Privacy and Data Protection Policy

At Narcolepsy UK, we are committed to safeguarding the privacy of visitors to our website and others whose personal data we process; this policy sets out how we treat your personal information.

1. What information do we collect?

We may collect, store and use the following kinds of personal information:

• information that you provide to us for the purpose of registering as a Registered Member of Narcolepsy UK;

• information that you provide to us in correspondence (on paper, by email or other forms of electronic communication);

• information about your computer and about your visits to and use of our website;

• information that you provide to us for the purpose of subscribing to our website services, email notifications and/or newsletters.

2. Using your personal information

Narcolepsy UK exists to support people with narcolepsy and those around them, and to interact with others such as physicians with an interest in narcolepsy. We use personal data only to help us pursue those objectives.

Specific ways in which we may use your personal information are:

• to enable us to send you information, by email or other means, about our activities and other information that we feel may be of interest to you;

• to enable us to respond to requests from you for information or assistance;

• to assist with raising funds for the charity and its purposes;

• to enable your use of services available on our website;

• to enable us to deal with enquiries and complaints made by or about you relating to our activities or our website.

We will not without your express consent provide your personal information to any third parties for any purpose. If at any time we feel that it may be beneficial to you or to others for your personal information to be disclosed to a third party, we will contact you and request your consent to such disclosure. Your personal information will not be disclosed unless you do consent to us doing so. Disclosure of information to third parties in this manner will most likely be for the purposes of research into narcolepsy.

3. Data retention and destruction

We consider it reasonable to assume that you have provided us with your personal information because you have an interest in narcolepsy. Given that narcolepsy is a life-long condition, we will continue to store your personal information unless you request us to delete it or we become aware of circumstances that mean it is no longer appropriate or necessary for us to retain it.

That said, we will conduct a data review in January each year, and any data that has not been used in the six preceding calendar years will at that point be destroyed.

4. Your rights

Under the General Data Protection Regulation (or comparable legislation), you have a number of rights in relation to your personal information, specifically:

To erasure

This is often referred to as the “right to be forgotten”. Essentially, this means that you can ask for your personal data to be removed from our records. If you notify us that you wish to exercise this right, we will promptly remove your details from our database. However, if we hold your details in a case file relating to advice or assistance that we have provided to you, we will retain that case file until it is destroyed in accordance with Section 3 above.

To be informed

You have the right to know what data we hold about you, and for what purpose. Upon request, we will provide that information to you.

Of access

You have the right to see what data we hold about you. Upon request, we will show you.

To object

You have the right to object to your data being processed by us. Should you exercise that right, we will promptly remove your details from our database. However, if we hold your details in a case file relating to advice or assistance that we have provided to you, we will retain that case file until it is destroyed in accordance with Section 3 above.

Of correction

You have the right to insist that any inaccuracies in the personal data we hold about you are rectified. Upon request, we will promptly correct any inaccuracies.

To data portability

You have the right to take a copy of the personal data that we hold about you. In view of the limited data that we will hold about you, this is unlikely to be of any value to you but we will endeavour to assist with any request for a copy of your personal data.

To restrict processing

You can insist that only data that is necessary is processed and retained by us. Should you feel that we hold any data that is not necessary for us to hold, you should contact us and we will endeavour to address your concerns.

Automated data processing control

You have the right not to be subject to a decision based on automated processing. We will not make any such decisions.

If you wish to exercise any of the above rights, you should contact us, in which case we will endeavour to address your concerns. Responsibility for GDPR requests will be held jointly by the Chair of the Trustees and the Operations Manager.

Ideally, you should contact us via the email address: data-protection@narcolepsy.org.uk. Failing that, you may contact us by post at:

Narcolepsy UK, P O Box 701, Huntingdon, Cambridgeshire, PE29 9LR

5. Disclosures

We may disclose information about you to any of our employees, officers, agents, suppliers or subcontractors insofar as reasonably necessary for the purposes as set out in this privacy policy.

In addition, we may disclose your personal information:

• to the extent that we are required to do so by law;

• in line with our Statement on Confidentiality if we feel that there is a significant risk of any intention to carry out an illegal or high hazardous act, particularly with the regard to the use of motor vehicles, operating heavy machinery or similar higher risk activities;

• in connection with any legal proceedings or prospective legal proceedings;

• in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk).

As noted above, except as provided in this privacy policy, we will not provide your information to third parties.

6. Security of your personal information

We will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.

Of course, data transmission over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet.

7. Cookies

Our website uses cookies.

A cookie consists of information sent by a web server to a web browser, and stored by the browser. The information is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.

We use Google Analytics to analyse the use of our website. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users’ computers. The information generated relating to our website is used to create reports about the use of the website. Google will store this information. Google’s privacy policy is available at: http://www.google.com/privacypolicy.html.

Most browsers allow you to reject all cookies, whilst some browsers allow you to reject just third party cookies. For example, in Internet Explorer you can refuse all cookies by clicking “Tools”, “Internet Options”, “Privacy”, and selecting “Block all cookies” using the sliding selector. Blocking all cookies will, however, have a negative impact upon the usability of many websites.

8. Policy amendments

We may update this privacy policy from time-to-time by posting a new version on our website. You should check this page occasionally to ensure you are happy with any changes.

9. Third party websites

Our website contains links to other websites. We are not responsible for the privacy policies or practices of third party websites.