Privacy
Your privacy is important to us. This privacy policy covers what we collect and how we use, disclose, transfer, and store your information.
Information governance
JPAC is hosted by NHS Blood and Transplant (NHSBT) for information governance purposes. As such, NHSBT is the data controller for the data processed by JPAC.
NHSBT is responsible for ensuring that all practices and processes within JPAC are designed to support people's privacy and data rights and making sure data protection is represented at a board level. All members of the JPAC Office team are employed by NHSBT.
For detailed information about how NHSBT collects and uses data, please refer to the NHS Blood and Transplant Privacy Policy.
NHS Blood and Transplant Data Controller
By email: dataprivacyteam@nhsbt.nhs.uk
In writing:
NHS Blood and Transplant
500 North Bristol Park
Filton
Bristol
BS34 7QH
What we collect from you
You may use the website without providing any personal information.
However, if you wish to contact us by email, you may be requested to provide relevant contact details to enable us to provide the information you require.
We will collect and process the following personal data when you contact the team by email:
- Name (first name and last name)
- Email address
We use website analytics to track certain information about all our website users based on what you do on the site. We mostly use Google Analytics for this. We use this information to analyse our users' demographics, interests, and behaviour on the site to understand and serve you better. The information we capture for this purpose does not identify any user.
Please refer to our Cookie Policy for further information on how we use cookies to support web analytics, as well as your rights in relation to these.
The website contains links to other internet sites which are outside our control and are not covered by this privacy policy. We are not responsible for data which you provide through any such linked websites. This privacy notice tells you what to expect us to do with your personal information.
Why we need your data
The legal basis for processing your personal data is legitimate interest.
Our legitimate interest relates to enabling us to contact you to provide you with the information you requested.
How long we keep your data
Outside of exemptions under specific legislation related to personal data, your information shall be retained for no longer than the purposes for which it is being processed as specified above.
Where your data is stored
Your data is stored on a secure system hosted by our website provider, available only to those with a legitimate need to access your data. We also design, build, and run our systems to make sure that your data is as secure and confidential as possible at every stage, both while it's processed and when it's stored.
Your rights
You have the right:
- to request information about how your personal data is processed, and to request a copy of that personal data
- to request that any inaccuracies in your personal data are rectified without delay
- to request that any incomplete personal data is completed, including by means of a supplementary statement
- to request that your personal data is erased if there is no longer a justification for them to be processed
- in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted
- to object to the processing of your personal data where it is processed for direct marketing purposes
In relation to monitoring threats to the system, identifying, and fixing technical issues, and identifying and tackling cyber security risks:
- you have the right to object to the processing of your personal data
In relation to all other data:
- you have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used, and machine-readable format
Changes to this notice
We may change this privacy notice. When we make changes to this notice, the 'last updated' date at the bottom of this page will also change. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, we will take reasonable steps to make sure you know.
Questions and concerns
If you have any questions or concerns about your privacy rights within JPAC, please raise these by using the contact details below:
Data Protection Officer contact
Eleanor Ward, Head of Data Security, Privacy Records Management
By email: DPO@nhsbt.nhs.uk
In writing:
NHS Blood and Transplant
500 North Bristol Park
Filton
Bristol
BS34 7QH
For independent advice about data protection, privacy, and data sharing issues, you can contact the Information Commissioner, who is an independent regulator.
Information Commissioner's Office (ICO)
Email address: icocasework@ico.org.uk
Local rate: 0303 123 1113
National rate: 01625 545 745
There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website).
Last updated on 1 May 2026