The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 2018 (the Act). In order to deliver our services North Wales Fire and Rescue Service (NWFRS) may need to process your personal data.

NWFRS is committed to treating your personal data lawfully and this privacy notice explains how we do this. We update this notice from time to time to reflect any changes to our service.

At the bottom of this page there is a link to additional, more specific privacy notices which relate more to individual departments which may be relevant to you.

The Chief Fire Officer of North Wales Fire and Rescue Service is registered as a ‘data controller’ with the Information Commissioners Office (ICO) and is responsible for ensuring the service handles all personal data in accordance with law.

This privacy notice explains:

• how we collect, store, use, disclose, retain and destroy personal data, including through our website.
• the steps we take to ensure personal data we process is protected.
• the rights individuals have when we process their personal data.
• The types of data we process

Our Contact Details and Data Protection Officer

You can contact our Data Protection Officer if you have any questions or concerns about how we process your personal data.

Post:

Data Protection Officer
North Wales Fire and Rescue Service HQ
Ffordd Salesbury
St Asaph Business Park
St Asaph
Denbighshire
LL 17 0JJ

Email: dpo@northwalesfire.gov.wales

What is personal data?

Personal data is any information that relates to an identified or identifiable natural person. An 'identifiable natural person' is anyone who can be identified, directly or indirectly from information, including by reference to a name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Why do we process your personal data?

To deliver public services and enable us to fulfil our statutory obligations.  This includes responding to incidents such as fires, floods, road traffic collisions and other emergencies.

We also process personal data for purposes in support of the safety and wellbeing of our staff and members of the public whilst carrying out our duties. This may include the processing of still or moving images or CCTV.

We may also process your data to allow us to fulfil the following:

• to contact you by phone, text, email or mail to obtain details about an incident from those who have reported or been involved.
• to check the quality or effectiveness of our service, this includes contacting you after providing a service to obtain your opinion on its delivery.
• to conduct home safety checks and provide fire prevention advice.
• to provide business fire prevention advice and to conduct business fire safety inspections. This includes regulatory, licensing and enforcement actions in relation to businesses.
• To respond appropriately to emergency situations.
• to conduct fire investigations.
• To investigate any concerns or complaints regarding our service.
• To research and plan new services.
• To maintain our records and accounts within legislative requirements.
• To check our service continues to meet its legal responsibilities.
• To undertake recruitment processes and to manage applications for employment.
• Administration of current and former employees
• Staff pension administration and occupational health and welfare services
• Vehicle and transport management
• Management of information technology systems
• Legal services
• Vetting and disclosure and barring checks
• Procurement
• Health and safety management
• Provision of educational programmes and schemes and youth engagement.

Whose personal data do we process?

We process information relating to a range of individuals, and the exact data we process will depend upon the service being provided. However, we may collect data from the following categories of people:

• Current and former employees and potential members of staff including pensioners and beneficiaries.
• Current and former cadets, volunteers or casual workers and their representatives where applicable such as parents/guardians.
• Suppliers
• Advisors, consultants and other professional experts.
• Individuals who we have attended to assist in an emergency and any witnesses.
• Individuals who we have attended to assist to provide advice, guidance and safe and well checks.
• Complainants and other correspondents.
• Children and young people (and their respective parents/guardians)

What types of personal data do we process?

We may process personal in following categories dependent upon the service being provided:

• personal details (such as name, address and biographical details)
• contact details
• family, lifestyle and social circumstances
• Employment, education and training details
• sound and visual images (eg from body worn cameras, live streaming or CCTV)
• location data
• When responding to emergencies or other incidents we may also process information relating to the incident including car or property details, or whether there are any hazardous chemicals present.
• financial details
• goods or services provided
• information identifying user vulnerability, persistent targeting,
• references to manual records or files
• information relating to health and safety
• complaint, incident, and accident details
• opinions and assessments of officers and staff in relation to individuals dealt with.

We may process some special category or criminal data which may include:

• Physical and mental health information, both declared and suspected.
• Racial or ethnic origin
• Trade Union membership
• Religious or other beliefs
• Sexual orientation

We may also process some criminal data including:

• criminal proceedings, outcomes and sentences.

The types of personal data we process will vary depending on the purpose. We aim to process the minimum amount of personal data necessary. You should not assume that we hold personal data in all of the categories identified for every person.  The categories identified may not be complete as occasionally we may gather personal data in other categories for the purposes described.

Where do we get the personal data we process?

We collect personal data from a variety of sources, including:

• individuals who visit the website and interact with it (including by filling in and submitting forms), and their relatives, guardians and other persons associated with them
• businesses (including security companies, and other supplies of goods and services, including processors) and other private sector organisations working with the service
• local authorities, national and local government departments and agencies
• partner agencies involved in crime prevention and safeguarding strategies
• legal representatives, prosecuting authorities, courts
• approved organisations and people working with the fire service
• ombudsmen and regulatory auditors
• Fire Authority
• Other emergency services
• current, past or prospective employers of individuals
• healthcare, social and welfare advisers or practitioners
• education, training establishments and examining bodies
• our employees, agents, and other temporary and casual works
• persons making enquiries or complaints
• financial organisations and advisors, and credit reference agencies
• survey and research organisations
• trade, employer associations; and professional bodies
• the media
• our own CCTV systems and body worn cameras

What is our lawful basis for processing personal data?

Our legal basis for processing will vary depending on the circumstances. Ordinarily, the relevant legal basis is that the processing is:

• necessary for performing a contract
• necessary to comply with a legal obligation (including employment law)
• in the public interest or for official purposes
• necessary to protect your vital interests
• in our legitimate interests or the interests of a third party

and on occasion

• with your explicit consent which you can withdraw at any time

What security measures do we use when processing your personal data?

We take the security of all personal data under our control seriously. We comply with our legal obligations regarding security and have put in place physical, electronic and managerial procedures to safeguard and secure any data we hold about you.

We ensure that appropriate policy and training measures are in place, including audit and inspection to protect our manual and electronic information systems from data loss and misuse. We continuously manage and enhance our compliance with relevant standards and guidance to achieve adequate and up-to-date personal data security.

What disclosures do we make of your personal data?

We may disclose personal data to a wide variety of recipients in any part of the world (including outside of the United Kingdom and the European Economic Area), including to those from whom we originally obtain personal data. Recipients may include:

• businesses (including security companies, and other supplies of goods and services, including processors) and other private sector organisations working with the police in anti-crime strategies
• partner agencies working on fire reduction or safeguarding initiatives
• local authorities, national and local government departments and agencies (including the HM Revenue and Customs, the Child Maintenance Service, and private safeguarding agencies)
• Fire Authority
• Law enforcement agencies
• Emergency Services.
• Unitary Authorities such as councils.
• legal representatives, prosecuting authorities, courts, prisons, and other partners in the criminal justice arena;
• bodies or individuals working on our behalf
• ombudsmen, auditors and regulatory authorities
• other bodies or individuals where required under any legislation, rule of law, or court order
• actuarial valuers and pension providers
• other bodies or individuals where necessary to prevent harm to individuals
• the media, including public disclosures via social media

We decide on disclosure case-by-case, disclosing only the personal information that is necessary and proportionate to a specific purpose and with appropriate controls and safeguards in place.

If we make disclosures outside of the United Kingdom and the European Economic Area to locations which do not have as extensive data protection laws we ensure that there are appropriate safeguards in place to certify that the personal data disclosed is adequately protected.

How long do we retain your personal data?

We keep your personal data for as long as necessary for the particular purpose or purposes for which we hold it.

What are your rights over your personal data we process, and how can you exercise them?

Under the Act you have a number of rights that you can exercise in relation to personal data we process about you. You do not have to pay to exercise your rights

We sometimes need to request specific information from you to help us confirm your identity and ensure your authority to exercise the rights. However, we do not share with you confidential information of third parties or information which is in the interests of public safety and security to withhold.

Right of Access: You can request access to the personal data we hold about you free of charge. Normally we will provide it within one month of receipt of your request unless an exemption applies. You can request access to the personal data we hold about you using the contact details in this privacy notice.

Right to be Informed: Subject to restrictions you are entitled to be told how we obtain your personal information and how we use, retain, and store it, and who we share it with. This privacy notice gives you that information, as well as telling you what your rights are under the relevant laws.

Right to Rectification: If we hold personal data about you that is inaccurate or incomplete you have the right to ask us to correct it. You can ask us to correct your personal data using the contact details in this privacy notice. We will reply to you within one month unless the request is complex.

Right to Request Erasure: Under certain circumstances you have the right to ask us to delete your personal data to prevent its continued processing where there is no justification for us to retain it. The circumstances most likely to apply are:

• where holding your personal data is no longer necessary in relation to the purpose for which we originally collected and processed it;
• where there is a legal obligation to erase the data;
• where you withdraw your consent to us holding your personal data if we are relying on your consent to hold it.

The right of erasure does not apply if we are processing your personal data:

• to comply with a legal obligation
• to avoid obstructing an official or legal inquiry, investigation or procedure
• to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties
• for the performance of a task carried out in the public interest or in the exercise of official authority
• for the establishment, exercise or defence of legal claims
• to exercise the right of freedom of expression and information
• for archiving purposes in the public interest, scientific research, historical research or statistical purposes where erasure is likely to make it impossible to carry out or seriously impair that processing.

If you want to ask us to delete your personal data you can do so using the contact details in this privacy notice. We will respond to you within one month unless the request is complex.

Right to Restrict Processing: Under certain circumstances you have the right to ask us to restrict the processing of your personal data. This may be in cases where:

• you are contesting the accuracy of your personal data
• while we are verifying the accuracy
• your information has been unlawfully processed and you oppose its erasure and have requested a restriction instead
• where we no longer require your personal data but you need it to establish, exercise or defend a legal claim and do not want us to delete it

Right to Data Portability: You have the right to obtain and reuse your personal information for your own purposes, transferring it from one environment to another. This right only applies to personal data provided by an individual and where the processing is based on their consent or for the performance of a contract and when that processing is carried out by automated means. If you wish to discuss this right, you can do so using the contact details in this privacy notice.

Right to Object: You have the right to object to:

• processing based on legitimate interests or performance of a task in the public interest.
• processing of your information for scientific and historical research and statistics
• direct marketing.

Any objection must be on grounds relating to your particular situation. If you want to exercise your right to object you can do so using the contact details in this privacy notice.

Rights related to automated decision making and profiling: You have the right not to be subject to a decision when it is based on solely automated processing (including profiling) and which produces a legal effect or similar significant effect on you. This right does not apply if the decision is authorised by law, is necessary for entering into or performance of a contract, or is based on your consent.

Right to withdraw consent: You have the right to withdraw your conset where we have relied on consent as a lawful basis to use or share your data.  We will explain this to you at the time we collect it.

Right to complaint to the regulator (the ICO): You are entitled to lodge a complaint with the Information Commissioner’s Office if the Constabulary has not resolved a data protection concern in line with good practice. The ICO can be contacted via their website: ico.org.uk or telephone: 0303 123 1113.

Website Privacy

We will treat information you provide to us in using this website in confidence and we will not disclose it to third parties unless we are required to do so by law, or as explained in this privacy notice.

We gather information about site usage to help the development and improvement of services to the public, and to protect the integrity of our systems from malicious users. We also gather information through the various functions available on the site that allow you to provide us with information (such as online forms) for the purposes described later in this privacy notice. At the moment this information consists of:

• information to examine what people are searching for, what they find, and occasions where no results are returned, and which does not identify individual users;
• information provided by users through online forms which may identify individual users and other individuals depending on what information users enter.
• statistical information obtained using analytical software (more information about this is in the 'How do we use cookies?' section of this privacy notice);

• your IP address and details of which browser you are using, which we record when you use our online forms

How do we use cookies?

Cookies are used on this website to improve user experience and for essential functionality; Cookies are pieces of information that a website transfers to your computer's hard disk for record keeping purposes. Cookies can make the web more useful by storing information about your preferences on particular sites, thus enabling website owners to provide more useful features for their users. They contain no name or address information or any information that will enable anyone to contact you via telephone, e-mail or any other means. Most browsers are initially set to accept cookies. If you would prefer, you can set your browser to disable cookies or inform you when they are set. However, given that we may sometimes use cookies you may not be able to take full advantage of our website if you do disable them.  Please refer to our cookie policy for more information.

Date of last update

We last updated this privacy notice on the 13th February 2025. We keep this privacy policy under regular review and update it if any of the information in it changes.

Information Commissioner

The Information Commissioner is responsible for ensuring we meet our obligations and can be contacted in the following ways:

By post:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Online at: Information Commissioner's Office

Our other privacy notices

• Fire Cadets
• Safe and Well Checks
• Arson Reduction Initiative (including our child friendly version)
• Phoenix Project (including our child friendly version)
• Service employee / ex- employee / retired individuals