Updated: 1 October 2020
We, at Thames Valley Air Ambulance (“TVAA”/”We”/”Us”/”Our”), are reliant on the support and generosity of the communities we serve to continue our vital work.
As a valued stakeholder of TVAA we are committed to protecting your privacy and the personal information you give to us.
If you have any questions, please contact us at email@example.com
- Why we hold and process personal information
- How will TVAA use your information?
- Lawful processing of your data
- Profiling for Direct Marketing
- How do we undertake research?
- Ethical screening and minimising risk
- Will we share your personal data with anyone else?
- Your rights
TVAA is a registered charity in England and Wales 1084910.
Our registered address is:
TVAA’s mission is to push the boundaries of medical intervention, helicopter aviation and on-scene patient care to deliver a unique life-saving service to patients, where and when it is needed the most.
Stakeholders can affect or be affected by the organisation’s actions, objectives and policies. Some examples of stakeholders are: employees, volunteers, supporters, suppliers, other emergency services, media, patients, the public.
We take active steps to ensure our stakeholders are aware of the ways in which they can help us achieve our overall purpose.
Personal information is information that can be used to identify you. We hold and process your personal information for a variety of reasons including:
- To administer donations
- To administer raffles, prize draws or competitions
- For the provision of health care and treatment
- To claim gift aid on donations
- When you sign up to fundraise for us or to take part in an event so we can communicate with you
- To support community-based fundraising and campaigning
- To provide supporters with marketing information about our events, fundraising activities and appeals so they are aware of other ways they can support us
- To undertake research and analysis to better understand and communicate with our supporter base and to reach new supporters
- To ensure we do not send marketing or unwanted information to those who have informed us they do not wish to be contacted (for example our suppression file and self-exclusion register)
- For internal record keeping, such as the management of feedback or complaints
- To understand how we can improve our services, products or information
- Administering and governing the charity
When processing personal data our approach follows the principles set out by the Data Protection Act:
- We process personal data lawfully, fairly and in a transparent manner
- We collect personal data only for specified, explicit and legitimate purposes
- We process personal data only where it is adequate, relevant and limited to what is necessary for the purpose(s) of processing
- We keep accurate personal data and take all reasonable steps to ensure that inaccurate personal data is rectified or deleted without delay
- Kept in a form permitting identification of the data subject for no longer than is necessary for the purpose(s) for which that data is processed
- Processed in a manner ensuring appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organisational measures (integrity and confidentiality)
TVAA will only contact you for marketing purposes such as keeping you up to date with Charity activities, or letting you know of ways in which you can support our work, where we have your consent, or we are otherwise allowed to do so.
TVAA will make it easy for you to tell us if you would like to receive marketing communications from us and hear more about our work and the ways in which you would like to receive this information (email, post and phone). We will not send marketing material if you tell us you do not wish to receive these communications and there are a variety of ways in which you can let us know how you prefer to be contacted.
TVAA may collect your personal data in the following circumstances:
- When you give it to us DIRECTLY
You may give us your personal data directly when you donate, sign up for one of our events, or when you communicate with us.
- When you give it to us INDIRECTLY
You may give us your information indirectly for example when you sign up to events or contribute to TVAA via fundraising sites like Just Giving. These independent third parties will pass your data to TVAA where you have indicated that you wish to support us and have given your consent, or it is a necessary part of completing a contract with you.
There will be times when your personal data is collected by an organisation working on our behalf (for example a professional fundraising agency) but as they are acting on our behalf, they cannot use your data for their own purpose. We remain the data controller and are responsible for the security and correct processing of that data.
- When you access TVAA’s Social Media
We might also obtain your personal data through your use of social media such as Facebook, WhatsApp, Twitter or LinkedIn, depending on your settings or the privacy policies of these social media and messaging services. To change your settings on these services, please refer to their privacy notices, which will tell you how to do this.
Updating your preferences with TVAA will not guarantee that you never see our contents on social media, since the social media site may select you based on other criteria and without your data having been provided by TVAA.
- When the information is publicly available
Personal data about individuals may be obtained and used in our research to identify those who might be interested in giving major gifts to charities. In this scenario, TVAA are looking to find out more about individuals, their interests, and motivations for giving and supporting and this takes place using publicly available information. This information may include newspaper or other media coverage, open postings on social media sites such as LinkedIn, and data from other sources such as Companies House, property registers and company websites.
Further information can be found in the Philanthropy and Profiling sections of this policy.
Use of other publicly available sources, such as the Mailing Preference Service (MPS) or Fundraising Preference Service (FPS), assist us in ensuring we do not send unsolicited mail or marketing material to those who have indicated they do not wish to receive these.
TVAA will conduct research and retain publicly available data relating to current and potential supporters in accordance with our retention schedules.
We only collect personal data that is relevant to the type of engagement you will have with us such as:
- Gift Aid declarations
- Signing up to an event or activity
- Requesting our newsletter
- Sharing your story
- Information on beneficiaries / legators / executors relevant to a legacy gift
- Participating in our lottery or raffle
- Staff and volunteers
- Observer shifts
- Your communication preferences and any changes
- Images, to include CCTV
- Call recordings
- Visitor information
The information we request, relevant to your engagement with us, could include:
- Contact details including telephone and email address
- Bank account / credit card details
- Images or film
- Date of birth
- Health details, relevant to an event or activity
- Your motivation for supporting us
- Deceased charity legators
- Records of communication (letters, phone calls, emails, financial history, and any additional notes – which may contain special category data, meeting notes, interests)
Special Category Data (Sensitive Personal Data)
TVAA may collect special category data, as defined by the General Data Protection Regulation.
One such example is health data which may be collected in relation to some of our events or activities. This is required to ensure that we provide appropriate facilities or support to enable you to participate.
Our HEMS work, relating to our patients, also requires TVAA to collect these categories of data including your mental and physical health, race and ethnic origins and genetics.
TVAA will only collect this information where it is necessary, if we are legally required to do so, or if we have your explicit consent.
All special category data is stored on secured databases with restricted access and deleted when no longer relevant. Special category data may be shared with third parties but only where we are required to do so or where the data is anonymised to remove any person identifiable information (PII).
We may use your information in the following ways:
- To confirm receipt of donations (unless you have asked us not to do this) and to say thank you. We may also send you information about the impact your donation or any other support is making or other ways to get involved and support Thames Valley Air Ambulance
- To promote the aims and objectives of the Charity
- In relation to correspondence you have entered into with us whether by letter, email, text, social media or any other means and to contact you about content you provide
- For internal record keeping, recording your relationship with us
- To fulfil sales contracts you may have entered into with us
- To contact you for reasons related to administering any donations or legacies you have made including Gift Aid, if claimed
- To implement instructions, you may have given us such as withdrawing consent to send marketing information or informing us through the Fundraising Preference Service that you do not wish to receive any marketing information
- To conduct database screening or research to build a better profile of our supporters so that we can more effectively target our communications and fundraising activities. This type of activity will mean we look to both include and exclude supporters that are currently on our database. You can choose to opt out of this screening at any time, by contacting firstname.lastname@example.org
- To keep your data up to date – for example, we use Royal Mail’s data on postal address changes to ensure we can maintain contact with you where we believe you are happy to be contacted by post. We also make use of services which notify us of the recently deceased and our reason for doing so is to try to avoid any distress that continued communication could cause. We may also check gone-away records. These checks help us to ensure the data we hold is accurate, up to date and compliant
- To use IP addresses to identify the approximate location of users, to block disruptive use and to record website traffic or to personalise the way our information is presented to you
- To administer our recruitment and employment processes
- To administer our patient story process
- To invite you to participate in surveys or research about TVAA or our work (participation is always voluntary)
- To analyse and improve the activities and content offered by our website and to provide you with the most user-friendly navigation experience. We may also use and disclose information in aggregate (so that no individuals are identified) for marketing and strategic development purposes
- To clarify or check your preferences if we find that details on our database about you are confusing or we are improving our database
The law on data protection requires us to rely on one or more lawful grounds to process your personal information. We consider the following grounds to be relevant:
- Specific Consent– Where you have provided specific consent for us to use your personal information in a certain way. For example, when you make a gift or contact us you have the option to ‘tick a box’ giving us consent to send you direct marketing information. An individual has the right to withdraw their consent at any time.
- Legitimate interest– Where it is reasonably necessary to achieve our or others’ legitimate interests (if what the personal information is used for is fair and doesn’t unduly impact your rights). When we legitimately process your information in this way, we consider and balance any potential impact on you (positive and negative) and your rights under data protection laws. We will not use your personal information where our interests are overridden by the impact on you, for example, where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted by law). Examples of legal processing based on legitimate interest include:
- Sending direct marketing material to supporters by post for fundraising purposes
- Conducting research to better understand who our supporters are
- Measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant and effective
- Promoting Thames Valley Air Ambulance on social media, Google, YouTube and other online platforms
- Taking and using photos or films of event participants and attendees
- Administering events
- Legal obligation– Where necessary so that we can comply with a legal or regulatory obligation to which we are subject. For example, HMRC requires us to collect information regarding Gift Aid or where we are ordered by a court or regulatory authority such as the Information Commissioner’s Office (ICO).
- Performance of Contract– Where we are entering into a contract with you or performing our obligations under it for example when you sign up to our terms and conditions.
When we use sensitive personal information, we require an additional legal basis to process under data protection law so we will either do so based on your explicit consent or identify another route available to us (for example if we need to process it for employment, social security or social protection purposes, your vital interests or in some cases, if it is in the public interest for us to do so).
Should you wish to update the information we hold about you or change your contact preferences then please contact us at email@example.com or call 0300 999 0135.
Ensuring your personal data is accurate is important for us and we would like to ensure we are able to communicate with you in ways you are happy with as well as being able to provide you with the information you are interested in.
Should you wish to change how we communicate with you or update your details please contact us:
0300 999 0135
Thames Valley Air Ambulance,
You can also opt out of email marketing communications separately:
You can click on the unsubscribe link provided in all our marketing communications
When can you expect to stop receiving marketing communications?
TVAA will make every effort to meet the following service levels when stakeholders ask
that we do not send them further marketing communications:
Email 48 hours from receipt of request
Telephone 48 hours from receipt of request
Mail 28 days from receipt of request
The extended time limit on actioning mail requests is longer due to production times for some mail campaigns. In most cases we would expect the change to be effective quicker. During this time period we advise that some mail campaigns may still be received.
Profiling is a common technique used to aid direct marketing and involves analysing data to improve the targeting of communications. TVAA uses profiling techniques to help ensure our communications are relevant. Profiling allows us to target our resources effectively, which donors consistently tell us is a key priority for them. It enables us to raise more funds, sooner, and more cost-effectively than we otherwise would whilst also identifying other areas of support such as volunteering, sharing networks and identifying potential future trustees. The data may have been provided to TVAA by you when responding to our marketing campaigns, or when using our website, or social media sites such as Facebook.
When building a profile, we may analyse geographic, demographic, and other information relating to you, as well as your previous responses to our marketing campaigns. We do this to determine whether we believe a marketing campaign might be of interest. Some of the data is provided by external organisations and may be provided at an aggregate level (e.g. by postcode). This helps to maximise the effectiveness of our campaigns and to minimise the wastage that would result from sending marketing information where it is not of interest.
If you do not wish us to use your data in this way, it is easy for you to opt out, just contact us at firstname.lastname@example.org.
As a fundraising organisation, TVAA undertake in-house research and analysis to gather or combine information about you from publicly available sources including but not limited to: Companies House, the Charity Commission, the Electoral Register, company websites, “rich lists”, Funds Online, social networks such as LinkedIn, property registers and news archives.
To carry this out efficiently, we may use trusted third-party specialist agencies to automate some of this work.
We conduct this research to help us ensure we contact you in the most appropriate way and with the most relevant information. It also supports us in raising funds in a more cost-effective way and assists us in identifying potential supporters and volunteers. Where we identify that you have the capacity and affinity to support TVAA at an increased level we may collect individual information about you to assist us in engaging in a more personalised way.
Using an individual approach like this means we can give you the best possible supporter experience which is aligned with both your type of engagement/support and capacity to give and our efficient use of resources. This research might also be used to exclude those who may be vulnerable to marketing.
There are a number of ways in which we may identify or communicate with potential donors:
- By conducting research on high value donors.
- By asking our existing high value donors to give.
- By inviting potential high value donors to attend our supporter events as a way of engaging with them in relation to the work that TVAA do. We might also identify potential new donors through researching event attendees who were previously unknown to us.
- By researching people who have not given to the charity in the past but who we believe might have a connection to our work and have the capacity to give.
- By asking our donors and influencers to open up their networks to us.
- By asking our donors and influencers to introduce us to potential donors we have identified through our research and that they have a link to.
If you would prefer us not to use your data in this way, please contact us at email@example.com
TVAA will conduct research carefully ensuring that information collected is not excessive or intrusive, is sourced reliably and appropriately using only credible, publicly available information and where that information has been made deliberately public.
Routine collection of large volumes of personal information related to your health, racial or ethnic origin, religious or political beliefs will not take place. It may be that our research does include some of this information however where it does, TVAA acknowledge and recognise the sensitive nature of the information and will ensure we only process and record this information if you tell us directly and therefore have agreed to the processing.
To meet our obligations as a charity, TVAA must look at taking reasonable and appropriate steps in order to understand who our donors are and especially where considerable sums might be donated to us.
Using charity law as our legal basis for processing, TVAA will look to conduct due diligence in order to provide assurances that both donations and support are from appropriate sources. TVAA will do this in order to protect our reputation and to mitigate possible risks.
There are principles in place which guide us in building mutually beneficial relationships with individuals, companies and foundations and these principles ensure we raise money legally, safely and transparently.
Our due diligence will be appropriate in relation to the fundraising opportunity and will not mean that our research will include personal details of every donor or lead to us questioning every donation that is made to us. In accordance with data protection requirements, any information will only be what is considered necessary for us to meet our obligations and that information will be processed in accordance with your rights. You can find out more information about your rights in the “Your Rights” section below.
TVAA will only use your personal data for the purpose(s) for which it was obtained and will not, under any circumstances, share or sell your personal data with any third party for their own marketing purposes and you will not receive marketing from any other companies, charities or organisations as a result of giving your data to us.
We may need to share your data with our service providers who help to deliver our projects, activities and goods. These service providers are “data processors” and will only act under our instruction and are subject to pre-contract scrutiny and contractual obligations containing strict data protection clauses. We will not allow these organisations to use your data for their own purposes or disclose to other third parties without our consent and will take all reasonable care to ensure they always keep your data secure.
Our service providers include but are not limited to fundraising agencies, prospect research companies, direct mailing companies, payment processors and software platform providers.
Social Media Sites
We may also use your email address and phone number to match to your account on Facebook or other social media sites to show you TVAA content while using these services. We only do this where you have opted in to marketing emails or phone calls and we keep your data secure by encrypting it. No data we hold about you is retained by the third party.
In addition, we may also use your email address and phone number to link to Facebook or other social media sites to identify other users of these sites whom we believe would be interested in TVAA, and we may then show them TVAA content. No data we hold about you is retained by the third party.
There are two ways to prevent this use of your data, you can either update your preferences at TVAA by opting out of the relevant channel of communication or you can do this via the social media site:
Updating your preferences with TVAA will not guarantee that you never see our content on social media, since the social media site may select you based on other criteria and without your data having been provided by TVAA.
Where legally required
TVAA will comply with legal requests where disclosure is required or permitted by law (e.g. government bodies for tax purposes, law enforcement agencies for the prevention and detection of crime or regulators such as Care Quality Commission subject to such bodies providing us with a relevant request in writing). Your data is only processed outside the European Economic Area (EEA) where we have verified that appropriate standards and safeguards are in place.
TVAA will hold your information for specific periods of time following the end of your relationship with us and these retention times will be dependent on the nature of your relationship and our legal obligations. Information may be held for a period of up to seven years however, in some cases we may be required to retain for a longer or shorter period.
Legacy income is vital to the running of the charity. We may retain data you provide to us indefinitely, to carry out legacy administration and communicate effectively with the families of people leaving us legacies. This also enables us to identify and analyse the source of legacy income we receive.
Where you contribute material to us, e.g. user generated content or in response to an event or activity, we will only keep your content for as long as is reasonably required for the purpose(s) for which it was collected unless otherwise stated at the point of generation.
If you request that we stop sending you marketing materials, we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.
TVAA retain personal data in accordance with their retention policy and register and review these on a regular basis. Please contact us if you would like to know more about our Data Retention, Archiving and Destruction.
TVAA place great importance on the security of all our supporters’, customers’, employees’ and patients’ data. We have security measures in place to protect against the loss, misuse and alteration of personal data under our control. Only authorised personnel may access user information and we use secure sockets layer (SSL) software to encrypt financial and personal information you input before it is sent to us.
Your information is stored by us on computers located in the UK and on servers within the EU. We may also store your information in paper files.
Some of the personal information collected from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by individuals operating outside the EEA who work for us or are working on our behalf. This includes staff engaged in, among other things, the processing of your payment details and the provision of support services. If you would like to receive further information about which services we use that may transfer your data outside the EEA and the security around such services then please contact us at DPO@tvairambulance.org.uk.
We will always ensure that your data is transferred safely and securely and that our data processors agree, by way of data sharing agreements, to process your data in such a way as to be compliant with GDPR.
In cases when we use external websites provided by other organisations such as Twitter, YouTube or Facebook, then we would ask you to consult their privacy policies.
Where we have provided a password enabling you to access specific parts of our websites, it is your responsibility to keep this password confidential. We advise you not to share your password with anyone.
Under data protection law you have rights you need to be made aware of. The rights available to you depend on our reason for processing your information.
- The right to access your personal information
- You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.
- The right to edit and update your personal information
- You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete the information you think is incomplete. This right always applies.
- The right to erasure
- You have the right to ask us to erase your personal information in certain circumstances.
- The right to restrict processing of your personal information
- You have the right to ask us to restrict processing of your information in certain circumstances.
- The right to data portability
- This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
- The right to object – including automated decision making and profiling
- You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or in our legitimate interests.
In most circumstances you will not be required to pay a fee for exercising your rights however we do reserve the right to charge a reasonable fee to cover our administration costs if we think your request is “manifestly unfounded or excessive” as advised by the ICO. We are required to respond to your request without undue delay and at the latest within one month.
If you make a request relating to any of the rights listed above, we will consider each request in accordance with all applicable data protection laws and regulations.
You can make the above requests by emailing firstname.lastname@example.org or by writing to:
The Data Protection Officer,
Thames Valley Air Ambulance,
TVAA are committed to working with you to obtain a fair and rapid resolution to any complaints or disputes relating to privacy matters.
If you require more information or have any questions or concerns please contact us by email at email@example.com; in writing to Data Protection Officer, Thames Valley Air Ambulance, Stokenchurch House, Oxford Road, Stokenchurch, Bucks HP14 3SX or calling 0300 999 0135
You also have the right to make a complaint directly to the Information Commissioner’s Office (ICO). They can be contacted at https://ico.org.uk/global/contact-us/
If you post or send any content that TVAA believe to be inappropriate, offensive or in breach of any laws, such as defamatory, abusive or hateful content on our forums or social media pages, TVAA, if necessary, may use your personal information to inform relevant third parties such as your internet provider or law enforcement agencies.
The inspirational stories from our former patients illustrate to our local community the difference we bring. By choosing to share your story with us, you will be helping to raise awareness of our vital service.
We will only share this information if we have obtained the explicit and informed consent of the individual involved or their parent or guardian if they are under the age of 18.
This information may be made public by us at events, in materials promoting our campaigning and fundraising work, or in documents such as our annual report.
The information provided to us as part of your story will be retained for a period of three years, as explained in our consent documentation, and will always be held securely with restricted access in place.
In order to carry out our work and provide care for patients, TVAA will obtain confidential information. The records about our patient’s health, treatment and care that we retain may be held in written form (manual records) and/or in secure digital format.
All TVAA staff have a legal duty to keep patient information safe and confidential within UK legislation including GDPR and the Data Protection Act 2018 along with other relevant healthcare regulations.
Patient information will only be shared if others, involved in their care, have a genuine need for it e.g. copies of patient records are handed over to the receiving hospital, so treatment can be continued safely and without delay.
We will not disclose your confidential patient information to third parties without your permission unless there are exceptional circumstances such as when the health or safety of others is at risk or where the law requires information to be passed on.
Patients/next of kin will not be contacted for promotion or marketing purposes without explicit consent.
Anyone who receives information from us also has a legal obligation to keep it confidential.
PATIENT DATA USED FOR RESEARCH PURPOSES
TVAA participate in research studies which may involve confidential patient information gathered directly during the course of our work and information provided from the NHS. Confidential patient information is information which identifies you and says something about your health care or treatment. Wherever possible research will be conducted without using your confidential patient information and will use data that does not identify you (anonymised). Information that only identifies you, like your name and address is not considered patient confidential information and may still be used.
YOUR HEALTH RECORDS
Data Protection legislation allows you to find out what information about you is held both on computer and in certain manual records. This is your “right of subject access” and applies to your health records. You are entitled to receive a copy, but you also need to be aware that in certain circumstances, your right to see some detail in your health record might be limited in your own interest or for other reasons. Your health record might include:
- Basic details about you e.g. your address and next of kin
- Notes and reports about your health and any treatment/care you need, have had or may need
- Details and records about treatment/care you are receiving
- Results of investigations
- Relevant information from other health professionals, relatives or those who care for you and know you well
- Follow up information on our in-hospital care, diagnosis and interventions.
REQUESTS FOR PERSONAL INFORMATION
All requests for patient personal information from TVAA should be made to: DPO@tvairambulance.org.uk
TVAA strive to ensure our patients and those we serve receive the best care always.
If you feel there has been a mistake or misunderstanding in the care, we have provided then we would like to hear from you. We can assist in resolving your concerns and ensure that we learn from any mistakes.
TVAA would like to resolve concerns or queries informally however, if you are unhappy with the treatment or service you have received from us you may wish to make a formal complaint. Our complaints procedure and policy can be found on our website: https://www.tvairambulance.org.uk/complaints
If TVAA are aware that we have not operated to our high standards and an incident occurs, we will be open and honest following our Duty of Candour ensuring those involved are notified in a timely manner. A full and thorough investigation will be conducted ensuring patient care and safety are paramount and the same mistake is not made again.
Contacts: Patient Liaison Manager
Senior Information Risk Owner
Data Protection Officer
As part of any recruitment process, TVAA collects and processes personal data relating to job applicants. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.
What information do we collect?
We collect a range of information about you. This includes:
- your name, address and contact details, including email address and telephone number;
- details of your qualifications, skills, experience and employment history;
- information about your current level of remuneration, including benefit entitlements;
- whether or not you have a disability for which TVAA needs to make reasonable adjustments during the recruitment process;
- information about your entitlement to work in the UK; and
- images of candidates taken during the recruitment process where we may have an extended recruitment period due to assessment days taking place.
We may collect this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.
We may also collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks. We will seek information from third parties only once a job offer to you has been made and will inform you that we are doing so.
Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).
Why do we process your personal data?
TVAA need to process data to take steps at your request prior to entering into a contract with you. We may also need to process your data to enter into a contract with you.
In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check a successful applicant’s eligibility to work in the UK before employment starts.
We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.
We may process information about whether applicants are disabled to make reasonable adjustments for candidates who have a disability. This is to carry out our obligations and exercise specific rights in relation to employment.
For some roles, we are obliged to seek information about criminal convictions and offences. Where we seek this information, we do so because it is necessary for us to carry out our obligations and exercise specific rights in relation to employment.
TVAA will not use your data for any purpose other than the recruitment exercise for which you have applied.
Who has access to your data?
Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy, TVAA’s Executive Management Team and IT staff (including our third-party provider) if access to the data is necessary for the performance of their roles.
We will not share your data with third parties unless your application for employment is successful and we make you an offer of employment. We will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure and Barring Service to obtain necessary criminal records checks.
TVAA will not transfer your data outside the European Economic Area.
How does TVAA protect your data?
TVAA takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.
How long will TVAA keep your data?
If your application for employment is unsuccessful, we will hold your data on file for 6 months after the end of the relevant recruitment process. At the end of this 6-month period or once you withdraw your consent, your data is deleted or destroyed.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will then be held will be provided to you in a new privacy notice or via our retention register.
What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to Us during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.
Recruitment processes are not based solely on automated decision-making.
TVAA collects and processes personal data relating to its employees to manage the employment relationship. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.
What information do we collect?
We collect and process a range of information about you. This includes but is not limited to:
- your name, address and contact details, including email address and telephone number, date of birth and gender;
- the terms and conditions of your employment;
- details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the TVAA;
- for specific clinical roles, details of HCPC, GMC registration, IHCD or driving competency
- DVLA checks
- information about your remuneration, including entitlement to benefits such as pensions or insurance cover;
- details of your bank account and national insurance number;
- information about your marital status, next of kin, dependants and emergency contacts;
- information about your nationality and entitlement to work in the UK;
- information about your criminal record;
- details of your roster (days of work and working hours) and attendance at work;
- details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
- details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
- assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;
- information about medical or health conditions, including whether you have a disability for which we need to make reasonable adjustments;
- details of trade union membership;
- CCTV recordings; and
- Vehicle telematics
- Video conferencing call recordings
- Biometrics – fingerprint scan for some operational staff
TVAA collects this information in a variety of ways. For example, data is collected through application forms, CVs or resumes; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments.
In some cases, TVAA collects personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from criminal records checks permitted by law.
Data is stored in a range of different places, including in your personnel file, in the HR management system and in other IT systems (including our email system).
Why do we process personal data?
We need to process data to enter into an employment contract with you and to meet our obligations under your employment contract. For example, we need to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer benefit, pension and insurance entitlements.
In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we are required to check an employee’s entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled. For certain positions, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake the role in question.
In other cases, we have a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee data allows us to:
- run recruitment and promotion processes;
- maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
- operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
- operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
- operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
- obtain occupational health advice, to ensure we comply with duties in relation to individuals with disabilities, meet our obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
- operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that we comply with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
- ensure effective general HR and business administration;
- provide references on request for current or former employees;
- respond to and defend against legal claims.
- to invite you to participate in surveys about TVAA, your work or your health & wellbeing.
- sending relevant communications to your work email address
Where we rely on legitimate interests as a reason for processing data, we have considered whether those interests are overridden by the rights and freedoms of employees or workers and have concluded that they are not.
Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities and for health and safety purposes). Biometric data is processed at RAF Benson solely for securing and restricting access to our drug store room.
Who has access to data?
Your information will be shared internally, including with members of the HR and recruitment team, your line manager, Directorate leads and CEO and IT staff if access to the data is necessary for performance of their roles.
We share your data with third parties to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks with Disclosure and Barring Service, HR consultancy to support and advise on all aspects of HR and to maintain legal compliance.
TVAA also shares your data with third parties that process data on our behalf and these include but are not limited to provision of the following services:
- Payroll / Payroll Giving
- Occupational health
- IT services
- Time and attendance
- HR consultants
- Legal consultants
- DBS checks
We may also share your data with third parties in the context of a sale of some or all its business. In those circumstances the data will be subject to confidentiality arrangements.
How long do we keep employee data for?
We will hold your personal data for the duration of your employment. The periods for which your data is held after the end of employment are set out in our retention policy.
What if you do not provide personal data?
You have some obligations under your employment contract to provide us with data. You are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide us with data to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.
Certain information, such as contact details, your right to work in the UK and payment details, must be provided to enable us to enter into a contract of employment with you. If you do not provide other information, this will hinder our ability to administer the rights and obligations arising as a result of the employment relationship efficiently.
Employment decisions are not based solely on automated decision-making.
Thames Valley Air Ambulance is committed to supporting volunteers and recognises the value-added benefit volunteers bring to the Charity.
During our relationship with you, it will be necessary for us to collect and process your personal data and, in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, TVAA are committed to being transparent about how we collect and use that information. This section provides you with information as to what personal information is collected and processed and what your rights are in relation to that processing.
Why do we process volunteer information?
TVAA will use information about you for the following primary reasons:
- To perform the services you have requested, such as processing your volunteer interest, sending you our newsletter and other information about the Charity.
- To manage and improve our website.
We may collect information about your interaction with the Site and the services on the Site. This may include information about your computer and, where available, your IP address, operating system and browser type. We reserve the right to perform statistical analysis of user behaviour and characteristics in order to measure interest in and use of the various areas of the Site and to ascertain the number of users that have visited particular web pages. We also keep track of what you do with our newsletters when you receive them for trends and statistics and to evaluate the efficiency of our newsletter and information service.
We may also use your information for detection of fraud and research purposes.
What information we may collect about you?
- Your name, address and contact details including email address and telephone number(s)
- Details of your qualifications, skills, interests and previous volunteer experience(s)
- Your photographic image
- Health information
- Date of birth
- Identification documents (i.e. driving license for those driving Charity vehicles)
- Name, address and contact details (including email) and relationship with nominated referees
- Whether you have a disability for which TVAA needs to make reasonable adjustments during the recruitment process or whilst volunteering at events
- Next of kin details
TVAA may collect this information in a variety of ways for example, data might be contained in application forms, obtained from identify documents or from reference/background checks.
Who has access to your data?
Your information may be shared internally for the purposes of the volunteer recruitment process. This includes members of HR, the recruitment team, interviewers involved in the process, the wider Fundraising team, TVAA’s Executive Management Team and IT staff if access to data is necessary for the performance of roles.
A limited amount of your data (e.g. name, telephone number, email address) may also be shared externally with event organisers or other volunteers to allow for communication about events you may be attending as a volunteer.
What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to TVAA during the volunteer recruitment process however, if you do not provide the information we may not be able to process your application properly or at all.
How long will TVAA keep your data?
If your application for becoming a volunteer is unsuccessful, TVAA will hold your details on record for a period of 6 months after the end of the process. At the end of that period or once you withdraw consent, your data is deleted or destroyed.
If your application is successful, then the personal information gathered during recruitment will be held in a secure location with access restricted to only those who require it. On notification that you no longer wish to be a volunteer for the Charity, your details will be deleted in line with our retention policy.
V1.4 update includes new sections for Job Applicants, Employee Data, Volunteer Data and Patient Data along with the addition of a section regarding Payment Transactions.
V1.5 minor changes/updates throughout the document
Significant update to Lawful Processing of Your Data
Addition of sections on Philanthropy, How Do We Undertake Research and Ethical Screening and Minimising Risk