For Data Protection requirements*, the data controller is Martin House Hospice Care for Children and Young People, (thereafter known as Martin House) Grove Road, Boston Spa, West Yorkshire, LS23 6TX. This is also our registered office. Our registered charity number is 517919 and our company registration number is 02016332.
Contacting us
If you would like further information on this privacy notice or exercise any of your rights, you can email us at: dataprotection@martinhouse.org.uk or at Martin House, Grove Road, Boston Spa, Wetherby, LS23 6TX.
We are committed to protecting and respecting your privacy, and we take your privacy very seriously.
The following information provides details on how we may collect, use, and where appropriate share personal information in accordance with the UK General Data Protection Regulations (UK GDPR).
Our commitment to you
To enable us to undertake our charitable objectives we collect and use personal information about individuals. We recognise the trust placed in us by individuals whose information we use. This notice (together with any other documents referred to in it) sets out the basis on how any personal data we collect from you, or that you provide to us, or that we obtain about, you will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
This notice applies to the public including our supporters, contractors, and other stakeholders.
We have a separate privacy notice for our employees, volunteers, and those applying to work with us and a separate privacy notice for the children, young people, and families we support.
This privacy notice provides details about:
- Your data protection rights as an individual
- Contacting us about your information
- The information we collect and use
- Why we share information about you
- How long we keep information about you
Your Data Protection rights
You have certain rights in relation to your personal information, although those rights will not apply in all cases or to all the information that we hold about you. For example, we may need to continue to hold and process information to establish, exercise or defend our legal rights.
You have the right to be informed about how we use the data you provide. We will try to be as transparent as possible in our interactions with you. Any time you give us personal information, you have a right to be informed about why we need it and how we will use it.
You have a right of access
You have a right of access to any of your personal data that we hold about you. You can contact us at any time to gain information about what data we hold about you and why we hold it. Please contact the Data Protection Officer at Martin House, details as above.
If you make a formal request, we will respond to acknowledge your request and will first require you to prove your identity. We may also ask you for information about any specific information you are seeking to help us make sure we meet your request fully and speed up the process.
If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
We will provide you with the information that you are entitled to as soon as possible and without unreasonable delay and at the latest within one month of your identity having been verified by us.
In exceptional cases, we may extend the period of compliance by a further two months if the request(s) are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.
There is no charge made for this right of this access by Martin House.
You have the right to ask us to correct inaccurate personal information.
If you believe the information we hold about you to be inaccurate or incomplete, you can ask us to correct it or complete it at any time e.g. the spelling of your name or your contact information.
You also have the right to ask for our processing of your personal data to be restricted. For example, if you are contesting the accuracy of data we are using about you. In such case, we will restrict our processing while we verify the accuracy of the data that we hold.
You can ask for certain information about you to be deleted.
You can also ask for certain information about you to be deleted, for example, if you are moving out of the area. In certain cases, we will be unable to delete all your information if there are statutory grounds that require us to retain it. In some cases we can refuse requests for complete erasure of the records that we hold, for example when we are legally obliged to keep hold of your data to comply with financial or other regulations (i.e. Gift Aid regulations, HMRC requirements); when we are carrying out a task in the public interest involving the data, when keeping the data is necessary for establishing, exercising or defending legal claims for Martin House, when erasing the data would prejudice scientific or historical research or archiving that is in the public interest (for example during the COVID-19 pandemic if we have good reasons to retain the data), when keeping hold of the data is necessary for reasons of public health; when keeping the data is necessary for the purposes of preventative or occupational medicine.
If any of the above apply, we can either fully or partly refuse to comply with your request.
We will respond to requests for deletion of personal data within 1 month of receiving the request.
You have the right to data portability
You have the right to data portability where processing is automated. In this case, you can make a request and this data can be exported from our systems for you.
You have the right to ask us not to process your personal data
It is always your decision as to whether you want to receive information about our valuable work, how we raise funds, and the ways you can get involved. If you do not want us to use your personal information in these ways please contact us. For example, you may opt out of any of our marketing at any time by clicking the ‘unsubscribe from this list’ link at the end of our marketing communications or by contacting us as detailed above.
What personal data we collect
Most of the personal information we process is provided to us directly by you for one of the following reasons:
- You wish to attend or have attended, an event.
- You subscribe to our e-newsletter.
- You have donated funds or goods to us.
- You play in the Martin House lottery or one of our raffles
- You have purchased goods or services from us.
- You have applied for a job or secondment with us.
- You are representing your organisation.
- You have made a complaint or enquiry to us.
- You have made an information request to us.
We also receive personal information indirectly, in the following scenarios:
- Your personal information is contained in reports from other professionals and organisations or is given to us by those organisations.
- We have processed your personal information as part of a campaign or fundraising aim (see below).
- From other hospices, public authorities, regulators, or law enforcement bodies.
- An employee of ours gives your contact details as an emergency contact or a referee.
- We have contacted an organisation about a complaint you have made, and it gives us your personal information in its response.
- A complainant refers to you in their complaint correspondence.
We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.
In some circumstances we are legally obliged to share information. For example, under a court order or where we cooperate with other regulatory bodies such as the Care Quality Commission, Charities Commission, or HMRC during inspections or investigations. We might also share information with other regulatory bodies in order to further their, or our, objectives. In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share the information and document our decision-making and satisfy ourselves we have a legal basis on which to share the information.
On rare occasions, we will be required by law to share information with law enforcement agencies such as the Police. You will not be informed if this takes place.
Our legal basis for collecting and sharing personal data
We must have a lawful basis for processing your information. The lawful bases for processing are set out in Article 6 (1) and 9 of the GDPR. These will vary on the circumstances of why we process and how we use your information:
• 6 (f) The legal bases for the majority of our processing is that the activities are within our legitimate interests as a charity that provides hospice care for children and young people. This includes our legitimate interest to generate support, donations, and income by direct marketing which are a routine part of the activities we undertake to fund our purposes as a Hospice. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We will not use your personal data for these activities where our interests are overridden by the impact on you and you have the right to ask us not to process your personal data for marketing purposes,
• (c) the processing is necessary for compliance with a legal obligation to which we are subject e.g. we must provide certain contact information and other details about our services to HMRC and the Charities Commission,
• (e) the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law,
• (b) the processing is necessary for a contract we have with the individual, or because they have asked you to take specific steps before entering into a contract,
• (d) to protect vital interests e.g. the processing is necessary to protect someone’s life,
• (a) you have given consent for us to process the information.
At times, we may use a balancing test known as a Legitimate Interest Assessment to support the lawfulness of our processing activities and to help us demonstrate accountability as it proves that we have made all considerations in determining our legal basis for processing the data in question.
Some of the personal data processed by Martin House will be information defined as Special Category Data. In order to lawfully process this type of information, Martin House will rely on the following Article 9 conditions:
- Article 9(2)(b) - Employment, social security, and social protection
Marketing
Martin House uses various ways to achieve our organisation ambition and to support our objectives as a Children’s Hospice.
We believe that supporters, families, and volunteers whose information we hold on our database, are fully aware of the nature of their relationship with us and the mutually beneficial reasons for staying in contact.
We will process the personal information you have supplied to us to conduct and manage our engagement to enable us to give you the most appropriate marketing, fundraising, information, service, and products and provide the best and most secure experience.
Fundraising and direct marketing
We love to keep our supporters updated with the latest news about our work and our fundraising activities.
We use a range of marketing activities and channels to contact our supporters – including our website, face-to-face fundraising, direct mail, SMS/text campaigns, email, and telephone.
With all new supporters, we will obtain consent to contact you by email, phone, and SMS. Where in the past we haven’t specifically asked for your consent to do this, we believe it is in Martin House’s legitimate business interest to let our supporters know about the latest news and share with you how else you can help. We only do this where we don’t believe sending these will impact your privacy or cause you harm or distress; however, you can always let our Supporter Care team know if you’d prefer us not to contact you in any of these ways.
We will send you marketing by post, based on it being within our legitimate interests to do so, unless you opt out. See ‘Our legal basis for collecting and sharing personal data’ on this page, for more information about our use of legitimate interests.
We also engage in online advertising, also to keep you aware of what we’re up to and to help you see and find our products.
Like many companies, we use targeted ads. We do this using a variety of digital marketing networks and ad exchanges, and we use a range of advertising technologies like web beacons, pixels, ad tags, cookies, and mobile identifiers, as well as specific services offered by some websites and social networks, such as Facebook’s Custom Audience service.
The banners and ads you see will be based on information we hold about you, or your previous use of the Site, including our social media accounts or on Site or Application banners or ads you have previously clicked on.
You can change or stop how you hear from us at any time by getting in touch with our supporter care team. Please find their details here: getinvolved@martinhouse.org.uk.
Your privacy interests
When we process your personal information for our legitimate interests, we will consider and balance any potential impact on you and your rights under data protection and any other relevant law. Our legitimate business interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you (unless where we are required or permitted to by law, for example where we are required by law to share personal data to HMRC for Gift Aid purposes or are required to share information with the Police).
The following are some examples of when and why we would use this approach in our work helping local children and families:
- Direct Marketing: We may contact you by post with marketing and fundraising messages which further the legitimate aims and objectives of Martin House. We will make sure our communications are relevant to you and where appropriate tailored to your interests. We will always include the option for you to stop any subsequent similar communication from us.
- Ordering or entering events online: In order for us to process an order or register you for an event, payment has to be taken and contact information collected, such as name, address, and telephone number that we require. Martin House will also keep a record of the transaction for Gift Aid or auditing purposes.
- Your best interest: Processing your information in this way helps to protect you against fraud when transacting on our website, and to ensure our websites and systems are secure.
- Personalisation: Where the processing enables us to enhance, modify, personalise or otherwise improve our services/communications for the benefit of our supporters.
- Analytics: To process your personal information for the purposes of customer analysis, assessment, anonymous profiling, and direct marketing, on a personalised or aggregated basis, to help us with our activities and to provide you with the most relevant information as long as this does not harm any of your rights and interests.
- We undertake in-house research and from time to time engage agencies to gather information about you from publicly available sources. We may also carry out screening to fast-track the research using our trusted third-party partners. You will always have the right to opt out of this processing. We may also carry out research using publicly available information to identify individuals who may have an affinity to our cause but with whom we are not already in touch. If you would prefer us not to use your data in this way, please email us at getinvolved@martinhouse.org.uk
- Research: To determine the effectiveness of promotional campaigns and advertising and to develop our products, services, systems and relationships with you. We may also carry out research on donors and prospective donors using information that is publicly available e.g. electoral roll, company websites, news articles, LinkedIn, Twitter, or Companies House.
- Due Diligence: On rare occasions, we may need to conduct investigations on supporters, potential customers, and business partners to determine if those companies and individuals have been involved or convicted of offenses such as fraud, bribery, and corruption.
- Complaints: In the event of any complaint, we may process your personal details to enable us to understand and investigate your complaint.
We will also hold information about you so that we can respect your preferences for being contacted by us.
Without these contact opportunities, Martin House’s income generation potential is put at risk, jeopardising the long-term continuation of the organisation. This is because:
- Our income generation opportunity is greatly increased if we undertake fundraising appeals – experience has shown that direct fundraising appeals generate higher response rates.
- The supporter experience is enhanced, and new opportunities are promoted where previous supporters, who do not object to being contacted by us, can be told about events and new attractions. Our research and experience show that the majority of supporters and families do want to hear regularly from us after our initial contact.
- Where it is relevant we will use postal communications to contact people. For example, our unsolicited introductory communications to people not previously engaged with us are heavily weighted toward postal contact.
Regular activities
Retail and Income Generation
Our shops have a key role in raising income to support our work as a charity. We will collect and hold personal information to support:
- Collection of donations
- Delivering purchases
- Enabling online orders
Digital Identities and Cookies
Where appropriate we use technology to support and assist us in undertaking our work. We collect information that enables us to manage and secure technology and provide insight about its use as follows:
- Cookies that analyse visitors to our website and social media pages
- Cookies that provide social media adverts tailored to you
- Device information about users of our Wi-Fi and other systems
- Social media advertising programmes e.g. Facebook Custom Audience
Details on how you can manage your cookie settings can be found at https://www.martinhouse.org.uk/Footers/Cookie-Policy
Administration and Governance
As a charitable organisation we also hold, and process data as required by regulatory bodies such as the Charities Commission. This can include personal information relating to:
- Enquiries or complaints about us.
- Processing financial transactions, maintaining our accounts, and prevention of fraud.
- Administering Gift Aid claims.
Sensitive Information
We occasionally process sensitive information about individuals in a limited manner as follows:
- To ensure your health and well-being on our premises or at an event.
- As part of monitoring equality and diversity in accordance with existing legislation.
Why we may share marketing information about you
We understand that sharing information is a sensitive topic. We will never sell your information and are committed to being transparent with you about where we legally share information, the reason why, and who with whom.
Your information may be shared internally, including with members of the fundraising, income generation, finance, HR, IT staff, where access to the data is necessary for legitimate purposes, i.e. in the event of a complaint about the performance of our roles, events, campaigns etc.
This sharing may include:
- Personal information with professional bodies and regulators in accordance with our statutory obligations
- Personal and financial details about donations for Gift Aid claims audits and anti-fraud legislation are shared with HMRC
- Personal details are shared with designated mailing houses for the purposes of sending printed communications
- Email addresses with providers of social media and email marketing platforms
- Information about the use of IT systems is shared with technical suppliers for the purposes of support and system administration
- Limited information about your digital identity is used to provide statistical information about the use of our IT systems including website and social media pages.
How long we keep your personal data
We only keep information for as long as necessary in accordance with legislation or relevant regulations. Once we no longer need to keep your information we remove it from our systems or securely dispose of it and we do this at the end of each financial year. Specifically:
- Supporter records are kept for seven years after the date of the last donation.
- Details about legacies we receive are kept for 12 years and details about legacy pledges are kept until the legacy is received.
- Information about financial transactions including supplier/ customer information is kept for seven years.
- Anonymised statistical information about website visitors is kept in accordance with Google’s Analytics data privacy and security policy for analytical purposes.
Notification of changes
This statement may change from time to time, for example, if the law around information changes or for operational purposes. We advise you to visit this page regularly to keep up to date with any changes.
Complaints
Martin House tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive details of all aspects of Martin House’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to: dataprotection@martinhouse.org.uk
* Data Protection Requirements means the Data Protection Act 2018, the EU Data Protection Directive 95/46/EC, the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice)(Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011, the General Data Protection Regulation and all other applicable laws and regulations relating to processing of personal data and privacy in any applicable jurisdiction as amended and replaced, including where applicable the guidance and codes of practice issued by the UK Information Commissioner or such other relevant data protection authority.
Employee & Volunteer Privacy Notice
For Data Protection requirements*, the data controller is Martin House Hospice Care for Children and Young People, (thereafter known as Martin House) Grove Road, Boston Spa, West Yorkshire, LS23 6TX. This is also our registered office. Our registered charity number is 517919 and company registration number is 02016332.
Contacting us
If you would like further information on this privacy notice or exercise any of your rights, you can email us at: dataprotection@martinhouse.org.uk or at Martin House, Grove Road, Boston Spa, Wetherby, LS23 6TX.
We are committed to protecting and respecting your privacy, and we take your privacy very seriously.
The following information provides details on how we may collect, use and where appropriate share personal information in accordance with the UK General Data Protection Regulations (UK GDPR).
Our commitment to you
This notice (together with any other documents referred to in it) sets out the basis on how any personal data we collect from you, or that you provide to us, or that we obtain about, you will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
This notice applies to our staff, volunteers and those applying to work with us.
We have a separate privacy notice for our fundraising supporters and contractors and a separate notice for the children, young people and families we support.
This privacy notice provides details about:
- Your data protection rights as an individual
- Contacting us about your information
- The information we collect and use
- Why we share information about you
- How long we keep information about you
Your Data Protection rights
You have certain rights in relation to your personal information, although those rights will not apply in all cases or to all the information that we hold about you. For example, we may need to continue to hold and process information to establish, exercise or defend our legal rights.
You have the right to be informed about how we use the data you provide. We will try to be as transparent as possible in our interactions with you. Any time you give us personal information, you have a right to be informed about why we need it and how we will use it.
You have a right of access
You have a right of access to any of your personal data that we hold about you. You can contact us at any time to gain information about what data we hold about you and why we hold it. Please contact the People team at hr@martinhouse.org.uk or the Data Protection Officer at Martin House, details as above.
If you make a formal request, we may also ask you for information about any specific information you are seeking to help us make sure we meet your request fully and speed up the process.
If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need in person or over the telephone.
We will provide you with the information that you are entitled to as soon as possible and without unreasonable delay and at the latest within one month.
In exceptional cases we may extend the period of compliance by a further two months if the request(s) are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.
There is no charge made for this right of this access by Martin House.
You have the right to ask us to correct inaccurate personal information.
If you believe information we hold about you to be inaccurate or incomplete, you can ask us to correct it or complete it at any time e.g. the spelling of your name or your contact information.
You also have the right to ask for our processing of your personal data to be restricted. For example, if you are contesting the accuracy of data we are using about you. In such case we will restrict our processing while we verify the accuracy of the data that we hold.
You can ask for certain information about you to be deleted.
You can also ask for certain information about you to be deleted. In certain cases, we will be unable to delete all your information if there are statutory or operational grounds that require us to retain it. In some cases we can refuse requests for complete erasure of the records that we hold, for example when we are legally obliged to keep hold of your data to comply with financial or other regulations (i.e. HMRC requirements); when we are carrying out a task in the public interest involving the data, when keeping the data is necessary for establishing, exercising or defending legal claims for Martin House, when erasing the data would prejudice scientific or historical research or archiving that is in the public interest (for example during the COVID-19 pandemic if we have good reasons to retain the data), when keeping hold of the data is necessary for reasons of public health; when keeping the data is necessary for the purposes of preventative or occupational medicine.
If any of the above apply, we can either fully or partly refuse to comply with your request.
We will respond to requests for deletion of personal data within 1 month of receiving the request.
You have the right to data portability
You have the right to data portability where processing is automated. In this case, you can make a request and this data can be exported from our systems for you.
Why we collect personal data
Martin House needs to process data to enter into an employment contract or a contract for services with you and to meet its obligations under that contract. For example, it needs to process your data to provide you with an employment contract or a contract for services, to pay you in accordance with your contract and to administer any relevant benefits or pension entitlements. We also need to process data on new, existing and former volunteers.
In some cases, Martin House needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled.
In other cases, Martin House has a legitimate interest in processing personal data before, during and after the end of the employment relationship.
At times, we may use a balancing test known as a Legitimate Interest Assessment to support the lawfulness of our processing activities and to help us demonstrate accountability as it proves that we have made all considerations in determining our legal basis for processing the data in question.
What personal data we collect
The personal data we collect could include:
- Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
- Date of birth.
- Gender.
- Marital status and dependents.
- Next of kin and emergency contact information.
- National Insurance number.
- Bank account details, payroll records and tax status information.
- Salary, annual leave, pension and benefits information.
- Start date and, if different, the date of your continuous employment.
- Leaving date and your reason for leaving.
- Location of employment or workplace.
- Copy of driving licence and car insurance.
- Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process).
- Employment records (including job titles, work history, working hours, holidays, training records and professional memberships).
- Compensation history.
- Performance information.
- Disciplinary and grievance information.
- Information about your use of our information and communications systems.
- Photographs.
- Results of HMRC employment status check, details of your interest in and connection with the intermediary through which your services are supplied.
We may also collect, store and use the following more sensitive types of personal information:
- Diversity and equal opportunities monitoring information – this can include information about your race or ethnicity, religious beliefs, sexual orientation, disability and other ‘special category data’
- Trade union membership.
- Information about your health, including any medical condition, health and sickness records, including:
- Where you leave employment and the reason for leaving is determined to be ill-health, injury or disability, the records relating to that decision;
- Details of any absences (other than holidays) from work including time on statutory parental leave and sick leave; and
- Where you leave employment and the reason for leaving is related to your health, information about that condition needed for pension purposes.
- Information about criminal convictions and offences.
- CCTV images may be used now or in the future to capture staff and volunteer activity in Martin House locations.
We collect personal information about employees, workers, volunteers and contractors through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employers, credit reference agencies or other background check agencies such as the Disclosure and Barring Service.
We will collect additional personal information in the course of job-related activities throughout the period of you working for us.
We may monitor and record electronic communications (website, email and phone conversations) for a number of reasons such as:
- staff and volunteer training
- records of conversations
- employee relations investigations
- the detection, investigation and prevention of crime
We will inform you if your call is being recorded or monitored.
Emails that we send to you or you send to us, may be retained as a record of contact and your email address stored for future use in accordance with our retention periods. If we need to email sensitive or confidential information to you, we may perform checks to verify the correct email address and may take additional security measures.
Please see our Data Protection Policy for details on how we define personal and non-personal data.
How we use your personal data
We'll only use your personal data in accordance with data protection legislation, and for the purposes stated in this privacy notice.
We'll:
- only ask for what is necessary for the performance of our contract with you and to enable us to comply with Legal Obligations.
The situations in which we will process your personal information include:
- Making a decision about your recruitment or appointment.
- Determining the terms on which you work for us.
- Checking you are legally entitled to work in the UK.
- Paying you and, if you are an employee or deemed employee for tax purposes, deducting tax and National Insurance contributions (NICs).
- Providing the following benefits to you:
- Annual leave entitlement
- Pension scheme
- Maternity and Paternity leave and pay
- Cycle to work and other salary sacrifice schemes
- Administering the contract we have entered into with you.
- Business management and planning, including accounting and auditing.
- Conducting performance reviews, managing performance and determining performance requirements.
- Making decisions about salary reviews and compensation.
- Assessing qualifications for a particular job or task, including decisions about promotions.
- Gathering evidence for possible grievance or disciplinary hearings.
- Making decisions about your continued employment or engagement.
- Making arrangements for the termination of our working relationship.
- Education, training and development requirements.
- Employee relations investigations
- Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work.
- Ascertaining your fitness to work.
- Managing sickness absence.
- Complying with health and safety obligations.
- System access and support
- Identity Cards
- To prevent fraud.
- To monitor your use of our information and communication systems to ensure compliance with our IT policies.
- To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution.
- To contact you in the case of an emergency or urgent operational situation.
- Equal opportunities monitoring.
We may take photos of you during work or at work events and use these for marketing and publicity purposes, both internally and externally.
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
We will:
- protect it and make sure nobody has access to it who shouldn’t
- ensure you know if you have a choice about giving us personal data
- make sure we don’t keep it for longer than is necessary
- delete or destroy it securely when we no longer have a need to keep it
We ask that you:
- give us accurate information
- tell us as soon as possible of any changes
- tell us as soon as possible if you notice mistakes in the information we hold about you
From time to time, we may conduct or ask you to take part in a survey to get your feedback, comments and opinions to help us improve our services.
Who we share your personal data with
If you are successfully recruited, we will upload your details to our HR system. As a member of staff you will sign a contract of employment and agree to additional terms on how your data is handled and stored.
We will share your data for statistical analysis (it will be anonymised first) if we are required to do so by law – for example, by court order, or to prevent fraud or other crime.
Any information we use in presentations or reports will be anonymised and will not identify any individuals. For example a report on recruitment and retention of staff or volunteers will not feature any of your personal data.
We do not disclose or share sensitive or confidential information without your explicit consent except where disclosure is required by law, or where we have good reason to believe that failing to do so, would put you or someone else at risk.
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing us, including the Department for Work and Pensions, HM Revenue and Customs and the Police.
Our legal basis for collecting and sharing personal data
The legal basis Martin House relies on will be determined by the specific process. However it is likely that Martin House will process this personal data under the legal basis of:
- Article 6(1)(a) – Consent
- Article 6(1)(b) - Contract
- Article 6(1)(c) - Legal Obligation
- Article 6(1) (f) – Legitimate Interest
Some of the personal data processed by Martin House will be information defined as Special Category Data. In order to lawfully process this type of information, Martin House will rely on the following Article 9 conditions:
- Article 9(2)(b) - Employment, social security and social protection
How long we keep your personal data
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. We will keep your personal data for the period of time as set out in statutory and regulatory requirements. We will delete or destroy your personal data securely.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Please see our Data Protection Policy for details about the further processing of personal data.
* Data Protection Requirements means the Data Protection Act 2018, the EU Data Protection Directive 95/46/EC, the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice)(Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011, the General Data Protection Regulation and all other applicable laws and regulations relating to processing of personal data and privacy in any applicable jurisdiction as amended and replaced, including where applicable the guidance and codes of practice issued by the UK Information Commissioner or such other relevant data protection authority.
Service User & Families Privacy Notice
For Data Protection requirements*, the data controller is Martin House Hospice Care for Children and Young People, (thereafter known as Martin House) Grove Road, Boston Spa, West Yorkshire, LS23 6TX. This is also our registered office. Our registered charity number is 517919 and company registration number is 02016332.
Contacting us
If you would like further information on this privacy notice or exercise any of your rights, you can email us at: dataprotection@martinhouse.org.uk or at Martin House, Grove Road, Boston Spa, Wetherby, LS23 6TX.
We are committed to protecting and respecting your privacy, and we take your privacy very seriously.
The following information provides details on how we may collect, use and where appropriate share personal information in accordance with the UK General Data Protection Regulations (UK GDPR).
Our commitment to you
This notice (together with any other documents referred to in it) sets out the basis on how any personal data we collect from you, or that you provide to us, or that we obtain about, you will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
This notice applies to the children, young people and families we support.
We have a separate privacy notice for our fundraising supporters and contractors and a separate notice for staff, volunteers and those applying to work with us.
This privacy notice provides details about:
- Your data protection rights as an individual
- Contacting us about your information
- The information we collect and use
- Why we share information about you
- How long we keep information about you
Your Data Protection rights
You have certain rights in relation to your personal information, although those rights will not apply in all cases or to all the information that we hold about you. For example, we may need to continue to hold and process information to establish, exercise or defend our legal rights.
You have the right to be informed about how we use the data you provide. We will try to be as transparent as possible in our interactions with you. Any time you give us personal information, you have a right to be informed about why we need it and how we will use it.
You have a right of access
You have a right of access to any of your personal data that we hold about you. You can contact us at any time to gain information about what data we hold about you and why we hold it. Please contact the Data Protection Officer at Martin House, details as above.
If you make a formal request, we will respond to acknowledge your request and will first require you to prove your identity. We may also ask you for information about any specific information you are seeking to help us make sure we meet your request fully and speed up the process.
If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
We will provide you with the information that you are entitled to as soon as possible and without unreasonable delay and at the latest within one month.
In exceptional cases we may extend the period of compliance by a further two months if the request(s) are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.
There is no charge made for this right of this access by Martin House.
You have the right to ask us to correct inaccurate personal information.
If you believe information we hold about you to be inaccurate or incomplete, you can ask us to correct it or complete it at any time e.g. the spelling of your name or your contact information.
You also have the right to ask for our processing of your personal data to be restricted. For example, if you are contesting the accuracy of data we are using about you. In such case we will restrict our processing while we verify the accuracy of the data that we hold.
You can ask for certain information about you to be deleted.
You can also ask for certain information about you to be deleted. In certain cases, we will be unable to delete all your information if there are statutory or operational grounds that require us to retain it. In some cases we can refuse requests for complete erasure of the records that we hold, for example when we are legally obliged to keep hold of your data to comply with certain regulations, when we are carrying out a task in the public interest involving the data, when keeping the data is necessary for establishing, exercising or defending legal claims for Martin House, when erasing the data would prejudice scientific or historical research or archiving that is in the public interest (for example during the COVID-19 pandemic if we have good reasons to retain the data), when keeping hold of the data is necessary for reasons of public health; when keeping the data is necessary for the purposes of preventative or occupational medicine.
If any of the above apply, we can either fully or partly refuse to comply with your request.
We will respond to requests for deletion of personal data within 1 month of receiving the request.
You have the right to data portability
You have the right to data portability where processing is automated. In this case, you can make a request and this data can be exported from our systems for you.
Where we collect information about you
If you are referred to one of our clinical services, we will collect data from you and may also receive and share it where necessary with other healthcare providers. Our current lawful basis for collecting personal information is contained within Articles 6 and 9 of the GDPR.
In order to provide complete care we may also collect some information about family members and carers. Where Next of Kin or family details are provided within clinical services, this information will not be passed to Fundraising, Marketing or any other internal department without explicit consent.
If you stay at or visit the Hospice, we may take photographic images of you, but always with your prior consent.
What personal data we collect
Personal data we collect may include one or more of the following:
- Name, address, telephone number, email address, date of birth, gender, ethnicity, religious beliefs, next of kin of the child or young person
• Health Care Records (electronic or paper and including images, audio, video, care assessments, plans, incidents, complaints) with consent
• GP and other health care professionals details
• Family representative details, such as name, address, telephone number and email address. In addition, we may need to contact other agencies for relevant health or social care information for the benefit of our service user’s care - Safeguarding information
Why we collect personal data
We use your personal data for a number of purposes. This may include the following:
- Information relating to diagnosis, treatment and care will be shared across our teams to ensure all our healthcare professionals are updated for continuing care
• To advise service users and families
•For medical research and educational purposes - If appropriate, information will be shared with external healthcare professionals such as GPs, Hospitals and other involved health care professionals
- If appropriate, information will be shared with our partners for the purpose of supporting care provision. An example of this could be where we share your address and details in order that our volunteer transport service can bring you to and from the hospice.
We may take photos of you and use these for marketing and publicity purposes, both internally and externally. This will always be with your prior consent.
Our legal basis for collecting and sharing personal data
As noted above, our current lawful basis for collecting personal information is contained within Articles 6 and 9 of the GDPR. Legitimately, we are allowed to process your data for one or more of these reasons:
- We have consent to use your information for continuing health care and support
• It is necessary for compliance with a legal obligation to which we are subject (for example a change in the law)
• We have a legitimate interest to do so – for example, where consent is absent and we need to provide immediate care or where we have a safeguarding concern
• It is in the public interest to do so (for example, a notification of infectious diseases (NOID) that need to be reported to the Local Authority health protection team)
• Data disclosure may be required by law, for example to government bodies and law enforcement agencies.
Some of the personal data processed by Martin House will be information defined as Special Category Data. In order to lawfully process this type of information, Martin House will rely specifically on the following Article 9 conditions:
- Article 9(2)(b) - Employment, social security and social protection
We understand that sharing information is a sensitive topic. We will never sell your information and are committed to being transparent with you about where we legally share information, the reason why and who with.
At times, we may use a balancing test known as a Legitimate Interest Assessment to support the lawfulness of our processing activities and to help us demonstrate accountability as it proves that we have made all considerations in determining our legal basis for processing the data in question.
We will keep your personal data for the period of time as set out in statutory and regulatory requirements.
Please see our Data Protection Policy for details about the further processing of personal data.
* Data Protection Requirements means the Data Protection Act 2018, the EU Data Protection Directive 95/46/EC, the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice)(Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011, the General Data Protection Regulation and all other applicable laws and regulations relating to processing of personal data and privacy in any applicable jurisdiction as amended and replaced, including where applicable the guidance and codes of practice issued by the UK Information Commissioner or such other relevant data protection authority.