Wheels for Wellbeing Privacy Notice
This notice applies to our services, cycling activities, campaigns, fundraising, communications, website and other charitable work.
| We want you to understand what information we collect, why we need it and what choices you have. We only use personal information where we have a lawful reason to do so. |
- Who we are
Wheels for Wellbeing (WfW) is the data controller for the personal information described in this notice. We are a charity registered in England and Wales (No. 1120905) and a company limited by guarantee (No. 06288610).
Address: 336 Brixton Road, London, SW9 7AA
Email: info@wheelsforwellbeing.org.uk Telephone: 020 7346 8482
You can contact our Data Protection Officer using the details above. Please put “Data protection” in the email subject line or on the envelope.
- Who this notice covers
This notice covers people who use or enquire about our services, cycling sessions or cycle-loan schemes; campaign supporters; donors and fundraisers; volunteers; event attendees; people appearing in photographs, recordings or case studies; website visitors; suppliers, partners and professional contacts.
We provide separate privacy information where a particular activity needs more detail, including recruitment, employment, safeguarding, research, children’s services or a specific project. That additional notice should be read together with this notice.
- Information we may collect
- Identity and contact information, such as your name, address, email address, telephone number and emergency contact.
- Service and participation information, such as bookings, attendance, cycle requirements, support needs, feedback, enquiries and correspondence.
- Health, disability and access information needed to provide safe, accessible and appropriate services.
- Safeguarding, accident, incident, complaint and insurance information where relevant.
- Donation, fundraising and payment information. Card details are normally processed directly by our payment provider and are not stored by WfW.
- Campaign, survey, consultation and research responses, including opinions and experiences you choose to share.
- Photographs, video, audio, case studies and the permissions or restrictions connected with them.
- Volunteer, supplier and professional-contact information.
- Technical information about use of our website, such as IP address, browser information and cookie choices.
Information received from other people
We usually collect information directly from you. We may also receive it from a family member, carer, support worker, referring organisation, local authority, healthcare or social-care professional, fundraising platform, event partner or publicly available source. Where appropriate, we will tell you about the source.
- Why we use personal information and our lawful bases
The lawful basis depends on the activity. The table below gives a concise summary. More than one basis may apply.
| Purpose | Examples | Usual lawful basis |
| Provide and manage services | Enquiries, bookings, sessions, cycle loans, access arrangements and communication with you. | Contract or steps at your request; legitimate interests; legal obligation; vital interests in an emergency. |
| Keep people safe | Risk assessment, emergency contacts, safeguarding, accidents, incidents and insurance. | Legal obligation; legitimate interests; vital interests; substantial public interest where applicable. |
| Campaign and demonstrate impact | Surveys, consultations, case studies, photographs, video, research and reports. | Consent, including explicit consent where required; legitimate interests for appropriately anonymised or low-risk organisational reporting. |
| Fundraise and administer donations | Processing donations, Gift Aid, supporter records and fundraising communications. | Contract; legal obligation; legitimate interests; consent for electronic marketing where required. |
| Run and improve WfW | Service evaluation, complaints, governance, audit, security, fraud prevention and planning. | Legal obligation and legitimate interests. |
| Communicate and promote our work | Newsletters, campaign updates, events and other communications. | Consent or another permission allowed by electronic-marketing law. Every marketing email provides an unsubscribe option. |
| Operate our website | Security, essential functions, preferences and analytics. | Legitimate interests for security and essential operation; consent for non-essential cookies. |
Our legitimate interests
Where we rely on legitimate interests, these include operating and improving our charity, providing accessible services, responding to enquiries, maintaining records, protecting people and systems, demonstrating impact and promoting our charitable aims. We consider the effect on your rights and do not use this basis where your interests override ours.
- Health, disability and other sensitive information
Health and disability information is special category data. We only collect it where it is relevant, and we restrict access to people who need it. In addition to an Article 6 lawful basis, we rely on an appropriate special-category condition. This may include your explicit consent, protecting vital interests, employment and social-protection obligations, safeguarding or another substantial-public-interest condition permitted by law.
Where we rely on explicit consent, you may withdraw it at any time. Withdrawal does not make earlier lawful use invalid, but we will stop future consent-based processing as soon as reasonably possible.
- Photographs, video, audio and case studies
We use identifiable images, recordings and personal stories only where we have an appropriate lawful basis and have provided clear information about the intended uses. Where the material reveals health or disability information, we obtain explicit consent unless another lawful condition clearly applies.
- You can choose whether your full name, first name or no name is published.
- You may set reasonable restrictions, such as not showing your home, precise location, family members or particular medical details.
- Approved photographers, videographers and communications suppliers may handle material for us under written confidentiality, security and data-protection requirements.
- Consent may have no fixed end date, but we keep it under review. You can withdraw consent for future use.
- We may not be able to retrieve printed material, broadcasts, archived publications, or copies already shared or downloaded by other people.
- Children and people who need support
We use clear, age-appropriate privacy information when we collect information about children. Where required, we obtain permission from a person with parental responsibility, while also involving the child and respecting their views and ability to understand. We may provide information in an alternative format or support someone to understand it.
- Who we share information with
We do not sell personal information. We may share relevant information with:
- IT, cloud-hosting, database, website, email, payment, booking and file-storage providers acting for us;
- photographers, videographers, designers, printers, researchers and other approved suppliers;
- funders, auditors and professional advisers, normally using anonymised or aggregated information where possible;
- delivery partners, venues, referral organisations and local authorities where necessary for the service or project;
- HM Revenue and Customs and other regulators where required;
- insurers, emergency services, safeguarding bodies, the police or courts where necessary to protect someone, manage an incident or comply with law;
- journalists, broadcasters, partners or the public where you have agreed to external publicity or public Photobank use.
Suppliers acting as processors may only use information on our instructions and must protect it. Where another organisation decides its own purposes, it is responsible for its own privacy information.
- International transfers
Some service providers may store or access personal information outside the UK. When this happens, we use a transfer permitted by UK data-protection law, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, or approved contractual safeguards. You may contact us for more information about the safeguards used for a particular transfer.
- How long we keep information
We keep personal information only for as long as it is needed for the purpose for which it was collected and to meet legal, safeguarding, insurance, contractual, funding, tax and accounting requirements. We use a retention schedule and securely delete or anonymise information when it is no longer required.
- Financial and Gift Aid records are retained for the period required by tax and accounting law.
- Accident, safeguarding, insurance and legal records may need to be kept for longer because a concern or claim can arise later.
- Consent records are kept while the related material is in use and afterwards where needed to show and respect your choices.
- Marketing information is kept until you unsubscribe or object, after which we may retain a minimal suppression record so that we do not contact you again.
You may ask us for the retention period that applies to a particular record.
- Security
We use proportionate organisational and technical measures to protect personal information, including access controls, staff training, secure systems, supplier checks, backups and incident-response procedures. No system can be guaranteed completely secure, but we act promptly if a personal-data breach occurs.
- Your rights
Depending on the circumstances and lawful basis, you may have the right to:
- ask for a copy of your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information or restrict how it is used;
- object to processing based on legitimate interests;
- receive certain information in a portable format;
- withdraw consent at any time;
- object to direct marketing at any time;
- ask for human involvement where a significant decision is made solely by automated means.
| Your right to object: You have an absolute right to object to direct marketing. You may also object to processing based on legitimate interests. Email info@wheelsforwellbeing.org.uk and tell us what you want us to stop. |
Rights are not absolute and an exemption may apply. We normally respond within one month. We do not usually charge a fee, but the law allows a reasonable fee or refusal where a request is manifestly unfounded or excessive.
- Complaints
Please contact our Data Protection Officer first so that we can try to resolve your concern. You also have the right to complain to the Information Commissioner’s Office (ICO).
ICO website: ico.org.uk/make-a-complaint Helpline: 0303 123 1113
- Cookies and website information
Our website uses cookies and similar technologies. Strictly necessary cookies support security and core functions. We will ask for consent before placing non-essential analytics, advertising or similar cookies. You can accept, reject or change your choices through our cookie settings.
Our separate Cookie Notice should list the cookies currently used, their providers, purposes and duration. Third-party content, such as embedded video, maps, donation tools or social-media features, may set cookies when enabled.
Our website may contain links to other organisations. Their websites and privacy practices are outside our control, so please read their privacy information.
- Changes to this notice
We review this notice regularly and update it when our activities, suppliers or the law change. The current version will be published on our website. Significant changes will be highlighted where appropriate.
Last updated: August 2026