This Privacy Notice sets out what personal data we, Eden Valley Hospice & Jigsaw, hold about you and how we collect and use it. It applies to current and former service users, supporters, lottery members and donors (together referred to as ‘Supporters and Service Users’ or ‘you’).
We are required by data protection law to give you the information in this Privacy Notice. It is important that you read the Privacy Notice carefully, together with any other information that we might give you from time to time about how we collect and use your personal data.
This Privacy Notice applies from 25 May 2018, when the General Data Protection Regulation comes into force. We may update this Privacy Notice at any time.
Who we are…
We are Eden Valley Hospice & Jigsaw and we are the “controller” for the purposes of data protection law. This means that we are responsible for deciding how we hold and use personal data about you.
- Our registered charity number is: 1008796
- You can email us at: firstname.lastname@example.org
- You can call us on: 01228 810801
- Our address is:
Eden Valley Hospice & Jigsaw
Eden Valley Hospice is also registered with the Information Commissioner in the UK as a Data Controller (registration number Z5275730).
What type of personal data do we hold about you?
Personal data means any information relating to a living individual who can be identified (directly or indirectly) in particular by reference to an identifier (e.g. name, donor number, email address, physical features). It can be factual (e.g. contact details or date of birth), an opinion about an individual’s actions or behaviour, or information that may otherwise impact that individual in a personal capacity.
Data about supporters can include:
- Name and contact information including postal address, telephone numbers and email address.
- Information such as your date of birth, the fundraising events, volunteering opportunities or activities you are interested in and your personal contact preferences.
- Financial information such as your debit/credit card or bank details so that we can process payments and donations. We do not store these details after they have been processed.
- Whether you are a UK taxpayer, so that we can claim Gift Aid on your donations.
- Information about donations you have made to Eden Valley Hospice & Jigsaw, and communications to and from you.
- How you heard about us and your reasons for supporting us.
- Event based information (e.g. your t-shirt size, medical conditions or dietary requirements).
- If you visit the Hospice you may appear in still images or video footage using Closed Circuit Television (CCTV) that is used on site for security purposes.
Data about service users (if you use our clinical services) can include:
- Information such as your name, age, gender, postal address.
- In some circumstances we may collect sensitive personal information concerning your health and wellbeing, ethnic origin, and/or religious views.
- During the referral process we will request information about your key medical issues/reason for referral, diagnosis and other data relating to your medical condition, home situation and the key healthcare professionals involved.
- As part of our efforts to provide complete, bespoke care for our patients, we may also collect some information about your family members and carers.
- During your visits to the Hospice itself you may appear in still images or video footage using Closed Circuit Television (CCTV) that is used on site for security purposes.
This information is collected for the purposes of providing clinical and social care services to those referred to us and could be used and shared between departments within the organisation as well as with other health and social care service providers under strict guidelines. We may also receive further information from the NHS which is only shared with us under strict guidelines and where information sharing could improve the delivery of care or is necessary for direct care.
Data protection law divides personal data into two categories: ordinary personal data and special category data. Any personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, physical or mental health conditions, sexual life or sexual orientation, or biometric or genetic data that is used to identify an individual is known as special category data. (The rest is ordinary personal data).
For our supporters, we only request ordinary personal data. Should we require anything that is classified as special category data, this will be highlighted to you and a reason given for its collection.
With regards our service users, special category data is collected much more regularly. The personal and/or sensitive personal information you provide to us will be used only for the purposes of providing you with services, or training or monitoring the quality of our services.
Why do we hold your personal data and on what legal grounds?
We hold and use your ordinary personal data for the purposes of funding and providing our services to the community. This will include, for example: management of your donor relationship with us; administration of your lottery membership; monitoring and assessment of our clinical services; administering your participation in one of our fundraising events; to fulfil sales made online or through our shops; performance of day-to-day business activities, etc.
Data protection law specifies the legal grounds on which we can hold and use personal data.
Most commonly, we rely on one or more of the following legal grounds when we process your personal data:
- Where we need it to perform the contract we have entered into with you (performance of the contract). This may include, for example, ensuring that we contact you to inform you of winnings in our Hospice Lottery, or that we use your provided details to set up a Direct Debit for making regular donations.
- Where we need it to comply with a legal obligation (legal obligation). This may occur where, for example, we are required by law to keep records on certain activities such as financial donations and clinical contacts or for HMRC audit or other legal reasons.
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (legitimate interest). Due to our status as a charity, this can include providing marketing materials to you following a donation you have made (as by making a donation you have shown interest in the activities of the Hospice). You can, of course, request that you do not receive marketing from us at any time.
How do we collect your personal data?
You provide us with most of the personal data about you that we hold and use. Other personal data about you we hold and use is generated by you in the course of your relationship with the Hospice (as a Supporter or Service User).
We collect personal information about you in several ways:
- through a referral form when being referred to our care
- if you send or deliver a donation to the Hospice
- if you donate goods to one of our Hospice shops and wish for us to claim Gift Aid
- via our website when you support us through making a donation; becoming a volunteer; applying for or taking part in, organising or attending a fundraising event; registering to take part in other types of non-fundraising events that we hold; joining a campaign, or requesting your donated goods be collected.
- when you contact us by mail, phone, or email.
- when you complete one of our online or paper-based surveys or purchase or order an item from our online shop.
- via an accident and incident form when you have been involved in an accident or incident on one of our premises or when attending one of our events or activities.
We may collect your personal information from other organisations and sources. For example, if you take part in an event run by another organisation with which we partner, such as the Great Cumbrian Run; when you raise funds via JustGiving, Virgin Money Giving or similar websites; or through social media platforms, e.g. Facebook, Twitter, LinkedIn or Instagram. We also utilise a canvassing agency for signing up members to our Weekly Lottery. If you sign up to the lottery via one or their representatives, the agency passes on your details to us.
When providing information to us via these channels, you should check these companies’ privacy policies and settings to understand how they use your personal information. We always check that third parties and other organisations have consent from you to pass your information on to us.
Who do we share your personal data with?
We have never and will never sell your data or share it with another company or charity for marketing purposes.
We keep your data safe and only share it when we are required to by law or we are using other companies’ services - for example:
- with the mailing house who send out our supporter newsletter twice a year
- with a data cleansing company to ensure the information we hold is up to date
- with the company who sign new players to our lottery
- with the company who process Gift Aid in our shops
- with the company who set up and process Direct Debits for Lottery and Regular Giving donations
- with HMRC for Gift Aid claims
- with the Gambling Commission if required by them to do so
Any company whose services we use in this way are required to treat your data as carefully as we do and use it only in the course of the work they are doing for us. We always use secure encryption when your data is transferred to or from them.
With regards clinical information about our Service Users, Eden Valley Hospice & Jigsaw will not disclose your personal information to any third party without your consent, except to:
- healthcare professionals and organisations involved in the provision of care and
- exceptionally, to professional bodies or otherwise as required by law, regulation or codes of practice.
How long will we keep your personal data?
We will not keep your personal data for longer than we need it for our legitimate purposes.
We take into account the following criteria when determining the appropriate retention period for Service Users’ and Supporters’ personal data:
- the amount, nature, and sensitivity of the personal data
- the risk of harm from unauthorised use or disclosure
- the purposes for which we process your personal data and how long we need the particular data to achieve these purposes
- how long the personal data is likely to remain accurate and up-to-date
- for how long the personal data might be relevant to possible future legal claims
- any applicable legal, accounting, reporting or regulatory requirements that specify how long certain records must be kept
Given the variety of Service Users’ and Supporters’ personal data that we use and the varying circumstances in which we use it, it is difficult to specify ahead of time precisely how long we will keep particular items of personal data. Where possible, we will add to this Privacy Notice to identify retention periods applicable to your personal data, which have been determined on the basis of the above criteria and which represent the longest period for which we will ordinarily keep it. This makes up part of Eden Valley Hospice & Jigsaw’s Data Retention Policy. We may often keep particular items of your personal data for less time. However, there may also be circumstances in which it is appropriate for us to keep particular items of your personal data for a longer period than that set out in Data Retention Policy. In particular, we will always keep your personal data for so long as we are required to do so under legal, accounting, reporting or regulatory requirements.
In addition, for some types of personal data, it is more appropriate to decide retention periods on a case by case basis (also using the criteria described above).
We will base these decisions on relevant circumstances, taking into account the criteria listed above.
You have a number of legal rights relating to your personal data, which are outlined here:
- The right to make a subject access request. This enables you to receive certain information about how we use your personal data, as well as to receive a copy of it and to check that we are lawfully processing it.
- The right to request that we correct incomplete or inaccurate personal data that we hold about you.
- The right to request that we delete or remove personal data that we hold about you where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
- The right to object to our processing your personal data where we are relying on our legitimate interest (or those of a third party), where we cannot show a compelling reason to continue the processing
- The right to request that we restrict our processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
- The right to request that we transfer your personal data to you or to another party, in a structured format. This right applies in respect of data that you have provided where our legal ground for using the data is that it is necessary for the performance of a contract or that you have consented to us using it (this is known as the right to “data portability”).
If you would like to exercise any of the above rights, please contact Gill Martin, Head of Finance & Facilities (email@example.com) in writing. Note that these rights are not absolute and in some circumstances we may be entitled to refuse some or all of your request.
If you have any questions or concerns about how your personal data is being used by us, you can contact Gill Martin at the above address, or arrange a meeting during office hours at the Hospice.
Note too that you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Details of how to contact the ICO can be found on their website.