Privacy Policy Privacy Policy (May 2021) At Hope House Children's Hospices, we are committed to protecting and respecting your privacy, so this policy explains when and why we collect personal information, how we use it, when and why we might share it and how we keep it secure. It also details your rights in relation to your personal information. Should you have any questions about this policy or your rights regarding your personal information, or if you would like to update your contact preferences, please use the following contact details: Information and Governance Manager Hope House Children's HospicesNant Lane, MordaOswestry, SY10 9BX 01691 671 999 [email protected] Who are we? Hope House Children’s Hospices has two children’s hospices; Hope House in Oswestry and Tŷ Gobaith in Conwy, is a registered charity in England and Wales (charity number 1003859), and a registered company in England and Wales (company number 2588103). We have two subsidiary companies - Hope House (Trading) Ltd. and Hope House (Lottery) Ltd. This policy will refer to ‘Hope House’ as a shorthand for the three combined companies. How do we collect personal information? We may collect your information when you use our website to contact us, register for an event, sign up to our Lottery, register for our newsletter, make a donation, or buy something from our online shop. Examples also include when you or your child stays at Hope House or Tŷ Gobaith, when we call you for medicines reconciliation or when you or your child register to participate in an organised activity or event, such as an away day for brothers and sisters. We may collect your information when you submit an application for a paid or voluntary position at Hope House, when you start in such a position or through questionnaires for staff and volunteers We may collect your information in writing, via email, over the phone, in person at one of our hospices, offices or shops or at an event organised by us or somebody else. Information might be provided in digital form, verbally or in writing, and be received directly from you or from a third party you have permitted to do so, such as your GP or a hospital consultant. What personal information do we collect and process? Personal information is anything which enables us to identify you in some way, such as your name, address, occupation, email address, date of birth, phone numbers and emergency contact details or bank or card details to set up a single or regular payment. For employees, volunteers and applicants, we might also collect health information regarding disabilities, information on prior criminal convictions, prior professional experience and remuneration, academic and professional qualifications and information regarding your race, religion and gender. Where we are providing nursing and medical care or other care services we will also require ‘special category’ or sensitive personal information such as medical and health information including details of diagnosis, medical history, medication, dietary needs and specific care preferences. We also collect information about bereavement from any family member referred to the Bereavement Support and Counselling Service. If you require assistance in obtaining financial or social support we may require details regarding your personal and household finances. We may also collect images of you on CCTV in operation at our hospices or shops. Our CCTV Policy is available upon request by emailing [email protected]. Using our website When making a payment on our website, your payment is collected by a third party processor, who specialise in secure online processing of transactions. When visiting our website, we will also record your IP address, and information regarding the pages you access. We use small files known as cookies to monitor usage of our website including visitor numbers and page views. Click here to read our Cookie policy. If you visit one of our pages that includes external content (e.g. YouTube), you may be presented with cookies from these websites; you should check these third party websites for more information about their cookies. You can disable cookies when using our website, though some of the functionality may be affected. We use Google Analytics to understand how people use our website so we can make it more effective. Google Analytics collects anonymous information about activity on our website using cookies. Why do we collect personal information? We only collect the minimum amount of personal information required to fulfil the purpose for which it is collected. You may request that we stop processing your information at a later date, though this will depend on the type of information and the reason for processing it. It may also affect your ability to participate in or benefit from some of the activities undertaken by Hope House. Personal information which we collect from you may be used in a number of ways, as detailed at the end of the policy under ‘Additional Information’. Hope House will only process your personal data where we have a legal basis for doing so as stipulated by current data protection and privacy legislation, namely:- Where we have your explicit consent In order to comply with a legal obligation When performing official functions or tasks in the public interest If it is in your or somebody else's vital interests To fulfil a contractual requirement When to do so is in our legitimate interests Consent Consent means offering you a real opportunity to state whether or not you wish to allow the processing of your personal information. When processing your information on the basis of consent, we will ensure you are fully aware of what you are consenting to and only use your information for that purpose. You can withdraw your consent at any time using the contact details above. Legitimate Interests Hope House may undertake data processing in pursuit of our legitimate interests, where to do so will not infringe your rights or interests as the data subject. To ensure this is correctly assessed, we undertake a balancing exercise to ensure that our processing will not adversely impact you. You have the right to object to the processing of your personal information on the grounds of legitimate interests as detailed below in ‘Right to object’. Data processing activities undertaken by Hope House Children’s Hospices based on Consent and Legitimate Interest are detailed at the end of this policy under ‘Additional Information’. Who do we share personal information with? Hope House will not share your information with third parties for marketing purposes and will not sell or rent your information to third parties, though within the Hope House, 'group' data is passed by Hope House (Lottery) Ltd to its parent company, Hope House Children's Hospices. Some of the systems operated by Hope House are provided and/or supported by third party providers. Where services are provided by a third party, your personal information may be released to the third party data processor under an agreed contract, which will fulfil the requirements of the data protection legislation, including stipulating how the information is to be transferred, secured and destroyed, the purpose(s) for which it can be used and how the processor will assist Hope House in ensuring your rights are fulfilled. Hope House may share your personal information with third parties outside of the European Economic Area if any of the exemptions detailed in the UK General Data Protection Regulation are met. In the case of data processors in the USA, only those certified under the U.S. Privacy Shield framework regarding the collection, storage, transfer, use and other processing of personal data will be utilised. Occasions when your information will be processed by a third party are detailed at the end of this policy under ‘Additional Information’. How do we protect personal information? We take appropriate physical, electronic and managerial measures to ensure that we keep your information secure, accurate and up to date, and that we only keep it as long as is reasonable and necessary. Any payment card, bank or direct debit details we receive on our website are passed securely to our payment processing provider according to the Payment Card Industry Security Standards, and all online financial transactions are encrypted using SSL (Secure Sockets Layer). How long do we keep personal information? We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations. We will hold your personal information on our systems for as long as is necessary for the original purpose, or as set out in any relevant contractual agreement you hold with us. What are your rights regarding your personal information? Right to be informed You have the right to be informed about the collection and use of your personal data by Hope House Children’s Hospices. Details of the types of information we collect, the purposes for which it is collected, who we share the information with and how long we retain it are detailed in this privacy policy which is updated periodically and always accessible via the Hope House website. Right of access You may obtain a copy of the personal information we hold about you by submitting your request to the contact details above. We will reply within one month of receipt of your request unless there is a compelling reason to extend this response time. We may refuse a request in certain circumstances, in which our justification will be communicated to you. Right to rectification You have the right to have any inaccurate personal information that we may hold for you rectified (corrected) and to request that any incomplete information be completed. You can make your request using the contact details above. If we accept that your information should be rectified, we will do so within one month. In certain circumstances, we may refuse a request if we consider the request to be unfounded or excessively repetitive. Right to erasure You can request that the information we hold about you be deleted by contacting us using the details above and we will respond within one month. The right to erasure applies if: we no longer need your information for the purpose for which we collected it; our processing of your information is based on consent, and you withdraw that consent; processing of your information is based on legitimate interests, and you successfully object; your information has been processed unlawfully; we have a legal obligation to remove your personal information. In certain circumstances, we may refuse a request for erasure if we consider the request to be unfounded or excessively repetitive, or if any of the specific provisions of the current data protection legislation apply. If we have shared your personal information with any third parties and accept your request for erasure, we will contact them accordingly so they can erase your information as well. Right to restrict processing You can make a request for information we hold about you to be suppressed (in other words to be stored but not used) in the following circumstances:- you have contested the accuracy of the information we hold and we are investigating; your information has been unlawfully processed but you want to restrict it, not erase it; you want us to keep your information after we need it in support of a legal dispute; you have objected to our processing of your information and we are investigating. You can make your request using the contact details above and we will respond within one month. In certain circumstances, we may refuse a request to restrict processing of your information if we consider the request to be unfounded or excessively repetitive. Right to data portability The right to data portability gives you the right to receive the personal information you have provided to us in a structured, commonly used and machine readable format. It also gives you the right to request that we transfer it directly to another controller. This only applies to information stored electronically, provided directly by you and which we process based on your consent. Right to object You have the right to object to the processing of your personal data in certain circumstances. We may continue the processing if there is a compelling reason for doing so, or if we consider the request to be unfounded or excessively repetitive. You can make your request using the contact details above and we will respond within one month. Rights related to automated decisions and profiling Hope House does not conduct any automated decision making or automated processing/profiling. Unauthorised sharing of information Whilst we take reasonable measures to ensure privacy, we may not always be able to prevent other individuals sharing information via (for example) their social media channels. When unauthorised sharing is brought to our attention, we will ask that the information be removed. However, this remains outside of our control. What should you do if you have a complaint? If you have a concern or complaint regarding Hope House’s processing of your personal data, you can contact us using the information above or by emailing [email protected]. Data Protection legislation also gives you the right to lodge a complaint with a supervisory authority and more information can be found on the Information Commissioner’s Office website at www.ico.org.uk. Additional Information – Service Users Why do we collect personal information? Personal information which we collect from you may be used in a number of ways including:- Replying to an enquiry you have made to Hope House via phone, text, email or post; Providing safe and appropriate care and support to you and your family; Assisting you in securing support from agencies, authorities and other charities; Sharing with other health and social care providers to ensure continuity of care; Sending you information about the charity and our activities; Meeting any legal or regulatory requirements that we are obliged to fulfil Consent We have determined that processing your data on the basis of consent is lawful when:- Accessing your or your child’s medical information to ensure continuity of care; Taking and using photographs of you or your child to promote the work of the charity; Sending communications to you via email or SMS text message promoting the work of Hope House and ways in which you can support us. Legitimate Interests We have determined that processing your data on the basis of legitimate interest is lawful when:- Processing referral & new user forms to ensure adequate information regarding care needs; Updating information on you and your family as part of respite stay admissions; The management of service user details on internal databases; The maintenance of paper and/or digital care plans and records of care; Taking photographs to support care provision or as a record of your child’s activities. Health and Social Care We have determined that processing your special category data on the basis of Article 9(2)(h) Health and Social Care is lawful when: Sharing information with other medical professionals to ensure appropriate care. Photographs Photographs may be taken of you or your family members during your interaction with Hope House Children’s Hospices for various reasons. These are shown in the below table, along with the lawful basis on which we will take and use these photographs and your rights regarding this usage:- Types of Photographs Lawful Basis Your Rights Photographs taken in a care setting to increase staff understanding and knowledge of a child’s care needs Legitimate interests You have the right to object, but not being able to use photographs for this purpose could limit our ability to provide appropriate care and so potentially lead to a withdrawal of service. Photographs taken of service users enjoying activities at the hospice or on days out to share with parents and other family members Legitimate interests Photographs of this type are taken for the enjoyment and information of service users and their families so could be stopped should you wish to object. Photographs taken of service users to promote the work of the hospice in local media or through online channels Consent Photographs will only be used for this purpose with your explicit consent, which you can withdraw at any time. Photographs used in situations where our actions are determined by a legal requirement or the safety of an individual Vital interests and/or legal requirement Objections would not prevent us from using photographs in these circumstances. Who do we share personal information with? Some of the systems operated by Hope House are provided and/or supported by third party providers, for example, database management at remote sites accessed via the internet. We may also share your personal information (including special category data such as health information) with third parties involved in your or your child’s care where appropriate and where there is a lawful basis for doing so. These third parties may include GP’s, consultants and other health and psycho-social care staff such as physiotherapists, nurses, social workers and counsellors. Occasionally we share personal details with health commissioners for the purpose of service planning and funding and with regulators and researchers. We will disclose personal information if required to do so by law or if we have concerns regarding the safety of any individual. We do not share any of your confidential information for planning or research purposes to which the National Data Opt Out would apply. However, should this change, you could decide to stop your information being shared for this purpose. You can find out more at: https://www.nhs.uk/your-nhs-data-matters/ Additional Information - Supporters Why do we collect personal information? Personal information which we collect from you may be used in a number of ways including:- Replying to an enquiry you have made to Hope House via phone, text, email or post; Creating a record of a donation you have made or processing a regular gift; Completing an order for something you have purchased from our online shop; Reclaiming Gift Aid on donations from HM Revenue and Customs; Registering you to participate in a fundraising activity or play the lottery; Sending you information about the charity, our activities and our fundraising events; Carrying out our obligations arising from any contracts entered into by you and us; Processing entries into a competition or raffle; Seeking your views/comments on the services we provide or activities we undertake; Notifying you of changes to our services, events or activities; Consent We have determined that processing your data on the basis of consent is lawful when:- Sending communications to you via email or SMS text message promoting the work of Hope House Children’s Hospices and ways in which you can support us. Legitimate Interests We have determined that processing your data on the basis of legitimate interest is lawful when:- Sending communication to you via the post about our work and ways you can support us; Telephoning you about our work and ways you can support us; Registering you for a fundraising event in which you wish to take part; Processing any of your information received from a third party (e.g. JustGiving); Maintaining your information on our secure database to record your support; Recording your contact details to enable collections/deliveries to addresses you provide. Who do we share personal information with? Some of the systems operated by Hope House are provided and/or supported by third party providers including database management and payment processing at remote sites accessed via the internet. We use external companies to assist with fundraising activities such as letter production and mailing, lottery recruitment and management and data analytics. If you use your credit or debit card to donate to us, buy something or make a booking online, we pass your credit card details securely to our payment processing partner as part of the payment process in accordance with the Payment Card Industry Standard. We hold details for up to 28 days for legal requirements after which they are deleted or destroyed. Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behaviour of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary to deliver their services to us or for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply: Your data will be made available to our website provider; The data that may be available to them include any of the data we collect as described in this privacy policy; Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA; This processing does not affect your rights as detailed in this privacy policy. Additional Information – Staff and Volunteers Why do we collect personal information? Personal information which we collect from you may be used in a number of ways including:- Replying to an enquiry you have made to Hope House via phone, text, email or post; Processing job applications, including CV, job references and DBS checks; Completing and retaining a signed contract of employment; Processing a completed volunteering opportunity application form; Processing Occupational Health and other health related referrals and responses; Sharing with other appropriate agencies/authorities, if we are required to by law, for the protection of public health; Confirming your right to work information; Processing payroll, tax and pension information and fulfilling our reporting obligations; Retaining your Emergency Contact information; Completing performance evaluations and pay reviews Maintaining up-to-date training and professional certification records (e.g. NMC); Maintaining records of disciplinary and grievance processes; Using head shot photographs for producing ID badges and security protocols. Consent We have determined that processing your data on the basis of consent is lawful when:- · Maintaining a record of potential employees or volunteers so we can contact you about future opportunities. Legitimate Interests We have determined that processing your data on the basis of legitimate interest is lawful when:- Processing job/volunteering applications, including shortlisting, interviewing and retention; Checking professional registrations, driving licenses, job references and health information; The setup, administration and deletion of staff/volunteer details on internal databases; Completion of agreements with volunteer professionals e.g. counsellors; Monitoring of employee/volunteer activity through (for example), email and phone records. Who do we share personal information with? Some of the systems operated by Hope House are provided and/or supported by third party providers including database management and payment processing at remote sites accessed via the internet. We use external companies to assist with payroll and pension processing, occupational health assessments, disclosure and barring service checks, professional qualification checks, training delivery, Workplace, staff and volunteer surveys and lone worker safety. Manage Cookie Preferences