Date of notice completion: Updated 05.08.26
Our contact details:
Name: The British Lymphology Society
Address: 59 Birmingham Rd, Lichfield WS13 6PG
Phone Number: 01452 790178
E-mail: admin@thebls.com
This notice informs you of our policy regarding the collection, use, and disclosure of personal data when you use our service and the choices you have associated with that data.
Your data protection rights
Under data protection law, you have rights including:
- Your right of access – You have the right to ask us for copies of your personal information.
- Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
- Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we, the BLS, have one month to respond to you. Please contact the BLS at admin@thebls.com if you wish to make a request.
We use your data to provide and improve the service we provide. By using the service, you agree to the collection and use of information in accordance with this policy.
The type of personal information we collect & how we use it
We state the purpose for which we collect and process the following personally identifiable information:
- Your name, email address(es) – to provide you with the services offered as part of your membership.
- Your name, email address(es) – as a record of your correspondence in the event of your contact with us.
- Your name, email address(es), postal address – to supply you with pertinent journals, newsletters, free webinars and other educational material (providing you ‘opt in’ to communications).
- Email address(es) – for automatic email notifications when new events or resources are posted on the website (providing you ‘opt-in’ to communications).
- Transactions / Google Analytics – to audit the usage of our website.
- Cookies – to enable your participation in interactive features of our services.
- Telephone number – to contact you regarding membership.
- Employment information – to understand the demographics of our membership.
Data in relation to our Directory of Lymphoedema Services listings:
As a member of the BLS, the information you provide for your directory listing is freely given by yourself and released into the public domain. Please do not list any information you would not like to be publicly available. (The BLS has no liability for any information you distribute via our directory listing).
Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for the processing of your information is your consent and the fulfilment of our membership contract to you.
- The process we undertake ensures your consent is freely given, informed and specific to the service you are consenting to receive.
- You can remove your consent at any time. You can do this by contacting the BLS at admin@thebls.com
- When purchasing membership, a contract is formed between you and the BLS in which your name, telephone number and email address are required to allow the BLS to provide the contracted services.
‘Opt out’ facilities
You may opt out of receiving any, or all, of these communications from us by following the unsubscribe link or instructions provided in any email we send.
How we store your personal information
Your information is securely stored. Our website data is stored on Payment Card Industry-compliant UK servers with security, including:
- Malicious software scanning; scanning for software with malicious intent
- 1 Tbps + DDoS protection; distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server. The 1 Tbps is the terabits per second network that can block up to the same volume of traffic attack.
- Web application firewall: protects web apps by filtering, monitoring, and blocking any malicious HTTP/S traffic
- Brute force login protection; safeguards against a single internet protocol (IP) address attacking a single user account. (An IP address is a unique numerical identifier for every device or network that connects to the internet).
- FTP security lock and 2FA; file transfer protocol and two-factor authentication security
Retention of your data
Unless prescribed by law, we will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy. Using our data retention schedule, we regularly analyse the personal information that we hold, and arrange disposal for the data fulfilling requirements for deletion. Please contact the BLS at admin@thebls.com for further information.
Transfer Of Data
If you are located outside the United Kingdom and choose to provide information to us, we transfer the data to the United Kingdom and process it there. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer. The BLS will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. No transfer of your personal data will take place to an organisation or a country unless there are adequate controls in place, including the security of your data and other personal information.
How we dispose of your personal information
The BLS’s website has automated rules coded into the system that inform when to delete and anonymise data. The rules are in line with the BLS’s data retention schedule.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at:
admin@thebls.com
Subject line: Data Protection Complaint
We will acknowledge your message within 30 days, review the issues you’ve raised, and keep you informed throughout the process. Once our investigation is complete, we will provide a clear written outcome.
If you remain dissatisfied after receiving our response, you can contact the Information Commissioner’s Office (ICO) for further guidance:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Definitions and their application to the BLS
Cookies
Files with a small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Tracking technologies also used are beacons, tags, and scripts to collect and track information and to improve and analyse our service.
You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our service. Examples of Cookies we use:
- Session Cookies - to operate our service.
- Preference Cookies - to remember your preferences and various settings.
- Security Cookies – for the purpose of security.
- Tracking Cookies - to track the activity on our service and hold certain information.
Data Controller: a person who (either alone or jointly or in common with other persons) determines the purposes and manner in which any personal data is to be processed.
Data Processors: any person (other than an employee of the Data Controller) who processes the data on behalf of the Data Controller. (The BLS may use the services of sub-processors to process your data more effectively).
Data Subject: any living individual who is the subject of personal data.
Location Data: we may use and store information about your location if you give us permission to do so (“Location Data”). We use this data to provide features of our service and to improve and customise our service. You can enable or disable location services when you use our service through your device settings.
Personal Data: information that relates to an identified or identifiable individual.
Usage Data: data collected automatically that is either generated by the use of the service or from the service infrastructure itself (for example, the duration of a page visit).
User: the individual using our service. The user corresponds to the data subject, who is the subject of personal data.
Disclosure for Law Enforcement: under certain circumstances, the BLS may be required to disclose your personal data:
By law or in response to valid requests by public authorities (e.g. a court or a government agency).
- To protect and defend the rights or property of the BLS.
- To prevent or investigate possible wrongdoing in connection with the service
- To protect the personal safety of users of the service or the public
- To protect against legal liability
Security of Data: The security of your data is important to the BLS, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.
Analytics: we may use third-party Service Providers to monitor and analyse the use of our Service.
Google Analytics: a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our service. This data is shared with other Google services. Google may use the collected data to contextualise and personalise the ads of its own advertising network.
You can opt-out from activity on the service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) from sharing information with Google Analytics about visit activity. For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: http://www.google.com/intl/en/policies/privacy/
Payments
We may provide paid products and/or services within the service. We use third-party services for payment processing (e.g. payment processors). We will not store or collect your payment card details. That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by the Payment Card Industry Data Security Standard (PCI-DSS), as managed by the PCI Security Standards Council; a collaboration of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.
The payment processors we work with are:
- Stripe: their Privacy Policy can be viewed at https://stripe.com/us/privacy
- PayPal: their Privacy Policy can be viewed at https://www.paypal.com/webapps/mpp/ua/privacy-full
Links To Other Sites
Our service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.
Changes To This Privacy Policy
We may update our Privacy Policy from time to time. We will inform you via email and/or a prominent notice on our service, prior to the change becoming effective and update the "effective date" at the top of this Privacy Policy.
Updated: 5th August 2026
----------------------------------------------------------------------
