Privacy Policy

Updated October 2026
A. Downing Ltd trading as Banstead Village Veterinary Surgery

At Banstead Village Vets, we’re committed to protecting and respecting your privacy.

This Policy explains how, when and why we collect personal data (in this document the words ‘personal data’ and ‘data’ are used to describe information that can identify an individual) about people who visit our website and/or are clients of the practice. We will describe how we use that data, the conditions under which we may disclose it to others, how we keep it secure, and how you can access it and make changes if you choose to do so.

We may change this Policy from time to time. Please check this page occasionally to ensure you’re happy with any changes. By using our website / registering as a client, you’re agreeing to be bound by this Policy.

Any questions regarding this Policy and our privacy practices should be sent by email to info@bansteadvillagevets.co.uk or by writing to Banstead Village Veterinary Surgery, 170a High Street, Banstead, Surrey, SM7 2NZ. Alternatively, you can telephone 01737 210011.

We will cover:

• 1. Who are we?
• 2. Information we collect.
• 3. Why we use information.
• 4. Sensitive information
• 5. Reminders, communication and marketing
• 6. CoVet transcription
• 7. Sharing information and international transfers
• 8. Cookies and website analytics
• 9. Retention
• 10. Your Rights
• 11. Security and breaches
• 12. Children, complaints and changes

1. Who we are

A. Downing Ltd, trading as Banstead Village Veterinary Surgery and Banstead Village Vets, is the data controller.

170A High Street, Banstead, Surrey, SM7 2NZ | info@bansteadvillagevets.co.uk | 01737 210011

Data Protection Officer: Andrew Downing, Practice Owner.

ICO registration: ZA057262 (registered June 2019)

2. Information we collect

We obtain information about you when you register with the practice, purchase products or services from the practice, communicate with us, use our website, complete a contact form, make an online booking, pay for services, take part in feedback or surveys, or otherwise use our services. We collect information needed to provide and administer veterinary services, including:

• Identity and contact data: First name, maiden name, last name, marital status, title, billing address, email address and telephone numbers.
• Sensitive data: Accessibility information, to aid us in helping you in the best way possible.
• Information linked to an animal’s care: such as clinical histories, treatment plans, prescriptions, referrals, test results, estimates and insurance claims.
• Financial and transaction data: Payments, invoices, statements, insurance information, and transaction references. We do not store bank or bank-card details.
• Technical and usage data: Internet protocol (IP) addresses, browser type and version, browser plug-in types and versions, time zone setting and location, operating system and platform, cookie and analytics information, pages visited, how visitors reached our website and other technology on the devices used to access our site.
• Profile data: Purchases, booked appointments, online-booking records, contact requests, interests, preferences, feedback, survey responses, emails, SMS, photographs and communication metadata. If you choose to connect with us via social media, for example Facebook or Instagram, we may collect your username, name, email address, gender and location.
• Marketing and communication data: Your preferences in receiving marketing communications and reminder messages from us, your communication preferences, consultation or selected telephone-call audio, transcripts and AI-assisted draft notes where CoVet is used, WhatsApp chats and payment trail information.

We usually obtain information directly from you. We may also receive it from an authorised representative, another veterinary practice, referral provider, laboratory, insurer, payment or communication provider, emergency service, public authority or appropriate public source.

Where we are required to collect personal data by law or under the terms of our contract with you, and you do not provide the requested data, we may not be able to perform the contract, for example to see your pet in consultation, carry out a procedure or dispense medicines. If this means we need to cancel our contract with you, we will notify you at the time.

If you provide personal data about another person, for example a spouse, family member or authorised representative, you confirm that you have their authority or consent to provide it to us for the relevant purpose.

3. Why we use information

Where we rely on legitimate interests, we balance our need against your rights. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

4. Sensitive information

Animal health information is not automatically a special category of personal information about a person. However, a conversation may reveal a person’s health, disability, religion or other protected information. We minimise irrelevant sensitive content and only retain it where necessary and supported by both a lawful basis and an applicable additional condition.

5. Reminders, communications and marketing

We use Digital Practice to send reminders by WhatsApp or SMS. Reminders may include appointment reminders and notices that parasite control, vaccinations or other preventative care are due. They may include a link or button allowing you to book an appointment or request or order the relevant product or service. Emails and post options can also be requested.

We treat a message as a service or care reminder where its content is limited to information reasonably connected with an existing appointment, current treatment or an item of preventative care recorded as due. If a reminder contains significant promotional content or encourages the purchase of products or services beyond the care reminder, we treat that content as direct marketing and apply the relevant consent or soft opt-in rules. You can object to direct marketing at any time. This does not normally stop necessary appointment or care communications, although you may tell us if you need an alternative reasonable communication arrangement.

We also use Digital Practice, including WhatsApp, for client communications. Each conversation has a reference number. Following our protocol, relevant content is stored in our practice-management system on the patient record or client communication tab, and is also retained within Digital Practice for reference.

Where you have told us how you prefer to receive reminders, we will update our records where reasonably possible. We no longer offer reminders by post or email, but you can contact us if you need an alternative reasonable communication arrangement.

Online bookings are retained in the booking system and as a filed confirmation email. We keep them only while needed for administration, evidence, queries, complaints or legal requirements. Records added to a clinical, client or financial record follow that record’s retention period.

6. CoVet transcription

We use CoVet to transcribe consultations and selected telephone calls so that we can create detailed patient and client records. An authorised team member reviews and corrects the output before relevant information is saved to the authoritative record. CoVet does not make treatment decisions.

Audio recordings are deleted immediately after transcription. CoVet drafts are deleted after review and incorporation onto the practice-management system (PMS). Relevant reviewed information incorporated onto the PMS is retained in accordance with the applicable patient or client record-retention period.

7. Sharing information and International transfers

We do not sell personal information or share it with other companies for their own marketing purposes without your prior consent. Where necessary, we may share it with veterinary and referral providers, laboratories, pharmacies, insurers, Health Club providers, payment and debt providers, professional advisers, technology and communication providers, regulators, courts, HMRC, law enforcement or animal-welfare bodies, and parties involved in a genuine business transfer.

Our key processors include CoVet and Digital Practice Limited, with which we have signed data-processing agreements. Digital Practice supports messaging, WhatsApp and SMS reminders, online booking, payments, reviews, website hosting and management, integrations, automation, analytics and digital marketing. Its agreement requires processing on our instructions, security and confidentiality, breach assistance, support with individual rights, equivalent subprocessor protections, compliance records, and deletion or return on termination unless law requires retention.

Third parties may only use personal data for the necessary purpose and must protect it appropriately. We may also disclose personal data where permitted or required by law, for example for the prevention or detection of crime.

Some providers or support teams may process information outside the UK. We require a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum or another permitted safeguard.

8. Cookies and website analytics; Links to other websites

Digital Practice manages our website. Visitors receive a cookie notice and can set preferences before non-essential technologies are used. Where permitted, we analyse website use and how visitors reached the site to understand performance and support marketing. Visitors can change their choices through the website’s cookie controls.

Our site may use cookies such as Google Analytics to compile reports on website use and help us improve the site, and Google Maps cookies where maps are embedded. Cookies collect statistical information about browsing actions and patterns and do not usually identify you as an individual unless linked with other personal data.

You can also control cookies through your browser settings. Turning cookies off may affect the functionality of our website.

Our website may contain links to third-party websites. We do not control those sites or how they process personal data. If you follow a link to another website, we recommend that you read that website’s privacy information.

9. Retention

We keep information only for as long as needed for its purpose and relevant clinical, professional, medicines, tax, insurance, complaint or legal requirements.

10. Your rights

Depending on the circumstances, you may ask us for access, correction, erasure, restriction or portability; object to legitimate-interest processing or direct marketing; withdraw consent; and challenge a solely automated decision with legal or similarly significant effects. We do not currently make such automated decisions about clients.

Rights are not absolute. We may retain information for legal or professional duties, claims or an accurate clinical record. We may verify your identity and normally respond within one month, subject to any lawful extension. Contact Andrew Downing using the details in section 1.

11. Security and breaches

We use proportionate measures such as access controls, authentication, encryption where appropriate, secure backups, maintenance, staff confidentiality and training, supplier checks, audit logs and secure disposal. No system is completely secure, so please do not send full payment-card details or unrelated highly sensitive information by ordinary email or WhatsApp. We investigate breaches, keep appropriate records and notify the ICO and affected people where required.

Information transmitted through our website is protected using industry-standard encryption where appropriate. You can look for the padlock symbol in your browser address bar. Emails and messaging services are not guaranteed to be 100% secure, so please do not send bank account details, full payment-card details or unrelated highly sensitive information by ordinary email or WhatsApp.

Where staff need to use mobile electronic devices for practice work, access is restricted to authorised staff and protected by appropriate security measures.

12. Children, complaints and changes

We are keen to protect the privacy of children aged 16 or under. If you are aged 16 or under, please get your parent or guardian’s permission before providing us with personal information. A parent, guardian or responsible adult will normally communicate with us where a child is involved. Different handling may be required for safeguarding, animal welfare, vital interests or another legal duty. Our online services are not designed to be offered directly to children.

Please contact Andrew Downing first with a concern. You may also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We review this policy when our processing changes and periodically thereafter. We publish the current version on our website, make previous versions available on request, and this version was last updated in July 2026.