Guidance

The Convention on International Trade in Endangered Species of Wild Fauna and Flora: Annex A - gifting declaration privacy notice

Updated 30 September 2024

Applies to England, Scotland and Wales

Your data is being collected by 

The data controller is the Department for Environment, Food and Rural Affairs (Defra) for personal data that you give to APHA. 

APHA is an Executive Agency of Defra. You can contact APHA’s Data Protection Manager by email at: data.protection@defra.gov.uk. 

APHA also works with the Scottish Government and Welsh Government, who are joint controllers with APHA for any relevant personal data. 

Any questions about how Defra or APHA is using your personal data and your associated rights should be sent to the above contact. 

The Data Protection Officer responsible for monitoring that Defra or APHA is meeting the requirements of the legislation can be contacted by email at: DefraGroupDataProtectionOfficer@defra.gov.uk. 

What personal data is collected 

We collect the following items of personal data: 

• name 

• contact details 

• details of the CITES specimen for which you are the new owner and or keeper 

• the previous owner or keepers Name and Address 

• the reason for which ownership was transferred 

How your personal data has been obtained, if from a third party 

By completing this gifting declaration, you have provided the data outlined above. If you are the original keeper of the specimen, this information will only be stored to verify legal acquisition when or if the recipient of the gifted specimen has applied for a commercial use certificate under Article 8 of Council Regulation (EC) No 338/97. This information will be stored securely alongside your application within the Pegasus system and retained in accordance with our retention policy. You can find more information from APHA’s personal information charter.

The legal basis for processing your personal data 

The lawful basis for processing your personal data is a public task. This means that the processing of your data is necessary in order for APHA to perform a task in the public interest or for official functions, whereby the task or function has a clear basis in law. Processing your personal data is necessary to prove legal acquisition of an Annex A CITES Listed specimen which is a requirement of the CITES convention and laid down by law in Council Regulation (EC) No 338/97 when applying for a commercial use certificate (Article 10 certificate) under Council Regulation (EC) No 338/97 Article 8. 

Consent to process your personal data 

The processing of your personal data is based on consent. You can withdraw consent at any time by emailing CITES.UKMA@defra.gov.uk.

Who APHA shares your personal data with 

We may share the personal data collected under this privacy notice with: 

• UKMA Scientific Authorities, Joint Nature Conservation Committee (JNCC) and Royal Botanic Gardens Kew 

• HM Revenue and Customs under the provisions of Article 14 of regulation 338/97 

• The Police and National Wildlife Crime units for the purpose of gathering and analysing intelligence on possible wildlife crimes 

We respect your personal privacy when responding to access to information requests. We only share information when necessary to meet the statutory requirements of the Environmental Information Regulations 2004 and the Freedom of Information Act 2000. 

Consequences of not providing the necessary data 

Not providing this data may impact the ability to prove legal acquisition and therefore your ability to obtain an Article 10 certificate for commercial use of the specimen under Council Regulation (EC) No 338/97. 

Personal data used for automated decision making or profiling 

The personal data you provide is not used for: 

• automated decision making (making a decision by automated means without any human involvement) 

• profiling (automated processing of personal data to evaluate certain things about an individual) 

Storing and using personal data outside the UK 

We will only transfer your personal data to another country that is deemed adequate for data protection purposes. 

How long APHA holds personal data for 

Retention periods are set by considering statutory, regulatory, legal, and security reasons, alongside historic value.

The CITES retention policy is 7 years from the date at which the import or export permit has been used, expired, or cancelled or from the point at which the certificate fulfilled its purpose. For Article 10 certificates, this can mean that information is held for the duration of that specimen’s life span.

All information in APHA is held in accordance with our retention policy. If you would like more information, please contact enquiries@apha.gov.uk.

Your rights 

The lawful basis for processing your data is public task, set out in article 6 of the UK GDPR. Find out about your rights under data protection law here: The rights of individuals ICO.

More information about your individual rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 can be accessed on the Information Commission Office website.

Complaints 

You have the right to lodge a complaint about the use of your personal data at any time with the Information Commissioner’s Office (ICO – the data protection supervisory authority) personal information charter.

APHA’s personal information charter broadly sets out details of Defra’s processing of personal data.