Privacy Policy

Last updated: May 2026

No Ifs. No Butts. is run by Action on Smoking and Health Wales, ASH Wales Cymru, a registered charity and company limited by guarantee.

This privacy policy explains how we collect, use, store and share personal information when people use this website, submit a report, contact us, complete a form, sign up to receive updates, or engage with our work.

We are committed to protecting your privacy and handling personal information safely, fairly and lawfully.

Who we are

No Ifs. No Butts. is part of Action on Smoking and Health Wales Cymru.

Registered charity number: 1120834
Company number: 6030302
Registered address: 14 Hollybush Rise, Cardiff, Wales, CF23 6TG
Email: report@noifs-nobutts.co.uk

For the purposes of data protection law, ASH Wales is the data controller for the personal information we collect through this website and related forms.

What information we collect

We may collect personal information when you:

• submit a report through No Ifs. No Butts.
• contact us by email, phone, post, form or social media
• make a training, resources or consultancy enquiry
• sign up to receive updates
• take part in a survey, event, interview or campaign activity
• use this website

The information we collect may include:

• your name, if you choose to provide it
• your email address, phone number or other contact details
• your organisation and role, if relevant
• details you provide in a report or enquiry
• information about a shop, seller, address, postcode, online account, product, price or pattern
• photos, screenshots or documents you choose to upload
• your communication preferences
• technical information, such as IP address, browser type, device type and website usage information

You can submit a report without giving your name or contact details.

Reports made through No Ifs. No Butts.

No Ifs. No Butts. allows people to report concerns about illegal tobacco, illegal vapes, cannabis THC products, online sales, underage sales and related concerns.

When you submit a report, we may collect the information you choose to provide. This could include:

• a shop name, address, postcode, street or area
• an online account, profile name, website or link
• a product name, price, photo or description
• details about hidden stock, repeat sellers or local patterns
• concerns about children or underage sales
• your contact details, if you choose to leave them

Reports are used to help build a clearer picture of what people are seeing locally. Where relevant, information may be shared with Trading Standards, enforcement partners or other appropriate bodies so they can assess the concern and decide what action may be needed.

If you choose to leave your contact details, they may be used to follow up on your report. You do not have to provide contact details to make a report.

Training, resources and consultancy enquiries

If you complete a training, resources or consultancy enquiry form, we will use the information you provide to:

• respond to your enquiry
• understand your organisation, audience and needs
• discuss training, resources, consultancy or campaign input
• provide information about relevant services
• manage any agreed work, booking, resource order or follow up

This may include your name, job title, organisation, email address, phone number, location, audience details, areas of interest and any budget or timing information you choose to provide.

How we use your information

We use personal information to:

• receive and review reports
• share relevant reporting information with enforcement partners
• respond to enquiries
• provide training, resources, consultancy or campaign support
• manage events, meetings, bookings or services
• send updates where you have asked to receive them
• carry out research, evaluation and reporting
• improve our website, forms and services
• keep records of our work
• meet legal, regulatory or safeguarding duties

We may use anonymised or aggregated information for reports, funding updates, campaign evaluation, public awareness work and research. This will not identify you personally.

Our lawful basis for using information

Depending on the situation, we may rely on one or more lawful bases under UK data protection law, including:

• Consent, where you have given clear permission, such as signing up to receive updates.
• Legitimate interests, where we use information to run No Ifs. No Butts., respond to enquiries, process reports, improve our work or support public awareness.
• Public task or public interest related activity, where information supports work with enforcement, public health or community safety partners.
• Contract, where information is needed to provide a service, booking, training or consultancy arrangement.
• Legal obligation, where we need to comply with the law or respond to a lawful request.

Where we rely on consent, you can withdraw your consent at any time.

Who we share information with

We do not sell your personal information.

We may share information with:

• Trading Standards
• Police or other enforcement partners
• local authorities or public bodies
• safeguarding partners, where relevant
• service providers who help us run our website, forms, email systems, events or campaigns
• research, evaluation or delivery partners working on our behalf
• legal, regulatory or professional advisers, where needed

When we use suppliers or partners to process personal information on our behalf, we expect them to handle it safely and only for agreed purposes.

Report information may be shared with enforcement partners if it is relevant to the concern raised. This may include personal information if you have provided it and it is relevant to follow up, assessment or action.

Confidentiality and safeguarding

We treat reports and enquiries carefully.

There may be situations where we need to share information to help prevent harm, support safeguarding, respond to suspected illegal activity, comply with the law, or protect someone’s safety.

We will only share what is necessary and proportionate.

Cookies and website analytics

This website uses cookies and similar technologies to help the website work, understand how people use it and improve visitor experience.

Some cookies are necessary for the website to function. Other cookies, such as analytics or marketing cookies, will only be used where consent is required and you have agreed.

You can manage your cookie choices using the consent button on the website.

You can change your cookie preferences at any time by selecting the consent button.

Third party websites and embedded content

This website may link to other websites or include content from third party services, such as videos, forms, maps, analytics tools or social media platforms.

Those third parties may collect information about you when you interact with their content or visit their websites. Their own privacy policies will apply.

We are not responsible for the privacy practices of external websites.

How long we keep information

We only keep personal information for as long as needed for the purpose it was collected, including reporting, follow up, legal, safeguarding, audit, funding, research or organisational record keeping purposes.

Report information may be kept to help identify patterns, repeat sellers, local hotspots and historic intelligence, especially where it may support enforcement or public health work.

Where information is no longer needed, we will delete it securely or anonymise it so it can no longer identify you.

How we keep information safe

We use organisational and technical measures to protect personal information from unauthorised access, loss, misuse or disclosure.

Access to personal information is limited to staff, suppliers or partners who need it for their role.

No method of online transmission is completely risk free. Please avoid sending highly sensitive personal information unless it is needed.

Your rights

You have rights over your personal information. These may include the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is inaccurate
• ask us to delete information in some circumstances
• ask us to restrict how we use your information
• object to how we use your information
• withdraw consent, where we rely on consent
• complain to the Information Commissioner’s Office

To exercise your rights, contact us at:

report@noifs-nobutts.co.uk

We may need to ask for information to confirm your identity before responding to a request.

Email updates and marketing

We will only send you email updates or marketing communications where we have a lawful basis to do so.

You can unsubscribe from email updates at any time by using the unsubscribe link in the email or by contacting us.

Children and young people

Some of our work relates to children and young people, including underage sales, youth vaping, smoking prevention and safeguarding concerns.

Where we collect information involving children or young people, we will handle it carefully and only use or share it where necessary, proportionate and lawful.

Reports about underage sales or children accessing products may be shared with appropriate partners where relevant.

Contact us

If you have questions about this privacy policy or how we use personal information, contact:

No Ifs. No Butts.
Action on Smoking and Health Wales Cymru
14 Hollybush Rise
Cardiff
Wales
CF23 6TG

Email: report@noifs-nobutts.co.uk

Complaints

If you are unhappy with how we handle your personal information, please contact us first so we can try to resolve it.

You can also complain to the Information Commissioner’s Office, the UK regulator for data protection.

Changes to this policy

We may update this privacy policy from time to time. The latest version will be published on this website.