fbpx accountarrow-down-linearrow-downarrow-left arrow-right arrow-up closedownload emailFacebookgrid-view instagramlinkedin list-view location notch-bottomnotch-topphonepinterestplay scroll-altscrollsearchtwitterwhatsappyoutube

Privacy Policy

Privacy Policy

Updated: 17 June 2022
Version:
1.7

We, at Thames Valley Air Ambulance (“TVAA”/”We”/”Us”/”Our”), are reliant on the support and generosity of the communities we serve to continue our vital work.

As a valued stakeholder of TVAA we are committed to protecting your privacy and the personal information you give to us.

This policy, together with our Terms of Use for the Site and our Cookies policy will provide you with the information you need to know about how we use and protect that personal information.

If you have any questions, please contact us at dpo@tvairambulance.org.uk

TVAA is a registered charity in England and Wales 1084910.

Our registered address is:

Stokenchurch House,
Oxford Road,
Stokenchurch,
Buckinghamshire,
HP14 3SX.

This privacy policy relates to all information obtained by Thames Valley Air Ambulance, Thames Valley Air Ambulance (Trading) Ltd and Thames Valley Air Ambulance (Leasing) Ltd and for which TVAA are the data controller. TVAA are registered with the Information Commissioner’s Office, registration numbers are Z1250695, ZA859690 and ZB111561.

TVAA’s Data Protection Officer, Caroline Darroch, is responsible for answering any questions you may have about this Privacy Policy. Caroline can be contacted at the above address, by email dpo@tvairambulance.org.uk or by phone: 0300 999 0135.

Thames Valley Air Ambulance is the charity that gives everybody in our community the best chance of surviving and recovering from an emergency. Together, we do everything in our power to protect, save and revive lives with the best critical care at the scene and beyond.

Stakeholders can affect or be affected by the organisation’s actions, objectives, and policies. Some examples of stakeholders are employees, volunteers, supporters, suppliers, other emergency services, media, patients, the public

We take active steps to ensure our stakeholders are aware of the ways in which they can help us achieve our overall purpose.

Personal information is information that can be used to identify you. We hold and process your personal information for a variety of reasons including:

  • To process donations
  • To administer raffles, prize draws or competitions
  • To claim gift aid on donations
  • When you sign up to fundraise for us or to take part in an event so we can communicate with you
  • To support community-based fundraising and campaigning
  • To provide supporters with marketing information about our events, fundraising activities and appeals so they are aware of other ways they can support us
  • To undertake research and analysis to better understand and communicate with our supporters and to identify potential supporters, donors, or other partners
  • To build profiles of supporters and potential supporters, so that we can tailor our communications and interactions and provide a more personalised experience with us
  • To ensure we do not send marketing or unwanted information to those who have informed us they do not wish to be contacted (for example our suppression file and self-exclusion register)
  • For internal record keeping, such as the management of feedback or complaints
  • To understand how we can improve our services, products, or information
  • Administering and governing the charity
  • To help us administer Covid-19 or other medical requirements
  • To support patients and their families through our aftercare services
  • For the provision of health care and treatment

When processing personal data our approach follows the principles set out by the Data Protection Act:

  • We process personal data lawfully, fairly and in a transparent manner
  • We collect personal data only for specified, explicit and legitimate purposes
  • We process personal data only where it is adequate, relevant, and limited to what is necessary for the purpose(s) of processing
  • We keep accurate personal data and take all reasonable steps to ensure that inaccurate personal data is rectified or deleted without delay
  • Kept in a form permitting identification of the data subject for no longer than is necessary for the purpose(s) for which that data is processed
  • Processed in a manner ensuring appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organisational measures (integrity and confidentiality)

TVAA will only contact you for marketing purposes such as keeping you up to date with Charity activities, or to let you know more about how you can support our work by applying legitimate interest, with the exception of text messages or email where we will need to have your specific consent.

TVAA will make it easy for you to specify how you would like to receive this information (email, post, and phone). We will not send marketing material if you tell us you do not wish to receive these communications and there are a variety of ways in which you can let us know how you prefer to be contacted.

TVAA may collect your personal data in the following circumstances:

  • a) When you give it to us DIRECTLY

You may give us your personal data directly when you donate, sign up for one of our events, or when you communicate with us.

  • b) When you give it to us INDIRECTLY

You may give us your information indirectly for example when you sign up to events or contribute to TVAA via fundraising sites like Just Giving. These independent third parties will pass your data to TVAA where you have indicated that you wish to support us and have given your consent, or it is a necessary part of completing a contract with you.

There will be times when your personal data is collected by an organisation working on our behalf (for example a professional fundraising agency) but as they are acting on our behalf, they cannot use your data for their own purpose. We remain the data controller and are responsible for the security and correct processing of that data. We also work with trusted Marketing Service Providers who help us deliver marketing communications. You should check their privacy policy when you provide your information to understand fully how they will process your data.

  • c) When you access TVAA’s Social Media

We might also obtain your personal data through your use of social media such as Facebook, WhatsApp, Twitter, or LinkedIn, depending on your settings or the privacy policies of these social media and messaging services. To change your settings on these services, please refer to their privacy notices, which will tell you how to do this.

https://www.facebook.com/policy.php
https://twitter.com/en/privacy
https://www.whatsapp.com/legal/#privacy-policy
https://www.linkedin.com/legal/privacy-policy

Updating your preferences with TVAA will not guarantee that you never see our content on social media, since the social media site may select you based on other criteria and without your data having been provided by TVAA.

  • d) When the information is publicly available

Personal data about individuals may be obtained and used in our research to help us understand our supporters better and identify those who might be interested in giving gifts to charities. In this scenario, TVAA are looking to find out more about individuals, their interests, motivations for giving and this takes place using publicly available information. This information may include newspaper or other media coverage, open postings on social media sites such as LinkedIn, and data from other sources such as Companies House, property registers and company websites.

Further information can be found in the Building Profiles of Our Supporters and Potential Supporters’ section of this policy.

Use of other publicly available sources, such as the Mailing Preference Service (MPS) or Fundraising Preference Service (FPS), assist us in ensuring we do not send unsolicited mail or marketing material to those who have indicated they do not wish to receive these.

For administering legacies, we try to rely on information provided to us by Executors/Administrators however we may also use Legacy Notification Services. TVAA may also be notified of the death of supporters by third parties such as solicitors or family members, particularly if we have been named as a beneficiary in a Will.

TVAA will conduct research and retain publicly available data relating to current and potential supporters in accordance with our retention schedules.

We only collect personal data that is relevant to the type of engagement you will have with us such as:

  • Donations you have made
  • Gift Aid declarations
  • Signing up to an event or activity
  • Requesting our newsletter or e-newsletter
  • Sharing your story
  • Information on beneficiaries / legators / executors relevant to a legacy gift
  • Participating in our lottery or raffle
  • Staff and volunteers
  • Responding to a survey or being part of a focus group
  • Observer shifts
  • Your communication preferences and any changes
  • Images, to include CCTV and videos
  • Call recordings
  • Video conferencing recordings including but not limited to Zoom and Microsoft Teams
  • Visitor information
  • Track and trace requirements (related to Covid-19 or other medical reasons)

The information we request, relevant to your engagement with us, could include:

  • Name
  • Contact details including telephone and email address
  • Bank account / credit card details
  • Images or film
  • Date of birth
  • Health details, relevant to a specific event or activity
  • Your motivation for supporting us
  • Deceased charity legators
  • Records of communication (letters, phone calls, emails, donation history, and any additional notes – which may contain special category data, meeting notes, interests)
  • Your opinions, for example if we have asked you to complete a survey about TVAA or our activities
  • Your interests and preferences, which may help us to provide personalised communications which are tailored to you

Special Category Data

TVAA may collect special category data, as defined by the UK General Data Protection Regulation.

One such example is health data which may be collected in relation to some of our events or activities. This is required to ensure that we provide appropriate facilities or support to enable you to participate.

Our medical emergency and aftercare services, relating to our patients, also requires TVAA to collect these categories of data including your mental and physical health, race and ethnic origins and genetics.

TVAA will only collect this information where it is necessary, if we are legally required to do so, or if we have your explicit consent.

All special category data is stored on secure databases with restricted access and deleted when no longer relevant. Special category data may be shared with third parties but only where we are required to do so or where the data is anonymised to remove any person identifiable information (PII).

We may use your information in the following ways:

  • To promote the aims and objectives of the Charity
  • To thank you and confirm receipt of donations (unless you have asked us not to do this). We may also send you information about the impact your donation, or any other support, is making or other ways to get involved and support Thames Valley Air Ambulance
  • In relation to correspondence you have entered into with us whether by letter, email, text, social media, or any other means and to contact you about content you provide
  • For internal record keeping, recording your relationship with us
  • To fulfil sales contracts you may have entered into with us
  • To contact you for reasons related to administering any donations or legacies you have made including Gift Aid, if claimed
  • To implement instructions you may have given us, such as withdrawing consent to send marketing information or informing us through the Fundraising Preference Service that you do not wish to receive any marketing information
  • To conduct research and analysis to build a greater understanding of our supporters in order to provide you with a more personalised experience with us through our communications and fundraising activities. This research may include surveys, focus groups, database screening and analysis. We may also analyse information you provide to us with other freely available public information to create a profile of supporter interests, preferences, level of potential donations, so that we can contact you in the most appropriate way and with the most relevant information. You can choose to opt out of this screening at any time, by contacting dpo@tvairambulance.org.uk
  • To keep your data up to date – for example, we use Royal Mail’s data on postal address changes to ensure we can maintain contact with you where we believe you are happy to be contacted by post. We also make use of services which notify us of the recently deceased and our reason for doing so is to try to avoid any distress that continued communication could cause. We may also check gone away records to help us ensure the data we hold is accurate and up to date.
  • To use IP addresses to identify the approximate location of users, to block disruptive use and to record website traffic or to personalise the way our information is presented to you
  • To administer our recruitment and employment processes
  • To administer our patient story process
  • To invite you to participate in surveys or research about TVAA or our work (participation is always voluntary)
  • To analyse and improve the activities and content offered by our website and to provide you with the most user-friendly navigation experience. We may also use and disclose information in aggregate (so that no individuals are identified) for marketing and strategic development purposes
  • To clarify or check your preferences if we find that details held about you on our database are confusing or we are improving our database

Data protection law requires us to rely on one or more lawful grounds to process your personal information. We consider the following grounds to be relevant:

  • Specific Consent – Where you have provided specific consent for us to use your personal information in a certain way. For example, when you make a gift or contact us you have the option to ‘tick a box’ giving us consent to send you direct marketing information. An individual has the right to withdraw their consent at any time.
  • Legitimate interest – Where it is reasonably necessary to achieve our or others’ legitimate interests (if what the personal information is used for is fair and doesn’t unduly impact your rights). When we legitimately process your information in this way, we consider and balance any potential impact on you (positive and negative) and your rights under data protection laws. We will not use your personal information where our interests are overridden by the impact on you, for example, where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted by law).
  • Examples of processing based on legitimate interests include:
    • Sending direct marketing material to supporters by post for fundraising purposes
    • Conducting research and analysis to better understand who our supporters and potential supporters are
    • Undertaking profiling to help us provide you with a more personalised and tailored experience across communications and fundraising activities
    • Measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant, and effective
    • Promoting Thames Valley Air Ambulance on social media, Google, YouTube, and other online platforms
    • Taking and using photos or films of event participants and attendees
    • Administering events

When we use sensitive personal information, we require an additional legal basis to process under data protection law so, we will either do so based on your explicit consent or identify another route available to us (for example if we need to process it for employment, social security or social protection purposes, your vital interests or in some cases, if it is in the public interest for us to do so).

  • Legal obligation – Where necessary so that we can comply with a legal or regulatory obligation to which we are subject. For example, HMRC requires us to collect information regarding Gift Aid or where we are ordered by a court or regulatory authority such as the Information Commissioner’s Office (ICO).
  • Performance of a Contract – Where we are entering into a contract with you or performing our obligations under it for example when you sign up to our terms and conditions.

Should you wish to update the information we hold about you or change your contact preferences then please contact us at info@tvairambulance.org.uk or call 0300 999 0135.

Ensuring your personal data is accurate is important for us and we would like to ensure we are able to communicate with you in ways you are happy with as well as being able to provide you with the information you are interested in.

Should you wish to change how we communicate with you or update your details please contact us:

Website:  
www.tvairambulance.org.uk

Email:
info@tvairambulance.org.uk

Telephone:
0300 999 0135

Post:
Thames Valley Air Ambulance, 
Ground Floor,
Stokenchurch House,
Oxford Road,
Stokenchurch,
Buckinghamshire,
HP14 3SX

You can also opt out of email marketing communications separately:

Email:        
You can click on the unsubscribe link provided in all our marketing communications

When can you expect to stop receiving marketing communications?

TVAA will make every effort to meet the following service levels when stakeholders ask that we do not send them further marketing communications:

  • Email – 48 hours from receipt of request
  • Telephone – 48 hours from receipt of request
  • Post – 28 days from receipt of request
    • The extended time limit on actioning mail requests is longer due to production times for some mail campaigns. In most cases we would expect the change to be effective quicker. During this time period we advise that some mail campaigns may still be received.

Researching and profiling are commonly used to aid fundraising and marketing communications. This involves analysing data to improve the targeting of our communications, so that we provide you with a more personalised supporter experience. Profiling allows us to target our resources effectively, which supporters consistently tell us is a key priority for them. It enables us to raise more funds, sooner, and more cost-effectively than we otherwise would whilst also identifying other areas of support such as volunteering, shared networks and identifying potential future trustees. This helps to maximise the effectiveness of our campaigns and to minimise the wastage that would result from sending marketing information where it is not of interest.

TVAA occasionally uses profiling techniques to help ensure our communications are relevant to you. The data we use to undertake this may have been provided to TVAA by you for example when responding to our marketing campaigns and surveys, when you have donated or fundraised for us, or when using our website, or social media sites such as Facebook.

This could include gathering information from publicly available sources including but not limited to: Companies House, the Charity Commission, the Electoral Register, company websites, “rich lists”, Funds Online, social networks such as LinkedIn, property registers and news archives, geographic and demographic information. To carry this out efficiently, we may use trusted third-party specialist agencies who can do this in a more cost-effective way.

Using a personalised approach like this means we can give you the best possible supporter experience aligned to your type of support as well as your capacity to give. This research might also be used to exclude those who may be vulnerable to marketing.

Profiling also allows us to identify potential supporters and there are a number of ways in which we may identify or communicate with those potential donors:

  • By conducting research on supporters
  • By asking our existing supporters to give
  • By asking supporters that may have given to TVAA in the past to give again
  • By asking our existing supporters to tell us more about their interests, preferences, opinions, and motivations for support. By inviting potential supporters to attend our events as a way of engaging with them and sharing the impact of their gifts. We might also identify potential new supporters through researching event attendees who were previously unknown to us
  • By researching people who have not given to the charity in the past but who we believe might have a connection to our work and have the capacity to give
  • By asking our supporters and influencers to open up their networks to us
  • By asking our supporters and influencers to introduce us to potential supporters we have identified through our research and that they have a link to
  • By sharing your data securely and in an anonymised form with social media sites to help us identify similar users of these sites that might be interested in our services (see section on Social Media Sites).

If you do not wish us to use your data in this way, it is easy for you to opt out, just contact us at DPO@tvairambulance.org.uk.

TVAA will conduct research carefully ensuring that information collected is not excessive or intrusive, is sourced reliably and appropriately using only credible, publicly available information and where that information has been made deliberately public.

Research could include analysing data that you have already provided to TVAA (see section on building profiles) or by inviting supporters to take part in activities such as surveys or focus groups.

Routine collection of large volumes of special category data related to your health, racial or ethnic origin, religious or political beliefs will not take place. It may be that our research does include some of this information however where it does, TVAA acknowledge and recognise the sensitive nature of the information and will ensure we only process and record this information if you tell us directly and therefore have agreed to the processing.

To meet our obligations as a charity, TVAA must look at taking reasonable and appropriate steps in order to understand who our supporters are and especially where considerable sums might be donated to us.

Using charity law as our legal basis for processing, TVAA will look to conduct due diligence in order to provide assurances that both donations and support are from appropriate sources. TVAA will do this in order to protect our reputation and to mitigate possible risks.

There are principles in place which guide us in building mutually beneficial relationships with individuals, companies and foundations and these principles ensure we raise money legally, safely, and transparently.

Our due diligence will be appropriate in relation to the fundraising opportunity and will not mean that our research will include personal details of every supporter or lead to us questioning every donation that is made to us. In accordance with data protection requirements, any information will only be what is considered necessary for us to meet our obligations and that information will be processed in accordance with your rights. You can find out more information about your rights in the “Your Rights” section.

TVAA will only use your personal data for the purpose(s) for which it was obtained and will not, under any circumstances, share or sell your personal data with any third party for their own marketing purposes and you will not receive marketing from any other companies, charities, or organisations as a result of giving your data to us.

We may share your information with other companies within our group.

Data Processors

We may need to share your data with our service providers who help to deliver our projects, activities, and goods. These service providers are “data processors” and will only act under our instruction and are subject to pre-contract scrutiny and contractual obligations containing strict data protection clauses. We will not allow these organisations to use your data for their own purposes or disclose to other third parties without our consent and will take all reasonable care to ensure they always keep your data secure.

Our service providers include but are not limited to fundraising agencies, prospect research companies, direct mailing companies, payment processors and software platform providers.

Social Media Sites

We may share your data in an anonymised format with social media sites such as Facebook, LinkedIn, or Twitter. Sharing your data in this way allows us to:

  • Match your profile and show you relevant TVAA advertisements, while using these services.
  • Identify similar users of these sites, known as look-a-like audiences, whom we believe would be interested in our services.

To carry this out effectively, we may from time-to-time use trusted third-party specialist agencies to support us with this work.

The data we share typically includes your email address and telephone number, but may also include your first name, surname, postal town, county, country, and company name if available. Data shared in this way is kept secure by turning it into anonymised code before it is sent – a process known as hashing. No data is retained by the third party. We are also unable to identify if your data was matched successfully or unsuccessfully with a corresponding social media profile to protect anonymity.

If you do not want TVAA to share your data with social media sites, you can either:

By updating your preferences with TVAA, we will no longer share your data with social media sites. However, this does not guarantee that you will never see our advertisements on social media because you could be targeted as part of:

  • Core audiences – social media sites allow TVAA to target potential supporters based on the data already owned by the social media platform itself. As an example, TVAA could advertise to individuals aged 30-40, living in Berkshire. If your social media profile met these conditions, and you had not opted-out via the individual platform, you would still see our advertisements.
  • Cookies data – our website uses advertising cookies, such as Facebook Pixel, to collect anonymised data on how you interact with the website. We use these cookies to target individuals with remarketing ads across social media sites. To find out more, or to control which cookies are recorded when you use our site, visit our Cookies policy.

To ensure you do not receive advertisements as part of these methods, please opt-out directly via the individual social media sites using the links above.

Where legally required

TVAA will comply with legal requests where disclosure is required or permitted by law (e.g. government bodies for tax purposes, law enforcement agencies for the prevention and detection of crime or regulators such as Care Quality Commission subject to such bodies providing us with a relevant request in writing).

Thames Valley Air Ambulance is grateful for every penny it receives, and we want to make sure that we provide you with safe avenues to donate. To ensure that your payment transactions are safe TVAA use the services of Stripe Payments Europe Ltd. This service is responsible for any card or online payment transaction you make to us and the organisation may hold data about you. As a result, we would like to direct you to their privacy policy: https://stripe.com/gb/privacy

TVAA will hold your information for specific periods of time following the end of your relationship with us and these retention times will be dependent on the nature of your relationship and our legal obligations. Information may be held for a period of up to seven years however, in some cases we may be required to retain for a longer or shorter period.

Legacy income is vital to the running of the charity. We may retain some data you provide to us indefinitely, to carry out legacy administration and communicate effectively with the families of people leaving us legacies. This also enables us to identify and analyse the source of legacy income we receive.

Where you contribute material to us, e.g. user generated content, survey responses or in response to an event or activity, we will only keep your content for as long as is reasonably required for the purpose(s) for which it was collected unless otherwise stated at the point of generation.

If you request that we stop sending you marketing materials, we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.

TVAA retain personal data in accordance with their retention policy and register and review these on a regular basis. Please contact us if you would like to know more about our Data Retention, Archiving and Destruction.

TVAA places great importance on the security of all data in our control and have security measures (physical, technical, and organisational) in place to protect it, both online and offline, from improper use, access, alteration, destruction, and loss.

All TVAA staff undertake regular data protection training to ensure the protection of your information.

Whilst most of the information we store and process about you stays in the UK, we may need to use the services or provide access and processing to service providers and other organisations located outside both the UK and the European Economic Area (EEA). If this is required we will conduct an appropriate risk assessment and put in place “additional measures” to safeguard your personal data and your rights.

The UK has recognised some countries and all of the EEA states as possessing data protection “adequacy” for the purposes of data transfers to these countries. The UK Government has decided no additional safeguards are needed to conduct data transfers to the EEA as these states have equivalent standards of data protection as the UK-GDPR.

In cases when we use external websites provided by other organisations such as Twitter, YouTube, or Facebook, then we would ask you to consult their privacy policies.

Where we have provided a password enabling you to access specific parts of our websites, it is your responsibility to keep this password confidential. We advise you not to share your password with anyone.

If you are under 18 then please let us know when you contact us and make sure you have the consent of a parent or guardian before providing us with any of your details. We are committed to protecting the privacy of anyone under 18 who may contact us and will ensure that your information is only used for the purpose(s) it has been provided for. There may be circumstances where we refuse certain services or events.

Under data protection law you have rights you need to be aware of. The rights available to you may depend on our reason for processing your information.

  • The right to access your personal information
    • You have the right to ask us for a copy of the personal information we hold about you. This right also applies to any other person whose personal data you provide to us. On receipt of such a request we will require proof of identify or proof of authority if the request comes from someone other than yourself. By requesting this information we can ensure we provide information to the correct person. We respond to these requests within 30 days of receipt.
  • The right to be informed
    • You have the right to be told how we are using your personal information and this policy document, and shorter summary statements used in our communications, are intended to provide you with a clear and transparent description of how your data may be used.
  • The right of rectification
    • You have the right to ask us to correct information we hold about you if you think it is inaccurate.
  • The right to erasure
    • You have the right to ask us to erase your personal information in certain circumstances. This is also known as the “right to be forgotten” and allows an individual to request deletion of their personal data where there isn’t a compelling reason for its continued processing by TVAA. It may be that we recommend suppression from future communications rather than data deletion.
  • The right to restrict processing of your personal information
    • You have the right to ask us to restrict processing of your information in certain circumstances. For example, if you think the data we hold is inaccurate and we disagree, then processing may be restricted until the accuracy has been verified.
  • The right to data portability
    • This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
  • The right to object – including automated decision making and profiling
    • You have the absolute right to stop the processing of your personal information for direct marketing purposes. You can exercise this right at any time.
    • Where our only legal basis for processing your personal data is your consent to do so, you can withdraw that consent at any time and we will have to stop processing your personal data. Please be aware that this will only affect a new activity and does not mean that processing carried out before you withdrew your consent is unlawful.

In most circumstances you will not be required to pay a fee for exercising your rights however we do reserve the right to charge a reasonable fee to cover our administration costs if we think your request is “manifestly unfounded or excessive” as advised by the ICO. We are required to respond to your request without undue delay and at the latest within one month.

If you make a request relating to any of the rights listed above, we will consider each request in accordance with all applicable data protection laws and regulations.

You can make the above requests by emailing dpo@tvairambulance.org.uk or by writing to:

The Data Protection Officer
Thames Valley Air Ambulance
Stokenchurch House
Oxford Road
Stokenchurch
Bucks
HP14 3SX

TVAA are committed to working with you to obtain a fair and rapid resolution to any complaints or disputes relating to privacy matters.

If you require more information or have any questions or concerns please contact us by email at dpo@tvairambulance.org.uk; in writing to Data Protection Officer, Thames Valley Air Ambulance, Stokenchurch House, Oxford Road, Stokenchurch, Bucks HP14 3SX or calling 0300 999 0135.

You also have the right to make a complaint directly to the Information Commissioner’s Office (ICO). They can be contacted at https://www.ico.org.uk/global/contact-us/ or in writing to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 1231113

If you post or send any content that TVAA believe to be inappropriate, offensive or in breach of any laws, such as defamatory, abusive, or hateful content on our forums or social media pages, TVAA, if necessary, may use your personal information to inform relevant third parties such as your internet provider or law enforcement agencies.

The inspirational stories from our former patients illustrate to our local community the difference we bring. By choosing to share your story with us, you will be helping to raise awareness of our vital service.

We will only share this information if we have obtained the explicit and informed consent of the individual involved or their parent or guardian if they are under the age of 18.

This information may be made public by us at events, in materials promoting our campaigning and fundraising work, or in documents such as our annual report.

The information provided to us as part of your story will be retained in line with the period detailed on our consent documentation and will always be held securely with restricted access in place.

In order to carry out our work and provide care for patients, TVAA will obtain confidential patient information.

Confidential patient information is information that identifies you and says something about your health care or treatment.

The records we hold about our patient’s health, treatment, and care may be held in written form (manual records) and/or in secure digital format and includes:

  • Basic details about you such as your address and next of kin details
  • Details about the treatment and care you are receiving
  • Notes and / or reports about your health including any treatment and care you need, have had, and may need
  • Results of investigations
  • Relevant information from other health professionals, relatives or those who care for you and know you well
  • Outcome data which includes information on investigations or treatment you received in hospital. This is shared in order to review our standards of treatment against a confirmed diagnosis and subsequent condition. This helps inform our future clinical practice.

Patient data is held within a secure confidential database and only accessible to those who have a genuine requirement. Patient data cannot be accessed for the purposes of fundraising.

All TVAA staff have a legal duty to keep patient information confidential.

Patient information will only be shared if others, involved in your care, have a genuine need for it e.g. copies of patient records are handed over to the receiving hospital, so treatment can be continued safely and without delay.

Patient records will also be shared with the South Central Ambulance Service, who commission our service.

Patient information may be shared with the Care Quality Commission (CQC), the independent regulator of health and social care in England. The CQC have powers under the Health & Social Care Act 2008 to access and use information where they consider this is necessary for them to carry out their function as the regulator. The CQC privacy policy can be found at https://www.cqc.org.uk/about-us/our-policies/privacy-statement#public

We will not disclose your confidential patient information to third parties without your permission unless there are exceptional circumstances such as when the health or safety of others is at risk or where the law requires information to be passed on. We may for example, share your personal data without your consent for the purpose of fulfilling our safeguarding responsibilities. This does not happen often but we may share your personal data:

  • If we believe there is a serious risk to the public, our staff or to other professionals;
  • To protect a vulnerable person, (child or adult) who we believe may be at risk.

Anyone who receives information from us is also under a legal obligation to keep it confidential.

PATIENT DATA USED FOR RESEARCH PURPOSES

TVAA participate in research to help improve the medical support we offer at scene and during transition to hospital. Research may involve confidential patient information gathered directly during the course of our work and information provided from the NHS. Confidential patient information is information which identifies you and says something about your health care or treatment. Wherever possible research studies will be conducted without using your confidential patient information and will use data that does not identify you (anonymised). Information that only identifies you, like your name and address is not considered patient confidential information and may still be used.

You can stop your confidential patient information being used for research and this will not affect your individual care or treatment. For more information regarding your NHS confidential patient information and opting out of its use for research please visit www.nhs.uk/your-nhs-data-matters.

For opting out of TVAA patient confidential information being used for research purposes please contact dpo@tvairambulance.org.uk or tvaa.feedback@nhs.net.

PATIENT LIAISON (AFTERCARE)

TVAA have a dedicated Aftercare team who review the health records created by our clinical team for the purpose of providing an aftercare service for our patients or their next of kin. The Aftercare team may also contact bereaved families to offer condolences and provide the opportunity to talk with TVAA.

As part of this service, patients and/or their next of kin may be contacted for the purpose of offering follow up or support. Information provided to our aftercare service is stored securely and with strict access controls in place.

YOUR HEALTH RECORDS

Data Protection legislation allows you to find out what information about you is held both on computer and in certain manual records.  This is your “right of subject access” and applies to your health records.  You are entitled to receive a copy, but you also need to be aware that in certain circumstances, your right to see some detail in your health record might be limited in your own interest or for other reasons.  Your health record might include:

  • Basic details about you e.g. your address and next of kin
  • Notes and reports about your health and any treatment/care you need, have had, or may need
  • Details and records about treatment/care you are receiving
  • Results of investigations
  • Relevant information from other health professionals, relatives or those who care for you and know you well
  • Follow up information on our in-hospital care, diagnosis, and interventions.

REQUESTS FOR PERSONAL INFORMATION

All requests for patient personal information from TVAA should be made to: DPO@tvairambulance.org.uk

RAISING CONCERNS

TVAA strive to ensure our patients and those we serve receive the best care always.

If you feel there has been a mistake or misunderstanding in the care, we have provided then we would like to hear from you. We can assist in resolving your concerns and ensure that we learn from any mistakes.

Our complaints procedure and policy can be found on our website: https://www.tvairambulance.org.uk/complaints

Should you contact us to raise a complaint, information you provide will be stored securely for the purposes of responding to you with the outcome of our investigation.

You can contact the Data Protection Officer using DPO@tvairambulance.org.uk

As part of any recruitment process, TVAA collects and processes personal data relating to job applicants. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.

What information do we collect?

We collect a range of information about you. This includes:

  • your name, address, and contact details, including email address and telephone number;
  • details of your qualifications, skills, experience, and employment history;
  • information about your current level of remuneration, including benefit entitlements;
  • whether or not you have a disability for which TVAA needs to make reasonable adjustments during the recruitment process;
  • information about your entitlement to work in the UK; and
  • images of candidates taken during the recruitment process where we may have an extended recruitment period due to assessment days taking place.

We may collect this information in a variety of ways. For example, data might be contained in application forms, CVs, or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.

We may also collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks. We will seek information from third parties only once a job offer to you has been made and will inform you that we are doing so.

Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).

Why do we process your personal data?

TVAA need to process data to take steps at your request prior to entering into a contract with you. We may also need to process your data to enter into a contract with you.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant’s eligibility to work in the UK before employment starts.

We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

We may process information about whether applicants are disabled to make reasonable adjustments for candidates who have a disability. This is to carry out our obligations and exercise specific rights in relation to employment.

For some roles, we are obliged to seek information about criminal convictions and offences. Where we seek this information, we do so because it is necessary for us to carry out our obligations and exercise specific rights in relation to employment.

TVAA will not use your data for any purpose other than the recruitment exercise for which you have applied.

Who has access to your data?

Your information may be shared for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers (including external experts) involved in the recruitment process, managers in the business area with a vacancy, TVAA’s Executive Management Team and IT staff (including our third-party provider) if access to the data is necessary for the performance of their roles.

We will not share your data with third parties unless your application for employment is successful and we make you an offer of employment. We will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure and Barring Service to obtain necessary criminal records checks.

How does TVAA protect your data?

TVAA takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused, or disclosed, and is not accessed except by our employees in the proper performance of their duties.

How long will TVAA keep your data?

If your application for employment is unsuccessful, we will hold your data on file for 6 months after the end of the relevant recruitment process. At the end of this 6-month period or once you withdraw your consent, your data is deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will then be held will be provided to you in a new privacy notice or via our retention register.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to us during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.

Automated decision-making

Recruitment processes are not based solely on automated decision-making.

Security Measures

TVAA have in place technical and organisational measures to protect the personal information we have.

Please refer to the section “Security and Storage of Personal Information we Hold” within our main policy document.

Your Rights

Please refer to the section “Your Rights” on our main policy document for information relating to your rights regarding our processing of your information.

You can exercise any of your rights or ask any questions relating to this policy by contacting DPO@tvairambulance.org.uk.

TVAA collects and processes personal data relating to its employees to manage the employment relationship. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.

What information do we collect?

We collect and process a range of information about you. This includes but is not limited to:

  • your name, address, and contact details, including email address and telephone number, date of birth and gender;
  • the terms and conditions of your employment;
  • details of your qualifications, skills, experience, and employment history, including start and end dates, with previous employers and with the TVAA;
  • for specific clinical roles, details of HCPC, GMC registration, IHCD or driving competency
  • DVLA checks, NHS Appraisal or ARCP/PDR records;
  • information about your remuneration, including entitlement to benefits such as pensions or insurance cover;
  • details of your bank account and national insurance number;
  • information about your marital status, next of kin, dependants, and emergency contacts;
  • information about your nationality and entitlement to work in the UK;
  • information about your criminal record;
  • details of your roster (days of work and working hours) and attendance at work;
  • details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
  • details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
  • assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;
  • information about medical or health conditions, including audiology and whether you have a disability for which we need to make reasonable adjustments;
  • details of trade union membership;
  • equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief;
  • Photographic images;
  • CCTV recordings;
  • Vehicle telematics;
  • Video conferencing call recordings; and
  • Biometrics – fingerprint scan for some operational staff

TVAA collects this information in a variety of ways. For example, data is collected through application forms, CVs, or resumes; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as benefit nomination forms); from correspondence with you; or through interviews, meetings, or other assessments.

In some cases, TVAA collects personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks permitted by law.

Data is stored in a range of different places, including in your personnel file, in the HR management system and in other IT systems (including our email system).

Why do we process personal data?

We need to process data to enter into an employment contract with you and to meet our obligations under your employment contract. For example, we need to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer benefit, pension, and insurance entitlements.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check an employee’s entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled. For certain positions, we may process criminal records data to assess your suitability for employment both when you are recruited (through appropriate criminal records checks) and in the course of your employment.

In other cases, we have a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee data allows us to:

  • run recruitment and promotion processes;
  • maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
  • operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
  • ensure employees are complying with relevant policies and procedures;
  • operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
  • operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
  • obtain occupational health advice, to ensure we comply with duties in relation to individuals with disabilities, meet our obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
  • operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that we comply with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
  • ensure effective general HR and business administration including payment of business expenses;
  • conduct employee surveys
  • recognise and communicate personal life events, birthdays, or national holidays (such as Easter or Christmas), and to recognise behaviour that goes above and beyond;
  • provide references on request for current or former employees;
  • respond to and defend against legal claims and enforce our legal rights;
  • maintain and promote equality in the workplace;
  • recognise your achievements;
  • invite you to work events and to participate in competitions;
  • conduct salary review and role benchmarking exercises

Where we rely on legitimate interests as a reason for processing data, we have considered whether those interests are overridden by the rights and freedoms of employees or workers and have concluded that they are not.

Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities and for health and safety purposes). Biometric data is processed at RAF Benson solely for securing and restricting access to our drug storeroom.

Where we process other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring. Data that we use for these purposes is anonymised or collected with the explicit consent of employees which can be withdrawn at any time by contacting hr@tvairambulance.org.uk. Employees are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

Who has access to data?

Your information will be shared internally, including with members of the HR and recruitment team, Payroll and Finance team, your line management, the CEO and their deputy, including their admin support, and IT staff, where access to the data is necessary for performance of their roles.

We share your data with third parties to obtain pre-employment references and annual appraisal records with other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks with Disclosure and Barring Service, or report suspected offences to the appropriate authorities.

TVAA may also share your data with third parties who process data on our behalf, and these include but are not limited to provision of the following services:

  • In connection with payroll processing
  • The provision of employee benefits, including those whose services we engage to provide and deliver gifts to staff
  • The provision of Occupational Health services
  • IT support
  • Time and attendance monitoring
  • Site security checks
  • CCTV
  • Legal advisors
  • Disclosure and Barring Services
  • Keyholding and alarm company
  • Pay benchmarking
  • Organisation and management consultants
  • NHS and Military partners for individuals seconded to TVAA
  • In connection with managing clinical shift patterns and change notifications.

We may also share your data with third parties in the context of a sale of some or all our business. In those circumstances the data will be subject to confidentiality arrangements.

How long do we keep employee data for?

We will hold your personal data for the duration of your employment. The periods for which your data is held after the end of employment are set out in our retention policy.

What if you do not provide personal data?

You have some obligations under your employment contract to provide us with data. You are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide us with data to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your right to work in the UK and payment details, must be provided to enable us to enter into a contract of employment with you. If you do not provide other information, this will hinder our ability to administer the rights and obligations arising as a result of the employment relationship efficiently.

Automated decision-making

Employment decisions are not based solely on automated decision-making.

Security Measures

TVAA have in place technical and organisational measures to protect the personal information we have.

Please refer to the section “Storage and Security of Personal Information we Hold” within our main privacy notice.

Your Rights

Please refer to the section “Your Rights” on our main privacy notice for information relating to your rights regarding our processing of your personal information.

You can exercise any of your rights or ask any questions relating to this notice by contacting DPO@tvairambulance.org.uk.

Thames Valley Air Ambulance is committed to supporting volunteers and recognises the value-added benefit volunteers bring to the Charity.

During our relationship with you, it will be necessary for us to collect and process your personal data and, in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, TVAA are committed to being transparent about how we collect and use that information. This section provides you with information as to what personal information is collected and processed and what your rights are in relation to that processing.

Why do we process volunteer information?

TVAA will use information about you for the following primary reasons:

  1. To perform the services you have requested, such as processing your volunteer interest, sending you our newsletter and other information about the Charity.
  2. To manage and improve our website.

We may collect information about your interaction with the Site and the services on the Site. This may include information about your computer and, where available, your IP address, operating system, and browser type. We reserve the right to perform statistical analysis of user behaviour and characteristics in order to measure interest in and use of the various areas of the Site and to ascertain the number of users that have visited particular web pages. We also keep track of what you do with our newsletters when you receive them for trends and statistics and to evaluate the efficiency of our newsletter and information service.

We may also use your information for detection of fraud and research purposes.

What information we may collect about you?

  • Your name, address, and contact details including email address and telephone number(s)
  • Details of your qualifications, skills, interests, and previous volunteer experience(s)
  • Your photographic image
  • Health information
  • Date of birth
  • Identification documents (i.e. driving license for those driving Charity vehicles)
  • Name, address, and contact details (including email) and relationship with nominated referees
  • Whether you have a disability for which TVAA needs to make reasonable adjustments during the recruitment process or whilst volunteering at events
  • Next of kin details
  • Bank details which may be used to process out of pocket expenses

TVAA may collect this information in a variety of ways for example, data might be contained in application forms, obtained from identify documents or from reference/background checks and directly from volunteers themselves.

Additional information may be collected throughout the course of your volunteering activities with us for example online identifiers when you visit our website or CCTV images should you work in particular areas of our HQ in Stokenchurch or if you attend our facility at RAF Benson.

We ask that should you provide information to us which relates to third party individuals you do so with their knowledge and understanding of our proposed use of that information.

Who has access to your data?

Your information may be shared internally for the purposes of the volunteer recruitment process. This includes members of HR, the recruitment team, interviewers involved in the process, the wider Fundraising team, TVAA’s Executive Management Team and IT staff (including our external provider) if access to data is necessary for the performance of their roles.

A limited amount of your data (e.g. name, telephone number, email address) may also be shared with event organisers or other volunteers to allow for communication about events you may be attending as a volunteer.

TVAA may also share your data with other TVAA entities, suppliers, or service providers where it is necessary for us to facilitate your volunteering. For example, Dot Digital or our mailing house who facilitate sending our newsletter and e-newsletter; Sign Up who we use for volunteer co-ordination; Stripe Payments Europe Ltd our payment providers. We may also share your data with organisations in relation to volunteer nominations or with external sites such as Rooms to Reward.

Where legally obliged, we may share volunteer information with external regulators or organisations. For example, we provide the Charity Commission and Companies House with basic contact details of our Trustees.

Before sharing your information with third parties we will ensure they also are in a position to handle your information in accordance with Data Protection Law.

Lawful basis for processing your personal data

We only use personal data when the law allows us to do so and we process your information relying on one or more of the following lawful bases:

  • Where we need to perform the contract you have entered into with us or in order to take pre-contract steps at your request and/or to perform our contractual obligations to you
  • Where it is necessary for us to comply with a legal obligation
  • Where you have freely provided your specific, informed, and unambiguous consent for particular purposes
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override these interests. Our legitimate interest is to fulfil our charitable purpose which involves sending direct marketing to our supporters, contacting our volunteers to plan and administer activities, take steps to ensure and monitor compliance with our legal obligations and internal standards and procedures, assess suitability of volunteers for potential roles and keep records of volunteer activities and performance.

In some cases, such as a medical emergency, it may be necessary for us to process your information to protect your interests (or someone else’s interests) or where it is needed in the public interest.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to TVAA during the volunteer recruitment process however, if you do not provide the information, we may not be able to process your application properly or at all.

How long will TVAA keep your data?

If your application for becoming a volunteer is unsuccessful, TVAA will hold your details on record for a period of 6 months after the end of the process. At the end of that period or once you withdraw consent, your data is deleted or destroyed.

If your application is successful, then the personal information gathered during recruitment will be held in a secure location with access restricted to only those who require it. On notification that you no longer wish to be a volunteer for the Charity, your details will be deleted in line with our retention policy.

Security Measures

TVAA have in place technical and organisational measures to protect the personal information we have.

Please refer to the section “Storage and Security of Personal Information we Hold” within our main privacy notice.

Your Rights

Please refer to the section “Your Rights” on our main privacy notice for information relating to your rights regarding our processing of your personal information.

You can exercise any of your rights or ask any questions relating to this notice by contacting DPO@tvairambulance.org.uk.

This privacy policy may be updated periodically and without prior notice to you to reflect changes in our information practices or relevant laws. TVAA will post a notice on their website pointing to this privacy notice to notify you of any substantive changes to the way we collect and use personal information. We will indicate at the top of the document when it was last updated.

TVAA would encourage their donors, supporters, volunteers, employees, patients, and stakeholders to check this Privacy Policy regularly so they can remain up to date with our working practices in relation to their personal information.

V1.4 update includes new sections for Job Applicants, Employee Data, Volunteer Data and Patient Data along with the addition of a section regarding Payment Transactions.

V1.5 minor changes/updates throughout the document.Significant update to Lawful Processing of Your Data. Addition of sections on Philanthropy, How Do We Undertake Research and Ethical Screening and Minimising Risk

V1.6 changes throughout the document to make it easier to understand with some key updates regarding our use of supporter information.

V1.7 addition to the section on When We Collect Information About You, Our Supporter and specifically the last sentence of the section on when we collect the information INDIRECTLY.

 

DOWNLOAD A COPY OF OUR PRIVACY POLICY

TVAA-Privacy-Policy-V1.7.pdf

354 KB

Download