Privacy policy
About us
Age UK Shropshire Telford & Wrekin is an independent charity. Charity registration no.1090445 and registered company number 4292896.
Age UK Shropshire Telford & Wrekin is registered with the Information Commissioner's Office as a Data Controller registration no. Z7508286.
Your privacy
We are committed to protecting your personal data in accordance with:
- The UK General Data Protection Regulation (UK GDPR)
- The Data Protection Act 2018
- The Privacy and Electronic Communications Regulations (PECR), where applicable
We process personal data lawfully, fairly and transparently and in accordance with the core data protection principles.
This privacy notice applies to people who use our services, donors, supporters and fundraisers, and people who contact us or visit our website.
How do we collect information from you?
- We collect information that you give to us:
This could be when you donate, make a payment, access a service, make a phone call to us, email us, lodge a complaint, attend an event, apply for a vacancy or voluntary position. - Information we get from your use of the website
When you visit the Site, we collect various personal information which may include your name, address, contact details, IP address, and information regarding which pages are accessed and when.
What type of information is collected from you?
We will only collect data required to carry out a specific purpose and will not use your information for other purposes without your permission.
Depending on your relationship with us, we may collect:
- Identity details (name, date of birth, gender)
- Contact details (address, telephone number, email)
- Financial details (bank details, payment information)
- Employment history (for applicants and volunteers)
- Health and medical information (where relevant to service)
- Information about family members and carers (where relevant to service)
- Marketing preferences
- Gift Aid declarations (including confirmation of UK taxpayer status)
We treat all personal data with care. Some information we process is classified as Special Category Data, including health data.
Below is a summary of our processing activities, lawful bases and retention periods:
| Processing Activity and Purpose | Personal Data Processed | Retention Time | Lawful Basis |
| Provision of services, including Information and advice services, Advocacy and representation, Trusted companion and Befriending, Help at Home, Home energy checks, Dementia support and respite, Social and community groups (e.g. chess, arts and crafts, friendship groups, movement classes) | We may collect your contact details; date of birth; financial information (income, benefits, savings); health and disability information; household and social circumstances; equality and diversity information (optional); and records of support and advice. | 7 years following end of service | Article 6(1)(f) – Legitimate interests Article 9 (2)(g) – Substantial Public Interest Schedule 1, Part 2, Paragraph 10 – Substantial Public Interest (Data Protection Act 2018) |
| Donations | Name, address, email, telephone number, bank/financial details. In the promotion of our services. | 7 years | Contract – you have agreed to provide these details in order to donate to us. |
| Retail (Shops) Processing purchases, deliveries, collections and Gift Aid claims. |
Contact details, payment information, Gift Aid declarations | 7 years | Article 6(1)(b) – Contract Article 6(1)(c) – Legal obligation (Gift Aid and financial compliance) |
| Job & Volunteer Applicants Recruitment and employment administration. |
Name, address, email, telephone number, employment history. Successful applicants joining our team, will be provided with full Privacy notifications during their induction period. | Unsuccessful candidates – 12 months from date of last contact. Successful candidates – 7 years following end of relationship |
Article 6(1)(b) – Contract (pre-contract steps) Article 6(1)(c) – Legal obligation |
| Marketing Communications and Information about our services | Name, contact details, communication preferences | Until asked to stop by you or until consent withdrawn by you. You can withdraw consent or opt out at any time by:
|
Article 6(1)(f) - Legitimate interests – we will provide information which we believe is of genuine interest to you. Article 6(1)(a) – Consent (where required under PECR). You may withdraw your consent or opt out of marketing communications at any time by clicking the unsubscribe link or contacting us |
| Website and Online forms We collect personal data submitted through contact forms and website enquiries. |
Name, email address, address, telephone number | 7 years | Article 6(1)(b) – Contract Article 6(1)(f) – Legitimate interests |
Sharing of Personal Data
We may share your data where necessary with:
- Department for Work and Pensions (DWP)
- Local authorities
- NHS or healthcare professionals
- Trusted partners (e.g. Octopus Legacy)
- IT providers (e.g. Charitylog)
- Marketing providers
- Payment processors
- Donation platforms
- Website hosting services
- IT Asset and Data Disposal providers
We may also share your data where required by law, including with:
- Law enforcement
- Regulators
- Insurers (where claims arise)
We may share anonymised information with third parties such as Age UK National for statistical purposes.
If our services are transferred to a third party, your data may be one of the transferred assets.
We will only share the minimum amount of information necessary, will keep your information secure, and will always discuss sharing with you wherever possible, unless safeguarding or legal reasons prevent us from doing so.
We will only share your information with external auditors where you have provided consent.
A full list of processors is available from our Data Protection Officer.
International Transfers
Our operations are based in the UK and your personal information is generally processed within the UK and countries within the European Economic Area (EEA). Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTA).
Keeping your information safe
We have implemented appropriate physical, technical and organisational measures to protect personal information from unauthorised access, use, alteration, destruction and loss.
Access to your data is restricted to only those who need access to it and we have strict policies governing the use and security of all personal data collected.
Financial transactions are processed Payment Card Industry Data Security Standards (PCI DSS) compliant providers.
In the event that we lose your data, or a device on which your data resides, or it is accessed by someone unauthorised, we will inform you if the loss or unauthorised access to your data has potential to cause you harm. We will report this to the Information Commissioners Office if required by law, who are responsible for regulating data protection legislation in the UK. https://ico.org.uk/
Your rights in relation to personal data
You have the following rights under UK GDPR:
| Right | Explanation |
| Right to be Informed | This means that we have to be transparent in how we collect and use your personal data |
| Right of Access | You have the right to access your personal data. |
| Right to Rectification | If the information we hold about you is inaccurate or incomplete you can request that we correct this |
| Right to Erasure | You can request that we delete or remove personal data in certain circumstances |
| Right to Restrict Processing | You have the right to request that we cease processing your data if
|
| Right to Data Portability | Where you have consented to our processing your data or where the processing is necessary for us to deliver a contract you can request a copy of that data be provided to a third party |
| Right to Object | You have the right to object to our processing in certain circumstances. For example, you can object to:
|
| Rights relating to Automated Decision-Making including Profiling | We do not use automated decision-making or profiling Where automated decision-making is applied, organisations must
|
If you wish to exercise any of these rights or make a complaint you can contact our Data Protection Officer.
How to Contact Us
For all data protection matters or questions relating to how we manage your data, or if you are concerned about how your data is being handled, you can contact our Data Protection Officer:
Data Protection Officer: Clinical DPO
Phone Number: 0203 411 2848
Email: ageukshropshireandtelforddpo@amicisdata.com
For complaints, please include the following where possible:
- Your name and contact information.
- A description of your concern or the data protection issue.
- Any relevant supporting information.
Complaints will be acknowledged within 30 days. We aim to fully respond and resolve the matter without undue delay. If your issue requires more time or clarification, we will keep you informed throughout.
If you are dissatisfied in how we have responded to your complaint, you have the right to complain to the UK Information Commissioner's Office (ICO):
Website: https://ico.org.uk/make-a-complaint/
Phone: 0303 123 1113
Address: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Use of Cookies on our website
Information about the use of cookies on our website can be found here: ageuk.org.uk/shropshireandtelford/privacy-policy/cookies