Skip to main content
Home Disclaimer and Privacy Statement

Privacy Notice, disclaimer and Terms of Use

UK NEQAS for H& I is strongly committed to protecting personal data.  This Privacy Notice explains the following:

  • Who are we
  • What information do we collect about you?
  • How we collect your information, why we need it and how we use it
  • Use of automated decision making and profiling
  • Use of cookies and other technologies
  • What legal basis we have for processing your personal data
  • When do we share personal data
  • Where do we store and process personal data
  • How we secure personal data
  • How long do we keep personal data for
  • Keeping us up to date
  • Your legal rights in relation to personal data including your rights to withdraw consent
  • How to contact us including how to make a complaint with a supervisory authority
  • How and when we review our privacy notice

We recommend you read this privacy notice thoroughly. Please contact us with any questions or concerns regarding our privacy practices. Our contact details are on our website and also contained within this Privacy Notice.

 

Who are we?

UK NEQAS for H&I is an external quality assessment provider and part of Velindre University NHS Trust. We are also part of a consortium of UK NEQAS centres based throughout the UK who provide healthcare related external quality assessment services to registered participants.

We act as a Data Controller and Data Processor in the following circumstances:

  • Data Controller – personal data collected to enable us to conduct normal business as UK NEQAS
  • Data Processor – personal data collected by other UK NEQAS centres and processed by us

Our privacy notice explains how UK NEQAS for H&I uses personal data. All references to ‘we’ or ‘us’ in this notice refer to UK NEQAS for H&I.

You can contact us via email on VelindreInformationGovernance@wales.nhs.uk

 

What information do we collect about you?

When we talk about personal data or personal information, we are only referring to information from which an individual person can be identified.  It does not include data where the identity has been removed.

Our activity across Wales, the UK and internationally are fundamental to ou success.  We collect and process information with key strategic partners across the health and care sector, blood services, academia, professional services and other funded projects.  This includes the following categories of information:

  • Identity data which includes your name and job title
  • Contact data (e mail address, telephone number)

To put this into context, it includes personal data collected as a result of:

  • Data held for the delivery of the NEQAS UK Programme
  • Completion of voluntary surveys
  • Provision of feedback
  • If you contact us

 

How we collect your information, why we need it and how we use it

When you contact us regarding the work we do, we will handle your data with the utmost care and are sensitive to the need to handle all data lawfully, fairly and transparently.
The methodology of collection varies but includes and is not exclusive to:

  • Information gathered from e-mail or written contact;
  • Information gathered from telephone contact;
  • Information gathered via the completion of an online forms within the NEQAS portal
  • Information gathered verbally or in writing at or in relation to events held by Velindre University NHS Trust

You should also be aware of our responsibilities under Freedom of Information legislation, our remit to provide information to meet internal and external audit requirements and our legal obligations (e.g. fraud prevention).

 

Use of automated decision making and profiling

The Trust does not undertake automated decision making and profiling.

 

The Use of Cookies and other technologies

This Notice lays out how and why we use cookies on the Velindre University NHS Trust site and the NEQAS portal and offers resources that will allow you to make an informed decision regarding the acceptance, rejection or deletion of any cookies that we use.

By using our website and portal, you consent to our use of cookies, so we recommend that you read through the information below. This cookies policy may change at any time, so please check it regularly.

A cookie is a small file of letters and numbers which often includes an anonymised, unique identifier. This means that it can be used to identify you without revealing your personal information. When you visit a website, it asks permission to store a cookie in the cookies section of your hard drive. Cookies are widely used on the internet to make websites work, to make them work more efficiently, or to provide information about your usage of the site to the site owner or other third parties. For example, if you add items to a shopping basket, a cookie allows the website to remember what items you’re buying, or if you log in to a website, a cookie may recognise you later on so that you do not have to put in your password again.

 

How do we use cookies?

We use cookies to improve the way our website works.  We also use third-party cookies set by Google Analytics to review our site functionality.

 

Third-party cookies

A third-party cookie is one that is associated with a different domain or website than the one that you visit. For example, on this site, we use third-party cookies built by Google to enable website analytics, but as our site is not on the Google domain, this makes their cookies “third-party” cookies. The Google Analytics cookie will recognise and count the number of people who visit our site, as well as providing other information such as how long visitors stay, where they move to on our site, and what pages receive the most visits. We cannot directly control how Google cookies behave.

 

What legal basis we have for processing your personal data

We always have a legal basis for processing personal data, the legal basis we use are as follows:

  • Where processing is necessary for the performance of a contract to which the data subject is party; or
  • Where the data subject has given consent to the processing of his or her personal data for one or more specific purposes; or
  • Where processing is necessary for compliance with a legal obligation to which we are subject; or
  • Where processing is necessary in order to protect the vital interests of the data subject or of another natural person; or
  • Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (the controller); or
  • Where processing is necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data

To put the use of the six legal basis’ we use for processing personal data in to context we will use the personal data and information we collect for the following purposes:

  • To manage our relationship with you
  • To comply with our legal and regulatory obligations
  • To deal with any feedback or complaint you may make
  • To manage financial/payment queries
  • To protect our business e.g. should it be necessary to defend any legal claim
  • To manage result submissions
  • To manage reports that we may undertake for you
  • To make suggestions and recommendations to you about the services we undertake and which may be of interest to you
  • To manage any performance issues
  • To undertake external quality assurance management activity

We must have a lawful reason for processing your personal information.  Most commonly, we will use your personal information in the following circumstances:

  • Where we need to deliver the programme or perform the contract for services we are about to enter into or have entered in to with you
  • Where we need to comply with a legal or regulatory obligation
  • Where you have given your consent to process your personal information

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. Information is only held for as long as there is a legitimate reason to do so, information that is no longer required is destroyed in such a way that it cannot be reconstructed. If you wish to obtain an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

 

When do we share personal data?

Disclosure of Information for legal or regulatory purposes

We may need to disclose your information to a third party as part of ongoing programme management and audit requirements.

Additionally, as part of our remit to conduct due diligence we may also need to release information to progress governance checks for specific requirements, programmes, other parties (or projects. We will carry out this process lawfully, proportionately and securely).

Third parties include:

  • External advisors and consultants directly engaged with programme/project delivery (please note that all advisors/consultants are bound by confidentiality requirements in their contracts);
  • Organisations who are partners with the UK NEQAS scheme
  • Our professional advisers e.g. lawyers, bankers, accountants
  • Third party service providers who provide administrative and support services to us
  • HMRC
  • If you choose to have samples delivered using a courier service it is necessary to share relevant contact details with an approved courier to allow them to deliver the samples and so they may contact you in the event of an issue with delivery.
  • If you register for UK NEQAS for H&I services through a 3rdparty agent or distributor it may be necessary to share your details with the agent/distributor and vice-versa to confirm the external quality assessment arrangements for samples and payments.
  • There are some occasions where we have a duty to share your information, e.g. with the National Quality Assurance Advisory Panels (NQAAPs) for performance monitoring of laboratories in the UK.

We will ensure that if information is required to be shared, then it will be shared securely, and you will be informed that we have shared it, who we have shared it with and how we shared it.

 

Where do we store and process personal data?

Personal data is stored with NHS Wales electronic systems and the NEQAS portal.  we undertake regular security reviews of all our platforms and conduct risk assessments as required under Article 35 of the EU GDPR and Chapter 2 of the Data Protection Act 2018 (UK GDPR) to comply with our duty as a Data Controller.    Please contact our Data Protection Officer for further information should you wish to understand how your data is processed.

 

How do we secure personal data?

We have in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised manner or otherwise used or disclosed.

To achieve this, we use encrypted secure technology to protect all personal information stored by us.  We operate up to date and regularly review policies for Data Protection, Information Governance, Password Policy, Information Security and Business Continuity (including Risk Assessments via the DPIA process and individual risk assessments) to support our business processes and to ensure that all personnel are aware of the importance of data security.

Access to information is permitted on a need to know basis.

 

How long do we keep your personal data for?

We only keep and process personal data for as long as there is a contractual or business requirement to do so or we are otherwise obliged to keep the same under any contractual, regulatory or legal requirement.  Once the requirement has expired, the information is deleted safely and securely from our systems in such a way that Information which is deleted is done so in accordance with current security regulations.

 

Keeping us up to date

As part of our responsibility to ensure that information we hold about you is up to date, we rely on you to keep us updated.  We request that where any of your details change, that you inform us so that we may update out records accordingly.

 

Your legal rights in relation to personal data including your rights to withdraw consent 

As a data subject, you have rights in relation to your Personal data. These are:

  • You have a right to access your personal information,
  • You have a right for incorrect information held about you to be rectified
  • You have a right for information which you no long wish us to hold to be erased (also known as the right to be forgotten)
  • You have a right for the processing of your information to be restricted
  • You have a right to data portability – for your personal information to be transported in a structured, commonly used, recognisable format
  • You have a right to object to the processing of your personal information,
  • You have a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you.

You also have the right to make a Subject Access Request. As part of this process you will be able to ascertain:

  • Whether or not your data is processed, and if so why
  • The categories of personal data concerned
  • The source of the data if you have not provided the original data
  • To whom your data may be disclosed, including outside the EEA and the safeguards that apply to such transfers.

We reserve the right to validate your identity prior to release of information.
We will not make any charges for such requests, unless the requests made repeatedly and are considered excessive.  We will respond to you request within 1 month of the date of request.

If you have provided consent to UK NEQAS to process any of your data, then you also have a right to withdraw that consent unless we are contractually or legally obligated to retain data.

In cases where we do not need to retain data for contractual or legal reasons, we will delete the data as soon as possible and at the very least within 28 days.

 

How to contact us, including how to make a complaint with a supervisory authority

You can contact UK NEQAS for H&I via a number of different routes.  We will deal with your enquiry in the same way regardless of how you choose to contact us.  For further information on how we process your data, please contact us in writing at:

UK NEQAS for H&I
Welsh Blood Service
Ely Valley Road
Talbot Green
CF72 9WB
Telephone: 01443 622185
E-mail: ukneqashandi@wales.nhs.uk

Alternatively, please contact our Data Protection Officer at: –
Velindre University NHS Trust
Unit 2 Charnwood Court
Parc Nantgarw
Nantgarw
Cardiff
CF15 7QZ
Email: VelindreInformationGovernance@wales.nhs.uk

For independent advice about data protection, privacy and data-sharing issues, or if you should ever be dissatisfied with the way we have handled or shared your personal data you can contact the Information Commissioners Office (ICO) at:

 

ICO Wales contact details

Information Commissioner’s Office – Wales
2nd Floor, Churchill House
Churchill Way
Cardiff
CF10 2HH
Telephone: 029 2067 8400
Fax: 029 2067 8399
Email: wales@ico.org.uk

ICO Head office details

Information Commissioner’s Office – Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113 or 01625 545745
Fax: 01625 524510
Website: www.ico.gov.uk

 

Review of the Privacy Notice

We regularly review all of our policies and procedures, we will post updates on our documentation and webpage, this Privacy Notice was last reviewed and amended on 17th February 2023

 

Disclaimer

Care is taken to ensure that the website content is accurate. Nevertheless, content is provided for general information only, and you use it at your own risk. We will not be held liable for damage or loss ensuing from any act or omission resulting from the use of information on this website.

 

Terms of Use

Permitted Use
Visitors to the UK National External Quality Assessment Service for Histocompatibility and Immunogenetics (this website) are granted permission to access published materials (content) subject to these terms. By using the website, you agree to be bound by the terms of use.

Whilst content may be accessed, downloaded and used for personal and non-commercial purposes (e.g. private research, study or in-house use); visitors must not reproduce or re-publish any material from this website without permission from the website / copyright owner.

All trademarks displayed on this site are either owned or used under license by the UK National External Quality Assessment Service for Histocompatibility and Immunogenetics and its affiliates. Without limitation, these include the brand names, images and strap lines and the logos. The unauthorized use of any trademark on this site is strictly prohibited
You acknowledge that all intellectual property rights relating to this website belong to UK National External Quality Assessment Service for Histocompatibility and Immunogenetics and where applicable, third party associates.

 

Virus Protection

We make every effort to check and test material for viruses. However, it is recommended that you run an anti-virus program on all materials downloaded from the internet. We cannot accept responsibility for any loss, disruption or damage to your data or computer system which may occur whilst using material derived from this website.

 

External/Linked Websites

UK National External Quality Assessment Service for Histocompatibility and Immunogenetics is not responsible for the content or reliability of any linked websites. We accept no liability in respect of the content or for the consequences of following any advice included on such sites.

Listing should not be taken as an endorsement of any kind.

We cannot guarantee that these links will work all of the time and have no control over the availability of the linked pages or change of website address.

UK National External Quality Assessment Service for Histocompatibility and Immunogenetics reserves the right to reject or remove links to any website.

 

Future Amendments

This website is controlled by UK National External Quality Assessment Service for Histocompatibility and Immunogenetics located at:

Ely Valley Road
Talbot Green
Pontyclun
CF72 9WB

The information provided on this web site is for general information purposes and is correct at the time of publication. We reserve the right to make changes to the web site as appropriate from time to time.