Last updated: August 2026

Age Cymru West Glamorgan takes your privacy seriously. This Privacy Notice explains what personal information we collect, why we collect it, how we use and protect it, who we may share it with, and the rights you have over your information.

We have tried to make this notice as clear and straightforward as possible. If you would like this information in Welsh, large print, Easy Read, audio or another accessible format, please contact us.

1. In brief

We only collect and use personal information where we have a clear reason to do so.

We may use your information to provide services and support, maintain appropriate client records, manage appointments, keep in touch with you, process donations and payments, collect feedback, recruit staff and volunteers, meet our legal and safeguarding responsibilities, and run the charity effectively.

We use trusted organisations and technology providers to help us do this. We remain responsible for ensuring that personal information is handled appropriately where another organisation processes it on our behalf.

We do not sell or rent your personal information.

You have rights over your personal information and can contact us at any time if you have a question, concern or complaint.

2. Who we are

Age Cymru West Glamorgan is a local charity supporting people to age well and enjoy life across Swansea, Neath Port Talbot and Bridgend.

Age Cymru West Glamorgan is a registered charity, number 1140989, and a company limited by guarantee, company number 07548947.

For the purposes of UK data protection law, Age Cymru West Glamorgan is the data controller for the personal information covered by this notice, unless we tell you otherwise.

Age Cymru, Age UK, other local Age Cymru organisations and other organisations within the wider Age network are separate organisations. We may work with or share information with them where this is necessary, appropriate and lawful, but they are not automatically included when this notice refers to "we", "us" or "our".

2.1 How to contact us about your information

If you have any questions about this notice, how we use your information or your data protection rights, please contact:

Data Protection Officer

Age Cymru West Glamorgan

250 Carmarthen Road

Swansea

SA1 1HG

Email: enquiries@agecymruwestglamorgan.org.uk

Telephone: 01792 648866

3. Who this notice applies to

This notice may apply to you if you:

• use or enquire about one of our services;
• book or pay for an activity, appointment or service;
• contact us by telephone, email, online or in person;
• subscribe to our newsletter or other communications;
• make a donation or support our fundraising;
• complete a survey or consultation;
• apply for a job, trustee role or volunteering opportunity;
• volunteer with us;
• attend one of our events or activities;
• visit our website or interact with us on social media; or
• otherwise have a relationship with Age Cymru West Glamorgan.

For some particular services, projects, surveys or activities, we may provide additional privacy information at the point we collect your information.

4. How we collect personal information

Most of the personal information we hold is provided directly by you. This could happen when you telephone us, email us, visit our offices, complete a form, use one of our services, make a booking, complete a survey, subscribe to communications, donate, volunteer or apply for a role.

Sometimes information is provided to us by someone acting on your behalf, such as a family member, carer, advocate or representative.

We may also receive information through referrals from other organisations or professionals where you have agreed to the referral, where there is another lawful reason for the referral, or where information needs to be shared to protect you or another person.

Information may also come to us through organisations providing services on our behalf, fundraising or payment platforms, event or booking systems, Age Cymru or Age UK network partners, commissioners or public bodies.

When you use our website or interact with our digital services, some technical information may be collected automatically through cookies and similar technologies. More information is provided later in this notice.

5. What personal information we collect

The information we collect depends on why you are dealing with us.

It may include your:

• name;
• address;
• email address;
• telephone number;
• date of birth; and
• other contact or identifying information.

If you use one of our services, we may record information about your circumstances, the reason you contacted us, the support you need, actions we have taken, referrals made, appointments, assessments, outcomes and other relevant service or case information.

For activities, events and appointments, we may hold booking information, attendance details, accessibility requirements, emergency contact details and payment information.

For donations and fundraising, we may hold information about donations, Gift Aid declarations, communication preferences and relevant financial records.

If you subscribe to our communications, we will hold your contact details, communication preferences and a record of when and how you gave us permission to contact you.

When you complete a survey or consultation, we may collect your responses and, where relevant, demographic or equality information. Many of our surveys are anonymous. If a survey is not anonymous, we will make this clear and explain what information is being collected and why.

When you telephone us, information may include your telephone number, the date and time of your call, a voicemail or recording where applicable, a transcript of what was said and information contained within your message.

If you apply to work or volunteer with us, we may collect application information, employment or volunteering history, qualifications, references, identity information and information required for appropriate safeguarding and Disclosure and Barring Service checks.

We may also collect technical information when you use our website, such as your IP address, device and browser information and information about how you use our website.

6. Sensitive and special category information

Some personal information needs additional protection under data protection law. This is known as special category data.

It can include information about health, disability, racial or ethnic origin, religion or philosophical beliefs, political opinions, trade union membership, genetic or biometric information used for identification, and information about sex life or sexual orientation.

Because of the nature of our work, there are circumstances where we may need to collect information about a person's health, disability, mobility, caring responsibilities or other sensitive circumstances. We will only do this where it is relevant and necessary.

We need both a normal lawful basis for using this information and an additional legal condition that allows us to process special category data.

Depending on the circumstances, this may include your explicit consent; protecting someone's vital interests in an emergency; meeting employment or social protection obligations; or processing that is necessary for a specific substantial public interest purpose recognised in law, such as safeguarding a child or an adult at risk.

Where additional safeguards are legally required, we will apply those safeguards and maintain the appropriate internal documentation.

Information about criminal convictions and offences is also given additional legal protection. We may process this information where appropriate for recruitment, volunteering, trustee appointments or safeguarding, including through Disclosure and Barring Service checks. We only do this where the law allows us to and where it is appropriate to the role or circumstances.

7. Why we use personal information

7.1 Providing services and support

We use information to respond when you contact us, understand your circumstances, provide information, advice or support, make referrals, arrange appointments, maintain appropriate records and deliver services you have asked us to provide.

Depending on the circumstances, our lawful basis may be legitimate interests, performance of a contract, legal obligation, consent or vital interests.

Our legitimate interest is in operating Age Cymru West Glamorgan effectively as a charity and providing appropriate, high-quality support to the people and communities we exist to serve.

7.2 Safeguarding and emergencies

We may use or share information where this is necessary to safeguard you or another person, prevent serious harm or respond to an emergency.

The lawful basis will depend on the circumstances and may include legal obligation, legitimate interests or vital interests. Where special category information is involved, we will also identify an appropriate condition under data protection law.

7.3 Appointments, activities and paid services

We use information to manage bookings, provide appointments and activities, take payments, issue confirmations or reminders and administer services you have asked to receive.

Where you are buying a service or entering into an arrangement with us, we will usually rely on performance of a contract or taking steps at your request before entering into a contract. We may also rely on legitimate interests for associated administration.

7.4 Donations, Gift Aid and financial administration

We use information to process donations and payments, maintain financial records, claim Gift Aid where appropriate, prevent fraud and meet accounting, taxation and regulatory requirements.

Our lawful bases may include legal obligation, contract and legitimate interests.

7.5 Feedback, surveys and research

We use feedback and survey information to understand people's experiences, assess whether our services are working, identify areas for improvement, demonstrate impact and help us plan future services.

Where possible and appropriate, survey information is collected anonymously or anonymised before analysis.

Where a survey collects identifiable information, the survey will explain this. Where particularly sensitive information is requested, we will make clear why it is needed and whether providing it is optional.

Our lawful basis will usually be legitimate interests or consent, depending on the nature of the survey and the information being collected.

7.6 Recruitment, volunteering and governance

We process information to recruit employees, volunteers and trustees, assess suitability, obtain references, carry out relevant checks and administer our responsibilities as an employer and charity.

The lawful basis may include taking steps before entering into a contract, legal obligation and legitimate interests. Additional legal conditions apply where special category or criminal offence information is processed.

7.7 Running and protecting the charity

We may use personal information for financial management, audit, quality assurance, regulatory compliance, complaints, governance, service monitoring, IT administration, cyber security, fraud prevention, staff training and the establishment or defence of legal claims.

Our lawful basis will usually be legitimate interests or legal obligation.

8. Our lawful bases

UK data protection law requires us to have a lawful basis whenever we use personal information.

Consent - where you have freely given us permission to use your information for a particular purpose. You can withdraw your consent at any time.

Contract - where using your information is necessary to enter into or perform a contract with you.

Legal obligation - where we need to use information to comply with a legal or regulatory requirement.

Vital interests - where using or sharing information is necessary to protect someone's life or physical safety.

Legitimate interests - where using information is reasonably necessary for the legitimate operation of the charity or the legitimate interests of another person, provided those interests are not overridden by your rights and interests.

Where we rely on legitimate interests, these may include delivering and improving our charitable services, responding to enquiries, managing relationships with clients and supporters, maintaining secure and effective systems, preventing fraud, managing the charity, demonstrating impact and carrying out appropriate fundraising.

We do not rely on consent simply because we hold personal information. We use the lawful basis that is most appropriate for the particular purpose.

9. Organisations that help us provide our services

We use trusted third-party organisations and technology providers to help us operate the charity and provide our services.

These may include providers of:

• client and care-record systems;
• appointment and booking systems;
• email and communication services;
• surveys and feedback tools;
• accounting and payment services;
• IT, email and cloud storage;
• recruitment and DBS-checking services;
• website analytics;
• Artificial Intelligence tools; and
• other specialist services needed to run the charity.

Where another organisation processes personal information on our behalf, we require appropriate data-protection, confidentiality and security arrangements.

We only provide or make available information that is reasonably necessary for the service being provided.

Some of our main systems are explained below because of the type of information they hold or because you may interact directly with them.

9.1 Client and service records

We use secure client and service-record systems to help us provide and record support.

This includes Charitylog and Nourish, formerly known as CarePlanner.

Depending on the service you receive, these systems may contain your contact details, information about the support we provide, assessments, appointments, service notes, outcomes and relevant health, wellbeing or other sensitive information.

Nourish is used particularly within some of our Dementia and Digital services.

Access to client records is restricted to people who need the information for their role.

9.2 Fresha

We use Fresha to help manage appointments and administration for The Wellbeing Studio.

Information processed through Fresha may include your name, contact details, appointment and booking history, the service booked, reminders and relevant payment or transaction information.

Payment card information is processed through the appropriate payment functionality or payment provider rather than being stored by Age Cymru West Glamorgan as full payment-card details.

Health information or other special category information required to provide a service safely is held within an appropriate Age Cymru West Glamorgan client record or other approved system rather than being entered into Fresha.

If you create or use your own Fresha account, use the Fresha Marketplace or interact directly with Fresha's services, Fresha may also process some information for its own purposes. Its own privacy information will apply to that separate processing.

9.3 Mailchimp

We use Mailchimp to manage our email mailing list and send newsletters and other communications.

We only add someone to these communications where they have asked or agreed to receive them. Consent may be provided through a sign-up form, recorded in Charitylog, given over the telephone or obtained through another clear consent process.

Where tracking features are enabled, information may be available to us about delivery and engagement with a communication, such as whether an email has been opened or a link has been selected. We use this information to understand whether our communications are useful and to improve them.

Every marketing email provides an option to unsubscribe.

9.4 SurveyMonkey

We use SurveyMonkey for surveys, consultations and feedback.

Many surveys are anonymous. Where a survey collects information that could identify you, this will be made clear at the point you complete it.

The information requested will depend on the particular survey. Some surveys may ask equality, demographic, health or other sensitive questions. Where this happens, we will explain why the information is being requested and whether providing it is optional.

10. Artificial Intelligence

We use approved Artificial Intelligence tools to support some of our work.

AI is used as an assistive tool. It does not remove the responsibility of our staff, volunteers or trustees to use appropriate human judgement.

10.1 ChatGPT Business

We use ChatGPT Business, provided by OpenAI, to support appropriate organisational tasks.

This can include helping to draft or improve communications, summarise or structure information, support analysis, generate ideas and reduce administrative work.

There may be circumstances where personal information is processed through the system because it is necessary for a legitimate piece of work. Where personal information is used, staff are expected to consider whether it is necessary, use only the information required for the task and avoid unnecessary disclosure of sensitive information.

AI-generated information is not treated as automatically correct simply because it has been produced by an AI system. Staff remain responsible for reviewing and appropriately using outputs.

We do not use ChatGPT or similar AI tools to make solely automated decisions about your access to our services or other decisions that have legal or similarly significant effects on you without meaningful human involvement.

10.2 AI-enabled telephone and voicemail services

We use ElevenLabs technology as part of an AI-enabled telephone or voicemail system.

If you interact with this system, information processed may include your telephone number, call date and time, your voice or voicemail recording, the content of your message, a transcript of the conversation or message, and an automated summary or categorisation needed to help us understand and respond to your enquiry.

We use this technology to receive calls and messages efficiently, understand what assistance is being requested and ensure the information reaches the appropriate member of our team.

Where a call is being handled, recorded or transcribed using AI technology, we will provide an appropriate notice to the caller.

We do not use callers' voices to create voice clones or to identify people using biometric voice recognition.

We keep appropriate human oversight of enquiries received through the system.

11. Who we share personal information with

We only share personal information where there is a legitimate reason for doing so.

Depending on the circumstances, this may include:

• organisations helping us deliver a service you have requested;
• Age Cymru, Age UK or other network partners where we are working together or making an appropriate referral;
• commissioners and funders where information is required to monitor a funded service;
• technology and IT providers working on our behalf;
• payment, banking and accounting providers;
• professional advisers, auditors, insurers and quality-assurance organisations;
• safeguarding organisations, local authorities, healthcare bodies or emergency services where necessary;
• regulators, courts, law-enforcement bodies or other authorities where we are legally required or permitted to share information; and
• other organisations where you have asked or agreed that information should be shared.

Where commissioners, funders or partners only require information about the overall performance of a service, we will use anonymous or aggregated information wherever possible.

We do not sell or rent your personal information.

12. International transfers

Some of the technology companies and service providers we use operate internationally or use suppliers and infrastructure located outside the United Kingdom.

This means that personal information may sometimes be processed in another country.

Where this amounts to a restricted international transfer under UK data protection law, we take steps to make sure the transfer is lawful and that appropriate protection is in place.

This may include using countries recognised by the UK as providing an adequate level of data protection or putting appropriate contractual and other safeguards in place.

You can contact our Data Protection Officer if you would like more information about safeguards relevant to a particular type of processing.

13. How long we keep personal information

We do not keep personal information indefinitely.

How long we retain information depends on:

• why it was collected;
• the type and sensitivity of the information;
• the service being provided;
• our legal and regulatory responsibilities;
• contractual or funding requirements;
• safeguarding considerations; and
• whether the information may be needed to establish or defend a legal claim.

Financial and accounting information may need to be retained for statutory periods.

Client and service records are kept for an appropriate period based on the nature of the service and our responsibilities to the individual.

Recruitment, employment, volunteering, trustee and safeguarding records have retention periods appropriate to their purpose and any relevant legal requirements.

Where identifiable survey information is no longer required, we will delete or anonymise it where appropriate.

If you unsubscribe from marketing, we may retain limited information on a suppression list so that we can respect your request not to receive further marketing.

When personal information is no longer required, it will be securely deleted, destroyed or anonymised.

14. Fundraising and marketing communications

We may tell you about our charitable work, services, activities, campaigns, fundraising appeals and ways to support us.

For marketing and fundraising communications by email, text message or telephone, we will only contact you where we have the appropriate permission or another lawful basis which allows us to do so.

For our Mailchimp mailing list, we only add you where you have agreed to receive these communications.

You can withdraw your consent or change your preferences at any time.

Marketing emails include an unsubscribe option, or you can contact us directly using the details at the beginning of this notice.

We may send appropriate fundraising or marketing communications by post where we have a legitimate interest in doing so and it is reasonable in the circumstances. You can ask us not to contact you by post at any time.

Changing your marketing preferences will not prevent us from sending essential administrative or service messages. For example, if you have booked an appointment, we may still need to contact you about that appointment even if you do not receive marketing.

15. Our website, cookies and online tracking

Like most websites, our website uses cookies and similar technologies.

Some cookies are necessary for the website to work correctly. Others may be used to understand how people use our website, measure the effectiveness of our communications or advertising, and improve people's experience.

We currently use services including Google Analytics and Meta technologies for analytics, measurement or digital communications.

Any other non-essential cookies, tracking or website-analysis technologies in use should be identified through our cookie information and cookie controls.

Where consent is legally required for a cookie or similar technology, it will not be treated as accepted simply because you visit our website.

You can use our website's cookie controls to make choices about non-essential cookies and change those choices.

Our separate cookie information provides more detail about the cookies and technologies currently in use.

16. Social media

We use social-media platforms to communicate about our work and engage with the community.

If you interact with us through platforms such as Facebook, Instagram or other social networks, we may receive information you choose to share with us or information made available through your account settings.

The social-media company will also process information for its own purposes. Its own privacy notice and account settings apply to that processing.

Please avoid sending particularly sensitive or confidential information through public social-media posts or messages where a more secure communication method is available.

17. Information security

We take appropriate technical and organisational measures to protect personal information.

These include:

• controlling who can access systems and information;
• using secure systems and authentication controls;
• restricting access according to role;
• maintaining appropriate backups and security measures;
• training staff and volunteers;
• reviewing risks; and
• requiring appropriate security and confidentiality standards from organisations processing information on our behalf.

The level of protection applied reflects the nature and sensitivity of the information and the potential risks to the people concerned.

No technology can remove every possible security risk, but we work to prevent personal information being accidentally or unlawfully lost, altered, disclosed, destroyed or accessed without authorisation.

18. Keeping your information accurate

We take reasonable steps to make sure the personal information we hold is accurate and up to date.

Please tell us if your contact details or other relevant information changes.

If you believe information we hold about you is incorrect or incomplete, you can ask us to correct it.

19. Your data protection rights

Data protection law gives you a number of rights. Which rights apply can depend on the circumstances and the lawful basis we are relying on.

Access - You can ask us whether we hold personal information about you and request a copy of it.

Correction - You can ask us to correct personal information that is inaccurate or complete information that is incomplete.

Erasure - In certain circumstances, you can ask us to delete your personal information. This right is not absolute and there are situations where we are legally entitled or required to retain information.

Restriction - In certain circumstances, you can ask us to restrict how we use your information.

Data portability - In some circumstances, where information is processed electronically on the basis of consent or contract, you can ask to receive information you provided to us in a structured, commonly used and machine-readable format.

Objection - You can object to certain uses of your personal information, including some processing based on legitimate interests. You have an absolute right to object to the use of your personal information for direct marketing.

Withdraw consent - Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not make our earlier use of the information unlawful.

Automated decision-making - Data protection law provides protections where solely automated decisions have legal or similarly significant effects. The AI tools described in this notice are used with human oversight and are not used by Age Cymru West Glamorgan to make such decisions about access to our services.

If you wish to exercise any of these rights, please contact our Data Protection Officer.

We may need to ask you for information to confirm your identity before providing personal information or acting on certain requests.

We will respond in accordance with the timescales required by data protection law.

20. Concerns and complaints about your information

If you are concerned about how we have collected, used, stored or shared your personal information, please contact our Data Protection Officer.

You can make a data protection complaint by email, telephone or in writing using the contact details at the beginning of this notice.

We will acknowledge a data protection complaint within 30 days of receiving it.

We will consider the complaint appropriately and without undue delay, make reasonable enquiries where needed, keep you informed where an investigation is continuing, and tell you the outcome without undue delay.

We hope we can resolve any concern directly with you.

If you remain unhappy with how we have handled your personal information or your complaint, you also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.

Information about making a complaint and the ICO's current contact details are available from the Information Commissioner's Office.

21. Children and young people

Our work is primarily focused on older people and adults.

There may nevertheless be limited circumstances where information about a child or young person is provided to us, for example as a family member, emergency contact, as part of safeguarding information or in connection with another person's circumstances.

Where we need to process information about a child or young person, we will only use what is necessary and apply appropriate safeguards.

22. Vulnerable circumstances

Many of the people we support may be experiencing difficult, sensitive or vulnerable circumstances.

We recognise that additional care may be needed when collecting, using or sharing personal information in these situations.

We aim to communicate clearly, collect only the information we need, respect people's choices wherever possible and balance privacy with our responsibility to safeguard people from harm.

23. Links to other websites

Our website may contain links to websites, booking systems or services operated by other organisations.

Once you leave our website, another organisation's privacy notice may apply to the information it collects directly from you.

We encourage you to read the relevant privacy information when using another organisation's website or service.

24. Changes to this Privacy Notice

We review this Privacy Notice regularly and will update it when our services, technology, legal responsibilities or use of personal information changes.

The latest version will be published on our website and the date at the top of this notice will show when it was last updated.

If we make a significant change to how we use personal information, we will take reasonable steps to make this clear to the people affected.