Updated: 11/12/2025
PRIVACY NOTICE
WHO WE ARE
In this Privacy Notice, ‘Advanced Therapies Wales’, ‘ATW’ and all references to ‘we’, ‘our’ and ‘us’ means the Advanced Therapies Wales Programme. We are hosted by Velindre University NHS Trust, .
WHAT IS THIS PRIVACY NOTICE FOR?
This privacy notice is for data collected by ATW for the purposes of developing and running our operations. We may collect personal data such as name, profession, phone numbers, email, workplace, dietary requirements relating to business development via our website or through any interactions we have with you at events or other correspondence. This notice informs you about how we protect your privacy and sets out the different areas where your privacy is concerned, outlining the data which is collected, the way it is processed, where it is stored and how long it is retained.
WE ARE A DATA CONTROLLER
ATW is a Controller of the personal data that you (the data subject) provide to us. We take data protection and security very seriously. Your personal data will only be available to relevant employees who need access to it. Our policy is to only use data processors who comply with the requirements set out in the UK GDPR and /or the EU GDPR (whichever is applicable). We maintain a data protection policy which governs the use and storage of all data that we process.
ABOUT YOUR DATA
Users contacting any of ATW’s services do so at their own discretion. Your personal information is kept private and stored securely until a time it is no longer required, has no use or you request for it to be deleted, in accordance with your rights, listed below.
ATW regularly uses information you submit to provide you with further information about the products/services that we offer or to assist you in answering any questions or queries that you may have submitted. This includes using personal details to subscribe you to any email newsletter program ATW operates but only if this was made clear to you and your express permission was granted.
EVENTS AND COMMUNICATIONS
ATW operates a contact program, used to inform subscribers about events, white papers, scientific research, sector specific news, products and services that ATW offers. Users can subscribe through an online automated process should they wish to do so, but they do so at their own discretion. Some subscriptions may be manually processed through prior written agreement with the user.
All personal details relating to subscribers are held securely and in accordance with the UK GDPR and / or the EU GDPR (whichever is applicable).
Email marketing campaigns published by ATW may contain tracking facilities within the actual email. Subscriber activity is tracked and stored in a database for future analysis and evaluation. Such tracked activity may include; the opening of emails, the clicking of links within the email content, times, dates, frequency of activity, IP organisation, IP address, company name, country, state, postcode.
This information is used to refine future email campaigns and to supply the user with more relevant content based around their activity.
ATW processes this data using the lawful basis of either legitimate interest or consent.
In compliance with data protection and electronic communications regulations, subscribers are given the opportunity to unsubscribe at any time through an automated system. This process is detailed in the footer of each email campaign. If an automated un-subscription system is unavailable, clear instructions on how to unsubscribe will by detailed instead on request.
EVENTS HOSTED BY ATW
ATW may host events and require additional information for the organisation of such events. All personal details regarding attendees are held securely and in accordance with the UK GDPR and / or the EU GDPR (whichever is applicable). The additional information required may include but is not limited to biographies, dietary requirements and accessibility needs. ATW will share this information with third parties, such as the caterers only to the level required to allow for organisation of the event. Such information will be retained according to our Data Retention Policy. Our lawful basis for this processing is legitimate interests but if we are processing special category personal data, such as food allergies, our lawful basis will be explicit consent.
EVENTS HOSTED BY THIRD PARTIES AND SPONSORED BY ATW
ATW may sponsor events, and as sponsor we shall sometimes be provided with personal data of the attendees such as name and contact details from the event organiser/host. The event organiser/host should inform you of when your personal details are being shared. All personal details regarding attendees are held securely and in accordance with the UK GDPR and / or the EU GDPR (whichever is applicable). Our lawful basis for this is legitimate interest and Such information will be retained according to our Data Retention Policy.
ATW WEBSITE
The ATW website uses cookies providing tracking facilities. Browsers’ activity is tracked and stored in a database for future analysis and evaluation. Such tracked activity may include: IP organisation, IP address and country. The tracking will only be activated with your consent. See our Cookie Policy on our website for further information.
EXTERNAL LINKS AND EMBEDDED CONTENT
Although ATW looks to only include quality, safe and relevant external links and content, users are advised to adopt a policy of caution before clicking any external web links mentioned throughout this platform.
External links are clickable text/banner/image links to other websites. Embedded content may include videos from other platforms such as YouTube, Vimeo, Wistua etc.
ATW cannot guarantee or verify the contents of any externally linked website or embedded content despite their best efforts. Users should, therefore, note they click on external links or content at their own risk and ATW cannot be held liable for any damages or implications caused by visiting any external links mentioned.
SOCIAL MEDIA PLATFORMS
Communication, engagement, and actions taken through external social media platforms that ATW participates on are covered by the terms and conditions as well as the privacy policies held with each social media platform respectively.
ATW will never ask for personal or sensitive information through social media platforms and encourages users wishing to discuss sensitive details to contact them through primary communication channels such as by telephone or email.
ATW may use social sharing buttons which help share web content directly from web pages to the social media platform in question. Users are advised before using such social sharing buttons that they do so at their own discretion and note that the social media platform may track and save your request to share a web page respectively through your social media platform account.
CLIENTS, COLLABORATORS AND COMMERCIAL PARTNERS
The main reasons that we collect data regarding clients and commercial partners, which will include other partners such as academics wishing to work with Advanced Therapies Wales are:
1. Managing relationships – We will collect the details for our contacts within your organisation, such as names, telephone numbers and email addresses. We may also hold extra information that you or someone in your organisation has chosen to tell us. We hold this information in order that we can maintain a relationship with you and enter into contractual arrangements etc.
2. Managing finances – We may collect personal information in relation to our Finance processes such as bank details, so that we can pay you. In certain circumstances, such as when you engage with our Finance teams, we may share information with other third parties such as debt recovery agents.
Our lawful basis for this processing is either contract or legitimate interests. If our contract is with an individual, the lawful basis will be contract, as we will be processing the data in order to fulfil our obligations under the contract with that individual. If the contract is with an organisation, we will process the personal data of the representative of that company in order to fulfil our obligations under the contract with the company and in these circumstances, we will be processing the personal data under the lawful basis of legitimate interests.
As mentioned above, we use some of your personal data in our legitimate interests, we do not think that any of the following activities prejudice individuals in any way – in fact, they help us to offer you a more tailored, efficient service. However, you do have the right to object to us processing your personal data on this basis.
3. Marketing and developing our business – we may from time to time collect personal information from you or other sources to help us to grow our business, such as when you provide us with a business card or we obtain your information at conferences etc. If we do obtain information in this way, we will inform you of our intention to use it in the development of our business.
We will always respect your right to restrict this type of processing of your personal data by providing you with the opportunity to opt-out of these type of processing. Our lawful basis for this processing is legitimate interests.
4. Support services – we might collect and hold personal information in providing supporting services, for example:
-
- Contacting individuals in relation to press releases
- Collating and managing business proposals
Our lawful basis for this processing is either consent or legitimate interests, depending on the circumstances.
SUPPLIERS AND SERVICE PROVIDERS
The main reasons that we collect data regarding suppliers are:
- Managing relationships – We will collect the details for our contacts within your organisation, such as names, telephone numbers and email addresses. We may also hold extra information that someone in your organisation has chosen to tell us.
- Managing finances – We may collect personal information in relation to our finance processes such as bank details, so that we can pay you. If you do not provide us with your payment details we will not be able to pay you. In certain circumstances, such as when you engage with our finance teams, we may share information with other third parties such as debt recovery agents.
Our lawful basis for this processing is either contract or legitimate interests. If our contract is with an individual, the lawful basis will be contract, as we will be processing the data in order to fulfil our obligations under the contract with that individual. If the contract is with an organisation, we will process the personal data of the representative of that company in order to fulfil our obligations under the contract with the company and in these circumstances, we will be processing the personal data under the lawful basis of legitimate interests.
ONLINE PLATFORM USERS
The main reasons that we collect personal data regarding users who register to a platform are:
- For management and administration of user accounts, which may require sharing personal data with third parties who administer, support or maintain the platforms.
- For reporting of metrics as necessary for example to improve the performance of the platform and the service provided.
- We may contact you to invite you to take part in surveys from time to time on the utility of the platform and invite you to take part in a case study. The purpose of this is to measure the impact that the programme is having on the progression of training, skills and expertise within the industry. Participation is entirely voluntary. The results of surveys will be retained for five years.
Our lawful basis for this processing is consent.
HOW LONG WE KEEP YOUR DATA
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal or reporting requirements.
WHERE YOUR DATA IS PROCESSED AND STORED
ATW assesses any data processor it engages in relation the processing of your personal data, including storage. As part of this assessment, we ensure that we have a relevant data processing agreement in place.
We do not normally transfer any personal data outside of the UK or the European Economic Area (EEA). If we do, we will take appropriate technical and organisational measures to safeguard your personal information as we:
- only allow personal data to be processed in countries in respect of which the UK has adequacy regulations, together with supplementary measures, if appropriate.
- we enter into appropriate contracts which the UK have confirmed provide adequate protection for personal data (Standard Contractual Clauses were initially approved by the European Commission and have been adopted by the UK for the time being. This may change in the future and the UK may issue its own contractual clauses. For the time being, see European Commission: Model contracts for the transfer of personal data to third countries). Supplementary measures may also be implemented, if appropriate.
WHAT ARE YOUR RIGHTS?
Under the UK GDPR and the EU GDPR you have a number of rights in relation to your personal data.
Right to Access – you may request a copy of the personal information that we hold about you.
Right to Rectification – You have a right to have data corrected if you believe that the data that we hold on you is incorrect. We would love to hear from you if you feel that we have something wrong.
Right to Erasure – In some circumstances, you have the right to have data we hold on you deleted.
Right to Restrict Processing – In some circumstances you have the right to ask us to stop processing your data without deleting it from our systems. You may do this for example if you want us to hold on to it for a different purpose.
Right to Object – You have the right to object to any processing that we undertake. We will take any objections into account but may override them if we can demonstrate that we need to continue with the processing. However, if the purpose we are processing your data is purely for marketing purposes, we always respect you right to object.
Right to Transfer – You have the right to have any data that we hold on you transferred to another controller.
Automated Decision Making – You have a right not to be subject to a decision based solely on automated processing, including profiling, if the decision produces legal effects for you or similarly affects you.
In the event that you wish to exercise any of your rights or that you wish to complain about how we have handled your personal data, please contact advancedtherapieswales@wales.nhs.uk or in writing at:
Advanced Therapies Wales
Welsh Blood Service
Ely Valley Road
Pontyclun
CF72 9WB
Our Data Protection Representative will then investigate your query or complaint and work with you to resolve the matter.
If you still feel that your personal data has not been handled appropriately according to the law, you can contact Information Commissioner’s Office (ICO) and file a complaint with them. The ICO can be contacted as follows:
Information Commissioner’s Office
2nd Floor
Churchill House
Churchill Way
Cardiff
CF10 2HH
www.ico.org.uk
Telephone: 0330 414 6421