Skip to content

Privacy policy

Age UK York Privacy Policy

Welcome

We appreciate that when you contact Age UK York, you trust us with your details and with a lot of personal and sensitive information. Under the General Data Protection Regulations (GDPR), you have a number of rights and we have a range of responsibilities towards your personal information. This policy explains what we do with your data, how we use it and how we protect it. It also explains your rights about your data.

This policy refers to Age UK York and its subsidiaries – a charity registered at the Charity Commission (Charity Number 1118346). Age UK York is the data controller responsible for your personal data.

This policy is effective from 1st June 2026. Your information will only be used in accordance with this privacy policy. We reserve the right to alter this Policy without notice. Any changes will be published on this website.

If you have any questions about this policy or how we use your data, you can contact our Data Protection Lead at:

Email: ageukyork@ageukyork.org.uk

Telephone: 01904 627995

Our promise

We promise that we will:

  • Value the personal data given to us and respect that trust
  • Be open with individuals about how we use their data and who we share it with
  • Make it easy for individuals to access and correct their personal data
  • Only collect the personal data we need
  • Delete personal data when we no longer need it
  • Have effective safeguards in place to make sure personal data is kept securely.
  • Provide training to staff, university placement students and volunteers who handle personal data and treat it as a disciplinary matter if they misuse or don’t look after personal data properly

What data do we collect?

We may collect, store and use the following kinds of personal data. We only collect the information we need in order to provide a service to you.

  • your name
  • your contact details (including postal address, telephone number, e-mail address)· your date of birth
  • your gender
  • information relating to your health and personal situation
  • your next of kin details
  • if you volunteer for us or apply for a job with us, information necessary for us to process these applications and assess your suitability (which may include things like employment status, previous experience depending on the context, as well as any unspent criminal convictions or pending court cases you may have)
  • information about your activities on our website and about the device you use to access these, for instance your IP address and geographical location;
  • where you have left us a legacy, any information regarding next of kin with which you may have provided us to administer this
  • information as to whether you are a taxpayer to enable us to claim Gift Aid
  • age, nationality, sexuality and ethnicity information for monitoring purposes

We collect this information directly from you, or occasionally from authorised third parties (e.g. family members, referrers, or partner organisations).

How do we use your data?

We may use your data to:

  • Respond to your enquiries for help and support
  • Ensure we understand your situation and enable us to guide you to the most appropriate services.
  • Save you having to repeat your situation again and again
  • Provide a record of what we have done to support you
  • Discuss your situation (with your consent) with other services who may be able to help you with your situation
  • To enable us to claim Gift Aid
  • To process your application as volunteer or employee
  • Administer our website and to troubleshoot, perform data analysis, research, generate statistics and surveys related to our technical systems;

We only collect the data that we need to collect in order to provide you with our services.

We may also extract anonymous information from the above for monitoring, reporting, and service improvement.

What lawful reasons do we have for storing your information?

Depending on the nature of our relationship with you, we have different lawful reasons for processing your information.

We rely on the following lawful bases under UK GDPR:

  • Legitimate interests.
  • To deliver and improve our services. If we need your details in order to offer you our services, we have a legitimate interest for storing your data as we are unable to offer you our services without your details.
  • Consent. Where you have given clear permission.
  • There are times when it might be useful for us to record your details as you may be coming back to us in the future and records of previous contacts are useful and prevent you having to repeat yourself. We will ask for consent to record your details if this is the reason.
  • We process sensitive personal data, sometimes referred to as ‘special category data’ under UK GDPR, which includes your health, ethnicity, sexuality and religious beliefs. We ask for consent to process your ethnicity, sexuality and your religious beliefs. We are allowed to process client’s health data as we are a provider of health and social care. We ask for consent to process volunteers’ health data which is needed because of our legal obligations under health and safety legislation and to ensure we can make any necessary adaptations for your role.
  • Legal obligation.
  • If you donate to us, we may collect your name and address for Gift Aid purposes as we have to pass them to HMRC. We have a legal obligation to process this data.

Sharing with third parties

We never sell your data.

We may share your data:

  1. With your consent
  2. Where it is required by law (e.g. safeguarding, crime prevention or to HMRC)

There are times when we feel it would be useful for us to discuss your situation with a third party and to share your information with them. We always ask for your permission to share with a third party and we always tell you who we are sharing with.

We have information sharing agreements with a number of third parties which outline what type of information we can share and what that organisation can do with it.

We also share data with trusted service providers (data processors), such as IT systems, email providers, and payment services. These organisations are required to protect your data and act only on our instructions.

There are times when we may have to share your information without your consent when we are required by law to do so. These could be for:

  • Prevention or detection of crime
  • If there are safeguarding issues that would affect the client or someone caring for the client in anyway.
  • Passing Gift Aid details to HMRC

We do not transfer your personal data outside the UK. If this changes, we will ensure appropriate safeguards are in place.

How do we protect your information?

Access to personal information is restricted to Age UK York employees, volunteers have limited access to information if they are involved in delivering a service to you.

All staff and volunteers who handle confidential information are trained to respect your privacy and to keep it safe.

We use secure systems and encryption where appropriate for online data storage.

Paper records are kept securely within our offices. If we need to take paper copies out of the office, we take a range of steps to keep it safe and to minimise the risk of data loss.

We have procedures in place to detect, report, and investigate data breaches. Where required, we will notify the Information Commissioner’s Office (ICO) and affected individuals. 

Your information rights

You can find out your information rights by visiting the Information Commissioner’s Website at www.ico.org.uk . This is a brief summary but should be read along with the advice on the ICO website.

Right of access.

You have the right to access information held by you at any time. We will not normally charge you for this but reserve the right to charge or refuse if the request is excessive or repetitive. We will respond to your request as soon as possible.

Subject Access Form (Word)

Subject Access Form (PDF)

Right to erasure.

You have the right to be ‘forgotten’ or erased which means you can ask us to delete or remove any personal data. There are reasons why we may not be able to remove your data. We are able to anonymise your data which allows for deletion of identifiable data.

Right to rectification.

You have the right to have inaccurate or incomplete information we hold about you corrected. If you believe the information we hold about you is inaccurate or incomplete, please provide us with details and we will investigate and, where applicable, correct any inaccuracies.

Right to restrict use of your personal information

You have a right to ask us to restrict the processing of some or all of your personal information in the following situations:

  • if some information we hold on you isn’t right, we’re not lawfully allowed to use it
  • if you need us to retain your information in order for you to establish, exercise or defend a legal claim
  • if you believe your privacy rights outweigh our legitimate interests to use your information for a particular purpose and you have objected to us doing so.

How long do we keep your data for?

Under Data Protection Law we must not keep any personal data for longer than we need to or process your data following your discharge from our service without explanation. Retaining records and archiving is covered in our Records Management Policy and Procedures which is followed by all relevant staff and departments. We keep pseudoanonymised data in order to establish a relationship with a client in event of future legacies.

Direct Marketing

We do not engage in direct marketing to our clients. However, we may occasionally send out information to you from Age UK York that may be of interest. We will only send out such information if we have your permission and this can be withdrawn at any time.

Cookies on our website

We use cookies for:

  • essential website functionality
  • analytics (e.g. understanding website usage)

You will be asked to consent to non-essential cookies when visiting our website. You can manage your preferences at any time via your browser settings.

You can find out about our cookie policy here.

https://www.ageuk.org.uk/york/privacy-policy/cookies/

If you have any questions about this policy, then please contact us on 01904 627995

Age UK York and a number of its trading and associated companies are registered with the Information Commissioner’s Office. Our address is:

St.Edmund's House, Margaret Street, York, YO10 4UX                     

ageukyork@ageukyork.org.uk

Version Number 3

Date 08/06/2026