Privacy Policy REWILD GOWER GDPR & CONFIDENTIALITY POLICY Organisation: ReWild Gower Location: South Gower, South Wales Date: Dec 2025 Review Date: Dec 2026 1. POLICY STATEMENT ReWild Gower is committed to protecting the privacy, confidentiality, and personal data of all participants, families, staff, volunteers, and partners. We comply with: •UK GDPR (General Data Protection Regulation) •Data Protection Act 2018 Personal information is collected only when necessary and is stored securely, used responsibly, and never shared without appropriate consent unless legally required. 2. SCOPE OF THIS POLICY This policy applies to all individuals involved with ReWild Gower, including: •participants and clients •parents or guardians •staff •volunteers •contractors •partner organisations It applies to all formats of information including: •paper records •digital records •emails •photos or videos •health and safeguarding information 3. WHAT PERSONAL DATA WE COLLECT ReWild Gower may collect the following information when necessary for delivering services safely and effectively. PARTICIPANT INFORMATION •name •date of birth •contact details •emergency contact details •relevant medical information •allergies •additional needs information •consent forms •attendance records PARENT / GUARDIAN INFORMATION •names •phone numbers •email addresses •emergency contacts STAFF AND VOLUNTEER INFORMATION •contact details •DBS checks •safeguarding training records •employment or volunteer agreements MEDIA With consent we may collect: •photographs •videos •testimonials These may be used for promotional purposes such as websites or social media. 4. HOW WE USE PERSONAL DATA Personal information is used only for legitimate purposes, including: •registering participants •ensuring safety and wellbeing •responding to medical or emergency situations •safeguarding responsibilities •communicating about sessions, events, or bookings •managing staff or volunteer roles •improving services •meeting legal or insurance requirements We only collect the minimum data necessary. 5. LAWFUL BASIS FOR PROCESSING DATA Under UK GDPR, ReWild Gower processes personal data under the following lawful bases: •Consent – when individuals agree to provide information •Legitimate interest – to safely deliver services •Legal obligation – safeguarding and regulatory compliance •Vital interests – protecting someone's health or safety 6. CONFIDENTIALITY All personal information shared with ReWild Gower will be treated as confidential. Staff and volunteers must: •respect the privacy of participants and families •only access information necessary for their role •not share personal information outside the organisation •store information securely •follow safeguarding procedures if concerns arise Confidential information will only be shared when necessary, including: •safeguarding concerns •medical emergencies •legal obligations Where possible, individuals will be informed before information is shared. 7. DATA STORAGE AND SECURITY ReWild Gower takes appropriate measures to protect personal data. DIGITAL DATA Stored securely using: •password-protected devices •secure cloud storage where applicable •restricted access PAPER RECORDS Stored: •in secure folders •in locked storage where possible •only accessible to authorised personnel 8. DATA RETENTION Personal data will only be kept for as long as necessary. Typical retention periods: •Participant records: up to 7 years •Accident or incident reports: minimum 7 years •Safeguarding records: as required by safeguarding guidance •Staff records: 6 years after employment ends After this period, data will be securely destroyed. 9. PHOTOGRAPHY AND MEDIA ReWild Gower will always request explicit consent before using photographs or videos. Participants or parents may choose: •consent for internal use only •consent for website/social media use •no consent Images will never include personal identifying details unless permission is granted. 10. YOUR DATA RIGHTS Under UK GDPR, individuals have the right to: •access their personal data •request corrections to inaccurate data •request deletion of their data •restrict processing •withdraw consent at any time •lodge a complaint with the Information Commissioner’s Office (ICO) Requests can be made by contacting ReWild Gower directly. 11. DATA BREACHES If a data breach occurs that may affect personal information: 1.The breach will be investigated immediately. 2.Steps will be taken to secure the data. 3.Affected individuals will be informed if necessary. 4.The ICO will be notified where legally required. 12. SAFEGUARDING AND CONFIDENTIALITY LIMITS Confidentiality cannot be guaranteed if information suggests: •a child or vulnerable person is at risk •someone is at risk of serious harm •a legal requirement to share information exists In these cases, information may be shared with appropriate safeguarding authorities. 13. RESPONSIBILITY The responsibility for data protection within ReWild Gower sits with the organisation lead. They are responsible for: •ensuring compliance with GDPR •maintaining secure records •responding to data requests •reviewing this policy annually