Privacy Policy

INTRODUCTION
This website (www.wakefieldhospice.org) is operated by Wakefield Hospice and Wakefield Hospice Trading Ltd.
Wakefield Hospice (referred to in this policy as “we”, “us” or “our”) pride ourselves on being open and transparent with our patients, their families, our supporters, volunteers, staff and anyone else who comes into contact with the Hospice, about how their personal data is stored and used. This includes the processes we adopt when we ask for donations to keep our organisation running.

This Privacy Policy explains what personal data we may collect about you, how we use it, and the steps we take to ensure that it is kept secure. We also explain your rights and how to contact us.

Legal compliance
Unless stated otherwise, Wakefield Hospice is the data controller in respect of all personal data collected by us on this website or otherwise. This means that we are responsible for ensuring that we do so in full compliance with the General Data Protection Regulation, all other related privacy laws and any codes of practice issued by the Fundraising Regulator or the Information Commissioner. Our intention is to be compliant, user friendly and to ensure our supporters only receive information they are interested in.

BY USING THIS WEBSITE AND/OR GIVING PERSONAL DATA TO US YOU INDICATE THAT YOU CONSENT TO US USING YOUR PERSONAL DATA IN ACCORDANCE WITH THIS PRIVACY POLICY
 
HOW TO CONTACT US
Website: www.wakefieldhospice.org
Email: enquiries@wakefieldhospice.co.uk
Phone: 01924 331400
Mail: Wakefield Hospice, Aberford Road, Wakefield, WF1 4TS
Wakefield Hospice is a Registered Charity No. 518392
 
THE PERSONAL DATA WE COLLECT AND ITS SOURCES

The type and quantity of personal data we collect and how we use it depends on why you are providing it. If you support us, for example, by making a donation, volunteering, registering to fundraise, signing up for an event or buying something from our shop, we will usually collect your name and your contact details. Occasionally we may ask for your date of birth, for example, if there is an age restriction on an event or activity you have chosen to take part in (for example, lottery players must be over 18).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Identity data – name, title, date of birth.
Contact data – location, full address, postcode, email address or telephone numbers.
Financial data - bank account details, credit card details
Transaction data – details of the donations you have made plus any products or services you have purchased from us, including date and time of booking or purchase and spend in relation to that transaction.
Technical data - internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our online channels/ platforms.
Profile data - purchases or orders made by you, your interests, preferences, feedback and survey responses, preferences about the use of products or services (including whether you are interested in certain events that we offer)
Usage data – information about how you use our website and services.
Marketing and communications data – your preferences in receiving marketing from us and your communication preferences.
CV Data – previous employment history, education, awards and references.
Clinical data – Clinical information as part of providing health or medical treatment.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

The following table explains the main types of personal data which we may collect, use, store and transfer. It also explains the purposes for which we use different categories of personal data, and the lawful basis or bases which we believe applies to those uses:
 
Purpose Types of personal data used Lawful basis for processing
To manage our relationship with you as a patient or service user, for example to communicate with you and to provide you with the correct care and treatment. Identity and Contact Data such as your name, home address and date of birth.

Clinical Data such as your medical history and NHS record		 Necessary for performance of our contract with you, compliance with our legal obligations, and for our legitimate interests in providing you with our proper ongoing care and treatment.
To provide you with information where necessary, as the next of kin of one of our patients. For example, to contact you in the case of an emergency or to facilitate any elements of patient care. Identity and Contact Data such as your name, home address, date of birth Necessary for our compliance with our legal obligations and for our legitimate interests in providing you with necessary information about the patient, as part of our provision of proper care for that patient.
To manage our relationship with you as a volunteer or an employee, for example to contact you, or to carry out any necessary administration. Identity and Contact Data Necessary for our legitimate interests in managing our volunteer network to support our organisation.
To process your application for a job or volunteer role with us, including if you are between the ages of 14-16 and apply to volunteer in our retail network or at our fundraising events, to volunteer as part of a formal work experience arrangement with your school. Identity and Contact Data
Career and Interests Data including any CV, career history information or references.
Child Data including name, home address, date of birth and information about their education.		 Necessary for our legitimate interests in the operation of our organisation in order to be able to respond to you and to consider you for a role within our organisation.
Where we collect and process Child Data in the context of an application for volunteering, we do so on the basis that it is in our legitimate interests to be able to consider and respond to you.
To provide any products or services you request to you, including taking payments and contacting you where necessary in relation to the same and to communicate with you in the event that any products or services requested are unavailable or if there is a query or problem with your request. Also to detect and reduce fraud and credit risk. Identity and Contact Data
Financial Data including bank account numbers and details
 		 Necessary for the performance of the contract that you have entered into with us, and for our legitimate interests in the operation of our organisation in order to be able to collect and process payments.
To administer this website, including troubleshooting, data analysis, testing, system maintenance and support Identity and Contact Data
Technical Data including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug in types and versions, operating system and platform and other technology on the devices you use to access this website. This may also include information about how you use our website and our services.
Profile Data such as username and password details, demographic postcode preferences and interests, and information such as feedback and survey responses.		 Necessary for our legitimate interests in providing and improving our website and customer service to you, to improving the services we offer you and to ensuring our website operates properly and for network security.
To ensure our third-party service providers can perform their obligations to us. Identity and Contact Data
Technical Data
Profile Data
 		 Necessary for our legitimate interests in ensuring that our third party providers such as external consultants and contractors are able to provide support services to us.
To deal with new enquiries Identity and Contact Data, including any data you provide when completing the ‘Contact Us’ form on this website. Necessary for our legitimate interests in the operation of our organisation in order to be able to respond to and deal with new enquiries.
To facilitate your account if you join our lottery, including undertaking any necessary age restriction checks and fraud prevention measures. Identity and Contact Data
Financial Data
 		 Necessary for the performance of the contract that will be in place between us.
To administer a donation you make to us, or to administer you as a gift aid donor. Including complying with Gift Aid requirements and communicating with you in the event of a query. Also detect and reduce fraud and credit risk. Identity and Contact Data
Financial Data		 Necessary for the performance of the contract that will be in place between us, and for our legitimate interests in the operation of our organisation in order to be able to collect and process donations.
To sign you up for, and communicate with you in relation to an event or activity you wish to take part in. Identity and Contact Data
Financial Data
Child Data		 Necessary for the performance of the contract that will be in place between us and for our legitimate interests in the operation of our organisation in arranging and facilitating fundraising and awareness events and activities.
Where we collect and process Child Data in the context of an event, we do so for our legitimate interests in the operation of our organisation in arranging and facilitating fundraising awareness events and activities.
To communicate with you once you have decided to leave the hospice as a volunteer, so that we can send you information about new events or activities you may wish to take part in in the future, or to send you any other information we think you may find interesting.  
Identity and Contact Data		 Necessary for our legitimate interests in developing, marketing and promoting our organisation.
To undertake market research in order to improve the products and services we offer. Identity and Contact Data
Profile Data		 Necessary for our legitimate interests to ensure that the goods and services we provide and the work we do are appropriate.
To create a profile about you to understand your preferences, including analysing demographic and geographic information so that we can enhance your experience and relationship with us, understand and respect your preferences and to provide information and details of relevant offers and opportunities where you have agreed to receive them. We may undertake in-house research and engage third party organisations such as fundraising agencies to help us identify people who may be able to support us with a larger gift or in other ways, using publicly available records. We may also collect information on your interests, for example board memberships, hobbies, or articles about you in the media. We use this information to tailor our communication with you and invite potential supporters to meetings, groups and events which may be of interest to you. Identity and Contact Data
Profile Data		 Necessary for our legitimate interests to ensure that our fundraising work is effective and to improve our ability to meet our aims.
 
 

Where it is appropriate we may also ask for:
  • Information relating to your health (for example if you are taking part in a high risk event such as one of our 10k or skydives)
  • How you heard about the event/activity/Hospice
  • Why you have decided to donate to us. We understand that you may have private reasons and we only want to know the answer if you are comfortable telling us
  • Your bank or credit card details (these are used for the single transaction only and are securely destroyed after use)
The information may come to us:
  • Directly from you such as when you make a donation; when you sign up to an event or activity; when you join our lottery; when you sign up as a Gift Aid donor in one of our shops or when you sign up as a volunteer.
  • From another organisation for example, where you use fundraising sites such as Just Giving or Virgin Money Giving to fundraise for Wakefield Hospice. These organisations may share your personal data with us if you allow them to do so.
  • From social media sites or apps. If your settings and preferences allow, we may obtain information (including personal data) from social media services such as Facebook, Twitter LinkedIn and Instagram.
Information about other people
If you provide personal data to us relating to any person other than yourself, you must ensure before you do so that they understand how their personal data will be used and that you are authorised to disclose it to us, and to consent to its use on their behalf.

CCTV
Wakefield Hospice operates a CCTV surveillance system at the Hospice and our retail outlets, with images being monitored and recorded internally. The system is owned, operated and managed by Wakefield Hospice. Images obtained from the system which include recognisable individuals constitute personal data and are covered by the GDPR and Data Protection Act 2018. As an organisation, Wakefield Hospice takes appropriate measures against unauthorised or unlawful processing and against accidental loss, destruction of or damage to personal data from its collection or creation, including how it is stored, all actions performed with and on the data and its disposal. Wakefield Hospice therefore only holds information which is necessary for legitimate business interests and restricted access where deemed necessary.
The primary purpose for use of CCTV by Wakefield Hospice is defined as:
Wakefield Hospice CCTV is used for maintaining public and patient safety, the security of property and premises and for the detection, prevention and investigating of crime. The information processed may include visual images, including personal appearance and behaviour of those displayed and recorded on the system.
The use of CCTV is regulated to provide consistency and compliance with the following relevant legislation.
• Requirements for processing personal data as set out in the GDPR and Data Protection Act 2018
• The Protection of Freedoms Act 2012
• Right to privacy as set out in Article 8 of the Human Rights Act 1998
• Regulation of Investigatory Powers Act 2000 (RIPA)
• The Crime and Disorder Act 1998 (regarding disclosure to investigators)
Images captured by the system are recorded continuously and may occasionally be monitored real time/live by Wakefield Hospice. No images displayed on monitors are visible from outside the premises and access to operate the system is strictly limited. No images, recordings or information gathered by the system shall be stored any longer than is required for the stated purpose. Relevant images or recordings or information will be deleted once their purpose has been discharged. If there is no legitimate reason to keep the recording, the data will be erased – in normal use images are overwritten and deleted automatically approximately every 30 days. All staff with access to the CCTV system are trained and made aware of the sensitivity of handling CCTV images and recordings.
 

WHY WE COLLECT PERSONAL DATA
We collect information for various reasons:
  • We collect and hold information about patients and next of kin to enable us to give you the correct care and treatment and to contact you and your loved ones. The information is held on computer, paper record or both.
  • We collect and hold information about staff and volunteers to communicate and carry out administration, as necessary for your role.
  • We collect and hold information from donors and supporters in order to make better decisions about how we raise and spend funds. As a registered charity, our Hospice relies on the people living in its local community for support – both financially and in kind. By gathering information about our community we can fundraise more efficiently and get the right information to the right people based on what they want to see. Ultimately this means our hospice is able to continue to provide excellent care to those who are dying and to support their families and friends.
  • We automatically collect technical data from visitors to our website to ensure that content from our website is presented in the most effective manner for you and for your computer.
 
IF YOU ARE USING OUR WEBSITES
IP addresses
In order to understand how users use this website and our services, we may collect your Internet Protocol addresses (also known as IP addresses). Your IP address is a unique address that computer devices (such as PCs, tablets and smartphones) use to identify themselves and in order to communicate with other devices in the network.

Links to other websites
Please note this website may contain links to other websites that are not controlled by us. These links are provided for your convenience. We are only responsible for our privacy practices and our security. We recommend that you check the privacy and security policies and procedures of each and every other website that you visit and each organisation that holds your personal data.

HOW WE WILL USE YOUR PERSONAL DATA
All personal data that we obtain about you and/or any other person whose details you provide will be recorded, used, and protected by us in accordance with current data protection law and this Privacy Policy. We will primarily use the personal data for the following purposes:
  • To provide the products and services you request (including taking payments) and to communicate with you in the event that any products or services requested are unavailable, or if there is a query or problem with your request, to process your application for a job or volunteer role with us
  • To administer any donations (including taking payments) you agree to make, including complying with Gift Aid requirements and to communicate with you in the event of a query
  • To administer your employment or voluntary work where you become an employee or volunteer
  • To detect and reduce fraud and credit risk
  • To carry out market research so that we can improve the products and services we offer
  • To create an individual profile for you (including analysing demographic and geographic information) so that we can enhance your experience and relationship with us, understand and respect your preferences and to provide information and details of relevant offers and opportunities where you have agreed to receive them. We may also collect information on your interests, for example, hobbies. We use this information to tailor our communication with you and invite potential supporters to meetings, groups and events which may be of interest to you.
  • To comply with our obligations as a charity under the charity regulations
  • To use IP addresses and monitor website use to identify locations, block disruptive use, record website traffic or personalise the way information is presented to you
 
Consent and lawful processing of personal data
Generally, we do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.  Please see the table above for further information.
 
Where we refer to legitimate interest above we have carried out a legitimate interest assessment (LIA) and are confident that the individual’s interests do not override those legitimate interests. 

Disclosing your personal data
We do not sell personal data.

In order to provide our products and services, we may, occasionally, appoint other organisations to carry out some of the processing activities on our behalf. These may include, for example, technology hosts, event administration, printing companies and mailing houses. In these circumstances, we will ensure that your personal data is properly protected and that it is only used in accordance with this Privacy Policy. 
We use third party electronic payment providers such as World Pay to administer some transactions. They have their own privacy policies and we encourage you to read them.
On very rare occasion, we may be required to disclose your details to the police, regulatory bodies or legal advisors or to comply with a court order or a legal obligation. In these circumstances we would be careful to only provide information that we are required to provide.

Clinical data
Wakefield Hospice is a local, independent charity and we are not part of the NHS, but we do work very closely with all NHS services in the Mid-Yorkshire district. Clinical information is part of the NHS records system. This allows us to share information securely with your GP and other care professionals.
 
If you are a patient, we may contact you with important information regarding your care, in the way that you have requested.

If you are the next of kin of a patient, we may contact you in the event of the death of a patient with further information on our services, for example, to offer bereavement support.
 
In accordance with NHS guidance, the Hospice has an appointed Caldicott Guardian; a senior member of staff responsible for protecting patient confidentiality and enabling appropriate sharing. The sharing of sensitive personal information is strictly controlled by law. We will consult you before information about you is shared to ensure we act with your consent. If you are unable to consent for any reason, we will only share information where it is in your best interests to do so.
 
HOW WE MIGHT CONTACT YOU
We may need to contact you for various reasons in a number of ways. If you have given consent or there is legitimate interest, we would like to contact you and/or any person whose information you provide to us with further information about Wakefield Hospice.
 
We will usually try to tailor the communications we send to you so that they are relevant and in line with the preference options you have chosen which form part of the personal profile we will create for you. 
 
 
Emails and Text messages
Under the Data Protection Act 2018 (“DPA”) and the Privacy and Electronic Communications Regulations (EC Directive) Regulations 2003 (“PECR”), we cannot send direct marketing information to you via text or email without your specific consent to use these channels, even if you’ve supplied your email address or mobile number to us in the past. Therefore, we will obtain your express consent before proceeding to send you direct marketing information.
 

Post and telephone marketing
It is not a legal requirement that we obtain explicit consent to contact you with direct marketing information via traditional mail or over the telephone if you have supplied us with your contact details. We will only contact you about something which is relevant to how you’ve contacted us or supported us in the past.
 
We will always provide details in our communications of how you can opt out.
 
 
Preferences / Subscribe / Unsubscribe
You and any other person whose personal data you have provided to us can change your/their mind about whether you wish to receive information.
You can change your communication preferences at any time by using any of the methods shown below (see the section ‘Updating and Correcting Personal Data’) or by following the instructions with each communication you/they receive.
We will provide details in our communications of how you can update your communication preferences and opt out from hearing from us.
Please note it may take up to one month for your changes to be implemented and for communications to start or cease.

DATA SECURITY
We take the security of personal data seriously. We employ security technology, including firewalls, and encryption to safeguard personal data and have procedures in place to ensure that our paper and computer systems and databases are protected against unauthorised disclosure, use, loss and damage.
 
Personal data in our databases is only accessible by appropriately trained staff and volunteers who need to access your personal data as an essential part of their role. All access is tracked through individual login credentials.
We only use third party service providers where we are satisfied that the security they provide for your personal data is at least as stringent as we use ourselves.

DATA RETENTION
We'll retain information for no longer than is legally required.  We may continue to hold some information for a period of time after our relationship has ended. This is to comply with our legal and regulatory obligations to keep records of our relationship, to resolve disputes or where it may be needed for future legal proceedings.

USE OF YOUR PERSONAL DATA OUTSIDE OF EUROPE
If we ever need to transfer your personal data to other territories outside of the United Kingdom or the European Economic Area, we will take proper steps to ensure that it is protected in accordance with this Privacy Policy and applicable privacy laws.
 
CHANGES TO THIS PRIVACY POLICY
Privacy laws and practice are constantly developing and we aim to meet high standards. Our policies and procedures are, therefore, under continual review. We may, from time to time, update our security and privacy policies. If we want to make any significant changes in how we will use your personal data we will contact you directly and, if required, seek your consent.
We will ensure our website has our most up to date policy and suggest that you check this page periodically to review our latest version.

UPDATING AND CORRECTING PERSONAL DATA
In order to save the Hospice money, we use data cleansing services to update us on people who have moved home or who have died. If you have registered a change of address with the Post Office’s National Change of Address database, we will update your details through this mechanism. Similarly, for relevant activity, if you use the Fundraising Preference Service to withdraw consent to receiving direct marketing from us, we will amend our records accordingly.
 
You may update or correct your personal data by visiting www.wakefieldhospice.org/data-protection or by contacting us and asking us to change your personal data (see the section ‘How to Contact Us’). Please include your name, address and/or email address when you contact us as this helps us to ensure that we accept amendments only from the correct person.
 
We encourage you to promptly update your personal data if it changes. If you are providing updates or corrections about another person, we may require you to provide us with proof that you are authorised to provide that information to us.
 
YOUR RIGHTS
You have a number of legal rights in respect of your personal data. These include:
  • The right to receive a copy of the personal data that we hold about you. The same right applies to any other person whose personal data you provide to us. We will require proof of identity and proof of authority if the request comes from someone other than the person whose data we are asked to provide. This will ensure we only provide information to the correct person. We normally expect to respond to requests within one month of receiving them.
  • Withdraw consent to direct marketing. You can exercise this right at any time and can ask us to do update your preferences. See section ‘Updating and correcting your personal data’ above for details.
  • Withdraw consent to other processing. Where the only legal basis for our processing your personal data is that we have your consent to do so, you may withdraw your consent to that processing at any time and we will have to stop processing your personal data. Please note, this will only affect a new activity and does not mean that processing carried out before you withdrew your consent is unlawful.
  • Rectification. If you consider any of your personal data is inaccurate, you can correct it yourself or ask us to do it for you (see section ‘Updating and correcting your personal data’ above for details).
  • Restriction. In limited circumstances you may be able to require us to restrict our processing of your personal data. For example, if you consider what we hold is inaccurate and we disagree, the processing may be restricted until the accuracy has been verified.
  • Erasure. Where we have no lawful basis for holding onto your personal data you may ask us to delete it.
  • Portability. In limited circumstances you may be entitled to have the personal data you have provided to us sent electronically to you for you to provide to another organisation.
  • Complaints to the Information Commissioner’s Office. You can find information on how to do this at www.ico.org.uk.


DATA PROTECTION OFFICER We have a Data Protection Officer (DPO), who can be contacted in the following ways should you have any questions or feedback about the way your data is handled:
Email: Data.Protection@wakefieldhospice.co.uk
Mail: Data Protection Officer, Wakefield Hospice, Aberford Road, Wakefield, WF1 4TS