Privacy notice

To give you more transparent and clear information on how we process your personal data, we have divided our Privacy Notice into different sections. Depending on how you interact with us, different sections of the notice will apply to you. Within these sections, we describe what personal data we collect, how we use it and what your rights are.

Who are we?

Hywel Dda Health Charities is the official charity of Hywel Dda University Health Board (registered charity number 1147863).

The aim of our charity is to make a positive difference to the health, wellbeing and experience of NHS patients, service users and staff across Carmarthenshire, Ceredigion and Pembrokeshire.

Basis for processing personal information

The charity uses any one of the following lawful basis for processing your personal information:

a) You have consented to us processing your data

b) There is a contractual relationship with you

c) We are legally obliged to process your data

d) We believe it is in the public interest to process your data and this interest is supported by clear law, e.g. safeguarding, equality.

It’s important that the personal information the charity obtains is held, used, transferred and otherwise processed in accordance with the legislation.

Information processed by the charity

Personal information is information that can be used to identify you. You can find examples of personal information in the four categories below.

Name, address and telephone numbers
date of birth
email address
photography/images

family and friend connections, such as parents and siblings
In some cases we may ask for your job role and the type of organisation you work for.

bank account details
credit/debit card details
whether you are a UK tax-payer so that we can claim Gift Aid (we don't collect information about your tax payments, only whether you are a tax-payer).

Special category (or sensitive information)

Information in this category is more sensitive than in the categories above and includes:

health and medical information
ethnicity
criminal convictions
diversity monitoring information.

The charity doesn't usually collect this type of information unless there's a clear reason for doing so. An example of when collecting this information is necessary is participating in an event where we need this information to ensure we provide you with the appropriate facilities.

The charity may also collect health information if you tell us about your experiences of Hywel Dda University Health Board healthcare services.

How we collect personal information

We collect information about you in the following ways:

when you, or someone on your behalf, makes a donation to us
when you ask about our services
when you attend an event and we ask for emergency contacts
when you register to participate in an event either directly with the charity or through a third-party and have indicated that you wish to fundraise for us
when you engage in our social media, digital advertising or message boards
when you voluntarily give the charity your personal information
when you subscribe to our charity publications or email newsletters.

The reasons the charity collects and uses information

We’ll collect and use your information for one or more of the following reasons:

for your participation or expressed interest in an event, ensuring you have all the required information
to ask you to help the charity by raising money on our behalf or donating money to us but always in accordance with our supporter commitment
where you made a donation in celebration of another individual and that individual, or a related person, wishes to know who has given
for the purposes of you entering a raffle, prize draw or competition
the taking and use of photography, images or film in case studies, media and press publications and marketing materials
to send you marketing materials by post (unless you've asked us not to)
to administer any requests where you are exercising your legal rights
to assess your personal information for credit risk, age verification or fraud prevention: charities can be targeted for illegal purposes such as money laundering and therefore we are required to monitor financial activity and report suspected fraud to the appropriate authorities
to support effective and efficient record-keeping

to analyse and improve our services regarding:
- fundraising
- retail
- supporting our charity.

How long we keep your information

Your information will be kept in accordance with our Retention and Destruction of Records Policy (opens in new tab), which details the length of time we hold your records for. Information will be disposed of securely once this period has lapsed.

Photography and images

Hywel Dda Health Charities uses photography, images and film. The images are used in media (such as newspapers, magazines, websites or broadcast outlets), on social media, in publications, on our website, in printed or online fundraising materials, in fundraising and awareness films or by our corporate partners who help us raise money to support the Charity.

Photography, images and film created for our advertising campaigns is taken and used with your consent.

We will discuss with you how your, and/or your child’s, image and information is going to be used and ensure you are happy for it to be used in this way. You can ask us to stop any time and we will refresh your consent every few years.

Event Photography

Where an event is organised by the charity, we will ask you for consent to use any photographs taken where you are the focus of the image. Permission will be requested either prior, during or after the event.

Where the photograph does not focus on you as an individual, e.g. where you appear in the background of the photograph or as one of a number of people in a group shot, it is not normally necessary for us to ask your permission. We will ensure the terms and conditions of the event tell you if there will be photographers present.

If you do not want your photograph taken, please either tell the photographer at the time, if it is convenient to do so, or contact the charity after the event. You can change your mind at any time, and we will refresh your consent on a regular basis.

At some events there may be photographers present who represent the media or the event organiser and for whom the charity is not responsible. Please review the terms and conditions issued by the event organiser for more information and inform the event organiser of your preferences and wishes in respect of photography taken.

Your Rights

Under the Data Protection legislation you have rights as an individual that you can exercise regarding the information we hold about you:

The right to be Informed – you have the right to be told about how your information is collected and used.
The right of Access – you are entitled to request access to and a copy of the information we hold about you.
The right to Rectification – you have the right to ask to have incorrect information about you corrected or incomplete information completed.

In some circumstances you may have:

The right to Erasure – you can ask us to delete your information.
The right to Restrict Processing – you can ask that we stop using your personal data for certain purposes, however, this may delay or prevent us from delivering a service to you.
The right to Object – you can object to profiling or any decisions about you that are made by wholly automated means.
The right to Data Portability – data processed by automated means should be provided in a portable format.

Many of the rights listed above are limited to certain defined circumstances. We will seek to comply with your request but may still need to hold or process information to fulfil our legal duties. We will tell you if this is the case.

Complaints and Enquiries

You have the right to make a complaint about the way we have processed your personal information. To do this, contact the Information Commissioner’s Office which is the statutory body that oversees data protection law:

ICO website (opens in new tab)

Telephone: 0330 414 6421

Email: wales@ico.org.uk

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

You can also contact our Data Protection Officer:

Email: dpo.hdd@wales.nhs.uk

Telephone: 01970 635442

Post: Data Protection Officer, Information Governance, IT Building, Bronglais General Hospital, Caradoc Road, Aberystwyth, SY23 1ER

Our privacy notice is not exhaustive in regard to all aspects of how we collect and use personal information, however we are able to provide any additional information or explanation needed. Please contact the Data Protection Officer, who is the organisation’s primary point of contact, for any queries in relation to how we use your information.