Data & Privacy
Introduction
This website (fferyllwyrllyn.co.uk) is provided by Fferyllwyr Llŷn Ltd, a group of NHS community pharmacies serving the Llŷn Peninsula and Gwynedd ("we", "our", or "us"). We are the controller of personal data obtained via our website, meaning we are the organisation legally responsible for deciding how and for what purposes it is used.
Please read this policy carefully. It explains who we are and how and why we collect, store, use and share information relating to you ("your personal data") in connection with your use of our website. It also explains your rights and how to contact us if you have a complaint.
When we collect and use your personal data we are subject to the UK General Data Protection Regulation (UK GDPR). This policy is primarily written for adults, including parents and guardians of child users, and relates to your use of our website only.
Personal data we collect
When you interact with the website, certain information may be collected in order to operate the site and provide services effectively.
Personal information
You may provide personal information when completing forms, booking a service, contacting the pharmacy, or engaging with features on the website. This may include your name, contact details, address, and other information you voluntarily submit. Providing this information is optional, but some services may not be available if required details are not supplied.
Technical and usage information
Certain technical information is collected automatically when you visit the website, including IP address, browser type, device information, operating system, access times, and pages you view. This helps us understand how the website is used and allows us to improve performance and user experience.
Payment information
If you pay a deposit for a service through the website, payment details are processed by external payment providers. We do not store full payment card information on our systems. Payment providers handle payment processing in accordance with their own privacy and security policies.
Mobile device information
If the website is accessed from a mobile device, limited device information such as device type, model, and system information may be collected to ensure the site functions correctly.
Information from third parties
In some circumstances, information may be received from third-party services where you have authorised such access, for example when interacting with services provided through integrated platforms.
How and why we use your personal data
Under data protection law, we can only use your personal data if we have a proper reason, for example:
- where you have given consent
- to comply with our legal and regulatory obligations
- to perform a contract with you or take steps at your request before entering into one
- for our legitimate interests or those of a third party
A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We carry out an assessment when relying on legitimate interests, to balance our interests against yours.
Information collected through the website may be used for purposes including:
- providing pharmacy services and responding to enquiries
- operating, maintaining, and improving the website
- communicating important updates or service information
- processing payments or service requests
- preventing fraud, abuse, or security incidents
- enforcing legal rights or defending legal proceedings
- monitoring usage patterns and website performance
- responding to customer support requests
- statistical analysis to help us understand our patient base
- complying with legal or regulatory obligations
Certain personal data we collect is treated as a special category to which additional protections apply under data protection law, including data concerning your health.
Disclosure of information
We may share information where necessary for operational, legal, or service-related purposes.
Legal requirements
Information may be disclosed where required to comply with applicable laws, regulations, legal processes, or lawful requests by public authorities.
Service providers
Certain third-party organisations may assist with website hosting, payment processing, communications, analytics, or technical support. These providers process information on our behalf under appropriate confidentiality and data protection obligations.
Business partners
Where services are delivered in collaboration with trusted partners (for example NHS Wales), limited information may be shared as necessary to provide those services.
Protection of rights
Information may be shared where reasonably necessary to investigate fraud, enforce policies, protect users, or defend legal claims.
PharmAppy platform services
The website operates using technology and infrastructure provided by PharmAppy Services Limited. Certain technical or operational data may be processed within systems operated by PharmAppy Services Limited in order to maintain platform functionality, security, and performance. PharmAppy Services Limited acts as a technology provider and processes information solely for the purpose of operating and supporting the platform.
Cookies and tracking technologies
The website may use cookies and similar technologies to improve functionality and user experience. Cookies are small data files stored on your device that allow websites to recognise returning users and understand how visitors interact with pages. These technologies may be used to:
- maintain essential website functionality
- remember user preferences
- analyse site usage and performance
- improve services and content
Most web browsers allow cookies to be managed or disabled through browser settings. Disabling cookies may affect certain features of the website.
Third-party websites
The website may include links to sites operated by third parties. Once you leave our website, this Privacy Policy no longer applies. We are not responsible for the privacy practices or content of external websites and recommend you review their privacy policies before submitting personal information.
Transferring your personal data out of the UK
Countries outside the UK have differing data protection laws, some of which may provide lower levels of protection. Where we transfer your personal data outside the UK, we do so only on the basis of an adequacy regulation under Article 45 of UK GDPR, appropriate safeguards such as standard data protection clauses under Article 46(2), or a specific exception under UK data protection law.
Security of information
We have appropriate security measures to prevent personal data from being accidentally lost, used, or accessed unlawfully, and we limit access to those who have a genuine need. No internet-based system can guarantee absolute security, and transmission of data online carries inherent risks.
We have procedures in place to deal with any suspected data security breach and will notify you and any applicable regulator where legally required.
Your data rights
You generally have the following rights, which you can usually exercise free of charge:
- request access to the personal information we hold about you
- request correction of inaccurate information
- request deletion of personal data where appropriate
- request restriction of processing your personal data
- request the transfer of your personal data to you or a third party
- object to processing of your personal data
- not to be subject to automated individual decision-making
- withdraw consent at any time
Requests can be submitted using the contact details below. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Retention of information
Personal information will be retained only for as long as necessary to fulfil the purposes outlined in this policy, including meeting legal, regulatory, or operational requirements.
Changes to this Privacy Policy
We may need to update this Privacy Policy from time to time. If the change is material, we will place a prominent notice on our website or update you by other appropriate means. This policy was last updated on 1 July 2026.
Keeping your personal data accurate and up to date
It is important that the personal data we hold about you is accurate and up to date. Please inform us of any changes in your data.
Contact
Fferyllwyr Llŷn Ltd