Privacy Notice
Introduction
This Privacy Notice tells you what to expect when the Older People’s Commissioner (the Commissioner) collects, uses, discloses, transfers and stores your personal information.
Please read this notice carefully to understand how we will use your personal information.
1. What information we may collect about you
The information we collect about you depends on why we are dealing with you. We may ask you for information such as your name, email address, postal address, telephone or mobile number, and location. We may also collect your name and home/work address for you to receive a hard copy of the Commissioner’s newsletter and a name and e-mail address to receive an e-newsletter.
Sometimes we will require you to provide additional personal information e.g. if you live with an illness, details of your medical history. We may also ask you to provide personal information which is considered special category data including your race or ethnicity, religious beliefs and sexual orientation.
We only ask you for information that we need to be able to undertake the Commissioner’s work.
We may collect information about you in the following circumstances:
· If you call us
When you call us we will collect information about you. We use this information in a number of ways including making a record of your call so that we can manage your query. We may also keep a record of the call for training or monitoring purposes. We may need to share your information with other organisations in order for us to be able to deal with your query. We will usually tell you if it is necessary for us to pass information on to other organisations.
- If you ask the Commissioner to assist you
We hold details of the people who request the Commissioner to use her powers to provide assistance such as:
Ø putting you in touch with organisations best placed to resolve your issue;
Ø intervening directly if you have been experiencing difficulties with a public service provider that you cannot resolve locally; or
Ø supporting you to make a formal complaint and monitoring how your complaint is dealt with.
- Information we receive from others
In some circumstances we may receive information about you from someone you have nominated to act on your behalf (for example, by way of a power of attorney, or you have specifically authorised them to contact us).
- If you participate in engagement, research or lived experience activities
We may collect information about you if you choose to take part in questionnaires, telephone surveys, online or face-to-face conversations, workshops, focus groups or other consultation or discussion activities that help inform the Commissioner’s work.
The information we collect will depend on the activity and may include your contact details, views, opinions, lived experiences and any other information you choose to share with us. Where appropriate, we will provide additional information about how your information will be used before you take part.
- Attendance at our events or webinars
When you attend a Commissioner event or webinar we will process your personal data. This may include an identifiable image of you in a photo or video. It may also include information about your lived experiences that you share with us.
· If you work for an organisation we engage with
In such circumstances we may receive information about you from you or from your employer or your colleagues. We will use this information to liaise with you in connection with our work.
2. How we will use your information
We will only use your personal information in accordance with the legal bases set out in paragraph 5 below.
Examples of how your information will be used including the following:
· by the Advice and Assistance team to contact you to deal with your request and enquiries;
· to allow the Commissioner to carry out her work;
· to inform the management of the Commissioner’s advice and assistance;
· in aggregate (so that no individuals can be identified) to inform the Commissioner’s policy function by identifying emerging issues and trends;
· photos and/or videos taken at events or recorded webinars may be posted on the Commissioner’s social media accounts (including Facebook, X, Instagram, YouTube, LinkedIn), on the Commissioner’s website, in the Commissioner’s newsletter or reports published by the Commissioner relating to the event; and
· to provide you with the Commissioner’s newsletter / e-newsletter with details of any forthcoming events that you have requested from us.
If you provide us with any personal information like your race or religious beliefs, this information will be anonymised and only used by the Commissioner for the purpose of providing statistics for diversity and equality monitoring. Monitoring this information helps us to understand the impact of our policies and practices on people who share particular protected characteristics. We will not use this data for any other purposes or reveal it to any other organisations except under statutory obligations.
3. Contacting you
We will use your contact information to send you important information which may be of relevance to you or your organisation via letters, emails or otherwise to telephone you.
We may also use the information we hold about you to send you copies of our newsletters / e-newsletters or details of engagement activities by post or email to ensure that older people know what the Commissioner does and how she does it. We will only send you marketing emails or newsletters by post where you have provided written confirmation that you are happy for us to do so. We will not send you marketing communications without your consent.
If you wish to receive a copy of our newsletter by post or email, or if you wish to receive details of other events we undertake, please email us at ask@olderpeople.wales or sign up via the link on our website.
If you no longer wish to hear from us, you may withdraw your consent at any time by emailing ask@olderpeople.wales. Every newsletter and email explains how to unsubscribe. Once you notify us, we will promptly remove your personal information from our database.
4. Sharing Information with Third Parties
Any third parties that process personal data on our behalf are required to do so in accordance with data protection law and under strict contractual terms.
We may share your information with:
· providers that may provide services on our behalf (for example, IT and system administration services);
· professional advisers including lawyers and auditors who provide consultancy, legal or accounting services;
· a third party organisation where it is necessary to do so to allow the Commissioner to undertake her work. In these circumstances, we will tell you who that third party is and why we need to share the information.
Otherwise, we will not share your information with any third party unless:
· we have your permission to do so; or
· we are required to do so by law.
5. The Commissioner’s legal basis for collecting, holding and using your information
Data protection laws set out various lawful bases which allows the Commissioner to collect, hold and use your personal information. These include:
· To allow the Commissioner to undertake her work in accordance with her functions as defined in Commissioner for Older People (Wales) Act 2006.
· Where the Commissioner is under a legal or regulatory obligation.
· Where the processing is necessary for the Commissioner’s legitimate interests, such as ensuring the security of network and information systems, or a third party’s legitimate interests, unless those interests are overridden by your rights and freedoms
· Where we rely on your consent. We will always tell you when consent is required and give you the opportunity to agree before we process your information.
· Where we (or a third party) have a recognised legitimate interest (RLIs). These are different to legitimate interests. RLIs apply where there are public interest reasons for processing (such as preventing or detecting crime, safeguarding individuals, responding to emergencies, supporting national or public security or defence, or sharing information with public bodies when they confirm it is necessary for their official functions).
For certain events you may be provided with additional privacy information.
6. Security and storage
Whenever we transfer your personal data out of the UK to service providers, we ensure a similar degree of protection is afforded to it by ensuring that the following safeguards are in place:
· We will only transfer your personal data to countries that have been deemed by the UK to provide an adequate level of protection for personal data, for example EU countries, Argentina and New Zealand.
We may use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Agreement or The International Data Transfer Addendum to the European Commission’s standard contractual clauses for
international data transfers. To obtain a copy of these contractual safeguards, please contact our Data Protection Officer using the details set out below. We will take all reasonable steps to ensure that your data is processed securely and in accordance with this privacy policy. Access to personal data will be restricted to Commissioner staff who need it.
How long will we keep your information
We will only keep your information for as long as it is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
Photographs and videos that are used for social media accounts, on the Commissioner’s website, in the Commissioner’s newsletter, and in reports published by the Commissioner will be available online for an indefinite period. The original photographs and videos will be securely stored only for as long as they are needed to support the Commissioner’s work and will be permanently deleted after use. All other photographs and videos taken but not used, will be securely stored for a maximum of 30 days before being permanently deleted.
If you have contacted us with a request or an enquiry, unless we use our statutory powers as set out below, we will retain your details for a period of 5 years from the date we have concluded your matter.
If we use our statutory powers under section 3 (Review of discharge of functions) or section 5 (review of arrangements) under the Commissioner for Older People (Wales) Act 2006 we will keep our details permanently.
7. Your rights
Under data protection laws, you have rights in relation to your information. You have the right to request from us a copy of the information we hold about you.
Additionally, you will have additional rights to request from us that:
· any inaccurate information we hold about you is corrected
· your information is deleted
· we stop using your personal information for certain purposes
· your information is provided to you in a portable format
Many of the rights listed above are limited to certain defined circumstances and we may not be able to comply with your request. We will tell you if this is the case.
If you make a request, we will need you to prove your identity with 2 pieces of approved identification (such as a passport and a utility bill no older than 3 months). Once we have this, we will aim to respond to you within one month.
Normally we will not charge you a fee for dealing with your request for a copy of personal information. There may be some circumstances when the law allows us to charge a fee. We will tell you if this is the case at the time of your request.
If you wish to exercise any of your rights, please contact the Data Protection Officer (contact details are found below).
8. Complaints
If you have a complaint as to how your information has been handled, you can make a complaint to the Commissioner by contacting the Data Protection Officer (contact details are found below).
If a complaint is received it will be acknowledged within 30 days from receipt and without undue delay, we will take appropriate steps to respond (including making any appropriate enquiries and keeping you informed of progress) and inform you of the outcome.
If you have a complaint that we cannot resolve, you have the right to complain to the Information Commission (formerly the Information Commissioner’s Office (ICO)), which is the statutory regulator for data protection matters. The Information Commission can be contacted at https://ico.org.uk/concerns/.
9. Contacting us
If you have any questions or comments about this Privacy Notice, please contact our Data Protection Officer (details below).
Write to:
Data Protection Officer
The Older People’s Commissioner for Wales
Cambrian Buildings
Mount Stuart Square
Cardiff
CF10 5FL
Email: ask@olderpeople.wales
Phone: 03442 640 670
If you have a complaint that we cannot resolve, you have the right to complain to the Information Commissioner’s Office, which is the statutory regulator for data protection matters. The Information Commissioner can be contacted at https://ico.org.uk/concerns/.
10. Changes to this privacy notice
We keep our privacy policy under regular review and we will place any updates on this page.