POLICY DERIVED BY H.R. & I.T SUB GROUP 

This policy should be read in conjunction with the Employee Handbook which can be accessed through the HR and IT Group or in the HR&IT Policy folder on the Hospice network.

1.    Introduction

Springhill Hospice is committed to protecting the privacy of everyone who uses our services: as patients and carers or as employees and volunteers; and that of anyone who supports our work through fundraising, retail or lottery activities. Please read this policy carefully, along with our terms and conditions and any other documents referred to in this policy, to understand how we collect, use and store your personal information.

2.    Who are We?

Springhill Hospice is registered as a charity in England and Wales (registered charity number 701798) and we are also registered as a company limited by guarantee (company number 2325905). Our registered office address is: Broad Lane, Rochdale, OL16 4PZ. This policy covers Springhill Hospice and its subsidiary companies; Springhill Hospice (Services) Ltd and Springhill Hospice (Lottery) Ltd.

3.    Legal Compliance

Springhill Hospice takes data protection very seriously. We are required to adhere to the requirements of the Data Protection Act 1998, the General Data Protection Regulations 2018 (GDPR), Public Records Act 1958, Freedom of Information Act 2000, all other related privacy laws and any codes of practice issued by the Fundraising Regulator (FR) or the Information Commissioners Office (ICO). Our intention is to be compliant, user friendly and to ensure our supporters only receive the information they are interested in. Unless stated otherwise, Springhill Hospice is the data controller in respect of all data collected by us on this Website or otherwise. This means that we are responsible for full legal compliance. 

As you browse our website, get in touch with us, or use our services we collect, process and store your personal information. This deepens our understanding of what you are interested in, and helps us to improve the efficiency of the services of the Hospice and fundraising communications.

Springhill Hospice and our trading subsidiaries will never exchange or sell your information to another organisation for their own marketing purposes. We know that this is important to you, and want to reassure you that you’re always in control of how we use your personal information in regards to marketing and fundraising activities.

We do however need to collect and use your personal information for carefully considered and legitimate business purposes, which help ensure we can run Springhill efficiently, raise funds effectively and deliver our charitable services. This policy sets out how your personal data will be used, what data we collect, our legal basis for its use, along with outlining your rights in respect of personal data.

4.    Why we Collect Personal Data

As a registered charity, Springhill Hospice relies on the people living in its local community for support - both financially and in kind. Information about our local community such as your personal information may be used to help us effectively deliver the Hospice’s services or to help us raise funds for those charitable services. 

Ultimately this means Springhill Hospice is able to continue to provide excellent care to those who need it and support their families, friends and carers. 

We collect and process personal information for certain legitimate business purposes, which include some or all of the following:

•    To provide appropriate treatment and care

•    Where processing enables us to monitor, enhance, modify, personalise or otherwise improve our services/communications for the benefit of our patients and supporters

•    To identify and prevent fraud

•    To enhance the security of our network and information systems

•    To better understand how people interact with our web and social media sites to ensure that content is presented in the most effective manner for you and your device

•    To provide postal communications which we think will be of interest to you to provide you with updates, news, information about our fundraising events and campaigns and training opportunities

•    To determine the effectiveness of promotional campaigns and advertising

Wherever we process data for these purposes we will ensure that we always keep your personal data rights in high regard and take account of these rights.

5.    How we Collect Personal Data

•    Information you give us. For example, when you enquire about our activities, register with us, make a donation to us, ask a question about our services or otherwise provide us with your personal information. This personal data may be given face to face, electronically (via email, our website or social media pages), on paper (such as any form you complete) or verbally (such as during any telephone conversations we have with you). 

•    Information we get from your use of our website and services. We collect information about the services you use and how you use them, like when you watch a video on YouTube, visit our website or social media pages (Facebook, Twitter and Instagram) or view and interact with our ads and content.

•    Information from third parties. We may also receive information about you from third parties. For example, this may be from other healthcare providers or from online fundraising sites such as Just Giving or BT MyDonate. This can include information such as your name, postal address, email address, phone number, your geographic location, credit/debit card details and whether you are a tax payer so that we can claim Gift Aid.  

•    Information about other people. If you provide personal data to us relating to any person other than yourself, you must ensure before you do so that they understand how their personal data will be used and that you are authorised to disclose it to us, and to consent to its use on their behalf.

Wherever possible we use aggregated or anonymous information which does not identify individual visitors to our website, social media pages, supporters at our events or service users.

Care and Support Services

If you, a relative, or friend are cared for or supported by Springhill Hospice, the personal and/or sensitive personal information you provide to us will be used only for the purposes of providing you with services, or training or monitoring the quality of our services.  

Springhill Hospice will not disclose your personal information to any third party without your consent, except to professional bodies, or otherwise as required by law, regulation or codes of practice. If you are receiving care as a patient we may need to disclose information to other healthcare professionals and organisations involved in your care, but will only do so with your consent.  If you are referred to one of our clinical services we will collect data from you and may also receive it from other healthcare providers.

6.    The Type of Personal Data we Collect

We always strive to provide a clear, honest and transparent approach regarding how and when we may collect and use your personal data. The overview below summarizes the different types of data we collect and some of the reasons why we do this. We may not use your personal information for all of these purposes – it will depend on the nature of our relationship with you, and how you interact with our services, websites, and fundraising activities. Data protection law recognises that certain categories of personal information are more sensitive, this is known as sensitive personal data and covers health information, race, religious beliefs and political opinions. We do not usually collect special categories of data about our supporters unless there is a clear reason for doing so. 

7. How we may use your Information
When Springhill Hospice collects and uses your personal information, we will make sure this is only done fairly and lawfully in accordance with at least one of the legal grounds available to us under Data Protection law. We may use your information to understand your needs and interests and to provide you with the best service we can. We want to have the best relationship we can with you and for you to enjoy your interactions with the Hospice.

7.1 Where we have your consent as a lawful basis we will use your data;

• to provide appropriate treatment and care
• to provide you with services, products or information you have requested
• to provide further information about our work, services, activities or products
• to invite voluntary participation e in surveys or research
• to further our charitable aims, including for fundraising activities
• to process your application for a job or volunteer role with us  

7.2 Where we have a legal/contractual obligation to you we will use your data; 

• to claim Gift Aid (this involves sharing your information with HMRC) 
• to fulfil sales made online or through our retail shops 
• to fulfil your membership to our Lottery or Raffles 
• for fraud prevention, credit risk reduction or otherwise as required by law or regulation 
•  for internal record keeping, for suppression lists and to record the ways in which you wish to hear from us and your interests regarding our work 
• for internal record keeping in relation to staff, volunteer and supplier/financial records
• to request Direct Debit payments in relation to memberships you have subscribed to 
• to register and administer your participation in fundraising activity for which you have registered

7.3 Where we have a genuine and legitimate reason and we are not harming any of your rights and interests we may use your data;  

• to process any donation(s) or payment(s) we may receive from you
• to make contact with you for administration purposes 
• to communicate volunteering opportunities
•  for internal record keeping, such as the management or feedback of complaints 
• to analyse and improve our work, services, activities, products or information (including our website) or for our internal records 
• to check on your preferences from time to time to ensure they are up to date 
• to send you direct marketing about ways in which you have supported the Hospice previously and where you have not specifically told us not to contact you. For example, if you have previously donated to our Light up a Life appeal, we will send it to you unless you tell us not to 
•  to register and administer your participation in events for which you have registered 
•  to confirm memberships and subscriptions (such as playing in our Lottery)

 *The lawful basis for the collection and processing of your personal data is: 

• That it is necessary to fulfil the contract that you are going to enter into or have entered into with Springhill Hospice 
• That you have given your consent and/or 
• That it is in the legitimate interests of Springhill Hospice and does not prejudice or harm your rights and freedom. Our legitimate interests for processing your data are:

Relevant and appropriate relationship – in relation to our provision of care and staff records.
Reasonable expectation – Where you a long term or regular supporter of Springhill Hospice and would expect to receive communications from us.
Direct marketing – We will send postal marketing and fundraising asks which further the aims and objectives of Springhill Hospice. We will make sure our postal marketing is relevant for you and tailored to your interests.
Online ordering – In order for us to process and fulfil an order or registration via our website, payment has to be taken and contact information collected such as name, address and contact details collected.
Your best interest – We will process your information to protect you against fraud when transacting on our website, and to ensure our websites and systems are secure.
Personalisation – We will adapt our processing to enable us to enhance, modify, personalise or otherwise improve our services or communications for the benefit of our supporters.
Analytics – We will process your personal information for the purpose of customer analysis, assessment, profiling and direct marketing, on a personalised or aggregated basis, to help us with our activities and to provide you with the most relevant information as long as this does not harm any of your rights and interests.
Research – We will process your data to determine the effectiveness of promotional campaigns and advertising and to develop our products, services, systems and relationships with you.
Due diligence – We may need to conduct investigations on supporters and business partners to determine if those companies or individuals have been involved or convicted of offences such as fraud, bribery and corruption.

Where we process your personal information for our legitimate interests we will consider and balance any potential impact on you and your rights under the Data Protection Act and any other relevant law. Our legitimate business interests do not automatically override your interests. We will not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted to by law such as to keep records on certain activities such as financial donations and clinical records or for HMRC audit or other legal reasons Where we have required and obtained your consent to process your personal data, you have the right to withdraw that consent at any time. If you do, it will not affect the lawfulness of any processing for which we had consent prior to your withdrawing it. 

7.4 Your credit and debit card information
If you use your credit or debit card to donate to us, or buy something online, we pass your card details securely to our payment-processing partner as part of the payment process. We do this in accordance with the Payment Card Industry Security Standard and don’t store the details on our website or databases.

8. Data Sharing
Springhill Hospice has never, and will never, share or sell your personal information to another organisation for their own marketing purposes. However, there are legitimate situations where we may share data with trusted third parties, subcontractors, our regulators and with law enforcement authorities. Examples of this may include:  

• With the mailing house who send out our mailings
• With a data cleansing company to ensure that the information we hold is up to date
• With the company who sign new players to our Lottery 
• With our Lottery provider
• With the company who processes Gift Aid in our shops 
• With HMRC for Gift Aid 
• With the Gambling Commission if required by them to do so
• With the Care Quality Commission if required by them to do so

 All our trusted partners are required to comply with data protection laws and our high standards. In these circumstances, we will always make sure appropriate contracts and controls are in place and we regularly monitor all our partners to ensure their compliance. We will ensure that your personal data is properly protected and that it is only used in accordance with this Privacy Policy. 

We may share personnel data in relation to staff and volunteers with our HR advisors and with the Care Quality Commission. 

We may share patient data with other healthcare providers with the patient’s consent. We may also be legally required to share it with local authorities and our regulator, the Care Quality Commission. Consent for this by patients can be withdrawn at any time. 

We use third party electronic payment providers such as PayPal to administer some transactions. They have their own privacy policies and we encourage you to read them. 

9. How we Might Contact You
We may need to contact you for various reasons and in a number of different ways. If you have given consent, or there is legitimate interest, we would like to contact you and/or any person whose information you provide to us with further information about Springhill Hospice. We will, where possible, try to tailor the communications we send to you so that they are relevant and in line with the preference options you have chosen which form part of the personal profile we will create for you.

10. Your Choice – Accessing and Updating your Preferences
It is always your choice as to whether you want to receive information about our work, how we raise funds and the ways you can get involved. You can change your preferences at any time by using the ‘your communication preferences’ form on the Springhill Hospice website, contacting us using the ‘how to contact us’ details below, or by following the instructions with each communication you receive. Please note it may take up to one month for your changes to be implemented and for communications to start or cease. 

We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted by us for such purposes. However, we will retain your details on a suppression list to help ensure that we do not continue to contact you.  

11. Updating and Correcting Personal Data
 We aim to ensure that all the information we hold about you is accurate, and, where necessary, kept up to date. We will seek to update consent from supporters on our Fundraising Database at a minimum of every 36 months. Consent from patients and families will be sought and updated at each point of admission. If any of the information we hold about you is inaccurate and either you advise us or we become otherwise aware, we will ensure it is amended and updated as soon as possible. 

Where appropriate, in order to save the Hospice money, we may use data cleansing services to update us on people who have moved home or who have died. If you have registered a change of address with the Post Office’s National Change of Address database, we will update your details through this mechanism.

12. Under 16s
Springhill Hospice is committed to protecting the privacy of the young people that engage with us. Some of our activities are targeted at families, particularly fundraising events. If you are under 16, please let us know when you sign up for events and ensure that you have the consent of a parent or guardian before giving us your details. We will ensure that your information is only used for the purposes it has been provided and in some circumstances may refuse certain services, products or events.

13. Vulnerable Supporters
Springhill Hospice is committed to protecting our vulnerable supporters and follow the guidance issued by the Fundraising Regulator and Institute of Fundraising regarding treating our donors fairly. We believe this helps to support our staff and volunteers who come into contact with supporters in providing high-quality customer care, ensuring anyone donating to Springhill Hospice is in a position to make a free and informed decision.  

14. How do we Protect Data?
At Springhill Hospice we take the security of personal data and privacy seriously. We employ appropriate measures through internal policies and controls to safeguard personal data and have procedures in place to ensure that our paper and computer systems and databases are protected against unauthorised disclosure, use, loss and damage. 

If we were to experience a data breach, this would be reported through our internal reporting system in line with our Incident/Accident Policy and where appropriate reported to the relevant supervisory authority within 72 hours of us becoming aware of the breach. 

Our website uses a HTTP/SSL secure certificate to ensure any information you send to us will be encrypted. Non sensitive details (such as your email address, etc.) are transmitted normally over the internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us and you do so at your own risk.

14.1 Network Security /Email

At Springhill Hospice the network is managed by Myson Pages. Appropriate firewalls and virus protection software have been installed with the assurance that these are safe, secure and conform to HSCN code of connectivity.

 All Springhill Hospice staff have a Microsoft office365 emails accounts (ending in @springhill.org.uk) and those staff whom work directly with patient care also have a standard NHSmail accounts (ending in @nhs.net).  The NHSmail is used for a secure national email service which enables the safe and secure exchange of sensitive and patient identifiable information within the NHS and with local/central government such as gov.uk, pnn.police.uk.

 Personal data stored in our database is only accessible by appropriately trained staff and volunteers who need to access, your personal data as an essential part of their role. All access is tracked through individual login credentials.  

 We only use third party service providers where we are satisfied that the security they provide for your personal data is at least as stringent as we use ourselves.

15. How long we keep your Information

We will normally keep your information for as long as is required to enable us to operate our services but we will not keep your information for any longer than is necessary. We will take into consideration our legal obligations, tax, and accounting rules when determining how long we should retain your information. If after this point you have not supported us or taken part in any of our events or activities we will keep only minimal personal data to ensure we can respect your preferences in the future.

 If you are a donor, we will only retain limited personal data if we haven’t had any contact with you within the last three years. *Gift Aid records are kept on file for a minimum of 6 years in order to comply with HMRC regulations. 

16. Use of your Personal Data Outside of Europe 
We do not currently transfer personal data outside of the United Kingdom or the European Economic Area. If this changes, and we do need to transfer your personal data to other territories, we will take appropriate steps to ensure that it is protected in accordance with this Privacy Policy and applicable privacy laws.  

17. National Data Opt-Out 
The national data opt-out was introduced on the 25th May 2018, enabling patients to opt out from the use of their data for research or planning purposes, in line with the recommendations of the National Data Guardian in her Review of Data Security, Consent and Opt-Outs. 

By March 2020, all health and care organisations are required to be compliant with the national data opt-out policy, where confidential patient information is used for research and planning purposes. 

Springhill Hospice has identified, we do not use confidential patient information for purposes beyond an individual’s care and treatment. However, we will ensure this privacy policy is available our staff, patients, volunteers.

18. Your Rights
Where Springhill Hospice is using your personal information on the basis of your consent, you have a number of legal rights in respect of your personal data. These include:  

• Right of Access – You are entitled by law to request a copy of the personal information we hold about you. The same right applies to any other person whose personal data you provide to us. We will require proof of identity and proof of authority if the request comes from someone other than the person whose data we are asked to provide. This will ensure we only provide information to the correct person. We expect to respond to requests within 30 days of receiving them.
• Right to be Informed – You have the right to be told how your personal information will be used. This policy document, and shorter summary statements used on our communications, are intended to be a clear and transparent description of how your data may be used. 
•  Withdraw consent to other processing – Where the only legal basis for our processing your personal data is that we have your consent to do so, you may withdraw your consent to that processing at any time and we will have to stop processing your personal data. Please note, this will only affect a new activity and does not mean that processing carried out before you withdrew your consent is unlawful. 
• Right to Object – You have an absolute right to stop the processing of your personal data for direct marketing purposes. You can exercise this right at any time and can update your preferences yourself or ask us to do it for you. See section ‘Updating and correcting personal data’ above for details.
• Right of Rectification – If you believe our records are inaccurate you have the right to ask for those records concerning you to be updated. See section ‘Updating and correcting personal data’ above for details.
• Right to restrict processing – In certain circumstances you may be able to require us to restrict our processing of your personal data. For example, if you consider what we hold is inaccurate and we disagree, then processing may be restricted until the accuracy has been verified.
• Right of Erasure – Where we have no lawful basis for holding onto your personal data you may ask us to delete it under your right to be forgotten. In many cases we would recommend that we suppress you from future communications, rather than data deletion.
• Right to Data Portability – In limited circumstances you may be entitled to have the personal data you have provided to us sent electronically to you for you to provide to another organisation.
• Complaints –see section ‘How to lodge a complaint’ below for more details.

 If you wish to find out more about these rights, please contact us using the details below

19. How to lodge a complaint
If you believe that we have breached your privacy in any way, we urge you in the first instance to contact our Data and Procurement Officer. All complaints, whether made verbally or in writing, must be brought to the attention of the Chief Executive as per company policy. If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office  

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow Cheshire
SK9 5AF
Tel: 0303 123 1113
Website: https://ico.org.uk

19. Changes to this Privacy Policy 
Privacy laws and practices are constantly developing and we aim to meet high standards. Our policies and procedures are, therefore, under continual review. We may, from time to time, amend or update security and privacy policies. 

We will ensure our website has our most up to date policy and suggest that you check this page periodically to review our latest version. 

This policy was last updated October 2023. 

How to contact us
If you have any questions regarding our Privacy Policy please contact us:
IT and Procurement Officer
Springhill Hospice Broad Lane OL16 4PZ
Tel: 01706 649920