This policy was last updated January 2022 and is due for review January 2023.

Overview

London’s Air Ambulance Charity (LAAC) relies on the generosity and support of individuals. We use personal information to carry out activities necessary to our operation and development, optimising decision making and fundraising more efficiently.  This policy describes how and why we will manage the information that we hold on you, how we protect your privacy when doing so, your rights and choices regarding this information, and further detail on how you can change how we manage that information. We promise to respect your personal data under our control and to keep it safe and not to do anything with it that you would not reasonably expect. We are committed to transparency about the collection of your information and what we will do with it. 

All patient data governance and privacy is managed by Barts NHS Trust and LAS NHS Trust and their privacy notices can be found here and here.

Who we are

London’s Air Ambulance Charity (hereafter referred to as LAAC) is the ‘data controller’ for the personal information that you provide and that we then collect, use, and store. This activity is done in accordance with Data Protection law including the UK’s Data Protection Act 2018, the EU General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulation.

London’s Air Ambulance Limited is a registered charity (number 801013) and company limited by guarantee (number 2337239). The charity’s registered and office address is 5th Floor, 77 Mansell Street, London, E1 8AN.

London’s Air Ambulance Trading Limited is a wholly owned subsidiary of London’s Air Ambulance Limited and its principal activities include running our weekly lottery and the retail of merchandise and services bearing the logo of London’s Air Ambulance. All profits are donated to London’s Air Ambulance Charity. It is a limited company (number 4836606) and the registered address is 5th Floor, 77 Mansell Street, London, E1 8AN.

How to contact us about data protection

To update the information we hold about you, change your contact preferences or if you have any questions about this policy please call Supporter Care on 020 3023 3319 or email [email protected]

Our contact details for data protection matters:

Colin Grove, Head of Data

London’s Air Ambulance

5th floor, 77 Mansell Street

London E1 8AN

Email : [email protected]

Telephone : 020 3023 3300

If you are not satisfied with how we are processing your personal data, you can make a complaint to the Information Commissioner’s Office. You can find out more about your rights under applicable data protection legislation from their website available at www.ico.org.uk

Your rights and access to your data

Overview

You have the right to ask for a copy of the personal data we hold about you. This is called a ‘Subject Access Request’.  You can also request to have the personal data we hold about you erased, to object to our use of your personal data, or to restrict the ways we use your personal data. To make any of these requests please see the further details below and then use the contact details above. You also have the right to update or correct the personal information we hold about you and where you have provided consent for us to use your personal information you have the right to withdraw your consent at any time.

Right to be Informed

You have the right to be told how your personal information will be used. This privacy policy, and shorter summary statements used on our communications, are intended to be a clear and transparent description of how your data will be used.

Right to access your personal information

You can ask what information we hold on you and request a copy of that information.

If you want to access your information please contact us with a description of the information you want to see.

Right to have your inaccurate personal information corrected (Right of Rectification)

If you believe our records are inaccurate or incomplete you have the right to ask for those records concerning you to be updated. Please provide us with details and we will investigate and, where applicable, correct any inaccuracies and confirm that we have done this.

Right to restrict use of your personal information

You have a right to ask us to restrict the processing of some or all of your personal information in the following situations:

  • if some information we hold on you isn’t right
  • we’re not lawfully allowed to use it
  • you need us to retain your information in order for you to establish, exercise or defend a legal claim                                                                                                                                                               
  • you believe your privacy rights outweigh our legitimate interests to use your information for a particular purpose and you have objected to us doing so

Right to erasure of your personal information (‘right to be forgotten’)

You have the right to be forgotten (i.e. to have your personally identifiable data deleted). We will still be required to keep an appropriate record of the request if we can delete your information and, in some instances, a legal basis will override the right to erasure.

Right for your personal information to be portable

If we are processing your personal information based on your consent, or in order to enter into or carry out a contract with you, and the processing is being done by automated means, you may ask us to provide it to you or another service provider in a machine-readable format.

Right to object to the use of your personal information

You have a right to stop the processing of your personal data for direct marketing purposes, as well as the right to object to other processing activities.

If we are processing your personal information for direct marketing purposes, and you wish to object, we will stop processing your information for these purposes as soon as reasonably possible.

Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office (ICO)

Lawful basis of processing

Under GDPR there are a number of legal bases upon which we can contact you for marketing and fundraising purposes. We have defined all our communications, including fundraising, as containing marketing elements, unless we write to you only about an administrative issue making no mention of our charitable aims.

We will only collect and use your data for marketing and fundraising purposes in accordance with one of the legal grounds available under GDPR. Specifically:

1) You have given your active, opt-in consent to receive our marketing by email or text message

2) It is in our legitimate interest to contact you by post or telephone.

All our decisions around communication with you based on 2) follow on from the principle that you would reasonably expect to hear from us and we will balance this against our legitimate interest at all times.

We will always ask for your consent to email and text you in a transparent and direct way. If you consent to this form of communication from us we will capture the fact, and will always provide the option to opt-out in future communications.

To update the information we hold about you, change your contact preferences or if you have any questions about this policy please call Supporter Care on 020 3023 3319 or email [email protected]

What is our legitimate interest?

We believe we have a legitimate interest to contact you by post or telephone to raise awareness of our work and increase knowledge that London’s Air Ambulance is a charity. It is also in our legitimate interest to raise funds to continue our work.

Activities we may undertake using your personal information based on our legitimate interest are:

  • Writing to you or telephoning you about our charitable work and/or to raise funds and awareness (unless you have asked us not to or have registered with the Telephone Preference Service, the Fundraising Preference Service or the Mailing Preference Service. In that case we will need to secure your consent to telephone you).
  • Our work with supporters and/or volunteers who may be able to align their interests in enhanced giving opportunities with us, identified using processes such as Wealth Screening. For further details please see our Philanthropy and Partnerships Privacy Notice.
  • We may also use third parties to carry out research of our supporter base to inform our fundraising strategy. This is an examination of trends in aggregate and will always be an anonymised process and we will not capture individual information resulting from it.
  • We may use third parties to obtain updated address information if you move home - and your current relationship with us justifies and requires us having current details.

What personal information do we collect about you?

Personal data, or personal information, means any information about a living individual. We collect, store and use the following kinds of personal information:

  • Basic personal details: your name; your contact details (including postal address, telephone number, e-mail address and/or social media identity); your date of birth; marital status; your gender.
  • Financial details: your bank or credit card details where you provide these to make a payment, in line with PCI-DSS compliance data will be minimised and encrypted and unavailable except under controlled circumstances; if you make a declaration that you are a taxpayer to enable us to claim Gift Aid.
  • Wealth Screening: people in our supporter base have varying abilities to support our work financially. We have a programme that actively seeks to match funding opportunities with donors. Further details of this can be found in our Philanthropy and Partnerships Privacy Notice.
  • Volunteering and employment: if you volunteer for us or apply for a job with us, information necessary for us to process these applications and assess your suitability (employment status, previous experience depending on the context, as well as any unspent criminal convictions or pending court cases you may have). For unsuccessful applications we will keep data for two years.
  • Online information:  we may record your activities on our website(s) or social media platforms when you interact with us, and about the device you use to access these, for instance your IP address and geographical location.
  • Event information: information about events, activities and products.
  • Health information: for example if you are taking part in or attending an event we will need to capture and engage with this information for health and safety purposes.
  • Legacy information: where you have left us a legacy, any information regarding next of kin you have provided us to administer this. We will retain information around legacy gifts for ten years.
  • Other Information: nationality and ethnicity information for monitoring purposes, your communication preferences, your donation and other support history, and any other relevant personal information you provide to us.

Operational use of live-stream video

London Ambulance Service in conjunction with London’s Air Ambulance is using an APP to obtain a secure live-stream video from incidents to help its control-room clinicians more accurately and rapidly assess patient injuries. This will only be done where clinically necessary, with patient and caller consent, or (where a patient is unable to consent) in a patient’s best interests. The data governance and privacy of its use lies with London Ambulance Service NHS Trust. Their privacy notice can be found here. No footage is stored and privacy controls are in place in connection with this tool.

Sensitive information

Certain types of personal information are in a special category under data protection laws, as they are considered to be more sensitive.  Examples of this “special category data” would be information about health, race, religious beliefs, political views, trade union membership, sex life or sexuality or genetic/biometric information. 

We only collect this type of information about our supporters to the extent that there is a clear reason for us to do so, for example asking for health information if you are taking part in a sporting event, or where we ask for information for the purpose of providing appropriate facilities or support.  

When you indirectly give us information

When you interact with us on social media platforms such as Facebook, WhatsApp, Twitter or LinkedIn we may also obtain some personal information about you. The information we receive will depend, in part, on the privacy preferences you have set on each platform and the privacy policies of each platform. To change your settings on these platforms, please refer to their privacy notices.

We may obtain information about your visit to our site, for example the pages you visit and how you navigate the site, by using cookies. Please visit our cookies policy for information on this.

If you are under 16

If you are aged under 16, you must get your parent/guardian’s permission before you provide any personal information to us.

How do we use your information?

We may use your information in the following ways:

  • To process transactions submitted by you
  • To meet our obligations arising from any contracts entered into by you and us
  • To verify your identity
  • To seek your views or comments on the services we provide
  • To notify you of changes to our services
  • To improve our services for marketing purposes
  • To send you communications that may be of interest to you. These may include information about the work of our charity, campaigns, appeals, other fundraising and marketing activities, promotions of our associated companies’ goods and services

Who do we share your information with?

We will only use your information for the purposes for which it was obtained. We will not, under any circumstances, sell or share your personal information with any third party for their own purposes, and you will not receive marketing from any other companies, charities or other organisations as a result of giving your details to us.

We will only share your data for the following purposes:

Third party suppliers: We may need to share your information with data hosting providers or service providers who help us to deliver our services, projects, or fundraising activities and appeals. These providers will only act under our instruction and are subject to pre-contract scrutiny and contractual obligations containing strict data protection clauses. We always aim to ensure that personal information is only used by those third parties for lawful purposes in accordance with this Privacy Notice, and we have a due diligence process that we follow before working with any third party supplier or volunteers.

Where legally required: We will comply with requests where disclosure is required by law, for example, we may disclose your personal information to the government for tax investigation purposes, or to law enforcement agencies for the prevention and detection of crime.

How long will we keep your data?

We only keep your information for as long as we need to, to be able to use it for the reasons given in this privacy notice.

  • Where someone has left LAAC a gift in their will we will maintain our records of that pledge to carry out legacy administration and communicate effectively with the families of people leaving us a legacy.
  • If you have kindly added Gift Aid to a donation we must record the fact that you are a UK taxpayer. HMRC requires that we maintain a record of that Gift Aid for seven years after your last donation to us.
  • If you apply for a job with us, and share sensitive information as part of the application process, the information will be stored in a personnel record if you are successful, or for six months after the closure of the recruitment campaign if your application has been unsuccessful.
  • For volunteers we keep information for four years after your last interaction with us.
  • Ten years after your last donation or if you request to receive no further contact from us, we'll continue to keep some basic information about you in our suppression list in order to avoid sending you unwanted materials in the future.

How do we protect and secure your data?

We are committed to protecting your personal information. We use appropriate technical and organisational measures, including encryption, to protect personal information and privacy, and we review these methods regularly. We protect your information using a combination of physical and IT security controls, including access controls that restrict and manage the way that information and data is processed, managed and handled. We also make sure that our staff are adequately trained in protecting personal information.

Our procedures mean that we may sometimes ask for proof of identity before we share your personal information with supporters or members – for example to check that we are speaking to the owner of that personal information.

In the unlikely event of a security breach that compromises our protection of personal information, and we need to let you know about it, we will do so.

Gift aid

The Gift Aid Declaration captures personal information such as name, contact details, and your declaration that you are a taxpayer. We use this information to create and submit a Gift Aid claim to HMRC. Information is stored securely and only used for the purposes it was collected for.

Under data protection legislation it is lawful for LAAC to process this data because it has legitimate interests in maximising the value of giving through proper use of the Gift Aid scheme. LAAC will retain this data for as long as it is needed to support Gift Aid claims and comply with any associated audit and inspection requirements.

Lottery

When entering our lottery we collect the following information about you:

  • Your full name to process your competition entry and contact you if you are a winner.
  • Your date of birth to confirm your eligibility to enter the lottery.
  • Your full address to contact you if you are a winner and if applicable send you your prize.
  • Your email address to contact you if you are a winner.
  • Your contact telephone number to contact you if you are a winner.
  • Your mobile telephone number if you have requested further information about a competition or entered a competition by text.

We use your personal data to provide our services to you, to process transactions and to administer user records.

It is necessary to process this information to fulfil our competition conditions to you. Our legal grounds in relation to this processing is contract, in that the processing is necessary for entry to the lottery.

As stated in the lottery terms and conditions, we would like to use the winner’s name for promotional purposes. Where we do so, our lawful basis is legitimate interests, however, if you would prefer to remain anonymous, please contact Supporter Care.

We may also ask to use winners’ stories and/or photographs for publication on the website, or to promote the lottery. Where we do so, our lawful basis will be consent and we will discuss this with you prior to publication.

Raffle

When you, or someone on your behalf, purchases raffle tickets we may approach you in the future, unless you tell us not to, asking you if you would like to re-enter the draw. To comply with data protection legislation we need to identify, and then advise you, of a lawful basis for processing for this activity.

The lawful basis for processing for our administration of the raffle is Contract. Your participation in the raffle means that we would not screen you against the Mailing Preference Service when we contact supporters inviting them to take part.

Volunteering

LAAC must process personal data to support and manage volunteers in their roles. As stated in the previous section, to comply with data protection legislation we need to identify, and then advise you, of a lawful basis for processing.

The lawful basis of processing for this activity is Contract.

LAAC must process the health data of volunteers for public health reasons, such as keeping members of the public and other volunteers safe and to fulfill its duty of care for volunteers under Section Three of the Health and Safety at Work Act 1974.

If a volunteering role involves direct contact with a partner organisation or supervision by another volunteer, LAAC will share relevant information.

Details shared may include, but are not limited to:

  • name
  • contact details
  • emergency contact details
  • training records
  • personal risk assessments

Your information might be used by us as we:

  • contact volunteers about volunteering opportunities and events
  • manage volunteers hours and working arrangements
  • provide training and guidance
  • address health and safety issues

Working with third parties

LAAC works with third parties to achieve our mutual goals – for example if you were to run the London Marathon, fundraising for us, we would need to liaise with their organisation and share your data. As and when we share your data you will be informed of the details. As such this section does not list the various third parties but rather the conditions under which the sharing takes place.

The parties acknowledge that LAAC is the data controller and the third party is the data processor in relation to any shared data.

The third party will process personal data only in accordance with LAAC’s written instructions.

Each party will ensure that any personal data supplied to the other party shall comply with GDPR and all applicable laws, regulations, codes of practice and guidelines relating to data protection.

The third party will not disclose any personal data to any data subject or third party other than at the written request of LAAC, except as required by law. At the termination of any agreement the third party will not make any further use of such information and will take all reasonable steps to return or irretrievably delete all personal data.

LAAC shall ensure it has all necessary rights and consents to process data, including supply of the privacy notice to the data subject, and to disclose data in accordance with the data protection legislation.

Both parties shall implement appropriate technical and organisational measures to ensure a level of security appropriate to protect the data.

Social media

Currently London’s Air Ambulance Charity maintains a presence on and therefore is a joint-data controller with the following third-party platforms:

When you interact with us on a social media platform we may obtain personal information. The information we receive will depend on the privacy preferences you have set on the platform and the privacy policy of that platform. To change your settings with any social media company, please refer to their privacy notice.

We do not routinely use social media to profile supporters, actual or otherwise, and we do not normally store any information obtained from social media about supporters, actual or otherwise. For exceptions to this please see our Philanthropy and Partnerships Privacy Notice. Messages received by us from you through social media will be responded to according to our supporter journey protocols. Actual postings or miscellaneous data about you that you supply online through social media would not be relevant to any Data Processing we undertake about you other than in specific circumstances.  If we were to determine that your social media data is relevant you would be immediately informed as to why we have decided to do this. Immediately that we were to properly make that evaluation you would be informed. There is a separate privacy notice and supporter pathway that you would be enrolled upon with the option at any time to withdraw your consent to further processing or communication. For the majority of supporters this will not be relevant and LAAC will, in effect, not engage with, or in any way process, any social media postings that you may make as individual data. Analysis of posts to determine trends of support, opinion and any other matter of relevance to optimising the activity of LAAC to achieve our mutual goals would not be relevant as Data Processing of a Data Subject as the matter will be held and engaged with only as aggregate information.

Communication, engagement and actions taken through external social media platforms that LAAC participates on are subject to the terms and conditions, as well as the privacy policies held with each social media platform respectively.

When browsing social media platforms where LAAC maintains a presence, we will be joint-controllers of your data with the third-party platform’s owner. The third-party platform will process your data in line with their privacy and cookie policies. In such circumstances, you will be able to update your cookie preferences directly on the third-party platform. You will not be able to update your preferences through LAAC.

Changes to our privacy policy

This privacy policy may change from time to time. For example, we will continue to update it to reflect new legal requirements.

If we make any significant changes in the way we treat your personal information we’ll make this clear on our website or by contacting you directly.