Privacy and data protection.

General and fundraising enquiries

Information we collect

• Your name and email address.
• Your phone number, if you choose to provide it.
• The enquiry topic you select and the message you submit.
• Technical information used to operate and protect the form, such as IP address, browser or user-agent information, page URL and submission time.

Please do not submit medical information or other special-category personal information through a general or fundraising enquiry form.

Why we use it

We use the information to respond to your enquiry, send it to the appropriate person, follow up where needed, discuss fundraising, community or corporate support, and protect the forms from spam or misuse.

Our lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR. Our legitimate interests are responding to an enquiry that you have chosen to send, managing fundraising and supporter relationships, and maintaining a secure, reliable website. We do not add people who submit these forms to a direct-marketing list.

How long we keep it

If an enquiry does not progress, we keep the form response and notification emails for no longer than 12 months after our last meaningful contact, then delete them. Spam and information that is no longer needed may be removed sooner.

If an enquiry develops into an ongoing fundraising activity, partnership or other relationship, we may keep relevant correspondence for as long as needed to manage that relationship and meet legal or accounting obligations. We will provide further privacy information before using personal information for a materially different purpose.

Volunteer enquiries

Information we collect

• Your name and email address.
• Your phone number and town or local area, if you choose to provide them.
• The volunteer roles that interest you and the experience or message you submit.
• Technical information used to operate and protect the form, such as IP address, browser or user-agent information, page URL and submission time.

Please do not submit medical information or other special-category personal information through the volunteer-interest form.

Why we use it

We use the information to respond to your enquiry, understand the roles that may suit you, arrange appropriate next steps and protect the form from spam or misuse.

Our lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR. Our legitimate interests are responding to an enquiry that you have chosen to send, managing expressions of volunteer interest and maintaining a secure, reliable website. We limit collection to information that is useful for this initial conversation and do not use the form submission for direct marketing.

Who receives the information

Access is limited to authorised people supporting Wish Ambulance Scotland and service providers that help us operate the website, email, forms, fundraising, payments and prize draws.

Depending on how you engage with us, recipients may include Automattic, Crowdfunder, Zeffy, Stripe, our email provider and organisations needed to deliver a prize, such as an event or ticketing provider. We may also disclose limited information to professional advisers, regulators, the Advertising Standards Authority, law-enforcement bodies or other public authorities where this is necessary and lawful.

The forms are provided by WordPress and Jetpack. Akismet checks submissions for spam. These services are operated by Automattic. Form responses are stored in the website database and notification copies are sent by email. We do not sell personal information.

Learn more in Automattic’s Privacy Notice and Cookie Policy.

International processing

Automattic may process information in the United Kingdom, European Union and United States. Zeffy is based in Quebec, Canada, and Zeffy and its service providers may process information in Canada, the United States and other countries. Where Wish Ambulance Scotland makes a restricted international transfer, we use an applicable UK adequacy arrangement or appropriate contractual safeguards. Automattic and Zeffy provide further information about their processing and transfer arrangements in their privacy documentation.

How long we keep volunteer enquiries

If an enquiry does not progress, we keep the form response and notification emails for no longer than 12 months after our last meaningful contact, then delete them. Spam and information that is no longer needed may be removed sooner.

If you progress to a formal volunteer application or onboarding, we will explain any additional information needed and provide further privacy information before collecting it. The initial enquiry may then become part of those separate volunteer records.

Your rights

Depending on the circumstances, you may have the right to ask for access to your information, correction, deletion, restriction of use, data portability, or to object to processing based on legitimate interests. These rights are not absolute, but we will respond in accordance with data-protection law.

To make a request, email support@wishambulancescotland.co.uk. You can also complain to the Information Commissioner’s Office.

Automated processing

We do not use automated decision-making to decide the outcome of general, fundraising or volunteer enquiries. A verifiably random computer process may be used to select a prize-draw winner from all eligible entries. Selection is by chance and is not based on profiling or an assessment of personal characteristics. An authorised person verifies the result and the winner’s eligibility before awarding the prize. Akismet uses automated checks to identify likely spam, which may prevent a spam submission from reaching our inbox.

Website analytics and Google

Google Site Kit places the Google tag on this website for Google Analytics. It is used to understand aggregated visits, page use and website performance so that we can improve the site. We do not use this optional analytics choice to enable advertising or personalisation.

The Google tag starts with analytics storage denied. If you accept optional analytics, Google may process online identifiers and information about your visit, including your IP address, approximate location, page URL, browser and device details, and interaction and performance information. Our lawful basis for optional analytics is your consent under Article 6(1)(a) of the UK GDPR.

When analytics storage is denied, Google Consent Mode may still send Google limited cookie-free signals about the consent state and page context for consent and aggregate measurement. Google says these signals do not use analytics cookies. Advertising storage, advertising user data and advertising personalisation remain denied.

Your choice is sent to the WordPress Consent API and Google Consent Mode. You can withdraw consent at any time by opening Cookie preferences, turning off optional website analytics and saving. Withdrawal stops future analytics storage and the site removes known first-party analytics cookies that it can access. It does not affect processing that was lawful before withdrawal.

Google may process information outside the United Kingdom and describes its safeguards, retention and use of information in the Google Privacy Policy and Google Business Data Responsibility information.

Crowdfunder widget and donations

The Support Us page contains an embedded Crowdfunder donation widget. When the widget loads, your browser connects directly to Crowdfunder and its content delivery provider. Crowdfunder may automatically receive technical and usage information, including your IP address, browser and device information, the page visited, and the date and time, and may use cookies or similar technologies.

If you select a donation amount or continue to Crowdfunder, you leave our website and Crowdfunder is responsible for the personal and payment information you provide there. Crowdfunder may provide Wish Ambulance Scotland with limited supporter and donation information so we can administer and account for donations and respond to related enquiries. Payment details are entered on Crowdfunder, not on this website.

Read Crowdfunder’s Privacy Policy and Cookie Policy before using the widget or donating.

Zeffy fundraising and prize draws

We use Zeffy to host some donation and fundraising forms and to process online entries and payments for prize draws. This may include the 500 Wishes campaign, community fundraising and event or prize-draw pages. When you follow a link to Zeffy, you leave this website and use a service operated by Zeffy.

Information we collect

• Your name, email address, telephone number and, where needed, postal address.
• The campaign or prize draw, number and route of entries, date and time, payment status, transaction or entry reference and amount paid.
• Information needed to confirm age, residence or other eligibility, but only where verification is reasonably necessary.
• Information contained in a free postal entry, together with communications, complaints and records relating to winner contact and prize fulfilment.

Full card and bank-account details are handled by Zeffy and its payment provider, Stripe. Wish Ambulance Scotland does not receive or store complete payment-card details.

Why we use it

We use this information to process donations, administer paid and free prize-draw entries, check eligibility, prevent duplicate or fraudulent entries, reconcile entry records, conduct and evidence a random draw, contact a winner, deliver a prize, handle complaints and meet legal, regulatory and accounting obligations.

Depending on the activity, our lawful bases are performance of a contract under Article 6(1)(b) of the UK GDPR, compliance with a legal obligation under Article 6(1)(c), and our legitimate interests under Article 6(1)(f) in administering fundraising fairly, preventing fraud, maintaining an auditable record and protecting the charity’s legal interests.

Paid and free prize-draw entries

Valid paid and free entries are placed into the same winner-selection process. We record the entry route only where needed to reconcile and verify entries; the route used does not give an entry preferential treatment in the random draw.

Winner information

If you win, we use your contact and eligibility information to notify you and arrange the prize. We may publish or make available limited information showing that a valid award took place, as explained in the applicable terms and conditions. Entrants may object to publication or ask us to reduce the information made available. We may still provide relevant winner information to the Advertising Standards Authority if challenged. Any wider publicity, photograph, interview or story will require separate agreement.

Marketing choices

Entering a prize draw, making a donation or submitting an enquiry does not automatically add you to a marketing list. If we invite you to receive future updates, that choice will be separate, optional and unticked by default. Where we rely on consent, you can withdraw it at any time.

Retention

We ordinarily keep prize-draw entry, selection, winner-contact and complaint records for up to 12 months after the draw closes, then delete or anonymise them unless a longer period is needed for legal, accounting, fraud-prevention or dispute purposes. Financial transaction records are retained for the period required by law. Original postal entries are stored securely and destroyed when they are no longer needed for administration, audit or a complaint. Copies of identity or eligibility evidence are deleted when verification, prize fulfilment and any related dispute are complete, unless continued retention is required by law.

Zeffy, Stripe and international processing

Zeffy is responsible for information it collects directly on its platform and may share with Wish Ambulance Scotland the supporter, entry and transaction information needed to administer the relevant activity. Stripe handles payment information under its own privacy arrangements. Zeffy and its service providers may process information outside the United Kingdom. Read Zeffy’s Privacy Policy and Stripe’s Privacy Policy for further details.

Zeffy may use cookies or similar technology on its own pages. The Cookie preferences control on this website applies to Wish Ambulance Scotland’s website and does not control cookies placed on Zeffy’s platform.

Security, cookies and changes

We use appropriate technical and organisational measures to protect personal information, including HTTPS, restricted administrative access and limiting access to people who need the information for their role. Paper postal entries are kept securely with restricted access and are confidentially destroyed when no longer required. Payment-card information is handled by Zeffy, Stripe or another identified payment provider; Wish Ambulance Scotland does not receive or store full card details. No internet, email or postal system is completely secure, so please do not send payment-card information, identity documents, medical information or other sensitive information unless we have specifically requested it through an appropriate method.

Necessary WordPress and Jetpack technology may use cookies or similar technologies to operate and secure the website. Optional Google Analytics, Jetpack Stats and WordPress.com performance measurement are controlled through Cookie preferences. See the Google information above and Automattic’s Cookie Policy for details.

We will review this notice and update it when our processing changes. The date at the top shows the latest revision.