Privacy policy

POLICY DERIVED BY H.R. & I.T SUB GROUP

1. Introduction
Springhill Hospice is committed to protecting the privacy of everyone who uses our services: as patients and carers or as employees and volunteers; and that of anyone who supports our work through fundraising, retail or lottery activities. Please read this policy carefully, along with our terms and conditions and any other documents referred to in this policy, to understand how we collect, use and store your personal information.

2. Who are We?
Springhill Hospice is registered as a charity in England and Wales (registered charity number 701798) and we are also registered as a company limited by guarantee (company number 2325905). Our registered office address is: Broad Lane, Rochdale, OL16 4PZ. This policy covers Springhill Hospice and its subsidiary companies; Springhill Hospice (Services) Ltd and Springhill Hospice (Lottery) Ltd.

3. Legal Compliance
Springhill Hospice takes data protection very seriously. We are required to adhere to the requirements of the Data Protection Act 1998, the General Data Protection Regulations 2018 (GDPR), Public Records Act 1958, Freedom of Information Act 2000, all other related privacy laws and any codes of practice issued by the Fundraising Regulator (FR) or the Information Commissioners Office (ICO). Our intention is to be compliant, user friendly and to ensure our supporters only receive the information they are interested in. Unless stated otherwise, Springhill Hospice is the data controller in respect of all data collected by us on this Website or otherwise. This means that we are responsible for full legal compliance. As you browse our website, get in touch with us, or use our services we collect, process and store your personal information. This deepens our understanding of what you are interested in, and helps us to improve the efficiency of the services of the Hospice and fundraising communications. Springhill Hospice and our trading subsidiaries will never exchange or sell your information to another organisation for their own marketing purposes. We know that this is important to you, and want to reassure you that you’re always in control of how we use your personal information in regards to marketing and fundraising activities. We do however need to collect and use your personal information for carefully considered and legitimate business purposes, which help ensure we can run Springhill efficiently, raise funds effectively and deliver our charitable services. This policy sets out how your personal data will be used, what data we collect, our legal basis for its use, along with outlining your rights in respect of personal data.

4. Why we Collect Personal Data
As a registered charity, Springhill Hospice relies on the people living in its local community for support - both financially and in kind. Information about our local community such as your personal information may be used to help us effectively deliver the Hospice’s services or to help us raise funds for those charitable services.
Ultimately this means Springhill Hospice is able to continue to provide excellent care to those who need it and support their families, friends and carers.

We collect and process personal information for certain legitimate business purposes, which include some or all of the following:

to provide appropriate treatment and care
where processing enables us to monitor, enhance, modify, personalise or otherwise improve our services/communications for the benefit of our patients and supporters
to identify and prevent fraud
to enhance the security of our network and information systems
to better understand how people interact with our web and social media sites to ensure that content is presented in the most effective manner for you and your device
to provide postal communications which we think will be of interest to you to provide you with updates, news, information about our fundraising events and campaigns and training opportunities
to determine the effectiveness of promotional campaigns and advertising Wherever we process data for these purposes we will ensure that we always keep your personal data rights in high regard and take account of these rights

5. How we Collect Personal Data

Information you give us. For example, when you enquire about our activities, register with us, make a donation to us, ask a question about our services or otherwise provide us with your personal information. This personal data may be given face to face, electronically (via email, our website or social media pages), on paper (such as any form you complete) or verbally (such as during any telephone conversations we have with you).
Information we get from your use of our website and services. We collect information about the services you use and how you use them, like when you watch a video on YouTube, visit our website or social media pages (Facebook, Twitter and Instagram) or view and interact with our ads and content.
Information from third parties. We may also receive information about you from third parties. For example, this may be from other healthcare providers or from online fundraising sites such as Just Giving or BT MyDonate. This can include information such as your name, postal address, email address, phone number, your geographic location, credit/debit card details and whether you are a tax payer so that we can claim Gift Aid.
Information about other people. If you provide personal data to us relating to any person other than yourself, you must ensure before you do so that they understand how their personal data will be used and that you are authorised to disclose it to us, and to consent to its use on their behalf.

Wherever possible we use aggregated or anonymous information which does not identify individual visitors to our website, social media pages, supporters at our events or service users.

Care and Support Services
If you, a relative, or friend are cared for or supported by Springhill Hospice, the personal and/or sensitive personal information you provide to us will be used only for the purposes of providing you with services, or training or monitoring the quality of our services. Springhill Hospice will not disclose your personal information to any third party without your consent, except to professional bodies, or otherwise as required by law, regulation or codes of practice. If you are receiving care as a patient we may need to disclose information to other healthcare professionals and organisations involved in your care, but will only do so with your consent. If you are referred to one of our clinical services we will collect data from you and may also receive it from other healthcare providers.

6. The Type of Personal Data we Collect
We always strive to provide a clear, honest and transparent approach regarding how and when we may collect and use your personal data. The overview below summarizes the different types of data we collect and some of the reasons why we do this. We may not use your personal information for all of these purposes – it will depend on the nature of our relationship with you, and how you interact with our services, websites, and fundraising activities. Data protection law recognises that certain categories of personal information are more sensitive, this is known as sensitive personal data and covers health information, race, religious beliefs and political opinions. We do not usually collect special categories of data about our supporters unless there is a clear reason for doing so.

Purpose	Examples of personal data we collect:
1. Delivery of charitable services	Delivery of our core Hospice services will require the recording of patient’s contact details and their eligibility for our charitable services. As a user of our clinical or community services we will need to collect information such as: Name Age Address Gender Possibly some sensitive personal information concerning your health and wellbeing, ethnic origin, sex life and religious views In order to provide complete care we may also collect some information about family members and carers Where appropriate we may need to take still images of you for medical purposes, such as in the case of pressure ulcers We also receive data about our patients, their families and carers from other healthcare providers. If you utilise our Advice Line your information will be recorded (on paper/computer) to allow support and appropriate advice to be given. This information will also be recorded for training and quality assessment purposes. If you stay on our premises, such as our In-Patient Unit, or visit our Day Therapies, we may collect your images on Closed Circuit Television (CCTV) used in some of the public areas at the Hospice for security purposes. We will not use your information for other purposes without your permission including the sharing of your data with our Fundraising and Marketing team, unless you specify this.
2. Fundraising and Marketing	Springhill Hospice undertake a range of fundraising and marketing activities that are designed to raise income or promote the aims and objectives of the charity. We use a range of fundraising and marketing activities and the type and quantity of personal data we collect and how we use it depends on why you are providing it. Where it is appropriate we may ask and record information about: Your name and contact information including postal address, telephone numbers and email address Event specific information. This is so we can cater for your needs and ensure our events are safe and legal. Examples include, but are not limited to: - Requesting sensitive personal information such as health information if you are participating in a “high risk” event such as a Skydive. - Dietary requirements if you are attending an event where a meal is supplied. - Your t-shirt size so we can provide you with a running vest for an appropriate event. - Your date of birth if there is an age restriction on an event or activity you have chosen to take part in, such as our Lottery. - Information about donations you have made to Springhill Hospice and communications to and from you. How you heard about an event/activity/the Hospice. Your personal contact/communication preferences. Why you have decided to donate to us. We understand that you may have private reasons for doing so and we only want to know the answer it you are comfortable telling us. Your bank or credit card details (when provided for a single financial transaction they are used and destroyed after use. For recurring financial transactions such as Direct Debit payments, bank or card details are stored securely in a locked cabinet). Information for Gift Aid – We collect information about whether you are a UK tax payer so that we can claim Gift Aid. Please rest assured we do not collect information about your actual tax payments, just whether you are a tax payer, or not. Your consent to use photographs, videos or quotes. Sensitive personal information if you make the information public or if you tell us about your experiences of the Hospice (for example you participate to act as a case study for us); we will make it clear when we collect this information from you what sensitive personal data we are collecting, why we are collecting it and the ways in which we may use it. We may also need to use your personal information for the prevention of fraud, to identify any misuse of our services, or for debt recovery. The personal information we collect about you for the purposes of our Fundraising and Lottery activities may also include photo images or video footage using Closed Circuit Television (CCTV) that is used in some of the public areas across Hospice sites for security purposes.
3. Management of Volunteers	If you are one of our fantastic volunteers, we may ask you to provide the following information: Your name and contact details Emergency contact information Contact details for referees Your interests, experience and relevant qualifications and the area of volunteering you are interested in Your availability Your driving licence record Any previous convictions Your DBS check Relevant medical information If you have received a service from us (such as counselling) in the past 12 months We may use your personal information to ensure that we can give you a volunteer role that is suitable to you, manage and support you in your volunteering role, deliver training, involve and update you on our projects and campaigns and to ensure your safety. This may include sending you newsletters or information about our fundraising activities so you can advise the public about our work. The personal information we collect about you may also include photo images or video footage using Closed Circuit Television (CCTV) that is used in some public areas across Hospice sites for security purposes.
4. Retail trading and e-commerce activity	Springhill Hospice operates a network of charity shops, an e-commerce website, and an e-bay store. If you interact with these services, we may use your personal information for the marketing of similar products. We may also use your personal information for the recovery of Gift Aid (where you have completed a Gift Aid declaration). The personal information we collect about you may also include photo images or video footage using Closed Circuit Television (CCTV) that is used in some public areas across Hospice sites for security purposes.
5. Analysis, Targeting, and segmentation	In order to fund our vital work, we have to communicate our aims and objectives and ask people for financial support. Efficiency is very important to us, as we value every single donation. Therefore, we only want to send communications that are genuinely interesting and relevant to you. We will make use of information you have given us, your interactions with our services, and some publicly available information to help us predict your interests, tailor and personalise our communications.
6. Staff administration	If you apply for or accept a job with us, we will collect, process and store your contact information, bank details and keep a full record of your application and employment history. We process the personal information of our employees for recruitment, staff administration, remuneration, pensions, and performance management purposes. The personal information we collect about you may also include photo images or video footage using Closed Circuit Television (CCTV) that is used on some Hospice sites for security purposes.
7. Our website	If you use our website we will store data about your internet browser, I.P. address, the timings of your visit and a record of which pages you looked at. IP Address - In order to understand how users use the Springhill Hospice website and our services, we may collect your Internet Protocol addresses (also known as IP addresses). Your IP address is a unique address that computer devices (such as PCs, tablets and smartphones) use to identify themselves and in order to communicate with other devices in the network. Cookies – Springhill Hospice uses “cookies” to help track and monitor the usage of our website. With cookies, the information we collect and share is anonymous and does not personally identify you. It does not contain your name, address, telephone number or email address. The cookies we use are cookieNotice, pxRatio and basketID, which is essential for parts of the site to operate. What is a cookie? A cookie is a small file of letters and numbers that we may put on your computer or mobile device when you access our website. These cookies allow us to distinguish you from other users of the website, helping us to provide you with a good experience when you browse our website and also to allow us to improve our site. For example, they will tell us whether you have visited our site before or whether you are a new visitor. Access www.allaboutcookies.org to find out more about cookies and how you can disable them. Links to other websites - The Springhill Hospice website may include links to other sites, not owned or managed by us. These links are provided for your convenience. We are only responsible for our privacy practices and our security. We recommend that you check the privacy and security policies and procedures of each and every other website that you visit and each organisation that holds your personal data. By using the Springhill Hospice website and/or giving personal data to us you indicate that you consent to us using your personal data in accordance with this Privacy Policy.

7. How we may use your Information
When Springhill Hospice collects and uses your personal information, we will make sure this is only done fairly and lawfully in accordance with at least one of the legal grounds available to us under Data Protection law. We may use your information to understand your needs and interests and to provide you with the best service we can. We want to have the best relationship we can with you and for you to enjoy your interactions with the hospice.

7.1 Where we have your consent as a lawful basis we will use your data;

to provide appropriate treatment and care
to provide you with services, products or information you have requested
to provide further information about our work, services, activities or products
to invite voluntary participation e in surveys or research
to further our charitable aims, including for fundraising activities
to process your application for a job or volunteer role with us

7.2 Where we have a legal/contractual obligation to you we will use your data;

to claim Gift Aid (this involves sharing your information with HMRC)
to fulfil sales made online or through our retail shops
to fulfil your membership to our Lottery or Raffles
for fraud prevention, credit risk reduction or otherwise as required by law or regulation
for internal record keeping, for suppression lists and to record the ways in which you wish to hear from us and your interests regarding our work
for internal record keeping in relation to staff, volunteer and supplier/financial records
to request Direct Debit payments in relation to memberships you have subscribed to
to register and administer your participation in fundraising activity for which you have registered

7.3 Where we have a genuine and legitimate reason and we are not harming any of your rights and interests we may use your data;

to process any donation(s) or payment(s) we may receive from you
to make contact with you for administration purposes
to communicate volunteering opportunities
for internal record keeping, such as the management or feedback of complaints
to analyse and improve our work, services, activities, products or information (including our website) or for our internal records
to check on your preferences from time to time to ensure they are up to date
to send you direct marketing about ways in which you have supported the Hospice previously and where you have not specifically told us not to contact you. For example, if you have previously donated to our Light up a Life appeal, we will send it to you unless you tell us not to
to register and administer your participation in events for which you have registered
to confirm memberships and subscriptions (such as playing in our Lottery)

*The lawful basis for the collection and processing of your personal data is:

That it is necessary to fulfil the contract that you are going to enter into or have entered into with Springhill Hospice
That you have given your consent and/or
That it is in the legitimate interests of Springhill Hospice and does not prejudice or harm your rights and freedom. Our legitimate interests for processing your data are:

- Relevant and appropriate relationship – in relation to our provision of care and staff records.
- Reasonable expectation – Where you a long term or regular supporter of Springhill Hospice and would expect to receive communications from us.
- Direct marketing – We will send postal marketing and fundraising asks which further the aims and objectives of Springhill Hospice. We will make sure our postal marketing is relevant for you and tailored to your interests.
- Online ordering – In order for us to process and fulfil an order or registration via our website, payment has to be taken and contact information collected such as name, address and contact details collected.
- Your best interest – We will process your information to protect you against fraud when transacting on our website, and to ensure our websites and systems are secure.
- Personalisation – We will adapt our processing to enable us to enhance, modify, personalise or otherwise improve our services or communications for the benefit of our supporters.
- Analytics – We will process your personal information for the purpose of customer analysis, assessment, profiling and direct marketing, on a personalised or aggregated basis, to help us with our activities and to provide you with the most relevant information as long as this does not harm any of your rights and interests.
- Research – We will process your data to determine the effectiveness of promotional campaigns and advertising and to develop our products, services, systems and relationships with you.
- Due diligence – We may need to conduct investigations on supporters and business partners to determine if those companies or individuals have been involved or convicted of offences such as fraud, bribery and corruption.

Where we process your personal information for our legitimate interests we will consider and balance any potential impact on you and your rights under the Data Protection Act and any other relevant law. Our legitimate business interests do not automatically override your interests. We will not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted to by law such as to keep records on certain activities such as financial donations and clinical records or for HMRC audit or other legal reasons Where we have required and obtained your consent to process your personal data, you have the right to withdraw that consent at any time. If you do, it will not affect the lawfulness of any processing for which we had consent prior to your withdrawing it.

7.4 Your credit and debit card information
If you use your credit or debit card to donate to us, or buy something online, we pass your card details securely to our payment-processing partner as part of the payment process. We do this in accordance with the Payment Card Industry Security Standard and don’t store the details on our website or databases.

8. Data Sharing
Springhill Hospice has never, and will never, share or sell your personal information to another organisation for their own marketing purposes. However, there are legitimate situations where we may share data with trusted third parties, subcontractors, our regulators and with law enforcement authorities. Examples of this may include:

With the mailing house who send out our mailings
With a data cleansing company to ensure that the information we hold is up to date
With the company who sign new players to our Lottery
With our Lottery provider
With the company who processes Gift Aid in our shops
With HMRC for Gift Aid
With the Gambling Commission if required by them to do so
With the Care Quality Commission if required by them to do so

All our trusted partners are required to comply with data protection laws and our high standards. In these circumstances, we will always make sure appropriate contracts and controls are in place and we regularly monitor all our partners to ensure their compliance. We will ensure that your personal data is properly protected and that it is only used in accordance with this Privacy Policy.

We may share personnel data in relation to staff and volunteers with our HR advisors and with the Care Quality Commission.

We may share patient data with other healthcare providers with the patient’s consent. We may also be legally required to share it with local authorities and our regulator, the Care Quality Commission. Consent for this by patients can be withdrawn at any time.

We use third party electronic payment providers such as PayPal to administer some transactions. They have their own privacy policies and we encourage you to read them.

9. How we Might Contact You
We may need to contact you for various reasons and in a number of different ways. If you have given consent, or there is legitimate interest, we would like to contact you and/or any person whose information you provide to us with further information about Springhill Hospice. We will, where possible, try to tailor the communications we send to you so that they are relevant and in line with the preference options you have chosen which form part of the personal profile we will create for you.

10. Your Choice – Accessing and Updating your Preferences
It is always your choice as to whether you want to receive information about our work, how we raise funds and the ways you can get involved. You can change your preferences at any time by using the ‘your communication preferences’ form on the Springhill Hospice website, contacting us using the ‘how to contact us’ details below, or by following the instructions with each communication you receive. Please note it may take up to one month for your changes to be implemented and for communications to start or cease.

We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted by us for such purposes. However, we will retain your details on a suppression list to help ensure that we do not continue to contact you.

11. Updating and Correcting Personal Data
We aim to ensure that all the information we hold about you is accurate, and, where necessary, kept up to date. We will seek to update consent from supporters on our Fundraising Database at a minimum of every 36 months. Consent from patients and families will be sought and updated at each point of admission. If any of the information we hold about you is inaccurate and either you advise us or we become otherwise aware, we will ensure it is amended and updated as soon as possible.

Where appropriate, in order to save the Hospice money, we may use data cleansing services to update us on people who have moved home or who have died. If you have registered a change of address with the Post Office’s National Change of Address database, we will update your details through this mechanism.

12. Under 16s
Springhill Hospice is committed to protecting the privacy of the young people that engage with us. Some of our activities are targeted at families, particularly fundraising events. If you are under 16, please let us know when you sign up for events and ensure that you have the consent of a parent or guardian before giving us your details. We will ensure that your information is only used for the purposes it has been provided and in some circumstances may refuse certain services, products or events.

13. Vulnerable Supporters
Springhill Hospice is committed to protecting our vulnerable supporters and follow the guidance issued by the Fundraising Regulator and Institute of Fundraising regarding treating our donors fairly. We believe this helps to support our staff and volunteers who come into contact with supporters in providing high-quality customer care, ensuring anyone donating to Springhill Hospice is in a position to make a free and informed decision.

14. How do we Protect Data?
At Springhill Hospice we take the security of personal data and privacy seriously. We employ appropriate measures through internal policies and controls to safeguard personal data and have procedures in place to ensure that our paper and computer systems and databases are protected against unauthorised disclosure, use, loss and damage.

If we were to experience a data breach, this would be reported through our internal reporting system in line with our Incident/Accident Policy and where appropriate reported to the relevant supervisory authority within 72 hours of us becoming aware of the breach.

Our website uses a HTTP/SSL secure certificate to ensure any information you send to us will be encrypted. Non sensitive details (such as your email address, etc.) are transmitted normally over the internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us and you do so at your own risk.

14.1 Network Security /Email
At Springhill Hospice the network is managed by NHS CSU. As part of the Heywood, Middleton and Rochdale COIN. Appropriate firewalls and virus protection software have been installed with the assurance that these are safe, secure and conform to NHS N3 code of connectivity.

Springhill Hospice uses Standard NHSmail (accounts ending in @nhs.net) these are a secure national email service which enables the safe and secure exchange of sensitive and patient identifiable information within the NHS and with local/central government such as gov.uk, pnn.police.uk

Personal data stored in our database is only accessible by appropriately trained staff and volunteers who need to access your personal data as an essential part of their role. All access is tracked through individual login credentials.

We only use third party service providers where we are satisfied that the security they provide for your personal data is at least as stringent as we use ourselves.

15. How long we keep your Information
We will normally keep your information for as long as is required to enable us to operate our services but we will not keep your information for any longer than is necessary. We will take into consideration our legal obligations, tax, and accounting rules when determining how long we should retain your information. If after this point you have not supported us or taken part in any of our events or activities we will keep only minimal personal data to ensure we can respect your preferences in the future.

If you are a donor, we will only retain limited personal data if we haven’t had any contact with you within the last three years. *Gift Aid records are kept on file for a minimum of 6 years in order to comply with HMRC regulations.

16. Use of your Personal Data Outside of Europe
We do not currently transfer personal data outside of the United Kingdom or the European Economic Area. If this changes and we do need to transfer your personal data to other territories, we will take appropriate steps to ensure that it is protected in accordance with this Privacy Policy and applicable privacy laws.

17. National Data Opt-Out
The national data opt-out was introduced on the 25th May 2018, enabling patients to opt out from the use of their data for research or planning purposes, in line with the recommendations of the National Data Guardian in her Review of Data Security, Consent and Opt-Outs.

By March 2020, all health and care organisations are required to be compliant with the national data opt-out policy, where confidential patient information is used for research and planning purposes.

Springhill Hospice has identified, we do not use confidential patient information for purposes beyond an individual’s care and treatment. However, we will ensure this privacy policy is available our staff, patients, volunteers.

18. Your Rights
Where Springhill Hospice is using your personal information on the basis of your consent, you have a number of legal rights in respect of your personal data. These include:

Right of Access – You are entitled by law to request a copy of the personal information we hold about you. The same right applies to any other person whose personal data you provide to us. We will require proof of identity and proof of authority if the request comes from someone other than the person whose data we are asked to provide. This will ensure we only provide information to the correct person. We expect to respond to requests within 30 days of receiving them.
Right to be Informed – You have the right to be told how your personal information will be used. This policy document, and shorter summary statements used on our communications, are intended to be a clear and transparent description of how your data may be used.
Withdraw consent to other processing – Where the only legal basis for our processing your personal data is that we have your consent to do so, you may withdraw your consent to that processing at any time and we will have to stop processing your personal data. Please note, this will only affect a new activity and does not mean that processing carried out before you withdrew your consent is unlawful.
Right to Object – You have an absolute right to stop the processing of your personal data for direct marketing purposes. You can exercise this right at any time and can update your preferences yourself or ask us to do it for you. See section ‘Updating and correcting personal data’ above for details.
Right of Rectification – If you believe our records are inaccurate you have the right to ask for those records concerning you to be updated. See section ‘Updating and correcting personal data’ above for details.
Right to restrict processing – In certain circumstances you may be able to require us to restrict our processing of your personal data. For example, if you consider what we hold is inaccurate and we disagree, then processing may be restricted until the accuracy has been verified.
Right of Erasure – Where we have no lawful basis for holding onto your personal data you may ask us to delete it under your right to be forgotten. In many cases we would recommend that we suppress you from future communications, rather than data deletion.
Right to Data Portability – In limited circumstances you may be entitled to have the personal data you have provided to us sent electronically to you for you to provide to another organisation.
Complaints –see section ‘How to lodge a complaint’ below for more details.

If you wish to find out more about these rights, please contact us using the details below

19. How to lodge a complaint
If you believe that we have breached your privacy in any way, we urge you in the first instance to contact our Data and Procurement Officer. All complaints, whether made verbally or in writing, must be brought to the attention of the Chief Executive as per company policy. If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow Cheshire
SK9 5AF
Tel: 0303 123 1113
Website: https://ico.org.uk

19. Changes to this Privacy Policy
Privacy laws and practices are constantly developing and we aim to meet high standards. Our policies and procedures are, therefore, under continual review. We may, from time to time, amend or update security and privacy policies.

We will ensure our website has our most up to date policy and suggest that you check this page periodically to review our latest version.

This policy was last updated November 2019.

How to contact us
If you have any questions regarding our Privacy Policy please contact us:
IT and Procurement Officer
Springhill Hospice Broad Lane OL16 4PZ
Tel: 01706 649920

Helping you

Helping us

POLICY DERIVED BY H.R. & I.T SUB GROUP

Get in touch

We are happy to answer any questions you have about our privacy policy