Privacy Notice

At Kidney Wales we are committed to respecting and protecting your privacy.

This notice explains how Kidney Wales (we or us) of Elfed House, Oak Tree Court, Cardiff Gate Business Park, Cardiff, CF23 8RS, collects, stores and uses your personal information.

We are the data controller of any personal information you provide to us.

If you have any queries about this privacy notice or wish to exercise any of the rights mentioned in it, please contact us, either in writing at Elfed House, Oak Tree Court, Cardiff Gate Business Park, Cardiff, CF23 8RS or via email at [email protected]

Who we are

Kidney Wales, was established 1967, and is a registered charity 700396 and company limited by guarantee 2268003.

Registered address, Elfed House, Oak Tree Court, Cardiff Gate Business Park, Cardiff, CF23 8RS

How we collect information about you

We may collect your personal information when you:

• Contact us via email, phone, SMS, social media post or via our websites
• Benefit from a Kidney Wales service/project
• Receive financial assistance or investment from a Kidney Wales grant
• Sign up to receive our newsletter
• Apply to work or volunteer for us
• Donate to us
• Register to take part in one of our meetings or events
• Fundraise on our behalf
• Complete a gift aid declaration form
• Provide Kidney Wales with goods or services

We may also collect information about your visit to our websites. This data is not personal to you and is used to help us better understand how visitors use our site, analyse the website performance and develop the website effectively.

What information do we collect?

We collect personal information such as name, address, email, phone number, date of birth (if appropriate).  If you are making a payment or donation to us, or we are making a payment / grant to you, we may also collect your bank account details.

Where do we collect your personal information from?

We will generally collect your personal information directly from you.

How we use your personal information

We may store your address, phone numbers and email address to provide you with important information regarding our services, t0 process your donations or regular payment agreements, to claim Gift Aid on your donations (if appropriate), for fundraising endeavours, for analysis purposes or for administrative or regulatory reasons.

We may also use your details to keep you updated about how your support is helping Kidney Wales, to inform you of forthcoming events and to contact you for fundraising purposes. This could be by email (if you have given us your consent) or by post (if we believe we have a legitimate reason to do so and you have not already told us you do not want to be contacted by post).

In addition, we may use your contact details to provide information about Kidney Wales which may be of interest to you. You will have the opportunity to opt out of receiving such marketing information when you first provide your details to us, and you can change your mind at any time by contacting [email protected]

If you no longer wish to receive these types of communications or want to change your contact preferences, please contact us directly: call 029 2034 3940, email [email protected] or write to us at Elfed House Oak Tree Court, Cardiff Gate Business Park, Cardiff, CF23 8RS.

Our legal basis for processing your information

We process your personal data only where you have expressly given us your consent, to fulfil a contract we have with you, when it is our legal duty to or where we are confident there is a legitimate interest to do so:

• Consent: where you have given clear consent for us to process your personal data for a specific purpose
• Contract: the processing is necessary for a contract that we have with you, or because you have asked us to take specific steps before entering into a contract
• Legal obligation: the processing is necessary for us to comply with the law (this does not include contractual obligations we may have
• Vital interests: the processing is necessary to protect someone’s life
• Public task: the processing is necessary for us to perform a task in the public interest, or for our official functions, and the task or function has a clear basis in law
• Legitimate interests: the processing is necessary for the legitimate interests of our organisation, or the legitimate interest of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

How we protect your information

We take all reasonable care and precautions to protect your information and use a combination of both physical and technical measures:

We do not retain credit or debit card details and our staff receive data protection training to ensure any personal data is handled and processed appropriately. Our computer network is guarded by firewalls and kept in a secure environment.

Unfortunately, the internet is not completely secure and although we will do our best to protect your information, we cannot guarantee its complete safety and any information provided is at your own risk.

Sharing your information

We never sell or share any information about you to other organisations for their own marketing purposes.

Your details may need to be shared with third party organisations who are working on our behalf. These organisations act as data processors and in these instances, we ensure a contractual agreement is in place to protect your data and ensure it is only retained for the necessary duration.

Your personal information may also be shared with third party organisations to comply with legal or regulatory obligations. An example organisation is HM Revenue and Customs who require certain information for Gift Aid claim processing.

Cookies and third party websites

Our website uses essential cookies to ensure you receive the best browsing experience possible. It’s important to us that you are aware of how these cookies are used, and we’d like to reassure you that no personally identifiable information is ever collected.

We may link you to third party websites which have their own privacy policies. We encourage you to look at their policies as we cannot accept any responsibility or liability for the content or security of those websites.

Your rights
You have the following rights under current data protection legislation:

• The right to be informed.
• The right to ask us to correct your personal information if it is inaccurate and to have incomplete personal information completed.
• The right to object to our processing of your personal information.
• The right to restrict processing of your personal information in certain circumstances.
• The right to ask us to have your personal information erased. This right is not absolute – it applies only in particular circumstances and, where it does not apply, we will tell you. We will not be able to comply if we are required to keep your personal information in order to comply with a legal obligation or to exercise or defend legal claims.
• The right to request access to the personal information held about you. This is often described as a Subject Access Request.
• The right to ask for your personal information in a reusable format (known as the right to data portability). This right only applies where personal information is being processed based on your consent or for performance of a contract and is carried out by automated means. This is separate to a Subject Access Request.

If you are unhappy with the way that we are handling your personal information, please contact [email protected] in the first instance and we will work to resolve your concerns. However, you do also have the right to complain to the Information Commissioner’s Office, which is the regulator for data protection laws: https://ico.org.uk/

Policy updates

We will continue to ensure this policy is as up-to-date as possible so from time to time, we may update it.

Last updated: February 2020