The IBD Registry is closing current activities by Easter 2024, and is in discussions through Spring 2024 about possible transition to an NHS organisation. See our Closure Announcement, Data Transfer Update, Closure FAQs and Achievements. 

IBD Registry Website Privacy Statement

This privacy statement is about the personal information we may collect about you when communicating with you.  We want you to understand why we hold and process this information and let you know what your choices are.  Please read this statement carefully and ensure that you understand it. Your acceptance is deemed to occur upon your first use of our Registry website. If you do not accept and agree with this privacy policy, you should stop using our Registry website immediately.

We act as the Data Controller for personal data that you submit to us, and protect that data in accordance with all relevant laws.

Our Registry website is owned by us and operated by us.

What does this policy cover?

This privacy policy applies to your use of our Registry website and contact you make with us for information on this website and the newsletter from this website.

Our Registry website may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites and we advise you to check the privacy policies of any such websites before providing any data to them.

Your rights

You have the following rights under the GDPR, which this privacy policy and our use of personal data have been designed to uphold:

  • The right to be informed about our collection and use of personal data;
  • The right of access to the personal data we hold about you;
  • The right to rectification if any personal data we hold about you is inaccurate or incomplete ;
  • The right to be forgotten – i.e. the right to ask us to delete any personal data we hold about you (we only hold your personal data for a limited time, as explained below but if you would like us to delete it sooner, please contact us using the details in section 12);
  • The right to restrict (i.e. prevent) the processing of your personal data;
  • The right to object to us using your personal data for particular purposes;

There are other data protection rights such as the right to data portability (obtaining a copy of your personal data to re-use with another service or organisation) and rights with respect to automated decision making and profiling.  However, these are not relevant to the processing we undertake and so we have not included it in the list above.

If you wish to find out more about how you can exercise these rights or if you have any cause for complaint about our use of your personal data, please contact us, or use the details below, and we will do our best to resolve the problem for you. You can request access to and/or deletion of your personal data using our Data Subjects Rights Portal.

If we are unable to help, you also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office. You can find out more here.

For further information about your rights, please contact the Information Commissioner’s Office or your local Citizens Advice office.

What data do we collect on our Registry website?

We have to define some key terms so that it is clear what we mean in key instances:

 

“Cookie” means a small text file placed on your computer or device by our Registry website when you visit certain parts of our Registry website and/or when you use certain features of our Registry website. Details of the Cookies used by our Registry website are set out in section 11, below;
“Cookie Law”
 means the relevant parts of the privacy and Electronic Communications (EC Directive) Regulations 2003;
“personal data”
 means any and all data that relates to an identifiable person who can be directly or indirectly identified from that data. In this case, it means personal data that you give to us via our Registry website. This definition shall, where applicable, incorporate the definitions provided in the Data Protection Act 2018 which incorporates the EU Regulation 2016/679 – the General Data Protection Regulation (“GDPR”); and
“We/Us/Our” means IBD Registry Ltd, a company limited by guarantee registered in England under company number 11197749, whose registered address is 3 St Andrews Place, Regent’s Park, London NW1 4LB

Depending upon your use of our Registry website, we may collect some or all of the following personal data, primarily through our mailing list opt-in page

  • The information we collect for our mailing list are first name, last name and email address.
  • If you use the email address provided by us on our website to contact us, we will store that information for the purpose of replying to you. (Your email address may include your name and your organisation, which is personal data).

We collect this information so that we can provide you with the services you are seeking.  The Mailing List opt-in explicitly asks for your consent for this, which is our lawful basis for processing this information about you.

We also use Cookies and similar technologies, and also Website Analytics (please see our Cookie Policy for more information on this)

We collect this information so that we can provide you with the services you are seeking.  This means it is necessary for our ‘legitimate interest’.  As such our lawful basis for processing this information about you is Article 6 (f):

processing is necessary for the purposes of the legitimate interests pursued by a controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

How do we collect and use your data when communicating with you?

We collect and use your personal Data for the following purposes and using the following services:

Mailing list management: we use the Mailchimp service to manage our mailing list, including new user ‘opt-in’ and ‘unsubscribe’ functions.

Website analytics: We use the Google Analytics services to enable us to monitor and analyse web traffic and they can be used to keep track of user behaviour.

Responding to your queries: if you contact us directly using the information on our website or in our newsletters and similar mailings, we will use the personal data (email address and your name) to respond to you.

All personal data is processed and stored securely, for no longer than is necessary in light of the reason(s) for which it was first collected. We retain personal data that you provide to us for news and updates on an ongoing period, as long as the newsletters (or similar) are continuing.  We retain personal data for replying to you for the reasonable duration of the conversation.

You will be asked for your consent for the IBD Registry using your personal data to send you emails.  Please remember, you have the right to withdraw your consent to at any time (this is also on the bottom of every Mailchimp email), and to request that we delete it.

How and where do we store your data?

We only keep your personal data for as long as we need to in order to use it as described above and/or for as long as we have your permission to keep it.

MailChimp data is stored in the USA, which is legally compliant via its “standard contractual clauses”, applicable if you have subscribed to our Mailing list. Otherwise, your data will only be stored within the European Economic Area (“the EEA”) (The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein).

Do we share your data?

We will not share any of your data with any third parties for any purposes, unless we have sought you express permission to do so.

In certain circumstances, we may be legally required to share certain data held by us, which may include your personal data, for example, where we are involved in legal proceedings, where we are complying with legal obligations, a court order, or a governmental authority.

We may compile statistics about the use of our Registry website including data on traffic, usage patterns, user numbers, sales, and other information. All such data will be anonymised and will not include any personally identifying data, or any anonymised data that can be combined with other data and used to identify you.

The third party processors used by us are Mailchimp (mailing provider) who hold data in the USA, WordPress (website content management) and Google Analytics (website usage), both of which hold the data located inside the EEA.

How can you control your data?

When you submit personal data via our Registry website, we give you options to restrict our use of your data. You can opt-out of receiving emails from us at any time by using the unsubscribe link provided in our Mailchimp emails, or by contacting us directly by email requesting to opt-out. These are in addition to your rights under the GDPR.

Your right to withhold information

You may access all of our Registry website without providing any data at all.

You may restrict our use of Cookies. For more information see our Cookie Policy.

How can you access your data?

You have the right to ask for a copy of any of your personal data held by us (where such data is held). We will provide any and all information in response to your request free of charge. Please contact us for more details at our email address given at the top of this policy or using the contact details below.

Our use of Cookies

Our Registry website may place and access certain first party Cookies on your computer or device. We use Cookies to facilitate and improve your experience of our Registry website and to provide and improve our services. We have carefully chosen these Cookies and have taken steps to ensure that your privacy and personal data is protected and respected at all times.

All Cookies used by and on our Registry website are used in accordance with current Cookie Law.

All our cookie related information is included in our Cookie Policy.

Contacting us

If you have any questions about our Registry website or this privacy policy, please contact us

If your contact is a request for information about the data we hold about you please state clearly that it is a subject access request.

Changes to our Privacy Policy

We may change this privacy policy from time to time (for example, if the law changes). Any changes will be immediately posted on our Registry website and you will be deemed to have accepted the terms of the privacy policy on your first use of our Registry website following the alterations. We recommend that you check this page regularly to keep up-to-date.