For Data Protection requirements * the data controller is Martin House Hospice Care for Children and Young People, (thereafter known as Martin House) Grove Road, Boston Spa, West Yorkshire, LS23 6TX. This is also our registered office. Our registered charity number is 517919 and company registration number is 02016332.
We are committed to protecting and respecting your privacy, and we take your privacy very seriously.
Our commitment to you
To enable us to undertake our charitable objectives we collect and use personal information about individuals. We recognise the trust placed in us by individuals whose information we use. This policy (together with any other documents referred to in it) sets out the basis on how any personal data we collect from you, or that you provide to us, or that we obtain about, you will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
This notice applies to the public including our supporters, contractors and other customers.
We have a separate privacy notice for our employees and volunteers and for the children, young people and families we support.
This privacy notice provides details about:
- Your data protection rights as an individual
- Contacting us about your information
- The information we collect and use
- Why we share information about you
- How long we keep information about you
Your Data Protection rights
You have certain rights in relation to your personal information, although those rights will not apply in all cases or to all the information that we hold about you. For example, we may need to continue to hold and process information to establish, exercise or defend our legal rights.
You have the right to be informed about how we use the data you provide. We will try to be as transparent as possible in our interactions with you. Any time you give us personal information you have a right to be informed about why we need it and how we will use it. You can find most of the information you need in this Privacy Notice.
You have a right of access
You have a right of access to any of your personal data that we hold about you. You can contact us at any time to gain information about what data we hold about you and why we hold it. Please contact the Data Protection Officer at Martin House, details as above.
If you make a formal request, we will respond to acknowledge your request and will first require you to prove your identity. We may also ask you for information about any specific information you are seeking to help us make sure we meet your request fully and speed up the process.
If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
We will provide you the information that you are entitled to as soon as possible and without unreasonable delay and at the latest within one month of your identity been verified by us.
In exceptional cases we may extend the period of compliance by a further two months if the request(s) are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.
There is no charge made for this right of this access by Martin House Hospice.
To make a request to Martin House Hospice for any personal information we may hold we would ask that you contact our Data Protection Officer, see contact details above.
You have the right to ask us to correct inaccurate personal information.
If you believe information we hold about you to be inaccurate or incomplete, you can ask us to correct it or complete it at any time e.g. the spelling of your name or your contact information.
You also have the right to ask for our processing of your personal data to be restricted. For example, if you are contesting the accuracy of data we are using about you. In such case we will restrict our processing while we verify the accuracy of the data that we hold.
You can ask for certain information about you to be deleted.
You can also ask for certain information about you to be deleted, for example, if you are moving out of the area. In certain cases, we will be unable to delete all your information if there are statutory grounds that require us to retain it. In some cases we can refuse requests for complete erasure of the records that we hold, for example when we are legally obliged to keep hold of your data to comply with financial or other regulations (i.e. Gift Aid regs, HMRC requirements); when we are carrying out a task in the public interest involving the data, when keeping the data is necessary for establishing, exercising or defending legal claims for Martin House Hospice, when erasing the data would prejudice scientific or historical research or archiving that is in the public interest (for example during the COVID-19 pandemic if we have good reasons to retain the data), when keeping hold of the data is necessary for reasons of public health; when keeping the data is necessary for the purposes of preventative or occupational medicine.
If any of the above apply, we can either fully or partly refuse to comply with your request.
We will respond to requests for deletion of personal data within 1 month of receiving the request.
You have the right to data portability
You have the right to data portability where processing is automated, although we don't currently carry out any such processing. If we do in future, you can make a request and this data can be exported from our systems for you.
You have the right to ask us not to process your personal data
It is always your decision as to whether you want to receive information about our valuable work, how we raise funds and the ways you can get involved. If you do not want us to use your personal information in these ways please contact us. For example you may opt out of any of our marketing at any time by clicking the ‘unsubscribe’ link at the end of our marketing communications or by contacting us as detailed above.
The information we collect and use
Most of the personal information we process is provided to us directly by you for one of the following reasons:
- You wish to attend, or have attended, an event.
- You subscribe to our e-newsletter.
- You have donated funds or goods to us.
- You have purchased goods or services from us.
- You have applied for a job or secondment with us.
- You are representing your organisation.
- You have made a complaint or enquiry to us.
- You have made an information request to us.
We also receive personal information indirectly, in the following scenarios:
- Your personal information is contained in reports from other Health care professionals and organisations or is given to us by those organisations.
- We have processed your personal information as part of a campaign or fundraising aim (see below).
- From other Hospices, public authorities, regulators or law enforcement bodies.
- An employee of ours gives your contact details as an emergency contact or a referee.
- We have contacted an organisation about a complaint you have made, and it gives us your personal information in its response.
- A complainant refers to you in their complaint correspondence.
We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.
In some circumstances we are legally obliged to share information. For example, under a court order or where we cooperate with other regulatory bodies such as the Care Quality Commission, Charities Commission or HMRC during inspections or investigations. We might also share information with other regulatory bodies in order to further their, or our, objectives. In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share the information and document our decision making and satisfy ourselves we have a legal basis on which to share the information.
On rare occasions we will be required by law to share information with law enforcement agencies such as the Police. You will not be informed if this takes place.
Lawful basis for processing
We must have a lawful basis for processing your information. The lawful bases for processing are set out in Article 6 (1) and 9 of the GDPR. These will vary on the circumstances of why we process and how we use your information:
• 6 (f) the legal bases for the majority of our processing is that the activities are within our legitimate interests as a charity that provides hospice care for children and young people. This includes our legitimate interest to generate support, donations and income by direct marketing which are a routine part of the activities we undertake to fund our purposes as a Hospice. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We will not use your personal data for these activities where our interests are overridden by the impact on you and you have the right to ask us not to process your personal data for marketing purposes,
• (c) the processing is necessary for compliance with a legal obligation to which we are subject e.g. we must provide certain contact information and other details about our services to HMRC and the Charities Commission,
• (e) the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law,
• (b) the processing is necessary for a contract we have with the individual, or because they have asked you to take specific steps before entering into a contract,
• (d) to protect vital interests e.g. the processing is necessary to protect someone’s life,
• (a) you have given consent for us to process the information.
Special Category Data
Where we process special categories data, for example data concerning health, racial or ethnic origin, or sexual orientation, we need to meet an additional condition under in the GDPR. Where we are processing special categories personal data for purposes related to the commissioning and provision of hospice and healthcare services the condition is:
Article 9(2)(h) – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services; or
Article 9(2)(b) – where processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the Martin House; or
Article 9(2)(f) – for the establishment, exercise or defence of legal claims (examples of our processing include processing relating to any tribunal or other litigation; or
v. Article 9(2)(a) – explicit consent (examples of circumstances where we seek consent include any dietary requirements and health information we receive from our patients who require a reasonable adjustment to access our services); or
vi. Article 9(2)(c) – where processing is necessary to protect the vital interests of the data subject or of another natural person (examples of our processing would be using health information about a patient or family member in a medical emergency).
Martin House uses various ways to achieve our organisation ambition and to support our objectives as a Children’s Hospice.
We believe that supporters, families and volunteers whose information we hold on our database, are fully aware of the nature of their relationship with us and the mutually beneficial reasons for staying in contact.
We will process the personal information you have supplied to us to conduct and manage our business to enable us to give you the most appropriate marketing, fundraising, information, service and products and provide the best and most secure experience. These are what we consider to be our 'Legitimate Interests'.
Your privacy interests
When we process your personal information for our legitimate interests, we will consider and balance any potential impact on you and your rights under data protection and any other relevant law. Our legitimate business interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you (unless where we are required or permitted to by law, for example where we are required by law to share personal data to the HMRC for Gift Aid purposes or are required to share information with the Police).
We retain a database of supporters and donors to enable us to continue to contact them and update them on activities within Martin House. Where contact may have lapsed or we have not contacted people for some time, provided they have not asked us to remove them from our mailing lists, Martin House has legitimate interests as outlined above for the purposes of fundraising communications to reactivate lapsed members or supporters for income generation purposes to support our cause as a Hospice.
We will always offer an opportunity to stop any subsequent similar communications from us.
The following are some examples of when and why we would use this approach in our work helping local children and families:
- Direct Marketing: We may contact you by post, telephone, email or text with marketing and fundraising messages which further the legitimate aims and objectives of Martin House. We will make sure our communications are relevant to you and where appropriate tailored to your interests. We will always include the option for you to stop any subsequent similar communication from us.
- Ordering or entering events online: In order for us to process an order or register you for an event, payment has to be taken and contact information collected, such as name, address and telephone number that we require. Martin House will also keep a record of the transaction for Gift Aid or auditing purposes.
- Your best interest: Processing your information in this way helps to protect you against fraud when transacting on our website, and to ensure our websites and systems are secure.
- Personalisation: Where the processing enables us to enhance, modify, personalise or otherwise improve our services/communications for the benefit of our supporters.
- Analytics: To process your personal information for the purposes of customer analysis, assessment, anonymous profiling and direct marketing, on a personalised or aggregated basis, to help us with our activities and to provide you with the most relevant information as long as this does not harm any of your rights and interests.
- Research: To determine the effectiveness of promotional campaigns and advertising and to develop our products, services, systems and relationships with you. We may also carry out research on donors and prospective donors using information that is publicly available e.g. electoral roll, company websites, news articles, LinkedIn, Twitter or Companies House.
- Due Diligence: On rare occasions we may need to conduct investigations on supporters, potential customers and business partners to determine if those companies and individuals have been involved or convicted of offences such as fraud, bribery and corruption.
- Complaints: In the event of any complaint, we may process your personal details to enable us to understand and investigate your complaint.
We will also hold information about you so that we can respect your preferences for being contacted by us.
Without these contact opportunities, Martin House’s income generation potential is put at risk, jeopardising the long-term continuation of the organisation. This is because:
- Our income generation opportunity is greatly increased if we undertake fundraising appeals – experience has shown that direct fundraising appeals generate higher response rates.
- The supporter experience is enhanced, and new opportunities are promoted where previous supporters, who do not object to being contacted by us, can be told about events and new attractions. Our research and experience shows that the majority of supporters and families do want to hear regularly from us after our initial contact.
- Where it is relevant we will use postal communications to contact people. For example, our unsolicited introductory communications to people not previously engaged with us is heavily weighted towards postal contact.
Trade and Generate Income
Our shops have a key role in raising income to support our work as a charity. We will collect and hold personal information to support:
- Collection of donations
- Delivering purchases
- Enabling online orders
Digital Identities and Cookies
Where appropriate we use technology to support and assist us in undertaking our work. We collect information that enables us to manage and secure technology and provide insight about its use as follows:
- Cookies that analyse visitors to our website and social media pages
- Cookies that provide social media adverts tailored to you
- Device information about users of our Wi-Fi and other systems
- Social media advertising programmes e.g. Facebook Custom Audience
Details on how you can manage your cookie settings can be found at https://www.martinhouse.org.uk/Footers/Cookie-Policy
Administration and Governance
As a charitable organisation we also hold, and process data as required by regulatory bodies such as the Charities Commission. This can include personal information relating to:
- Enquiries or complaints about us.
- Processing financial transactions, maintaining our accounts and prevention of fraud.
- Administering Gift Aid claims.
We occasionally process sensitive information about individuals in a limited manner as follows:
- To ensure your health and wellbeing on our premises or at an event.
- As part of monitoring equality and diversity in accordance with existing legislation.
Why we may share marketing information about you
We understand that sharing information is a sensitive topic. We will never sell your information and are committed to being transparent with you about where we legally share information, the reason why and who with.
Your information may be shared internally, including with members of the fundraising, income generation, finance, HR, IT staff, where access to the data is necessary for legitimate purposes, i.e. in the event of a complaint about the performance of our roles, events, campaigns etc.
This sharing may include:
- Personal information with professional bodies and regulators in accordance with our statutory obligations
- Personal and financial details about donations for Gift Aid claims, audits and anti-fraud legislation are shared with HMRC
- Personal details are shared with designated mailing houses for the purposes of sending printed communications
- Email addresses with providers of social media and email marketing platforms
- Information about the use of IT systems is shared with technical suppliers for the purposes of support and system administration
- Limited information about your digital identity is used to provide statistical information about the use of our IT systems including website and social media pages.
How long we keep information about you
We only keep information for as long as necessary in accordance with legislation or relevant regulations. Once we no longer need to keep your information we remove it from our systems or securely dispose of it and we do this at the end of each financial year. Specifically:
- Supporter records are kept for seven years after the date of the last donation.
- Details about legacies we receive are kept for 12 years and details about legacy pledges are kept until the legacy is received.
- Information about financial transactions including supplier/ customer information is kept for seven years.
- Anonymised statistical information about website visitors is kept in accordance with Google’s Analytics data privacy and security policy for analytical purposes.
Notification of changes
This statement may change from time to time, for example, if the law around information changes or for operational purposes. We advise you to visit this page regularly to keep up to date with any changes.
Martin House tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive details of all aspects of Martin House’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to: email@example.com
If you have any queries about the process or how we handle your information, please contact us in the first instance at firstname.lastname@example.org
If you believe that Martin House has not complied with your data protection rights, you can complain to the Information Commissioner’s Office, their address is Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by calling 0303 123 1113.
* Data Protection Requirements means the Data Protection Act 2018, the EU Data Protection Directive 95/46/EC, the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice)(Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011, the General Data Protection Regulation and all other applicable laws and regulations relating to processing of personal data and privacy in any applicable jurisdiction as amended and replaced, including where applicable the guidance and codes of practice issued by the UK Information Commissioner or such other relevant data protection authority.