Privacy Policy

---

The John Burns Foundation respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you have contact with us and / or visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.

We are a “data controller” for the purposes of the Data Protection Act 2018 and the EU General Data Protection Regulation 2018 (“Data Protection Law”). This means that we are responsible for the processing of your personal information. 

For further information on our privacy practices, please contact our Data Protection Manager. 

Name: Melanie Jones

Address: The John Burns Centre, Park House, Carmarthen Road, Kidwelly Carmarthenshire, SA17 5AB

Phone Number:01554 890840 E-mail: melanie@johnburnsfoundation.org

The type of personal information we collect- 

We currently collect and process the following information:

· Identity Data includes [first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender].

· Contact Data includes [billing address, delivery address, email address and telephone numbers].

· Financial Data includes [bank account and payment card details].

· Transaction Data includes [details about payments to and from you and other details of products and services you have purchased from us].

· Technical Data includes [internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website]. 

· Profile Data includes [your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses]. 

· Usage Data includes [information about how you use our website, products and services]. 

· Marketing and Communications Data includes [your preferences in receiving marketing from us and our third parties and your communication preferences].

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. 

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

· apply to work for us.

· apply for our help and assistance. 

· subscribe to our service or publications. 

· request marketing to be sent to you. 

· enter a competition, promotion or survey. 

· give us feedback or contact us. 

· to use our facility

We also receive personal information indirectly, from the following sources in the following scenarios:

Automated technologies or interactions  - As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, (see Cookie policy) and other similar technologies. 

This information is used to make improvements to our website. Information may include:-

· which of our pages you visit the most.

· which of our services are of most interest to you. 

· how you interact with our website. 

· monitoring additional links activity. 

· we also use this information to personalise the way our website is presented when you visit. 

Third parties or publicly available sources - We also receive personal data about you from various third parties [and public sources] such as:-

Technical Data from

analytics providers - Google, 

advertising networks – Facebook 

search information providers – Companies House

We use the information that you have given us in order to use our resources more effectively by:-

· To use data analytics to improve our website, products/services, marketing, customer relationships and experiences.

· To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you.

· To administer and protect our charitable organisation and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) 

Sharing your information 

The personal information we collect about you will mainly be used by our staff and volunteers. 

We may share this information with our trusted partners who help us to deliver our services. Any information shared is reliant on the strict adherence to Data Protection Laws, we ensure this by entering into contracts with the service providers. Information is only passed on for the purpose for which it is intended and is never used for any other purpose. 

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

(a) Your consent. You are able to remove your consent at any time. You can do this by contacting our Data Protection Manager 

(b) We have a contractual obligation.

(c) We have a legal obligation.

(d) We have a vital interest.

(e) We need it to perform a public task.

(f) We have a legitimate interest.

How we store your personal information 

We take looking after your information very seriously, therefore we have implemented organisational procedures and security measures to protect any personal information we have under our control. 

Your information is securely stored electronically on our servers. Access to information is limited to authorised personnel and only accessed when there is a legitimate need to do so. 

Data Retention 

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purpose of satisfying any legal requirements. We may retain personal data for a longer period in the event of a complaint or if we reasonably believe there is prospect of litigation in respect to our relationship with you. 

Your Rights 

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information. 

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances. 

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us if you wish to make a request.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information. 

How to complain

If you have any concerns about our use of your personal information, or you wish to make a complaint please contact our Data Protection Manager (Melanie Jones, Foundation Project Development Manager) by email or write to us at the above address. 

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address: 

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk