Registered Charity No: 519767
Company Registration No: 2208426
Gambling Operations Number 000/005230/N/30378110004
VAT Number: 997 3057 70
Registered Offices: St Cuthbert’s Hospice, Park House Road, Durham, DH1 3QF
St Cuthbert’s Hospice is registered with the Information Commissioner in the UK (Registered No: Z22126399) and is legally bound to comply with the requirements of
the Data Protection Act 1998.
What type of information we have and why we have it
When reading this document and we mention St Cuthbert’s Hospice this relates to both St Cuthbert’s Hospice Limited and St Cuthbert’s Hospice Win Win Lottery unless otherwise stated.
We at St Cuthbert’s Hospice aim to be as transparent as we can about how and why we communicate with you and how we will use your personal information.
St Cuthbert’s Hospice is committed to protecting the personal information of all those who provide it, regardless of the reason, whether it is provided online or offline.
In this statement we will tell you:
- why we are able to process your information
- what purpose we are processing it for
- whether you have to provide it to us
- how long we store it for
- who we share it with
St Cuthbert’s Hospice is the data controller (based on the definitions in the General Data Protection Regulations – GDPR) for the personal information we process, unless otherwise stated.
Why we collect your data
Most of the personal information we process is provided to us directly by you for one of the following reasons:
- You have been referred to one of our clinical services (this information will usually be provided initially by another health provider such as your GP).
- You are a family member of a patient using our services.
- You have made a complaint or enquiry to us.
- You have made a donation to us.
- You play our Lottery
- You wish to attend, or have attended, an event.
- You subscribe to one of our newsletters.
- You have applied for a job or secondment with us or continue to work for us as a member of staff or a volunteer.
- You are representing your organisation.
- Suppliers/Contractors
You may fit into more than one category so please read any sections that apply to you.
We make it easy for you to tell us how you want us to communicate with you and include information on how to change your communication preferences. If you prefer not to hear from us, please get in touch using our contact details outlined at the end of this Privacy Notice.
We won’t use your personal information for activities where our interests are overridden by the impact on you. For example, where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law).
Access to your information
You have the right to ask for a copy of the personal information St Cuthbert’s Hospice holds about you and to correct any inaccuracies in that information.
When requesting clinical information, a consultant with specialist training (the Caldicott Guardian) will review the information before it is disclosed to ensure that no information is shared inappropriately.
We will aim to respond to your request within one month however if it is a complex request we will keep you informed of any potential delay.
There may be rare occasions when we are asked to disclose information to the police or other enforcement agencies. We will consider this on a case by case basis and aim to minimise data that is shared while still supporting the prevention or detection of crime.
Your right to rectification
You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
When you ask us to rectify any information we hold about you we will take reasonable steps to investigate whether the data is already accurate or needs to be amended. We will then contact you to confirm the data has been corrected, deleted or added to. If we believe the data is accurate and therefore disagree with your request we will write to you to inform you of our decision and rationale.
If your request relates to clinical information recorded we are not allowed to delete certain notes from your clinical record, however, in these instances we will make a note that you disagree with the content.
We will action your request within one month.
Your right to erasure
You have the right to ask us to erase your personal information in certain circumstances. However, this excludes the following
- Where we have a legal obligation to keep hold of your data, such as healthcare regulations, employment law, financial regulations.
- When keeping your data is necessary for establishing, exercising or defending legal claims.
When making a request to be erased from our systems we will confirm that this has been carried out or advise you of the legal reason for not proceeding with your request.
Your right to restriction of processing
You have the right to ask us to restrict the processing of your information in certain circumstances for example if you are concerned about the accuracy of data or how it is being used. We will action your request within one month.
Your right to object to processing
You have the right to object to our processing of your data where it relates to processing for our legitimate interests or for direct marketing. If this is the case please contact us using the contact details above and provide us with information about your objections. We will action your request within one month.
Your right to object to data portability
We would always attempt to accommodate requests to access your data in a portable version, however, we do not currently have any systems that would support the electronic transfer of data as outlined in GDPR. Healthcare records can be shared with consent via SystmOne, the national Summary Care Record or via sending paper notes if systems are incompatible. However, we will consider on a case-by-case basis and do our best to respond where we can.
You are not required to pay any charge for exercising your rights. We have one calendar month to respond to you.
Please note that we may ask for proof of identification before processing any request.
Where we work with other providers
This privacy notice does not cover how any partner organisations processes personal information; this includes any external links connected to our website. We encourage you to read the privacy notices on the other websites you visit. We do work with partner organisations to ensure that appropriate data sharing agreements or appropriate terms and conditions are in place to ensure that they are equally compliant in keeping your data as safe as we do.
Raising Concerns
We work to high standards when it comes to processing your personal information. If you have queries or concerns about St Cuthbert’s Hospice handling of your data or that of anyone working on our behalf, please contact us. If you remain dissatisfied with any immediate response to a particular situation, we will escalate this using our complaints policy.
Where your data is held
Your personal data is held on secure servers operated by both St Cuthbert’s Hospice and agencies contracted by us. We do not transfer your data outside the European Economic Area (EEA) and we comply with the protection offered to you under the GDPR and the Privacy and Electronic Communications Regulations 2003 EC Directive (PECR).
Data Security
Personal data is collected and stored securely subject to stringent security measures and is protected against misuse. When we use external data processing services, we do so only under strict contractual terms to mirror the security policies that we have in place.
1. PERSONAL DATA
“Personal data” for the purpose of this notice means any information which helps the Hospice to identify living individuals, such as your name, address, telephone or email address. This data may also include financial details and optional information such as personal, family and lifestyle details. “Identify” means information that tells you something about that person at that time which could have an impact on them e.g. a photograph.
We are committed to holding your personal data securely. This means that only those of our staff, volunteers and contractors that have need to see it, have access. The minimum necessary personal data supplied will be held, and will only be used for the purpose it was supplied. All data will be held securely, in line with our
Data Protection Policy. For details of how information is held and stored please see our: Information Governance Policy.
2. PERSONAL DATA RELATING TO CLIENTS
Clients include, but are not limited to;
- Patients/guests/relatives/carers
- Customers/suppliers/contractors
- Human Resources – staff and volunteers
- Finance and Service User information
- Organisational administrative information
- Complainants
The Hospice obtains contact details (names, addresses, and phone numbers) and health details from clients. This data is obtained, stored and processed solely to assist staff and volunteers in the efficient running of the service requested by the client. Personal details, including next of kin or family details supplied by clients are not used to send marketing material or Hospice newsletters, unless prior consent is obtained. However, information is passed onto our Family Support Team when a patient dies to enable an offer of bereavement support to be made directly to a patient’s loved ones. If you stay on or visit our premises, such as our Inpatient Unit, we may collect your image on CCTV. We may take photographic images of you for medical purposes, with your prior consent, such as in the case of pressure ulcers, to assist in your care. We also receive data about our patients and their families and carers from other healthcare providers.
NHS Data Opt-out
The information we collect about you can be used and provided to NHS healthcare organisations for purposes beyond your individual care, for instance to help with:
- Improving quality and standards of care
- Research into the development of new treatments
- Preventing illness and diseases
- Monitoring safety
- Planning services
This may only take place where there is a clear legal basis to use this information. Confidential patient information about your health and care is only used like this where allowed by law. You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt-out your confidential patient information will still be used to support your individual care. To find out more or to register your choice to opt-out, please visit
www.nhs.uk/your-nhs-data-matters.3. PERSONAL DATA RELATING TO DONORS/SUPPORTERS
The type of personal information we collect
As clinical, fundraising and internal human resources information is collected for entirely different purposes, we do not pass information between the different systems in order to protect your confidentiality unless you have given consent for us to do so. The only exception to this is when a patient dies in our care we will inform fundraising to ensure that any supporters who have died while receiving care with St Cuthbert’s Hospice are not contacted inappropriately causing distress to the family. We will ask for the information we need in order to process your donation or request. This can vary depending on how you choose to support us. We generally record your name, address and any contact information that you choose to give us. We sometimes ask for information about you which is relevant to a specific event, campaign or activity. For example your age for an age restricted event or activity; your T shirt size if you receive one as part of an event or the name of the person that you would like to remember as part of one of our in memory campaigns. You can always choose if you do not want to tell us this information.
Purpose and lawful grounds for processing
The purpose of capturing your personal and potentially sensitive information (i.e. health information for physical events) within income generation (e.g. fundraising and lottery) will be for the purpose of processing your donation, lottery membership, organising an event, processing your gift aid etc. Where there is a ‘legitimate interest’, we will also use your information to contact you about Hospice news, events and other activities that we think may be of interest to you.
What do we mean by ‘legitimate interests’?
The GDPR allows us to collect and process your personal information if it is reasonably necessary to achieve our or others’ legitimate interests, as long as that processing is fair, balanced and does not unduly impact your rights.
St Cuthbert’s Hospice legitimate interests
In broad terms, our “legitimate interests” means running St Cuthbert’s Hospice as a charitable entity in pursuit of our aims and ideals.
Your legitimate interests
“Legitimate interests” can also include your interests, such as when you have requested information, goods or services from us.
How do we balance these interests?
When we legitimately processed your personal information in this way, we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We won’t use your personal information for activities where our interests are overridden by the impact on you.
How we get your personal information
You may provide us with your information online via our website, on a paper form or verbally. We also process information that you provide via third party data processors and they then provide to us, such as Just Giving.
We also purchase data from third party providers in order to promote St Cuthbert’s fundraising activities via telephone marketing. We screen any purchased lists against the TPS and our own ‘do not call’ lists containing donors who have previously opted out of receiving calls. We make rigorous checks to ensure that lists purchased are accurate and that the details were obtained fairly and lawfully. A quality agreement is in place with all third party suppliers of marketing lists. If recipients from purchased data lists are contacted and subsequently become donors, members of our lottery or ask to find out more about the work of the Hospice, they will be advised that their data will be processed in line with the Hospice’s privacy notice and data protection policy.
Why we have it
If you make a donation to the Hospice, take part in one of our fundraising events or campaigns or join the Lottery we use your data to:
Marketing Preferences
We will use the data supplied when you have made a donation to the Hospice or signed up to one of our newsletters to contact you about Hospice news, events and any other information we think will interest you. On the basis of legitimate interest, we will occasionally contact you via post. This includes our bi-annual newsletter, ‘Insight’ which is sent in the Spring and Autumn. You can opt out of received post at any time. On the basis of legitimate interest, we will occasionally telephone you to tell you about our Hospice news and events. We exclude any contacts that have subscribed to the telephone preference service (TPS). You can opt out of receiving telephone marketing calls at any time. With your consent, we will email you to tell you about Hospice news and events. This includes our monthly e-newsletter. You can opt out of receiving email marketing at any time. To update your marketing preferences please call 0191 386 1170 ext. 5 or email
enquiries@stcuthbertshospice.com.
How we store your personal information
Donor information is held on our fundraising database “Donorflex” and our Lottery Database “Lottery Master”. The information that you provide when you make a donation or join our Lottery is held securely on these databases.
If you consent for us to communicate with you via email your contact information will be stored on our fundraising and lottery databases as well as Mail Chimp and Active Campaign. Mail Chimp and Active Campaign are third party platforms and are bound by the same data protection laws that we are.
Payment Processing
We do not keep your credit or debit card number on our fundraising database; Donorflex. Once processed, these are confidentially and securely destroyed and removed from any forms. If you provide us with your bank account number and sort code to set up a direct debit, we will keep these to process a recurring payment. We use a company called Secure Collections to process Direct Debit donations. Secure collections are a direct debit processor based in the UK and are bound by the same data protection laws that we are:
https://www.securecollections.com/home. If you provide us with your bank account number and sort code to join the St Cuthbert’s Hospice Win Win Lottery, we will store these securely in order to process a recurring payment for entry into our lottery draw. St Cuthbert’s Hospice contracts Donor Debit (a product of Buffalo Fundraising Consultants with the BACS Facilities Management services provided by CTT Charity Payments) to set up and manage Direct Debit payments for the lottery in accordance with St Cuthbert’s Hospice and our donors instructions. This includes a submission of Direct Debit to Bacs. In this respect St Cuthbert’s Hospice is the data controller and CCTCP is the data processor. CCTCP will treat any data it processes confidentially and shall only act on the instructions of St Cuthbert’s Hospice as the data controller when acting as the data processor on behalf of St Cuthbert’s Hospice and shall have in place appropriate technical and organisational measures against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to personal data. Donor data may be shared with CTTCP’s third party service provider so that CTTCP can use its Service User Number for the purposes of delivering the services and any further information necessary to make the processing of their Donor Data fair and legal. CCTCP are a direct debit processor based in the UK and are bound by the same data protection laws that we are:
https://www.donordebit.co.uk/. If you wish to make an online donation to St Cuthbert’s Hospice via our website you will be directed to PayPal who process the financial transaction:
https://www.paypal.com/gb/home.
To ensure the maximum level of security is applied to your data, all transactions over the internet to and from these areas are encrypted. Credit and debit card information and bank details are not held on our database or web servers. PayPal are bound by the same data protection laws that we are.
Whilst we endeavour to take all reasonable steps to protect your personal information we cannot guarantee the security of any data you disclose to us whilst online. By adding your personal information to the St Cuthbert’s Hospice website you accept the inherent security risks of communications over the internet and you agree not to hold St Cuthbert’s Hospice responsible for any breach of security unless this is due to our negligence or wilful default. We also take payments via cheque, cash, and CAF (Charities Aid Foundation) voucher. We will record amounts and cheque information for processing purposes.
4. PERSONAL DATA FROM PEOPLE WHO EMAIL US
Any email sent to us, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy.
Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.
5. PERSONAL DATA RELATING TO COMPLAINTS
A complaint or adverse comment can be made verbally (in person or by phone) or in writing (in a letter, in an email or on a form). Our information, How to Make a Complaint, will be available to all of our users from the outset of their treatment as part of their induction to the service. This information will also be available on the Hospice website, at the Hospice reception, and in the Hospice retail outlets. When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We do compile and publish statistics showing information like the number of complaints we receive, but not in a form which identifies anyone.
We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis. We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for 10 years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle. Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.
6. PERSONAL DATA RELATING TO JOB APPLICANTS AND CURRENT AND FORMER HOSPICE EMPLOYEES AND VOLUNTEERS
When individuals apply to work at St Cuthbert’s Hospice, we will only use the information they supply to us to process their application and to monitor recruitment statistics. Where we want to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from the Disclosure and Barring Service we will not do so without informing them beforehand unless the disclosure is required by law.
Personal information about unsuccessful candidates will be held for 12 months after the recruitment exercise has been completed, it will then be destroyed or deleted. We retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data. Once a person has taken up employment with the Hospice, we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once their employment with Hospice has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it.
7. PERSONAL DATA ON OUR WEBSITE
This part of the policy relates specifically to the website http://www.stcuthbertshospice.com/
We collect personally identifiable information through our website.
For example, you may be asked to supply personal data in certain sections of the Hospice’s website, via forms, surveys and questionnaires. When we collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.
7.1 Financial Transactions on our Website
In order to process credit card, direct debit or other financial transactions St Cuthbert’s Hospice may ask for your bank or card details. If you wish to make an online donation to St Cuthbert’s Hospice you will be directed to the PayPal website, which is accessed via the ‘Donate’ section of the website. In order to input this information you will be directed to a secure page for financial transactions. St Cuthbert’s Hospice does not store or record any of these financial details. To ensure the maximum level of security is applied to your data, all transactions over the internet to and from these areas are encrypted. Credit and debit card information and bank details are not held on our web servers. We endeavour to take all reasonable steps to protect your personal information. However, we cannot guarantee the security of any data you disclose to us whilst online. By adding your personal information to the St Cuthbert’s Hospice website you accept the inherent security risks of communications over the internet and you agree not to hold St Cuthbert’s Hospice responsible for any breach of security unless this is due to our negligence or wilful default.
7.2 Third Party Services
When someone visits our website we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.
For sponsored events we encourage supporters to use the Just Giving or Virgin Giving websites. These third parties will only share your information with us when you have given permission for them to do so. You can find out more about this very easy and efficient means of collecting sponsorship for your event by visiting:
St Cuthbert’s Hospice contracts Capen Limited, operating as Zaffo (a company
registered in England and Wales (company number 8141955) to process online ticket sales for its raffles through the Capen website.
As part of their service, Capen will only use player’s personal data for the following purposes;
- To provide their services (including raffle draw and donation facilities) to you and to administer user records;
- To process transactions including the purchase of tickets to the draw
- To arrange for the fulfilment of prizes.
- Where you opt in to receiving news and fundraising updates via email.
Capen’s payment service provider will process customer not present transactions for nominated card types in a secure, online real-time environment and Credorax authorises the transaction with card issuing banks.
7.3 Links to other websites
This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.
7.4 E-newsletter
We use a third party provider, MailChimp, to deliver our monthly e-newsletter. We gather statistics around email opening and clicks help us monitor and improve our e-newsletter. For more information, please see
https://mailchimp.com/legal/privacy/
7.5 Use of cookies
7.6 Copyright
All rights reserved; no part of the website, including information, images, photos, logos and names can be republished, posted, broadcast in any form whatsoever without prior written permission by the copyright holders.
Documents on this site may not be downloaded, altered or adapted for any purpose without prior written permission from the copyright holders.
8. INFORMATION SHARING
Normally, St Cuthbert’s Hospice will be the only people who are able to access your personal information. However, there may be times when we need to give your details to others, such as:
- IT providers who provide support to us to manage the computers, phone systems or software that we use and from whom we secure confirmation that their data storage and use policies are at least as stringent as ours;
- Public relations companies and other organisations that help us in printing and sending out our marketing material.
- We may sometimes be required to disclose your personal data by law such as by a regulator with appropriate power, or court order.
We do not give anyone else access to your information, in return for payment, for their marketing or commercial purposes.
We will not share your personal information with anyone who claims to represent you unless we are satisfied that you have appointed them or they act in some recognised official capacity. There may be a delay to us dealing with requests whilst we confirm the caller’s identity, or check that we have your approval to deal with them.
Track and Trace
Some new measures have been put in place within the Hospice so that we can re-open safely to the public. This includes collecting visitors’ personal information to support the various contact tracing schemes in the UK.
Specific information will be collected that has been set out in government guidance. This will include things like your name, contact details and date visited for example. This information will be stored securely in case it should be required for contact tracing purposes.
This personal information that we collect for contact tracing will not be used for other purposes, such as direct marketing. The personal data obtained for contact tracing purposes will be erased after 21 days in line with government guidance. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, this information will be securely disposed of.
9. COMPLAINTS OR QUERIES
The Hospice tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
This privacy notice does not provide exhaustive detail of all aspects of the Hospices collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.
10. ACCESS TO PERSONAL INFORMATION
The Hospice will try to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a verbal or written ‘subject access request’ under the Data Protection Act 1998. If we do hold information about you we will:
- Give you a description of it;
- Tell you why we are holding it;
- Tell you who it could be disclosed to; and
- Let you have a copy of the information in an intelligible form.
To make a request to the Hospice for any personal information we may hold you should contact our Data Controller:
Data Controller
St Cuthbert’s Hospice
Park House Road
Durham
DH1 3QF
If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone. If we do hold information about you, you can ask us to correct any mistakes by, once again, contacting the Data Controller.
11. CHANGES TO THIS PRIVACY NOTICE
St Cuthbert’s Hospice may from time to time need to update and amend this policy in light of changes in the law or developments in our own or industry standards. The latest version of this policy will be posted on our website.
12. HOW TO CONTACT US
St Cuthbert’s Hospice,
Park House Road,
Durham
DH1 3QF
Tel: 0191 3861170
ASSOCIATED DOCUMENTS AND PROCEDURES
Document Name: Privacy Notice
Date of last review: November 2020
Date of next review: November 2023
