BPAS – Marketing and External Affairs
This privacy notice was last updated on 19th July 2018.
Your ‘personal data’ or ‘personal information’ is any piece of information that would allow us to identify you as an individual. The processing of personal data is governed by the EU General Data Protection Regulation (the “GDPR”) and national laws that implement the GDPR in each European Economic Area (“EEA”) country.
We take your privacy very seriously, and this document sets out what personal information we collect from you in relation to this service, how we intend to use it and what your rights in respect of that information are. By participating in a case study or campaign, you are accepting and consenting to the practices described in this Privacy Notice.
It is important that you read this Privacy Notice (together with any other privacy notice or fair processing notice we may provide you with on specific occasions when we are collecting or processing personal data about you) and we encourage you to keep copies of all such notices for your records.
Our products and/or services are not intended for children and we do not knowingly collect data relating to children.
The controller of your personal information is British Pregnancy Advisory Service (BPAS), which is a charity and limited company registered in England and Wales under Guarantee No: 1803160 and registered Charity No: 289145 and registered with the UK Information Commissioners Office under data controller number: Z5613684 (“we”, “us”, “our”).
Should you have any query in respect of this Privacy Notice or your personal information, you can contact us at the following:
Data controller: British Pregnancy Advisory Service (BPAS)
Website https: //www.bpas.org
Address: 20 Timothys Bridge Road, Stratford Enterprise Park, Stratford-upon-Avon, Warwickshire, CV37 9BF
Telephone: +44 345 365 5050
As part of our campaign work we sometimes use case studies and additional data from data subjects. This data privacy notice is therefore supplemental to the Marketing, events and Social Media Data Privacy Notice. This is because processing in this manner is limited to a small number of individuals that choose to share additional information with us and the public.
We may collect, use, store and/or transfer information about your identity, contact details and marketing & communications preferences if you agree to share your information with us (electronically or in person), including:
Additionally, if you explicitly consent we may collect, use, store, publish and/or transfer information about your health records and medical information.
We may also collect, use and share aggregated data such as statistical or demographic data for any purpose if you cannot be identified in any way. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
We collect your personal information through different methods, including:
Technical data from analytics providers
Health data from other providers if you have consented for us to collect this
Public sources of information on the internet based on what you you have made publicly available.
We will use your personal information in the following ways and for the following purposes:
Purpose - to put together a case study or campaign that contains some or all your information based on what has been agreed.
Legal basis - we will rely upon you consent to use this information for the case study or campaign.
Purpose - to put together a case study or campaign that contains some or all your medical information based on what has been agreed.
Legal basis - your data will only be used if you explicitly consent to its usage for the purpose that has been described to you.
You do not have to provide your personal information to us, this is entirely optional, as we are processing your data for a case study or campaign that will be publicly available. If you want to participate, but do not want your personal data disclosed in the case study or campaign you have the choice on how your data is used. You have two options in relation to allowing us to use your data:
Should you choose not to provide it, we will be unable to use your information for the case study or campaign – and we will not use it without your consent.
We maintain strong physical, electronic and procedural safeguards to protect the confidentiality, integrity and availability of your personal information. We have taken appropriate security measures against illegal and/or unauthorised access to your personal information, and against the accidental loss of, or damage to it.
Depending on what you agree with us, we will only disclose as part of the case study or campaign what you have given us permission to. All other data will be protected in line with the above statement.
If you have consented for us to do so, then we will share your data with the public as part of a case study or campaign. All other personal information sharing is the same as for Marketing and events and Social Media Data Privacy Notice.
If you are a resident of a country in the EEA, we may need to transfer your personal information outside of the EEA, for example where our data storage facilities or processing locations are in another country.
Whenever we transfer your personal data outside of the EEA, we ensure a similar degree of protection is afforded to it by putting adequate, legally-approved safeguards in place, including at least one of the following:
If you would like more information about our safeguards, please contact us using the details supplied in Section 2 above.
Please note that some of the social media companies that we interact with may share your data outside of the EEA. We have no control over this as it is bound by their data privacy notices to you. Please see section 8 above and review their data privacy notices carefully.
We will only retain your personal data for as long as necessary to fulfil the purposes we hold it for, including for the purposes of satisfying any legal, accounting or reporting requirements. In general, we will need to keep the information that we collect from you for the following periods of time:
Your information - your personal information provided for the case study or campaign
Retention Period - We will retain this information for the lifetime of the relationship between us or the length that the case study / campaign is active. We will then archive this and maintain it for as long as it is in the public’s interest and forms part of a relevant archive.
You have the right to withdraw consent or ask us to stop processing your data at any time. We know that consent degrades over time, so we will check every two years with you that your consent is still valid.
If you ask us to stop processing your data we will only retain enough information to ensure that we can comply with your requirements, to ensure that we do not contact you again.
We may sometimes need to keep a copy of your personal information for a longer period, for example in the event of an incident, to investigate a data breach or to comply with legal requirements. We will never keep your personal information for longer than we consider necessary.
In all cases, your personal information will be securely destroyed once the retention periods described above expire.
You have rights in respect of the personal information we hold on you, including the right to ask us to:
Should you wish to exercise any of those rights, please contact us using the details set out in Section 2 above.
Where we need to use your personal data for another reason, other than for the purpose for which we collected it, we will only use your personal data where that reason is compatible with the original purpose.
Should it be necessary to use your personal data for a new, unrelated purpose, we will endeavour to notify you and communicate the legal basis which allows us to do so before starting any new processing.
The exception to this is where use of the personal information is required or permitted by law e.g. generation of reporting information for the government or for another legal reason that may require us to contact you. In this case, we may process your personal information without your knowledge or consent.
You also have the right to lodge a complaint with our supervisory authority, the Information Commissioner’s Office, which can be contacted at the following:
Supervisory Authority UK: Information Commissioner’s Office
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Telephone: 0303 123 1113
We may need to make changes to this Privacy Notice in the future (for example, to comply with new legal requirements). Where that is the case, we will provide you with a revised Privacy Notice on our website, which you can access. If required by law, we will seek your prior approval before revising this Privacy Notice.
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.