This Policy describes how we collect information from service-users and the general public, the type of personal and confidential information we collect and what we will use that information for.
References in this Policy to “we” or “us” means ASH Wales Ltd.
The charity will only use information that we collect about individuals in the manner set out in this Policy. We are committed to protecting personal and confidential information. For the purposes of the Data Protection Act 1998, we are the data controller of your personal information. We reserve the right to amend, vary and/or to withdraw this Policy from time to time. In the event of any changes we will be responsible for determining the appropriate form that such notification should take.
Collection of Personal and Confidential Information
Personal information is any information about an individual from which they can be identified, such as name, address and email address.
Confidential information would be information provided on the understanding that it will not be shared more widely or for purposes other than agreed.
ASH Wales will collect personal and confidential information provided by individuals when they agree to provide this. For example, to make a donation, to participate in an interview or complete a survey, when booking a place for an event or contact the charity for other purposes in writing, by email, by phone or via the website.
We may also collect information about your use of the ASH Wales Website when you access and browse the ASH Wales Website.
Personal and Confidential information may be supplied by the individuals themselves or by third-party partners involved in joint initiatives with ASH Wales. Where the information is supplied by a third-party, ASH Wales will ensure that express consent is given to share this information with the charity and that individuals are aware of how the information will be managed and used.
Use of Personal and Confidential Information
ASH Wales will use the personal and confidential information provided by individuals for the following purposes:
- If they wish to attend an event to enable the management and administration of the booking.
- If they wish to obtain a product or service (free or fee-paying) for the purpose of processing the order.
- If they participate in an interview, complete a survey or are otherwise involved in providing research information, for the purpose of collating, reporting and analysing the results of research.
- If they make a donation or other payment, for the purpose of processing the donation or payment.
- For any purpose which reasonably arises out of or in connection with the individual accessing the services of ASH Wales.
- If the charity needs to notify individuals about important changes or developments in ASH Wales.
- On occasion, to verify the personal and/or confidential information already supplied to ensure it is up to date and accurate. We reserve the right to request additional personal and/or confidential information from individuals in order to undertake checks (generally with respect to financial transactions) using appropriate third parties for this purpose. In such cases, we will obtain expressed consent to do this from the individual.
- To contact individuals by post, telephone or email to promote the aims and objectives of the charity. Individuals may choose not to be contacted in this way for these purposes by writing to ASH Wales.
- To contact individuals by fax or email to promote our aims and objectives, to request donations, to provide details of our and/or third parties’ products and services which we think may be of interest to you and to ask you to complete questionnaires and surveys. You can choose not to be contacted in this way for these purposes by writing to ASH Wales.
Disclosure of Personal Information
We will not sell or hire the personal information we collect about individuals to any third parties. We do, however, reserve the right to disclose personal information in limited circumstances to certain third parties as follows:
- To the individual’s bank or building society and third parties who process donations and payments on our behalf.
- To appropriate third parties for the purposes of verifying your personal information and/or creditworthiness (with respect to a donation or other financial transaction.)
- Where disclosure is necessary (i) in response to a subpoena, court order or government request or request by any other appropriate authority; (ii) for the purposes of taking legal action to establish or exercise our legal rights or defend legal claims against us; (iii) to investigate, prevent and/or take other action in connection with possible illegal activities, suspected fraud and/or situations involving potential threats to the physical safety of any persons; (iv) actual or suspected violations of the charity’s data protection policies; or (v) as otherwise required and/or permitted by law or regulation;
- We may also pass aggregate information on the usage of the ASH Wales Website, participation in events, results of research studies, etc. to third parties but this will not include information that can be used to identify individuals (i.e. will be anonymous.)
Disclosure of Confidential Information
We reserve the right to disclose your confidential information only in the following circumstances:
- To your bank or credit/debit card provider for the purpose of obtaining donations or payments.
- To appropriate third party organisations who process credit/debit card payments on behalf of the charity.
- Aggregate information resulting from participation in events or research studies, but this will not include information that can be used to identify individuals.
Security and Accuracy of Personal and Confidential Information & Data Retention
ASH Wales has organisational measures in place designed to protect the personal and confidential information of individuals. We will use all reasonable measures to protect information from alteration, loss or misuse. We will retain personal and confidential information from individuals for a reasonable period and for so long as the law requires.
All information provided about individuals is stored securely. The charity will not be responsible for any personal information disclosed to third parties that does not offer a secure way to transmit information to the charity (e.g. email).
All information provided about individuals in printed format will be stored in locked filing systems and be available only to staff who require access to this information in order to undertake their work (e.g. event management, research studies, etc.).
All staff of the charity are bound by the organisation’s policy on Confidentiality and breach of this policy or others related to information management and data protection could constitute a disciplinary offence.
Accessing and Updating Personal and Confidential Information
Individuals are entitled to see the personal information held about them by the charity and they may ask the charity to make any necessary changes to ensure that it is accurate and kept up to date. Individuals wishing to access this information or update details of the information are asked to write to the Office Manager at ASH Wales.
Destruction of Personal and Confidential Information
Manual destruction of files, records and computer printouts containing sensitive data and confidential information will be carried out in a secure manner (e.g. security shredding). Personal and confidential information provided by electronic means will be deleted from the charity’s systems on a regular basis.