data is Article 6(1)(c) of the GDPR to comply with a legal obligation where a legal obligation applies, or otherwise legitimate interests. Our legitimate interests are ensuring the safety of staff, volunteers, visitors and the public we engage with and protecting Wales Air Ambulance’s reputation and interests.

    The lawful basis we rely on to process any information you provide which is special category data, such as health, religious or ethnicity information is either Article 9(2)(b) of the GDPR, that the processing is necessary in the field of employment and social security and social protection law or Article 9(2)(f), which relates to processing for the establishment, exercise or defence of legal claims.

    What we need and why and how long is it kept

    All visitors are required to provide their name, company they work for, person they are visiting and their car registration number. We retain logbooks for up to 4 years. 

    We collect your name, contact details and information relating to the incident or accident, including injuries sustained, so we can comply with reporting procedures. We may also keep records of follow-up enquiries we have with you and notes relating to an investigation as part of the reporting procedure.

    Records relating to health and safety accidents and incidents are kept for 40 years from the date that the record was made.

    Records relating to safeguarding incidents are kept for up to 30 years from the date that the record was made.