Data Protection is important to us.

St John Gibraltar collects personal information so we can provide our services safely and properly. This includes helping you take part in our activities and events, completing risk assessments, planning volunteers, and keeping you informed.

We only collect the information we genuinely need.

What information we collect
We may collect your name, contact details, emergency contact, and any information needed for risk assessments. We only collect special category information, such as medical details, when it is necessary for your safety or the safety of others.

How we use your information
We use your information to carry out risk assessments, plan volunteers and resources, communicate with you, and meet our legal duties as a charity in Gibraltar. We do not use your information for marketing unless you clearly agree.

How long we keep your information
Our organisational policy is to keep personal information for seven years. If you want us to delete or change your information sooner, please tell us. We will do this in line with Gibraltar’s data protection laws.

Who sees your information
Your information is only shared when necessary, such as with authorised St John volunteers or emergency services if required. We never sell your information.

Your rights
You can ask us to give you a copy of your information, correct it, delete it, or limit how it is used. You can also object to certain uses of your data.

To use any of these rights, contact our Data Protection Officer.

Data Protection Officer
Matthew J. Turnock
Email: dpo@stjohn.gi
Telephone: +350 200 77390

If you need to contact the Gibraltar Regulatory Authority
If you are concerned about how your data is being used, you can contact the Gibraltar Regulatory Authority.

Gibraltar Regulatory Authority
2nd Floor, Eurotowers 4
Gibraltar GX11 1AA
Email: info@gra.gi
Telephone: +350 200 74636

Keeping your information safe
We use secure systems and only allow authorised people to access your information. All volunteers are trained to handle personal data responsibly.