1. Introduction

The Bangladeshi Women’s Association Wales (BWAW) is committed to protecting the privacy and security of the personal information we hold about our service users, employees, volunteers, trustees, and supporters. We treat your information with respect and are dedicated to keeping it safe and confidential.

This policy explains how we collect, use, store, and share your personal data. It also outlines your rights regarding your information. We ensure that we use your information in accordance with all applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Where We Get Your Information

We may collect information about you in the following ways:

• Directly from you: When you contact us, use our services, register for an activity, become a member, volunteer, or make a donation.
• From third parties: With your explicit consent, we may receive referrals or information from other organisations supporting you, such as social services, healthcare providers, or other community groups.
• Automatically: Through the use of cookies on our website (please see our separate Cookies Policy for more details).

3. The Personal Data We Collect and Why

The type of information we collect depends on your relationship with BWAW. We will only collect the data we need to provide our services and fulfil our charitable objectives.

For our service users, this may include:

• Basic details: Name, date of birth, address, contact details (phone, email), National Insurance number.
• Family and circumstances: Details of your children, family information, and next of kin/emergency contact details.
• Sensitive (Special Category) Data: This is more sensitive information and we will always have a clear, specific legal basis for processing it, such as your explicit consent or where it is necessary for the provision of health or social care. This may include:
• Information about your ethnicity, religion, and other equalities monitoring information.
• Details of your physical or mental health.
• Information about the support you need and the support we provide.
• Risk assessments and safeguarding information.
• Criminal record history (processed under the control of official authority or for substantial public interest).

We use this information to:

• Provide you with safe, effective, and tailored support.
• Safeguard you, your children, and others from harm.
• Fulfil our contractual and legal obligations to funders and regulators (e.g., local authorities, Welsh Government).
• Monitor the equality, diversity, and inclusion of our services.
• Plan and manage our organisation effectively.
• Conduct anonymised research to improve our services.
• Share anonymised case studies (with specific, additional consent if not anonymised).

4. Our Legal Basis for Processing Your Data

Under data protection law, we must have a lawful basis for processing your personal data. For BWAW, the primary bases we rely on are:

• Consent: You have given clear consent for us to process your personal data for a specific purpose (e.g., sending you marketing newsletters).
• Contract: The processing is necessary for a contract we have with you (e.g., as an employee), or because you have asked us to take specific steps before entering into a contract (e.g., providing support services).
• Legal Obligation: The processing is necessary for us to comply with the law (e.g., reporting safeguarding concerns or for tax purposes).
• Vital Interests: The processing is necessary to protect someone’s life (e.g., in a medical emergency).
• Legitimate Interests: The processing is necessary for our legitimate interests or the legitimate interests of a third party, provided your interests and fundamental rights do not override those interests. This includes administrative tasks, fraud prevention, and network security.
• Special Category Data: For sensitive data, we process it under additional conditions, such as your explicit consent, or where it is necessary for the provision of health or social care, or for reasons of substantial public interest.

5. How We Share Your Information

We will never sell your personal data.

We may share your information with third parties only in the following circumstances:

• Within BWAW: To ensure staff, volunteers, and managers can provide you with consistent and safe support.
• With Partner Agencies: To safeguard you and others, and to ensure we work effectively with other organisations supporting you (e.g., social services, police, health professionals). This will only be done with your consent, unless we have a legal or vital interest reason to do so without it.
• With Funders and Regulators: To comply with our reporting and monitoring requirements to bodies like local authorities and the Welsh Government. Data is typically anonymised for statistical purposes.
• For Audits: To enable regulatory bodies and funders to audit our services to ensure we meet required standards.
• When Legally Required: If required by law, we may need to disclose your information to the police, regulatory bodies, or legal advisors.

6. How We Keep Your Data Safe

We are committed to ensuring your information is secure. We have implemented appropriate physical, technical, and organisational measures to protect your data.

• Digital Records: Stored on secure, password-protected systems with firewall protection. We use cloud services that comply with UK data protection standards.
• Access Control: Access to your personal information is restricted to staff and volunteers who need it to perform their duties.
• Training: All staff and volunteers receive data protection training.

7. How Long We Keep Your Information

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

In line with our Safeguarding Policy and other legal obligations, we will typically hold service user records for 5 years after our support ends. In some specific cases, we are required by law or contract to retain data for longer periods.

8. Your Data Protection Rights

You have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the information we hold about you (a “Subject Access Request”).
• Right to Rectification: You can ask us to correct any inaccurate or incomplete information.
• Right to Erasure: You can ask us to delete your personal data in certain circumstances (this is not an absolute right).
• Right to Restrict Processing: You can ask us to temporarily halt the processing of your data.
• Right to Data Portability: You can ask for your data in a machine-readable format to transfer to another service.
• Right to Object: You can object to us processing your data based on legitimate interests.
• Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing.

To exercise any of these rights, please contact us using the details in Section 9.

9. How to Contact Us

If you have any questions about this policy or wish to exercise your rights, please contact:

The Data Protection Lead
Bangladeshi Women’s Association Wales (BWAW)
Tahmina Khan
Email: bwawales@gmail.com
Phone Number: 07816910201

10. Changes to This Policy

We may update this policy from time to time. The latest version will always be available on our website or from our office.