Privacy Notice

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. If you wish to contact us about any of the rights described below please do so. We do have a form which can be returned via email to dataprotectionofficer@stoswaldsuk.org, however you can make this request in any format and an email or letter would also suffice as long as you provide sufficient information to enable us to complete this request.

We will aim to respond to your request within one month however if it is a complex request, we will keep you informed of any potential delay.

Please note that we may ask for proof of identification before processing any request.

You have the right to ask for a copy of the personal information St Oswald’s Hospice holds about you.

Please direct any requests to access personal data to the Data Protection Officer at dataprotectionofficer@stoswaldsuk.org, or on 0191 2850063.

When requesting clinical information, a consultant with specialist training (the Caldicott Guardian) will review the information before it is disclosed to ensure that no information is shared inappropriately.

We will aim to respond to your request within one month however if it is a complex request we will keep you informed of any potential delay.

You can read more about subject access requests on the ICO website by clicking this link.

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

When you ask us to rectify any information we hold about you we will take reasonable steps to investigate whether the data is already accurate or needs to be amended.

We will then contact you to confirm the data has been corrected, deleted or added to. If we believe the data is accurate and therefore disagree with your request we will write to you to inform you of our decision and rationale.

The ICO offers additional guidance about this, which you can access here.

You have the right to ask us to erase your personal information in certain circumstances. However, there are exclusions to this including:

• Where we have a legal obligation to keep hold of your data, such as healthcare regulations, employment law, financial regulations.
• When keeping your data is necessary for establishing, exercising or defending legal claims.
• If your request relates to clinical information recorded we are not allowed to delete certain notes from your clinical record however in these instances we will make a note that you disagree with the content.

When making a request to be erased from our systems we will confirm that this has been carried out or advise you of the legal reason for not proceeding with your request.

The ICO provides additional guidance on this and you can read more about it here.

You have the right to ask us to restrict the processing of your information in certain circumstances for example if you are concerned about the accuracy of data or how it is being used.

The ICO provides additional guidance on this and you can read more about this right here.

You have the right to object to our processing of your data where it relates to processing for our legitimate interests, for direct marketing or for research or statistical purposes. If this is the case, please contact us using the contact details above and provide us with information about your objections.

The ICO provides useful guidance on this right. You can read more about this right here.

You have the right to get your personal data from an organisation in a way that is accessible and machine-readable*. You also have the right to ask an organisation to transfer your data to another organisation. This only applies in certain situations, such as when you have provided consent for using your information or in relation to a contract with us. If you would like to know if your information can be provided in this way, please contact dataprotectionofficer@stoswaldsuk.org.

*Machine readable means data that is in a format which can be automatically read and processed by a computer. The Re-use of Public Sector Information Regulations 2015 defines ‘machine-readable format’ as “a file format structured so that software applications can easily identify, recognise and extract specific data, including individual statements of fact, and their internal structure.

The ICO provides useful guidance on this right. You can read more about this right here.

You have the right to prevent “automated processing” about you, which means decision being made about you without people being involved. This may include automated individual decision making where a decision is made without any human involvement e.g. using an algorithm to determine if you are eligible for a job role and also profiling where your personal data may be used to analyse or predict things about you.

You may be able to object to decisions being made about you in this way or the use of profiling in certain circumstances. If you would like to know more about how to raise concerns in relation to automated processing, please contact dataprotectionofficer@stoswaldsuk.org.

It is worth noting that at the current time we do not use your personal data for automated decision making within any of our services or functions detailed in this privacy notice.

The ICO provides useful guidance on this right. You can read more about this right here.

We may need to share your personal data with any of our employees, volunteers, trustees, suppliers or subcontractors where it is necessary for the purposes set out in this notice.

Types of third parties who may have access to your personal data include:

• Third Party IT System Suppliers who may host your data on their systems and may need some level of access to resolve technical concerns
• Printers and digital advertising suppliers to print off and send out information to you
• Event companies who may be supporting us to run events you may be involved in
• Other health care providers and medical suppliers
• Government bodies where appropriate e.g., HMRC for tax purposes, Companies House, Charities Commission
• Police and local authorities to support crime prevention and safeguarding activities
• Our insurers
• Pension providers
• Coroner’s Service

We may disclose your personal information:

• To the extent that we are required to do by law
• In connection with any ongoing or prospective legal proceedings
• In order to establish, exercise or defend our legal rights (including providing information to others for the purpose of fraud prevention and reducing credit risk)
• To any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such or authority would be reasonably likely to order disclosure of that personal information

We will never sell or share your personal information with other organisations for their direct marketing purposes. Except as provided in this policy, we will not provide your personal information to other third parties.

This privacy notice does not cover how any partner organisations may process personal information; this includes any external links connected to our website. We encourage you to read the privacy notices on the other websites you visit. We do work with partner organisations to ensure that appropriate data sharing agreements or appropriate terms and conditions are in place to ensure that they are equally compliant in keeping your data as safe as we do.

We work to high standards when it comes to processing your personal information. If you have queries or concerns about St Oswald’s Hospice handling of your data or that of anyone working on our behalf, please contact us at dataprotectionofficer@stoswaldsuk.org.

If you remain dissatisfied with any immediate response to a particular situation, we will escalate this using our complaints policy. If you continue to have concerns you can report them to the Information Commissioner’s Office here.

Your personal data is held on secure servers operated by both St Oswald’s Hospice and agencies contracted by us.

Occasionally, in order to meet the purposes defined in this notice, we may need to transfer your personal information to countries or jurisdictions outside the UK. In such cases, we ensure that our suppliers provide adequate protection for the confidentiality and security of this information and the rights of individuals in connection to the transfer of personal data.

Specific safeguards exist to govern this sharing, including ensuring that these countries have adequate data protection provisions in place as agreed by the Information Commissioner’s Office or other additional safeguards are in place, most commonly by implementing standard contractual clauses agreed by the ICO for international transfers within contracts.

The Hospice takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed and it is not accessed except by those authorised to do so in the performance of their duties.

Personal data is collected and stored securely subject to stringent security measures and is protected against misuse. When we use external data processing services, we do so only under strict contractual terms to mirror the security policies that we have in place.

If you are a patient, we will need to collect information about you, your condition and others involved in your care in order for us to be able provide the best possible care to you.

The Data Protection legislation splits data into categories including personal and more sensitive special categories data, we will collect both kinds of data from you as set out below.

Personal information

The personal information we hold about you may include the following:

• NHS Number, name, address, date of birth.
• Telephone numbers.
• Next of kin / emergency contact.

Sensitive Personal Information (special category data)

The sensitive personal information we hold about you may include the following:

• Details of your current or former physical or mental health. This may include information about any health care you have received or need, including about clinic and hospital visits and medicines administered.
• Details of services you have received from us.
• Information relevant to your continued care from other people who care for you or know you well, such as other health and social care professionals and relatives.
• Details of your race and/or ethnicity.
• Details about any disabilities.
• Details about your language preferences.
• Details of your religion.
• Details of any relevant genetic data or biometric data relating to you.
• Data concerning your sexual orientation.

The confidentiality of your medical information is of paramount important to us, therefore we make every effort to prevent unauthorised access to and use of information relating to your current or former physical and mental health.

If you are referred to St Oswald’s Hospice clinical services, the purpose of collecting your personal and sensitive health information is to provide you with appropriate and safe healthcare. It is also an important tool to be able to share plans and progress between the team members involved in your care. We may from time to time also ask you for additional information for the purposes of audit or research.

We do have a legal obligation to maintain healthcare records as set out in Regulation 17 or the Health and Social Care Act 2008, Regulations 2014, and as such, we need to capture information about you and your care to provide you with safe and effective treatment. Under the UK GDPR we also have a legitimate interest to use your data to support your healthcare (Article 6(1)(e)) and to support effective health care delivery and management (Article 9(2)(h)).

When starting to use our services, a member of the clinical team will seek your consent to share this information with other healthcare professionals involved in your care. There may also be occasions where we share your information with other healthcare organisations without your explicit consent, where we feel there is a legitimate interest to share this information to support your direct care e.g. forwarding referrals to other hospices who may need to support your care needs.

As a partner in the Great North Care Record (GNCR), we need to request and share your information from and with other relevant parties who are part of your care and ongoing support network.

Full details of the member organisations of the GNCR, what data may be viewed across the GNCR network, and what the benefits are to being part of the GNCR are available from the GNCR website.

If you have any objection to being part of the GNCR you can contact the GNCR helpline on 0344 811 9587 and speak to a member of the GNCR team. In order to log and process your objection they are required to collect some basic demographic information about you. This team will always seek to comply with your request, but in some circumstances your information may need to be used to comply with our other legal duties.

We will seek additional consent in the event of your participation in any additional activities outside of the purpose above, for example the use of photographs for teaching materials. We may also ask your consent to use any photographs for marketing purposes and this will be done very explicitly. No photographs or data will be used for this purpose without your consent.

We gather health information about you from a number of sources including:

•  Directly from you
•  From the person referring you to our service
•  From other people involved in your care

We keep your data primarily on a patient information system called SystmOne which is a product used by many NHS providers and allows us the capability to share appropriate information, with your consent, with other users of the system involved in your care.

Some services also keep paper notes for the day-to-day elements of care.

All clinical notes are reviewed and updated by the clinical team looking after you.

We may from time to time offer you the opportunity to become involved with research projects linked to St Oswald’s Hospice, in these cases your direct consent will be obtained and the care of your data will be outlined as part of the project as it may differ from project to project.

In order to continue to improve our services and respond to the changing needs of service users we may from time to time contact you to contribute to surveys or focus groups. Participation is always voluntary and where possible anonymous.

We will keep your clinical record for 8 years after your discharge from the service, or for 25 years if you are a child using our service. Your notes may be kept for longer in very particular circumstances such as involvement in a clinical trial but in these instances specific consent would be obtained.

Data collected from surveys are retained anonymously and destroyed after they have been summarised and any feedback analysed.

The NHS has a National Data Opt-Out scheme by which you can opt out of your data being used for research or planning purposes. To find out more, see ‘Compliance with the NHS National Data Opt-Out Operational Policy’ in the Other Privacy Issues section below.

Names and contact details of next of kin or emergency contact as well as other people important to our patients.

As a Hospice we provide holistic care to palliative care patients and also support for families and carers. As such it is important to understand family dynamics, who information is to be shared with and also identify who may need to be referred for additional support within our carer support or bereavement services.

We collect the details of family members and emergency contacts for patients in our care. We do this under the grounds of Legitimate Interest of the person in our care to provide the best possible support to them and their loved ones. There is also the Legitimate Interest of the family members who require support as a carer in their own right or become bereaved who may choose to receive support from our bereavement team.

St Oswald’s Hospice is a partner in the Great North Care Record (GNCR) and we need to request and share patient’s information from and with other relevant parties who are part of the patient’s care and ongoing support network.

Full details of the member organisations of the GNCR, what data may be viewed across the GNCR network, and what are the benefits to being part of the GNCR are available from the GNCR website.

If you have any objection to patient’s being part of the GNCR you can contact the GNCR helpline on 0344 811 9587 and speak to a member of the GNCR team. In order to log and process your objection they are required to collect some basic demographic information about you. This team will always seek to comply with your request, but in some circumstances your information may need to be used to comply with our other legal duties.

We record this information as part of the clinical record of the patient. If you are referred for carer or bereavement support, you will be registered as a patient / client in your own right and the details given in the section about patient data above will also apply.

We will use the data to invite you to a memorial service or advise you of other services that may be of benefit to you following the death of a loved one.

We will not pass your data on to our fundraising department.

We may occasionally invite you to contribute to surveys or focus groups so that we can better understand the needs of friends and families when their loved one is accessing services at St Oswald’s Hospice. Participation will be voluntary and often anonymous.

Basic information may also be recorded about you if you attend as a visitor e.g. in visitor sign in books.

Very occasionally, you may be approached to participate in research in the interests of improving services and Palliative Care more broadly. This will always be explained in full and your explicit consent gathered for any research project.

As your data forms part of the clinical record, it will be kept for 8 years after the patient is discharged or 25 years if they are a child.

Any survey data will be destroyed after it has been analysed and all reports will be completely anonymous.

The NHS has a National Data Opt-Out scheme by which you can opt out of patient data being used for research or planning purposes. To find out more, see ‘Compliance with the NHS National Data Opt-Out Operational Policy’ in the Other Privacy Issues section below.

The list below shows the main categories of personal data we may collect. More detail on some of these areas of more sensitive information are included below:

• Personal identifiers i.e. name, home address, personal telephone number/e-mail address
• Details of your qualifications, professional membership, skills, experience and work history
• Information about your current level of remuneration (only for paid roles)
• Whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process
• Gender
• Marital status
• If you have any cautions or convictions which may show on a criminal record check with the Disclosure & Barring Service
• Information relating to your health
• Information about your right to work in the UK
• Personal data which you otherwise voluntarily provide, e.g., ethnicity, religion

Please note: This list is not exhaustive and we will update it periodically to reflect any major changes.

Most of the personal data we process is collected directly from you i.e. through CV’s, application forms or collected through interviews or other forms of assessment (including online testing e.g. psychometrics). Occasionally we may be provided with data from recruitment agencies or work placement organisations who you have asked to act on your behalf.

For all paid job applicants we will only seek information from third parties e.g. references, health screening and criminal record checks once a conditional job offer has been made.

For volunteer applicants we will seek references once we have received your completed application form but we will not seek criminal record information (if relevant) until you have been offered a role.

Some personal data is considered highly sensitive and is subject to additional safeguards. The Hospice aims to limit the sensitive personal data which it processes as follows:

Health Information

We process health information if we need to make reasonable adjustments to the recruitment process for applicants who have a disability e.g., whether adjustments need to be made during a test or interview. This is to carry out our obligations and exercise specific rights in relation to employment.

Disclosure and Barring Service (DBS) checks/information

Given the nature of our organisation, DBS clearance is required in most roles. All applicants selected for assessment/interview will be asked if they have any cautions or convictions that may show up on a criminal record check. We will only seek a DBS check (if applicable) once the offer of a role is made and accepted. The HR/Volunteer Department can provide further guidance to applicants on request.

Equal Opportunities Monitoring

The Hospice is committed to providing equal opportunities for all applicants and we will process information relating to ethnic origin, race, nationality, sexual orientation, disability etc., alongside information relating to gender and age, for the purposes of equal opportunities monitoring.

Applicants are entirely free to decide whether or not to provide such data and there are no consequence of failing to do so.

All special categories of data are confidential and will only be shared internally where there is a specific and legitimate purpose to do so.

We use the information we have collected in order to:

• Manage the recruitment process
• Assess and confirm a candidate’s suitability for the role and decide who will be appointed
• To make reasonable adjustments to the recruitment process for candidates who have a disability in line with our legal obligations
• To ensure effective general HR/Volunteer administration
• To respond to and defend against legal claims
• Information such as ethnic origin, sexual orientation, religion or belief, is used for the purposes of equal opportunities monitoring with the explicit consent of applicants, which can be withdrawn at any time.

Please note: This list is not exhaustive and we will update it periodically to reflect any major changes.

We will not use your data for any purpose other than the recruitment exercise for which you have applied unless you have agreed to have your CVs kept on record for future employment or volunteer opportunities.

Under the UK General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

• Legitimate Interest – we need the information to enable us to assess your suitability for the position you have applied for prior to entering into a contract or volunteer/employment/work placement relationship with you
• We have a legal obligation – for example we must check eligibility to work in the UK before employment starts
• We have your consent to retain your information for future employment or volunteer opportunities

Your information will be stored and shared internally for the purposes of the recruitment exercise. This includes members of the HR/Volunteer team, interviewers involved in the recruitment process and managers in the business area with a vacancy.

Paper information is stored in locked cabinets and access is strictly limited to the HR/Volunteer Team, interviewers involved in the recruitment process, managers in the business area with a vacancy and in certain emergency situations the Hospice Management Team (HMT) or Duty Coordinator.

Electronic data is stored on the HR/Volunteer Database and Hospice IT systems, including email, with access strictly limited to the HR/Volunteer Team, interviewers involved in the recruitment process, managers in the business area with a vacancy and in certain emergency situations HMT, the Duty Coordinator or IM&T Manager.

No automated decision making is involved in our recruitment process.

The Hospice policy is to retain personal data only for as long as needed to fulfil the purpose for which it was collected or otherwise as required under applicable laws and regulations.

If your application is unsuccessful we will keep your personal data on file for:
• Twelve months if you are applying for a paid role
• Six months if you are applying for a volunteer role
• Three months if you are applying for a work placement

The only exception to the above is where you have agreed for your information to be kept on file for future work or volunteer opportunities.

The list below shows the main categories of personal data we may collect. More detail on some of these areas of more sensitive data are included below:

• Personal identifiers i.e. name, home address, personal telephone number/e-mail address.
• Date of birth.
• Driving licence number and car registration (if applicable).
• Gender.
• Marital status.
• Emergency contact information.
• Criminal record information.
• Information relating to your health.
• Photograph (for identification purposes stored on the HR Database and/or for the issue of a Smartcard).
• Documents evidencing your right to work in the UK.
• Bank account details and national insurance number.
• Documents gathered during recruitment i.e., cv, application form, references, qualifications.
• Documents relating to professional memberships, insurance, essential qualifications, statutory and mandatory training and revalidation.
• General employment records including details of training, disciplinary and grievance matters, benefits, holiday, other absences, employment contract, performance records (including appraisals and revalidation), working hours, .
• Information gathered through the Hospice’s monitoring of its IT systems and CCTV recording.
• Personal data which you otherwise voluntarily provide, e.g. ethnicity, religion.

Please note: This list is not exhaustive and we will update it periodically to reflect any major changes.

Most of the personal data we process is collected directly from you i.e., through CV’s, application forms, passport or other identity documents or during meetings held with you. We may also receive personal information indirectly from third parties, such as:

• Previous employers when taking up references.
• Medical professionals to assess health before and during employment.
• The Disclosure & Barring Service (Criminal Record Information) to meet our legal obligations in relation to working in an environment with vulnerable adults and/or children.

Some personal data is considered highly sensitive and is subject to additional safeguards. The Hospice aims to limit the sensitive personal data which it processes as follows:

Health Information

The Hospice may process information about an employee’s physical or mental health in compliance with its obligations in connection with employment, in particular:

• To administer sick pay entitlements.
• To comply with obligations owed to disabled employees.
• To comply with patient care, health regulatory and health and safety obligations.
• To maintain a sickness absence record.
• To obtain health advice and support from our external Occupational Health Service Provider.
• To offer staff complementary health services.

All health information is confidential, and it will only be shared internally where there is a specific and legitimate purpose to do so. We have implemented appropriate physical, technical, and organisational security measures to secure your personal data against accidental loss and unauthorised access, use, alteration, or disclosure.

Disclosure and Barring checks/information (DBS)

Given the nature of our organisation, DBS requirements apply to most employees.
We are required to carry out DBS checks for roles as described in the Criminal Records policy. In all cases, we carry out the checks in line with the applicable law.

DBS checks will be repeated periodically during the course of employment in line with Hospice protocols.

We will always treat DBS information as confidential and it will only be shared internally where there is a specific and legitimate purpose to do so. We have implemented appropriate physical, technical, and organisational security measures to secure your personal data against accidental loss and unauthorised access, use, alteration, or disclosure.

Equal Opportunities Monitoring

The Hospice is committed to providing equal opportunities for employment and progression to all of its employees and from time to time we will process information relating to ethnic origin, race, nationality, sexual orientation and disability, alongside information relating to gender and age, for the purposes of equal opportunities monitoring and gender pay gap reporting.

We have implemented appropriate physical, technical, and organisational security measures designed to secure your personal data against accidental loss and unauthorised access, use, alteration, or disclosure.

In addition, this monitoring will always take place in accordance with appropriate safeguards as required under applicable law, including:

• The provision of information relating to ethnic origin, race, nationality, sexual orientation and disability for the purposes of monitoring will be voluntary and processed for this purpose only.
• The monitoring will be conducted on the basis of using anonymised data so individual employees cannot be identified.

We use the information we have collected in order to:

• Pay your wages and administer any benefits under the employment contract.
• Manage day to day tasks and responsibilities.
• Manage and assess performance and revalidation activities, including the conduct of annual appraisals.
• Consider eligibility for promotion or alternative roles.
• Comply with legal requirements, such as reporting to the local tax authority or professional regulators.
• Address disciplinary, grievance or health issues with individual employees.
• Monitor the proper use of Hospice IT systems.
• Appropriate facilities management e.g., car parking.
• Management of incidents.
• Prevent fraud or any illegal activity.
• Meet our legal obligations in respect of health and safety and disability legislation.
• To ensure effective general HR administration.
• To record all types of absence and leave to ensure effective workforce management and compliance with duties in relation to entitlements and pay/benefits.

Please note: This list is not exhaustive, and we will update it periodically to reflect any major changes.

We need the information to enable us to fulfil our obligations as your employer. As well as some of the purposes detailed above in relation to specific types of personal data, under the UK General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

• We have a contractual obligation for some data.
• We have a legal obligation for other data items.
• You also have the option to provide consent to the use of some data such as sexuality, ethnicity or disability status for the purposes of equality monitoring.

Paper information is stored in locked cabinets and access is strictly limited to the HR Team, your line manager and in certain emergency situations the Hospice Management Team (HMT) or Duty Co-ordinator.

Electronic data is stored on the HR Database and Hospice IT systems, including email, with access strictly limited to the HR Team, your line manager and in certain emergency situations HMT, the Duty Co-ordinator or IM&T Manager.

We may share some of this information with:

• Your line manager, certain members of the finance team and/or the relevant Director for your role.
• The Disclosure & Barring Service.
• The Independent Safeguarding Authority.
• The Care Quality Commission.
• Regulatory bodies i.e., the Nursing & Midwifery Council, or General Medical Council.
• Occupational health and/or external counselling providers.
• Our legal representatives.
• Pension providers.
• HMRC or any appropriate government body.

In all cases not governed by regulation or legislation, the employee personal data is shared under the terms of a written agreement between the Hospice and the third party which includes appropriate security measures to protect the personal data in line with this Notice and our obligations. The third parties are permitted to use the personal data only for the purposes which we have identified or as permitted by law, and not for their own purposes, and they are not permitted to further share the data without our express permission.

None of your data will be used for automated decision making.

DBS information will be stored in compliance with DBS rules. DBS information will typically be retained for a maximum period of 6 months or until the next CQC inspection, whichever is the longer, although the date, certificate number, level of check and outcome will remain on the employee’s record.

The Hospice policy is to retain personal data only for as long as needed to fulfil the purpose for which it was collected or otherwise as required under applicable laws and regulations Current retention periods are shown in the Standard Operating Procedure Library, Document Retention Procedures in Sharepoint. Under some circumstances we may anonymise your personal data so that it can no longer be associated with you. We reserve the right to retain and use such anonymous data for any legitimate business purpose without further notice to you.

If you have any queries about your personal data held by HR or would like access to your personal data held by St Oswald’s Hospice then please contact them directly on HumanResources@stoswaldsuk.org or via the DataProtectionOfficer@stoswaldsuk.org email.

What we need will vary depending on the type of fundraising interaction however the most common details collected will be name, contact details, donation details, bank details and for some events, health information.

Patients, staff and volunteers can also be donors, supporters or customers.

If you are a donor, supporter and/or customer the information we will collect will be that which we require to process your donation, purchase, gift aid donation or to keep you safe during an event.

We collect name and contact details, payment details where appropriate and in addition, we ask you to supply information about the type of person or organisation you are so we understand your relationship with St Oswald’s Hospice so as to tailor future communications to you.

Often people who interact with St Oswald’s Hospice have more than one status within the organisation meaning your data may have been collected a number of times for different purposes by different departments. We do not share your data internally for marketing purposes unless you have given us permission to do so. On most data collection forms within St Oswald’s Hospice we will ask you if you’re happy to receive marketing from us. If you give consent for us to market to you we also ask if you would kindly let us know your status or status’ with us, i.e. are you:

• Another organisation (name requested if applicable)
• A member of staff
• A volunteer
• Next of kin to a patient
• A patient of ours
• A friend or relative of a patient
• We also always give the option: Prefer Not to Say

If you do kindly tick the correct box(es), this gives us permission to use this status information which will help us protect you and send you information more relevant to you in future.

Other areas of the organisation do not share this information with Fundraising unless you have given your consent for them to do so.

In addition to the information you provide, Fundraising may use online platforms such as Facebook, Twitter, Instagram and LinkedIn in order to gather available information about you where relevant. Any information we are given, or gather about you which is in the public domain, will help us tailor the information we send you to your needs to ensure it is as relevant to you as possible.

The purpose of capturing your personal and potentially sensitive information (i.e. health information for physical events) within income generation (e.g. fundraising) will be for the purpose of processing your donation, organising a sponsored event, processing your gift aid etc. This will be done on the basis of explicit consent which will be gathered from entry forms and other marketing materials.

If you tell us your status, here is how we will use this information:

If you tell us you are a staff member:

We will stop sending printed paper copies of information to your home address and ask that you pick up a newsletter from display points around the Hospice, one of our shops or through internal emails instead. This will help us save money on printing and postage.

If you tell us you are a volunteer:

We would like to continue to communicate with you with more relevant information to you such as updates, volunteer opportunities and fundraising, as we know so many volunteers not only give their valued time but also support us in our fundraising and for that we are truly grateful. If you are worried about postage costs and have an email address, we can send a lot of this information to you via email, which will allow us to keep in touch with you without the printing and postage costs. However, in order to email you we would need you to stipulate you are happy to receive emails from us.

If you tell us you are a patient:

As you are currently receiving support and care from us, if you tell us you are a patient, unless you opt out, we will continue to send you the newsletter to keep you up to date with our activities, but will not send you any direct requests to help fund our service. If you choose not to divulge this information we completely understand but please note that if we do not know you are a patient, you may receive requests from us for funds in future and we apologise if this causes you any distress. Please know this is not our intention. If you do not wish us to know your status, please tick the “Prefer Not to Say” option and we will continue to communicate with you as we would any other supporter.

If you tell us you are Next of Kin, or a friend or relative of a current or previous patient:

If we have this information within Fundraising this will help us send information to you about service updates and fundraising opportunities we have specifically for people who would like to help in memory of a loved one. Many people choose to fundraise in memory and find it a positive way of helping them to come to terms with the death of their loved one, but there is absolutely no obligation to do this and we understand if you wish to opt out and no longer receive information from us. If you do not wish us to know your status please tick the “Prefer Not to Say” option and we will continue to communicate with you as we would other supporters.

If you have kindly allowed us to claim Gift Aid back on your donation of money or goods it is your responsibility to let us know if your tax status has changed when you make any further donations. You can do so by contacting enquiries@stoswaldsuk.org telling us your name, address and new status.

Under the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, we cannot send marketing information to you via text or email without your specific consent to use these channels, even if you’ve supplied your email address or mobile number to us in the past.

It is not a legal requirement that we obtain explicit consent to contact you with marketing information via traditional mail or over the telephone if you have supplied us with your contact details and assuming we are contacting you about something which is relevant to how you’ve contacted us or supported us in the past.

However you can opt out of receiving marketing from us via these channels at any time by emailing supportercare@stoswaldsuk.org or call 0191 246 9123.
It may be that you have played the lottery which is run by St Oswald’s Hospice Promotions Limited but is managed via the same donor platform as other St Oswald’s Hospice Limited events and donations. Your marketing preferences are the same across both companies.

We shall process the data you supply in order that we can assist you and respond appropriately. We will not share or sell your data for marketing purposes outside of St Oswald’s Hospice companies.

To subscribe to one of our newsletters we need your name and email address.

Our purpose for collecting the information is so that we can provide you with a service and let you know about upcoming events or information that may be of interest to you.  We use your information to be able to send the newsletters as cost effectively as possible via email.

The legal basis we rely on for processing your personal data is your consent under Article 6(1)(a) of the UK GDPR.

We only use your details to provide this service, we do not pass your details on. We gather statistics about email opening and clicks using industry standard technologies including Clear Gifts and Mailchimp to help us monitor and improve our newsletter.

We use external suppliers to deliver the e-newsletter, currently Mailchimp. For more information, see the Mailchimp Privacy Notice.

Contact details, details of your request and additional information needed to verify your identity.

Our purpose for collecting the information is so that we can respond to your complaint, enquiry or request appropriately.

The legal basis we rely on for processing your personal data is Legitimate Interest of both parties in resolving the issue or query raised and to comply with our legal obligation to respond to your requests under Data Protection Act law.

We only use your details to provide a response to you, we then retain a minimal log of complaints and access requests to be able to monitor the service and how it can be improved. We are also required to share anonymised versions of the logs with the NHS under the provision of the NHS contract.

All logs are maintained on Microsoft software internal to St Oswald’s Hospice.

We keep a log of complaints for eight years from the date of the complaint and data subjects rights requests are retained for three years from the date of requests.

If you wish to attend one of our events, you will be asked to provide your contact information including your organisation’s name and, if offered a place, information about any dietary requirements or access provisions you may need. We may also ask for payment if there is a charge to attend.

Our purpose for collecting this information is so we can facilitate the event and provide you with an acceptable service. We also need this information so we can respond to you.

The legal basis we rely on for processing your personal data is legitimate interest in providing relevant training to staff and consent under Article 6(1)(a) and Article 9(2)(a) of the UK GDPR where health data needs to be processed. When we collect any information about dietary or access requirements we will do so purely for your own safety and participation in the event. Such data will not be retained after the event has taken place.

If you are not successful in securing a place, we will let you know and hold your details on a reserve list in case a place becomes available. If you are allocated places at an event, we will ask for information about any dietary/access requirements. We will not share this information in any identifiable way with the venue, and we delete it after the event.

We use data processors to help facilitate the events. We collect registration information from some of our conference microsites, this will be clear in any communications about the event. We would encourage you to check their privacy notices. We may sometimes charge a fee to attend an event. If this happens, our communications about the event will provide details of the data processor we use to collect payments.

Your attendance at a course may be retained on your personnel file, otherwise your data will be deleted after the provision of the course.

We hold the names and contact details of individuals acting in their capacity as representatives of their organisations, across the business.

If this relates to interactions regarding our regulatory functions, the legal basis is Article 6(1)(e) of the UK GDPR. If the interactions relate to suppliers, contracts, buildings management, IT services etc., the legal basis is Article 6(1)(b) in relation to managing your contract with us, Article 6(1)(c) of the UK GDPR for any legal obligation, or Article 6(1)(f) because the processing is within our legitimate interests as a business.

Your information will be held on our internal secure systems.

If the interactions relate to health care professionals, you need to know that St Oswald’s Hospice is a partner in the Great North Care Record (GNCR). The GNCR is a way of sharing patient information with health and care workers. We need to request and share patient’s information from and with other relevant parties who are part of the patient’s care and ongoing support network.

Full details of the member organisations of the GNCR, what data may be viewed across the GNCR network, and what the benefits are to being part of the GNCR are available from the GNCR website.

We do monitor any emails sent to us, including file attachments, for viruses or malicious software. You must ensure that any email you send is within the bounds of the law.

For social media pages that we operate, we require the supporter to request to follow our relevant social media channel.

St Oswald’s Hospice website contains links to our social media pages where we operate our business accounts. These social media pages are hosted and operated by third parties under their own differing privacy policies. Should you choose to access one of our social media pages, you will be leaving St Oswald’s Hospice website, this Privacy Notice will no longer apply and you will be bound by the Terms and Conditions of the external Social Media site. Upon entering the Social Media site, it is your responsibility to abide by the relevant Terms and Conditions and we accept no responsibility for your misuse of any social media site.

To allow us to showcase our services, provide communication about the Hospice and our fundraising activities to generate awareness and fundraising income via Social Media pages and engagement with our followers.

We operate a variety of Social Media pages to allow us to operate our business, provide information about fundraising events, retail services and maximise revenue income. We also provide links to Social Media sites of partner organisations that we feel could be of legitimate interest to our supporters, patients and their families.

We gather statistics around social media traffic and click through rates to help us monitor and improve our online presence. We are able to view the profiles of our supporters online depending on how much information they have shared via their own personal privacy settings. We engage with our supporters via social media and answer their queries online.
All our social media pages and their content are stored on external servers run by external providers.

Our supporters follow our social media pages until either they choose to unfollow the page, they request that we remove them from the page, or we choose to deactivate or close that social page.

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• You are a member of our lottery scheme.
• You have made a complaint or enquiry to us.
• You have applied for a job or secondment with us or continue to work for us as a member of staff or a volunteer.
• You are a representative of your company/organisation/association
• You are a supplier or contractors

You may fit into more than one category so please read any sections that apply to you.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. If you wish to contact us about any of the rights described below please do so. We do have a form which can be returned via email to dataprotectionofficer@stoswaldsuk.org however an email or letter will suffice as long as you are clear about the request you are making.

We will aim to respond to your request within one month however if it is a complex request we will keep you informed of any potential delay.

Please note that we may ask for proof of identification before processing any request.

You have the right to ask for a copy of the personal information St Oswald’s Hospice Promotions Limited holds about you.

Please direct any requests to access personal data to the Data Protection Officer at dataprotectionofficer@stoswaldsuk.org, or on 0191 2850063

You can read more about subject access requests on the ICO website by clicking this link.

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

When you ask us to rectify any information we hold about you we will take reasonable steps to investigate whether the data is already accurate or needs to be amended.

We will then contact you to confirm the data has been corrected, deleted or added to. If we believe the data is accurate and therefore disagree with your request we will write to you to inform you of our decision and rationale.

The ICO offers additional guidance about this which you can access here.

You have the right to ask us to erase your personal information in certain circumstances. However, there are exclusions to this including:

• Where we have a legal obligation to keep hold of your data, such as healthcare regulations, employment law, financial regulations.
• When keeping your data is necessary for establishing, exercising or defending legal claims.
• When making a request to be erased from our systems we will confirm that this has been carried out or advise you of the legal reason for not proceeding with your request.

The ICO provides additional guidance on this and you can read more about it by clicking this link.

You have the right to ask us to restrict the processing of your information in certain circumstances for example if you are concerned about the accuracy of data or how it is being used.

The ICO provides additional guidance on this right. You can read more about this right here.

You have a right to object to our processing of your data in various situations, including where it relates to processing for our legitimate interests, for direct marketing or for research or statistical purposes. If this is the case, please contact us using the contact details above and provide us with information about your objections.

The ICO provides additional guidance on this right. You can read more about this right by clicking this link here.

You have the right to get your personal data from an organisation in a way that is accessible and machine-readable*. You also have the right to ask an organisation to transfer your data to another organisation. This only applies in certain situations, such as when you have provided consent for using your information or in relation to a contract with us. If you would like to know if your information can be provided in this way, please contact dataprotectionofficer@stoswaldsuk.org

*Machine readable means data that is in a format which can be automatically read and processed by a computer. The Re-use of Public Sector Information Regulations 2015 defines ‘machine-readable format’ as “a file format structured so that software applications can easily identify, recognise and extract specific data, including individual statements of fact, and their internal structure.

The ICO provides useful guidance on this right. You can read more about this right here.

We may need to share your personal data with any of our employees, volunteers, trustees, suppliers or subcontractors where it is necessary for the purposes set out in this notice.

Types of third parties who may have access to your personal data include:

• Third Party IT System Suppliers who may host your data on their systems and may need some level of access to resolve technical concerns
• Printers and digital advertising suppliers to print off and send out information to you
• Event companies who may be supporting us to run events you may be involved in
• Other health care providers and medical suppliers
• Government bodies where appropriate e.g., HMRC for tax purposes, Companies House, Charities Commission
• Police and local authorities to support crime prevention and safeguarding activities
• Our insurers
• Pension providers
• Coroner’s Service

We may disclose your personal information:

• To the extent that we are required to do by law
• In connection with any ongoing or prospective legal proceedings
• In order to establish, exercise or defend our legal rights (including providing information to others for the purpose of fraud prevention and reducing credit risk)
• To any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such or authority would be reasonably likely to order disclosure of that personal information

We will never sell or share your personal information with other organisations for their direct marketing purposes. Except as provided in this policy, we will not provide your personal information to other third parties.

This privacy notice does not cover how any partner organisations may process personal information; this includes any external links connected to our website. We encourage you to read the privacy notices on the other websites you visit. We do work with partner organisations to ensure that appropriate data sharing agreements or appropriate terms and conditions are in place to ensure that they are equally compliant in keeping your data as safe as we do.

We work to high standards when it comes to processing your personal information. If you have queries or concerns about St Oswald’s Hospice Promotions Limited handling of your data or that of anyone working on our behalf, please contact us at dataprotectionofficer@stoswaldsuk.org

If you remain dissatisfied with any immediate response to a particular situation, we will escalate this using our complaints policy. If you continue to have concerns you can report them to the Information Commissioner’s Office here.

Your personal data is held on secure servers operated by both St Oswald’s Hospice Limited on behalf of St Oswald’s Hospice Promotions Limited and agencies contracted by us.

The systems in use are Donorflex (used for the lottery) and Kudos (used to capture gift aid information and goods donations accepted within the shops).

Occasionally, in order to meet the purposes defined in this notice, we may need to transfer your personal information to countries or jurisdictions outside the UK. In such cases, we ensure that our suppliers provide adequate protection for the confidentiality and security of this information and the rights of individuals in connection to the transfer of personal data.

Specific safeguards exist to govern this sharing, including ensuring that these countries have adequate data protection provisions in place as agreed by the Information Commissioner’s Office or other additional safeguards are in place, most commonly by implementing standard contractual clauses agreed by the ICO for international transfers within contracts.

St Oswald’s Hospice Promotions takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed and it is not accessed except by those authorised to do so in the performance of their duties .

Personal data is collected and stored securely subject to stringent security measures and is protected against misuse. When we use external data processing services, we do so only under strict contractual terms to mirror the security policies that we have in place.

The sharing of information between St Oswald’s Hospice Promotions Limited (data controller) and St Oswald’s Hospice Limited (data processor) is set out in the memorandum of understanding between the two companies.

In order to process your lottery entry we need your name, contact details, number of tickets and bank details.

The purpose of capturing your personal information will be for processing your participation in the lottery scheme. This will be done on the basis of explicit consent which will be gathered from entry forms.

St Oswald’s Hospice Promotions Limited utilises a donor database (Donorflex) to manage the lottery and all other donations to St Oswald’s Hospice. As such, being a lottery player generates a donor account on Donorflex. If you are also a donor in other ways, all of your generosity is recorded on one donor record and as such is shared between the two companies by being on a shared database. We use a single marketing preferences system across the two companies as if we were a single company, therefore when you join the lottery, make a donation through participation in an event, or by regular giving, your marketing preferences are the same across the two companies.

Under the Data Protection Act 2018, we cannot send marketing information to you via text or email without your specific consent to use these channels, even if you have supplied your email address or mobile number to us in the past. We would generally communicate with you by post or telephone in order to process any winning claims or issues with ticket purchases.

It is not a legal requirement that we obtain explicit consent to contact you with marketing information via traditional mail or over the telephone if you have supplied us with your contact details and we are contacting you about something which is relevant to how you’ve contacted us or supported us in the past. By ‘us’ we mean both St Oswald’s Hospice Limited and St Oswald’s Hospice Promotions Limited.

However you can opt out of receiving marketing from us via these channels at any time by emailing supportercare@stoswaldsuk.org or call 0191 246 9123. These preferences as stated above will be used across St Oswald’s Hospice Limited and St Oswald’s Hospice Promotions Limited.

We shall process the data you supply in order that we can assist you and respond appropriately. We will not share or sell your data for marketing purposes outside of St Oswald’s Hospice Limited or St Oswald’s Hospice Promotions Limited.

At St Oswald’s Hospice Promotions Limited we may take photographs and videos most commonly for marketing and promotional purposes such as in the event of a lottery win. Where necessary we will ask for written consent from participants and this can be withdrawn at any time simply by contacting a member of the Communications and Marketing Team on enquiries@stoswaldsuk.org.

Contact details, details of your request and additional information needed to verify your identity.

To be able to investigate a complaint, respond to your query or request.

Support services for managing data protection requests, complaints and enquiries are provided by St Oswald’s Hospice Limited (data processor) on behalf of St Oswald’s Hospice Promotions Limited (data controller).

Our purpose for collecting the information is so that we can respond to your complaint or enquiry appropriately.

The legal basis we rely on for processing your personal data is Legitimate Interest of both parties in resolving the issue or query raised and to comply with our legal obligation to respond to your requests under the Data Protection law.

We only use your details to provide a response to you, we then retain a minimal log of complaints and access requests to be able to monitor the service and how it can be improved. We are also required to share anonymised versions of the logs with the NHS under the provision of the NHS contract.

All logs are maintained on Microsoft software within St Oswald’s Hospice Limited on behalf of St Oswald’s Hospice Promotions Limited.

We keep a log of complaints for eight years from the date of the complaint and subject access requests are retained for three years from the date of request.

St Oswald’s Hospice Promotions Limited is committed to improving services and developing opportunities for raising additional income to support St Oswald’s Hospice services. We may occasionally offer you the opportunity to participate in research, audit or satisfaction surveys in order to help us develop and audit current services and support innovation. All participation is voluntary and any resulting reports will be anonymous and presented in a summarised form before being shared with a wider audience. Where necessary your explicit consent will be sought when entering a research project and can be withdrawn at any stage.

Where required to do so by the government or to support the NHS Track and Trace system in the fight against COVID-19, St Oswald’s Hospice may collect and share details of staff, volunteers, visitors or patients. Where this is the case notices will be made clear at signing in points and this information will be destroyed securely after 21 days. If you object to your data being used for this purpose please let us know via the dataprotectionofficer@stoswaldsuk.org

If we decide to change our Privacy Notice, we shall post changes on this page so that you are always aware of how St Oswald’s Hospice Promotions Limited uses your personal information.

We keep our privacy notice under regular review to make sure it is up to date and accurate. It was last reviewed in July 2023.