Confidentiality Policy

Introduction

At Warm Wales, we recognise that householders who discuss social welfare problems with us will need to share confidential information.  We provide a confidential service, and we commit to protecting client and householder confidentiality.  We review our systems and processes regularly to ensure the personal information of people seeking help and support is well-protected. 

Warm Wales holds Personal Data about householders, clients and other individuals for a variety of Business Purposes.  This policy sets out the basis on which any personal data and information will be processed by us.

For the purposes of the Data Protection Act 2018 (the Act) and The General Data Protection Regulation (GDPR) the data controller is: Warm Wales Cymru Gynnes, Llewellyn House, Harbourside Business Park, Port Talbot, SA13 1SB

Scope

It is our intention to clearly set out the terms on which we provide advice and guidance to householders and clients, regarding their data.

We may collect and process the following data about you:

• information that you provide by filling in contact or uploading forms on our website www.warmwales.org.uk which may include your name, address, contact details, your personal circumstances and your contact preferences.
• occasional surveys that we use for research purposes, although you do not have to respond to them.
• details of your visits to our site including, but not limited to; traffic data, location data, weblogs and other communication data, this statistical data does not identify any individuals.

If you contact us, we may keep a record of that correspondence and/or phone call, and record your personal details and data preferences.

Definitions

In this policy:

“Business Purposes” means the purposes for which Personal Data may be used by Warm Wales, e.g. personnel, administrative, financial, regulatory, payroll and business development purposes;

“Personal Data” has the same meaning as set out in the General Data Protection Regulation (“GDPR”);

“Processing Data” means obtaining, recording, holding or doing anything with data, such as organising, using, altering, retrieving, disclosing or deleting it.

General principles

Warm Wales’s policy is to process Personal Data in accordance with the applicable data protection laws and rights of individuals as set out below.

Warm Wales will observe the following principles in respect of the processing of Personal Data:

• to process Personal Data fairly and lawfully in line with individuals’ rights;
• to make sure that any Personal Data processed for a specific purpose are adequate, relevant and not excessive for that purpose;
• to keep Personal Data accurate and up to date;
• to keep Personal Data for no longer than is necessary;
• to keep Personal Data secure against loss or misuse;
• not to transfer Personal Data outside the EEA without adequate protection.

All employees at Warm Wales have responsibility for the practical application of our Data Privacy policy.  Warm Wales’s duty of confidentiality and the overlap with our duties under data protection legislation is well understood by colleagues.

Colleagues will remind householders of the obligation for those householders to notify authorities of any change in their circumstances which may change their eligibility for funding.

Fair and lawful processing

We will not process Personal Data unless:

• the person whose details are being processed has consented to this;

or if processing is necessary:

• to perform Warm Wales’s legal obligations or exercise legal rights;
• for a contract Warm Wales has with the individual, or because they have asked us to take specific steps before entering a contract;
• to protect someone’s life or protect someone who is at serious risk of harm including disclosures of abuse or serious threats or concerns around self-harm and suicide, or safeguarding concerns for children and vulnerable adults;
• for us to perform a task in the public interest; including under money-laundering and anti-terror legislation;
• for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

When gathering Personal Data or establishing new data protection activities, we will ensure that individuals whose data is being processed receive appropriate data protection notices to inform them how the data will be used.

It will normally be necessary to have an individual’s explicit consent to process Personal Data. Their consent should be informed, which means it needs to identify the relevant data, why it is being processed and to whom it will be disclosed. Colleagues can contact the Projects Director for more information on obtaining consent to process Personal Data.

Accuracy, adequacy, relevance and proportionality

Colleagues will ensure data processed by them is accurate, adequate, relevant and proportionate for the purpose for which it was obtained.   Information shared by householders with individuals at Warm Wales will be kept confidential within Warm Wales but may be shared with other colleagues to enable effective provision of service.  This does not affect our general principle of limiting access to client records to those colleagues who need to access them.

Personal Data obtained for one purpose will not be used for unconnected purposes unless the individual has agreed to this. 

Individuals have the right to ask Warm Wales to correct Personal Data relating to them which they consider to be inaccurate. If a colleague receives such a request and does not agree that the Personal Data held is inaccurate, they should nevertheless record the fact that it is disputed and inform  the Projects Director.

Security

All colleagues must be familiar with this policy and comply with its terms.  Colleagues must always be mindful of security of IT equipment to ensure Personal Data is kept secure against loss or misuse, in accordance with Warm Wales’s policies. Where Warm Wales uses external organisations to process Personal Data on its behalf additional security arrangements are in place with those organisations to safeguard the security of Personal Data.

Data retention

Personal Data should not be retained for any longer than necessary. The length of time over which data should be retained will depend upon the circumstances including the reasons why the Personal Data was obtained.

Rights of individuals

Individuals have the right to be informed about how, why and on what basis the Personal Data is processed. Any questions relating to this should be referred immediately to the Project Director.

Individuals are entitled to request access to information held about them. All such requests should be referred immediately to the HR Manager.  This is particularly important because Warm Wales must respond to a valid request within the legally prescribed time limits.

Individuals are also entitled to request to have their Personal Data deleted from Warm Wales’s records in certain instances. All such requests should be referred immediately to  the HR Manager. This is particularly important because Warm Wales must respond to a valid request within the legally prescribed time limits.

Individuals also have the right to restrict the processing of their Personal Data in certain circumstances. All such requests should be referred immediately to  the  Projects Director.

Colleagues will not send direct marketing material to someone electronically (by email for example) unless that individual has explicitly consented to receiving marketing material.  Colleagues should action any request from an individual not to use their Personal Data for direct marketing purposes and should notify their Manager about any such request.

Reporting

Colleagues have an obligation to report actual or potential data protection compliance failures to their Manager  immediately upon becoming aware of such failure/potential failure. This allows Warm Wales to investigate the failure and take remedial steps if necessary and make any applicable notifications.

In situations where abuse is disclosed or fraud is suspected, colleagues must notify their Manager or another Manager as detailed in the Safeguarding Policy.

Consequences of failing to comply

Warm Wales takes compliance with this policy very seriously. Failure to comply puts both colleagues and Warm Wales at risk. The importance of this policy means that failure to comply with any requirement may lead to disciplinary action, which may result in dismissal.

Colleagues with any questions or concerns about anything in this policy should not hesitate to discuss these with the HR Manager.

References

The Information Commissioner’s Office https://ico.org.uk/

ICO helpline 0303 123 1113

Warm Wales Registration Number Z8754426

Policy last reviewed Feb 2026