Summary information
How we will use your personal data, the legal bases we will rely upon, how long we will keep your personal data, and other details will depend upon who you are and why we need your personal data in the first place.
For transparency, we provide comprehensive privacy information relating to the different categories of individuals/services that this privacy notice applies to. You can select the section(s) that apply to you for relevant details. A general summary is provided here, covering the types of information we might collect, how we might collect it, and why.
| The personal data that we process will depend on the nature of our relationship with you. We collect, store and use the following kinds of personal information: |
- Your name;
- Your contact details (including postal address, telephone number, email address and/or social media identity).
- Your date of birth;
- Your gender and/or personal title or pronouns, such as Mr, Mrs, Ms, him, her, they;
- Your bank or credit card details you provide to us for payments;
- Information in volunteer or job applications, which may include things like employment status, previous experience, equal opportunities monitoring, health information and/or criminal convictions or pending court cases;
- Contact details of next of kin;
- Your tax / Gift Aid status;
- Your interests and marketing preferences;
- Your fundraising and/or donation history;
- The personal information of dependents that you provide to us, such as if they are fundraising with you (this information is kept within your record notes, and you remain the main contact);
- Photographs or video footage you have shared or agreed to, for example at an event, and location data attached to digital imagery;
- Information about activities on our website or social media, including IP address, location data and other tracking cookies;
- CCTV recordings;
- Visitor records and/or accident and incident forms;
- Patient information that you have shared with us for publicity;
- Any other personal information you provide to us to help with enquiries, complaints or support.
|
| We only process the personal data required for our identified purposes. We will use personal information to: |
- provide you with the services, products or information you asked for;
- administer your donation or support your fundraising, including processing Gift Aid;
- keep a record of your relationship with us;
- respond to or fulfil any requests, complaints or queries you make to us;
- understand how we can improve our services, products or information;
- manage our events and fundraising activities;
- protect the health, safety and wellbeing of you, our staff, volunteers and other members of the public;
- further our charitable objectives;
- send you correspondence and communicate with you;
- process applications for funding;
- administer our website and other online platforms;
- conduct due diligence and ethical screening;
- identify potential supporters, donors, ambassadors or other partners;
- personalise information which is presented to you and/or to provide you with targeted advertisements;
- process your application for a job or volunteering position;
- audit and administer our accounts;
- meet our legal obligations, for instance to perform contracts between you and us, or our obligations to regulators, government and/or law enforcement bodies;
- carry out fraud prevention and money laundering checks; and/or
- establish, defend or enforce legal claims.
|
| Most of the personal data we process has been collected directly from you, but there may be other sources of information or a combination of both. We collect information in the following ways: |
- You may give us your information when you donate, sign up to our Lifesaving Lottery, sign up to one of our fundraising activities or inform us of your own fundraising, make enquiries with us, sign up for our newsletter, register as a volunteer, apply for a job, share your personal stories for news, order goods online, use our collection or delivery service, visit and ‘sign in’ at one of our premises, or complete accident or incident forms.
- We may collect personal information when you visit our website or social media, through CCTV or dashcam footage, in photographs and videos that you consent to at events or recorded webinars and calls, through research such as due diligence checks, or via public sources to better understand your interests for news and updates.
- Personal information may be shared with us from suppliers acting on our behalf such as lottery agents, you apply for a job or voluntary role through an external agency or website, through marketing preference services such as the Fundraising Preference Service, digital fundraising platforms such as JustGiving, or via representatives who are authorised to liaise with us on your behalf. You should check any privacy notice when you give your personal information to a third party.
|
IN DETAIL –
Enquiries we receive from you
Purpose and lawful basis for processing
When you contact us to make an enquiry, we collect information, including your personal data, so that we can respond to it and fulfill your request.
The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon for responding to your enquiry are:
- Our legitimate interest in assisting you with your enquiry.
- Our legitimate interest in improving our business and training our staff.
If your enquiry involves providing us with any special category personal data such as health, religious or ethnic information, we will only process that information if it is necessary for reasons of substantial public interest or where you have given your express consent, under Article 9(2) of the GDPR.
What we need and why and how long is it kept
We need enough information from you to answer your enquiry. We use information from web forms, emails, mail, telephone and social media platforms to send you information or materials that you have requested. We will usually need to take your name and contact details from you, and we may make notes to provide you with a further service as required. If you contact us via email or post, we will need a return address for a response.
General enquiries that do not relate to an existing record are kept for up to 1 year after the case is closed. Complaints are kept for up to 7 years after the case is closed. Enquiries relating to data rights requests are kept for up to 7 years from resolution. For enquiries and complaints relating to ongoing fundraising, lottery and donation records, these may be kept for longer. Please refer to the relevant sections below for more information.
Donations
Purpose and lawful basis for processing
When you make a donation to us, whether online, over the phone, by post or via social media like Facebook, as a one-off donation or regular giving membership, we collect information, including your personal data, so that we can process your donation and reclaim tax via Gift Aid.
The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon to process your donation and to obtain any tax reimbursements is that it is in our legitimate interests to maximise the donations received to be able to fulfil our charitable purposes.
What we need and why and how long is it kept
Any donations you make will require personal and financial information. We collect your contact information (such as name, telephone or email address) and your payment details (such as a credit card or Direct Debit instructions). We may also collect details about your tax status.
Contact information, financial information and tax status are used to process the donation and reclaim tax through Gift Aid. Financial information that is collected is held securely and deleted on an ongoing basis (credit and debit card details are not stored by us). Your contact information may be used to get in touch with you in order to process the donation and to check if we can reclaim Gift Aid. Gift Aid and donation records are kept for at least 7 years from the last action.
When you make a donation to us, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates.
Lifesaving Lottery subscriptions
Purpose and lawful basis for processing
In subscribing to our Lifesaving Lottery membership, we will require personal and financial information in order to fulfil the subscription process, administer your membership and contact you if you have won a prize or there is an issue with your subscription.
The lawful basis we rely on to process your personal data is article 6(1)(b) of the GDPR which allows us to process personal data when this is necessary for the performance of a contract.
What we need and why and how long is it kept
We collect your contact information (such as name, telephone or email address) and your payment details (such as a debit card or Direct Debit instructions). These are used to fulfil the subscription process and process payment. Your contact details are also used to administer your membership and notify you if you have won a prize.
Financial information that is collected is held securely and deleted on an ongoing basis (debit card details are not stored by us). Your contact information may be used to get in touch with you in order to fulfil the subscription, discuss your membership and respond to any enquiries you may have. Lottery membership records are kept for up to 7 years from the last action.
When you become a Lifesaving Lottery member, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates.
Fundraising
Purpose and lawful basis for processing
We are grateful for any fundraising activities you choose to undertake in aid of Wales Air Ambulance. When you contact us for information on how to fundraise, we will ask for your name and contact details to enable us to provide you with information, answer your queries and for general support with your fundraising activity.
Sometimes when you sign up to take part in specific fundraising events, we will also require emergency contact details.
When paying in the money you have raised we may, depending on the method you use, need to process your bank or credit card details to take payment of the monies raised. Should you use a sponsor form to keep a record of the monies raised, we will also process names, contact details and the tax status of your sponsors in order to process payments and reclaim tax through Gift Aid on eligible donations.
The lawful basis we rely on to process your personal data and that of people who sponsor you is article 6(1)(f) of the GDPR which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon are:
- our interests in raising money for the charity by facilitating fundraising activities, and
- processing donations and maximising donations through Gift Aid, where applicable.
If your enquiry involves providing us with any special category personal data such as health, religious or ethnic information, we will only process that information where you have given your express consent.
What we need and why and how long is it kept
We collect your name, telephone number, email address and postal address in order to offer and coordinate any support, requests or enquiries you have during your fundraising with us and to send you any materials that may assist with your fundraising activity.
When we ask for emergency contact details, we need this information for health and safety purposes. We do not ask for information relating to health conditions or assess your suitability to take part in an event.
When using a sponsorship form we need the names, addresses and tax status of the sponsors to be able to reclaim tax via Gift Aid.
When using a bank transfer or a credit/debit card to pay the monies you have raised to us, we will need your bank or card details in order to process the payment. This information is held securely and deleted on an ongoing basis (credit and debit card details are not stored by us).
Personal data for fundraising activities and events is held for up to 7 years from the last action.
There are a variety of different ways you can donate to us and if you decide to do so via an online giving platform such as JustGiving or Facebook, any personal data processed will be done under the terms of the relevant online giving or social media platform. Other people, not us, control these platforms and you should therefore review the terms and conditions and privacy policies of these other organisations. That way, you will understand how they will use your information, what information relating to you they will place in the public domain, and what you can do if you are unhappy about it.
When you fundraise for us, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates
Grant fundraising: Trusts and Foundations
Purpose and lawful basis for processing
Wales Air Ambulance researches grant funding opportunities relevant to us, which may include sourcing the names and contact information (including publicly available information) of Trustees, grant officers, secretaries or other persons actively involved in the Trust or Foundation. This personal data will be used so we can contact you with our enquiries regarding a grant and the application process.
The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon are our interests in raising money for the charity by facilitating grant funding we may be eligible for.
What we need and why and how long is it kept
We collect the contact details of the relevant person(s) involved in the Trust or Foundation, so we can contact you about the grant. This includes name(s), email address(es), a postal address and telephone number(s).
This information is held either indefinitely if the details remain accurate and we continue to have contact with you about grant opportunities, or for 7 years since the last action.
Publicity – Fundraising or patient stories
Purpose and lawful basis for processing
An important part of what we do is raising awareness of our charitable activity in the public domain, to generate interest and support for Wales Air Ambulance. This may include stories shared on social media, on our website, in the press or in literature we produce.
We are always grateful to supporters who approach us or agree to share their story. If you agree to share your story, we will use the information gathered from you (from web forms, emails, mail, telephone and social media, for example) to generate publicity and raise awareness of our work with your permission.
The lawful basis we rely on to process your personal data is Article 6(1)(a) of the GDPR which allows us to process personal data where you have given your consent to the processing. If your story involves providing us with any special category personal data such as health, religious or ethnic information, we will only process that information where you have given your explicit consent.
Where the information provided is in relation to a child under the age of 18, we will request the consent of a person with parental responsibility for the child. Parents/guardians and individuals who are 18 or over will be asked to complete a consent form or provide another form of written consent to process the information.
If we are already in contact with you regarding a donation, lottery subscription, fundraising or voluntary activity, we may use this information to ask you if you would be interested in sharing your story. Your preferences will be recorded so we know if we can or cannot contact you about publicity opportunities in future.
What we need and why and how long is it kept
We need your name and contact details to liaise with you regarding your story and details of your activity, or the incident which occurred when you required our assistance, together with information about your experience of the service we provide and any other relevant information.
You can withdraw your consent at any time. However, this will not affect the validity of consent previously provided for publications already made.
We will keep your personal data until you inform us that you no longer wish us to use the information for publicity purposes, or if the case study has not been actively used for more than 5 years. If your records also relate to donations, lottery subscriptions or voluntary activity we may keep some of your details for longer (see the relevant sections of our privacy notice). An index of the deleted record, a redacted consent form and the original press release are retained indefinitely. The withdrawal process will include asking individuals if they wish for digital testimonials within WAAC’s control to be erased; for example, on our website.
Ordering goods online
Purpose and lawful basis for processing
When making your purchase online, you will be required to provide us with your personal data so that we can process the order, take payment and deliver the products you have purchased.
The lawful basis we rely on to process your personal data is article 6(1)(b) of the GDPR which allows us to process personal data when this is necessary for the performance of a contract.
What we need and why and how long is it kept
We collect your contact information (such as name, postal address, telephone or email address) and your payment details (such as a credit card).
Your card details are required to enable us to take payment. This information is held securely and deleted on an ongoing basis (credit and debit card details are not stored by us). Your contact information may be used to get in touch with you in order to fulfil your order or if there any queries with your order. Your address is required in order to deliver the products you have purchased. Records of online orders are kept for up to 7 years from the last action.
When you order goods online from us, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates.
Delivery and collections service
Purpose and lawful basis for processing
When you contact us to arrange a collection of unwanted goods for our charity shops, or when you use our delivery service for furniture and other large items bought in our shops, we will collect your personal data so that we can fulfil the service you have requested.
If you sign up to our Gift Aid scheme through the sale of your unwanted goods, we will also process your personal data to reclaim tax via Gift Aid.
The lawful basis we rely on to process your personal data for collections and Gift Aid is article 6(1)(f) of the GDPR, which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon are:
- Our interests in raising money for the charity by facilitating donations of goods for our shops,
- Maximising the sale of donated goods through Gift Aid, where possible.
The lawful basis we rely on to process your personal data for our delivery service is article 6(1)(b) of the GDPR which allows us to process personal data when this is necessary for the performance of a contract.
What we need and why and how long is it kept
We collect your name, address and telephone number so we can locate your premises and contact you if we need to regarding your delivery or collection. Payment for the delivery service is taken in our shops when purchasing the goods. We may also collect details about your tax status.
When you use our delivery or collection service, we will ask you if you would like to receive news and updates from Wales Air Ambulance in future. Your preferences will be recorded so we know if we can or cannot send you news and updates.
Gift Aid records are kept for at least 7 years from the last action. Personal data used for our delivery and collection service is kept for up to 3 years from the last action.
Signing up to a newsletter or updates (direct marketing)
Purpose and lawful basis for processing
If you sign up to receive newsletters or updates from us, we will ask you to provide your name and contact details in order to send you the newsletters or updates you have requested.
The lawful basis we rely on to process your personal data is Article 6(1)(a) of the GDPR which allows us to process personal data where you have given your consent to the processing.
What we need and why and how long is it kept
Direct marketing preferences are recorded in a ‘granular’ way. This means we keep a record of the methods you have specifically consented to us using to send news and updates (for example, email only).
We collect your name, email address and/or postal address and/or telephone number, and your preferences as to how you want to be communicated with, in order to process your request and to send you the newsletters or updates you have requested. We may also keep a record of certain topics you may be interested in, such as running events, and use this information to make decisions about the type of news and updates we send you (please refer to the Profiling section).
We will keep your personal data until you inform us that you no longer wish to receive newsletters or updates from us. If your personal data forms part of a fundraising or donation record, we may keep your personal data for longer but consent to receive news and updates will be removed from the record.
If you withdraw consent, it may be necessary and appropriate to keep an indefinite record that you do not want to be contacted, using the least amount of information to correctly identify you (please refer to the Suppressions section).
Data matching and profiling your interests
Purpose and lawful basis for processing
To make sure that we send you the right information, and manage our resources efficiently, we sometimes undertake data matching and profiling if you have chosen to receive news and information about Wales Air Ambulance.
Data profiling is the process of examining our database of supporter information to create groups with similar characteristics or interests. We may combine this with publicly available information, data matching, to help us determine if you might be interested in getting involved in fundraising or volunteering activities, or sending other information that we feel may be of interest.
The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR which allows us to process personal data when this is necessary for our legitimate interests. The legitimate interests we rely upon are our interests in ensuring:
- our communications are relevant and timely.
- we are sending information that we believe is of interest to you – for example, events in your area.
- we understand how you may be able to help us in the future.
- we raise funds for our lifesaving service in the most cost-effective ways, spending donor’s money responsibly.
- we exclude anyone who may be vulnerable, for example under 18s or adults at risk, and anyone who has registered with a preference service, from receiving marketing from us.
What we need and why and how long is it kept
When you engage in an activity with us, such as fundraising or donating, the activity is recorded alongside your other personal data (name, contact details and Gift Aid status) and your preferences to receive news and information about Wales Air Ambulance. If you have consented to receive news and information, we will use your records to tailor communications to you.
We may combine our records with public sources such as news articles, foundation websites, annual reports and public wealth databases, to help tailor these updates.
We do not use special category data (such as health, religious or political beliefs, racial or ethnic origin) in profiling. We do not undertake profiling using the personal data of anyone under the age of 18. Profiling activity is not solely automated, which means there is a trained member of staff checking data accuracy and that the minimum amount of information is used to help get our tailored news updates right.
You have the right to change your preferences for news and updates at any time. If you would prefer us not to use your personal data in this way, please contact us via dataprotection@walesairambulance.com or 0300 0152 999.
Records are kept for up to 7 years from the last action. If you withdraw consent, it may be necessary and appropriate to keep an indefinite record that you do not want to be contacted, using the least amount of information to correctly identify you (please refer to the Suppressions section).
Direct marketing suppressions (record of objection)
Purpose and lawful basis for processing
You can object to direct marketing from us at any time. When you object to direct marketing, the personal data we receive from you or an agency on your behalf (such as the Fundraising Preference Service or Telephone Preference Service) is called a Suppression Record.
The lawful basis we rely on to process your personal data suppression is Article 6(1)(f) of the GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests. Our legitimate interests are ensuring we do not send you marketing communications such as news and updates when you have exercised your right to object to direct marketing.
What we need and why and how long is it kept
Suppression records are held indefinitely to ensure we do not send you direct marketing communications. We need to hold enough personal data to be able to correctly identify your suppression record. This includes your name, email address and/or postal address and/or telephone number.
Website
Purpose and lawful basis for processing
When you use our website, some personal data will be obtained about you and used in order to maintain and monitor the performance of our website and to enable us to continually improve our website.
The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests. Our legitimate interests are ensuring that our website is up to date, efficient and user friendly.
Our website includes hyperlinks to, and details of, third party websites. We have no control over, and are not responsible for, the privacy policies and practices of third parties.
What we need and why and how long is it kept
We collect technical information about your visit, including the full Uniform Resource Locators (“URL”), clickstream to, through and from our website (including date and time), page response times, download errors, length of visit to certain pages, and methods used to browse away from the page.
Some of the information is collected by us each time you use our website through our use of cookies. Further information about the cookies we use and the purposes for which we use them can be found in the Use of Cookies section of this notice.
When you send us personal data through the website, for example when joining our lottery, making a donation or ordering goods, your personal data is processed via our website content management system (CMS) and retained for up to 7 years in line with the relevant sections above.
Social media
We operate a number of social media platforms including, but not limited to, Facebook, X, TikTok, YouTube and Instagram. Depending on your settings or the privacy policies for each social media site or messaging service, you might give us permission to access personal data from those services. For example, when you send us a message, tag us in an event photo or make a donation.
Although this policy covers how we will use any data collected from these social media sites, it does not cover how the providers of social media websites will use your information. Please ensure you read the privacy policy of social media sites before sharing data and make use of their privacy settings and reporting mechanisms to control how your data is used.
Applying for a job or voluntary role
Purpose and lawful basis for processing
Our purpose for processing this information is to assess your suitability for a role you have applied for and to help us develop and improve our recruitment and selection process.
The lawful basis we rely on for processing your personal data is article 6(1)(b) of the GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract or agreement.
If you provide us with any information about reasonable adjustments you require under the Equality Act 2010, the lawful basis we rely on for processing this information is article 6(1)(c) to comply with our legal obligations under the Act.
The lawful basis we rely on to process any information you provide as part of your application which is special category data, such as health, religious or ethnicity information is article 9(2)(b) of the GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights.
We process information about applicant criminal convictions and offences. The lawful basis we rely on to process this data is Article 6(1)(c) to comply with a legal obligation. In addition, we rely on the processing condition under Article 9(2)(b) where the processing is necessary for complying with employment, social security and social protection law and/or Article 9(2)(g) where the processing is necessary for reasons of substantial public interest, namely, preventing or detecting unlawful acts, safeguarding, protecting the public against dishonesty, preventing fraud or suspicion of terrorism or money laundering.
What we need and why and how long is it kept
We will use all the information you provide during the recruitment process to progress your application with a view to offering you an employment contract or a volunteering role with us, or to fulfil legal or regulatory requirements if necessary. We will use your name and contact details to correspond with you as part of the process.
If you provide us with any information about reasonable adjustments you require, we will use this information to make any reasonable adjustments required.
We will not share any of the information you provide with any third parties for marketing purposes.
We will use the contact details you give us to contact you to progress your application. We may also contact you to request your feedback about our recruitment process. We will use the other information you provide to assess your suitability for the role.
We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions as part of the recruitment process.
To make sure we meet our legal data protection and privacy obligations, we only hold on to your information for as long as we actually need it for the purposes we acquired it in the first place.
In most cases, this means that information gathered as part of the recruitment exercise will usually be retained for up to 6 months after the recruitment exercise has been completed. In the case of a successful applicant, information which is relevant to the ongoing employment or volunteering relationship will be transferred to the employee’s/volunteer’s personnel record and retained in accordance with the periods applicable for employees and volunteers. If you wish to remain registered on our recruitment platform for future opportunities, this information is retained based on your consent until you no longer wish to be registered for job alerts.
Call and meeting recordings
Purpose and lawful basis for processing
From time to time, WAAC may record teleconference calls and virtual meetings/events using the software and cloud-based systems available on our devices. This will be for one of the following purposes:
- To provide an exact record of a scheduled call or meeting in order to accurately transcribe minutes.
- To publish a webinar as part of publicity or fundraising activities. A webinar is a seminar or other presentation that takes place on the internet, allowing participants in different locations to see and hear the presenter, ask questions, and sometimes answer polls.
For the purposes of a webinar, the lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR where the processing is necessary for our legitimate interests. The legitimate interests we rely on are to generate awareness of the charity and its activities to maximise support and income.
The lawful basis we rely on to record teleconference and virtual meetings is article 6(1)(a) of the GDPR, which allows us to process personal data where you have given your consent to the processing.
What we need and why and how long it is kept
We will collect your name, email address and/or telephone number before the call or meeting begins. Where consent is required, it will be requested by us in writing, either via the contact details you have provided or via a tick-box or verbal declaration at the start of a virtual meeting/event; the recording of a call or meeting will not proceed if we do not have explicit consent from all participants. In the case of a promoted webinar we will provide advance notice that we intend to record and publish the event.
Where consent is required, you can withdraw your consent at any time. However, this will not affect the validity of consent previously provided for any recordings already made.
Any participation by you within the teleconference or virtual meeting/event will be recorded for the duration of the activity. This can include your username, audio and video input, auto-generated transcriptions, and document and screen-sharing from your device.
Please also ensure you read the privacy policy of virtual meeting sites before sharing data and make use of their privacy settings and reporting mechanisms to control how your data is used.
Recordings for transcription purposes are retained for up to 6 months from the date of the recording. Webinars which are published by WAAC are retained indefinitely.
CCTV and dashcams
Purpose and lawful basis for processing
We use Closed-circuit television (CCTV) footage outside or inside our buildings, and dashcams on the vehicles we use for our retail delivery and collection service. The purpose for processing this information is for security and safety reasons and/or insurance or legal purposes.
The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests. Our legitimate interests are to ensure the safety of our property, staff and visitors, and where necessary to support the establishment, exercise or defence of legal claims.
What we need and why and how long it is kept
We process CCTV images and dashcam footage to prevent crime and protect buildings and assets from damage, for the personal safety of staff, visitors and other members of the public.
CCTV recordings are usually deleted after approximately 28 days and dashcam footage is overwritten after one day, unless an incident has occurred and the CCTV or dashcam footage is required to be retained for a longer period to assist with the incident.
Visitor, health and safety and safeguarding records
Purpose and lawful basis for processing
Wales Air Ambulance will keep a record of visitors to its premises, which are recorded in a visitor’s logbook or electronic sign-in device.
As part of your visit to some of our premises, you may be asked if you require assistance to evacuate from the building should the fire alarm be activated. If required, a Personal Emergency Evacuation Plan (PEEP) will be prepared with you based on your individual needs.
We keep a record of any accidents or incidents reported to us on any of our premises. This includes personal data provided when reporting the incident, such as your name, contact details, health and incident information.
Some members of staff, on our premises or in the community, carry personal safety devices. These devices can be activated if staff are subjected to abuse, aggression or fear of abuse or aggression. The Charity has zero tolerance for violence or aggressive behaviour towards its staff and volunteers. When a device is activated, it will start an audio recording and geolocation tracking that is monitored by a trusted service provider who may contact emergency services on our behalf.
This information is collected so that we can:
- Follow Health & Safety reporting procedures including the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (‘RIDDOR’),
- Comply with our legal obligations under the Health and Safety at Work Act 1974, the Management of Health and Safety at Work regulations 1999 and any other relevant Health and Safety Laws,
- Learn from and improve our health and safety practices (reports are anonymised for analysis purposes),
- Keep accurate records for the establishment, exercise or defence of legal claims.
The lawful basis we rely on to process your personal data is Article 6(1)(c) of the GDPR to comply with a legal obligation.
The lawful basis we rely on to process any information you provide which is special category data, such as health, religious or ethnicity information is either Article 9(2)(b) of the GDPR, that the processing is necessary in the field of employment and social security and social protection law, or Article 9(2)(f), which relates to processing for the establishment, exercise or defence of legal claims.
Safeguarding means protecting people’s health, wellbeing and human rights, and enabling them to live free from harm, abuse and neglect, which includes children, young people and at-risk adults, from harm that arises from coming into contact with our employees, volunteers, trustees or other individuals associated with Wales Air Ambulance. It is our responsibility to implement stringent procedures and ensure records and the reporting of safeguarding matters are handled appropriately and in line with the Children Act 1989, the Safeguarding Vulnerable Groups Act 2006 and any other relevant Safeguarding legislation, guidance and policies.
The lawful basis we rely on to process your personal data for safeguarding purposes is Article 6(1)(c) of the GDPR to comply with a legal obligation where a legal obligation applies, or otherwise legitimate interests. Our legitimate interests are ensuring the safety of staff, volunteers, visitors and the public we engage with and protecting Wales Air Ambulance’s interests.
The lawful basis we rely on to process any information you provide which is special category data, such as health, religious or ethnicity information is either Article 9(2)(b) of the GDPR, that the processing is necessary in the field of employment and social security and social protection law or Article 9(2)(f), which relates to processing for the establishment, exercise or defence of legal claims.
In rare cases, we may rely on Article 6(1)(d) and, if special category data is involved, Article 9(2)(c) of the GDPR where the processing is necessary to protect the vital interests of an individual (that is, essential to their life) and they are physically or legally incapable of giving consent.
What we need and why and how long is it kept
All visitors, including but not limited to volunteers, contractors, service providers, employees of partner organisations, job candidates, and charity supporters, are required to provide their name, company they work for (if applicable to their visit), person they are visiting, their car registration number and the date and time they enter and leave premises (records are automatically timestamped for digital sign-in).
Digital sign-in systems may require a photograph for identification, depending on the nature of the visit. For example, a contractor requiring access to a restricted area. If a companion app is being used for a digital sign-in system, the app tracks your phone location on our premises and stops tracking outside of premise boundaries.
We retain visitor records for up to 4 years.
For Personal Evacuation Emergency Plans (PEEPs), we will collect the information you provide to us that is relevant to your individual requirements in the event of an emergency evacuation. This may include your name, your contact details or next of kin, date(s) of your visit(s), health or disability information that helps to inform the plan, and communication during an emergency evacuation.
How long we retain a PEEP record for depends on the nature of your relationship with us. It will remain on record for up to 4 years since a visit to our premises, or longer if it is required as part of an investigation.
For incident or accidents reported to us, we collect your name, contact details and information relating to the incident or accident, including injuries sustained, so we can comply with reporting procedures. We may also keep records of follow-up enquiries we have with you and notes relating to an investigation as part of the reporting procedure.
The retention period for health and safety records will depend on the accident or incident. General accidents/incidents are kept for up to four years from the date of the event or, in the case of a child, up to four years after their 18th birthday. Accidents/incidents relating to health exposure to certain substances or agents are kept for 40 years.
Records relating to safeguarding incidents are kept for up to 30 years from the date that the record was made.
Suppliers, contractors and service providers
Purpose and lawful basis for processing
Wales Air Ambulance may process the personal data of representatives, employees, or other people from our suppliers and service providers, and all other external workers such as contract workers and advisors.
The purposes of processing your personal data will depend on the nature of our relationship with you or your employer, and your function. This includes but is not limited to:
- To manage our suppliers and service providers and perform our duties pursuant to a contractual relationship, or the preparation of a contract;
- To grant you access to our facilities and/or technologies to allow you to perform services;
- To ensure compliance with policies and legal requirements;
- To preserve our legal interests;
- To monitor performance and manage resources.
The lawful basis we rely on to process your personal data is article 6(1)(b) of the GDPR which allows us to process personal data when this is necessary for the performance of a contract.
What we need and why and how long is it kept
We obtain your personal data either directly from you or through the supplier or service provider for whom you work. The types of personal data that we process will vary depending on your function, location and any terms and conditions of engagement relevant to you.
Some of types of personal data we may process include: name, contact details, your employer and job title, identity documentation, billing information, work related information, and communications such as emails. Some personal data may be inferred from the information you provide, or arise in the context of managing our engagement with you and your employer.
When visiting our premises, we may also process CCTV footage, health and safety incident logs, or visitor logbook information. See the relevant sections in this notice.
Personal data is retained for up to 6 years from the date of contract termination. Personal data may be retained for longer if it relates to health and safety or safeguarding records. See the relevant sections in this notice.
