Privacy policy

Privacy Policy

Children’s Hospice South West recognises the trust that you place in us when providing us with your personal data, and we are committed to being transparent and respectful in the ways we handle your information.  

This policy tells you how we collect, securely hold and use your information, and your rights in having your personal data protected. We may make changes to this policy from time to time, so please check back occasionally.  If we make any significant changes we will make this clear on our website or notify you directly so that you can see what has changed.  

Who we are

We are Children's Hospice South West (also known as CHSW) and are registered charity number 1003314. Our head office is at Redlands Road, Fremington, Barnstaple, EX31 2PZ and you can contact us by emailing enquiries@chsw.org.uk or by calling 01271 325 270. 

How we gather and use your information

Supporter Information that we receive directly from you

When you contact us, we collect personal information from you, such as your name, address, email address, phone number and, where appropriate, your date of birth. You may complete a form on our website, or you may give us your details via a phone call, email, via social media platforms, or on a paper form.

We ask for your details in connection with the specific request that you make. For example, you may give us your information in order to make a donation, make an online purchase, ask us a question, register for a fundraising event, join our lottery, or purchase items from us.    

When you provide any personal information, we will store it to our secure supporter database, Salesforce. We will process your information to record and administer your request and we will use these details to dispatch your goods or contact you about your request, support or transactions.  

We will record details of when you digitally interact with CHSW via our website and emails, which may include the use of cookies (in accordance with our Cookie policy). 

Supporter Information that we receive indirectly

In some cases, we will receive your personal information through a third party. This is most likely to be through our online shop (Shopify) or an online fundraising tool, such as JustGiving, a social media platform or via our Lottery Canvassers who collect information via an electronic tablet, on which the data is not stored. 

Shopify

The personal information we collect through Shopify allows us to process and fulfil any online orders that you make in our online shop. The information you enter within Shopify is transferred and stored in our donor database, Salesforce in accordance with CHSW data retention policies. For further information, read Shopify’s full privacy policy for customers at www.shopify.com/legal/privacy/app-users 

Online fundraising platforms

When you sign up for an online fundraising service, you should ensure you are happy with the organisation’s Privacy Policies.  

If you state that you are fundraising for CHSW, then your details will most likely be passed to us to allow us to administer your fundraising activity and your details will be added to our supporter database. Unless we have an administrative query about your donation, we will only contact you to offer support with your event, to thank you and will only send you future marketing, if you specifically give your consent for this.  

If you are a donor supporting a fundraising event on these online platforms, your details are only added to our database if you have opted in to receive future marketing communications from us when making that donation.  

Next of Kin and In Memoriam

When we receive in memoriam donations from Funeral directors with the details of Next of Kin, these details are entered onto the database in order to send thank you letters from us. No further marketing communications will be sent unless individuals have specifically opted in to receive this from us.  

We also receive Next of Kin information from a range of third-party sites including Love 2 Donate and Muchloved.com where Next of Kin details are added to the database for the purpose of thanking but not for marketing. 

Job and volunteer applicants

If you apply to work or volunteer for CHSW, we will only use the information you give us to process your application and to monitor recruitment statistics. If we want to disclose information to someone outside CHSW - for example, if we need a reference, or need to process a Disclosure and Barring Service (DBS) check - we will make sure we tell you beforehand, unless we are required to disclose this information by law.  

If you are unsuccessful in your application, we will hold your personal information for six months after we've finished recruiting the post you applied for. After this date we will destroy or delete your information. Successful applicants will be provided with information about how their details would be used as a CHSW employee during the appointment process.  

Our families

We also collect information from the families that we provide care for. This is discussed in detail with families during their first points of contact with us. (See separate Section below)  

Families who we support may also receive information about forthcoming CHSW activities that they may wish to take part in. If a family engages with fundraising for CHSW, at the point of contact they will be asked to advise their marketing preference to opt in or out of receiving marketing communications from us. Marketing Preferences can be updated at any time by calling us.  

Your information and events

If you register to take part in an event, you will receive communications that specifically relate to your participation in that event, such as logistical information and safety details. This might include SMS messages where essential, for example if an event must be postponed or cancelled. Where sponsorship is an integral part of the event you have chosen to take part in, we will send you fundraising support information in relation to your specific event.  

We may receive your details as part of a group registration for an event. It is the lead participant’s responsibility to ensure that the group members are aware of this Privacy Policy and that they have permission to register all participants for the event. We will record the details of all participants on our supporter database and contact them in relation to the event. We will not send marketing communications to participants without their specific and individual consent.   

Sensitive information

There may be occasions when we ask you to provide additional personal information which may be sensitive. For example, if you are taking part in an event, then we may ask if you have any health or medical issues that we need to be aware of. By providing this information, you are giving us permission to use it for the purposes of the event.  

It may be necessary for us to pass this sensitive information to a third party who we request to provide a service on our behalf at the event e.g. first aiders contracted by us to work at the event. We ensure that in these circumstances, that these third parties treat your confidential information with the same high standards as CHSW.  

Third party event providers

Some of our fundraising events are run using the services of other organisations. These are indicated on our website as Third Party Events, with details shown to tell you who the organiser is when you register. If you take part in one of these events, CHSW will share your details with the event organiser who may contact you about your participation in the event. We ensure that our Third Party Event providers only use your information for the purposes of your participation in the event and securely destroy (or return to us) all data after the event. CHSW remains the data controller at all times.  

Taking part in the Raise a Smile Lottery

When you register to play the lottery, your details are entered onto our Lottery database and you are allocated a unique, randomly selected lottery ticket number; this system operates the lottery draws using software approved by the Gambling Commission. Participants have to be aged over 18 to play and their details are also added to our supporter database. You will hear from us about matters relating to your lottery subscription. You will only receive marketing communications from us if you have specifically asked for this.  

Customers buying single tickets via the CHSW shops do not have to provide any personal details to take part.

Registering for Gift Aid via our shops

If you provide your details to us for Gift Aid purposes when donating items to CHSW shops, then this information is stored on the Retail EPOS system. This system processes information about the sale of your donated items. Your details are also added to our supporter database where we will record your marketing preferences.  

If you have opted in to receiving further marketing communications from us, we will periodically send marketing communications to you via your chosen contact method.  

You will also hear from us about matters relating to Gift Aid claimed on the sale of your donated goods. We will share your information with HMRC, as a legal requirement of the Gift Aid scheme.   

Visiting our hospice sites and shops 

When you visit our hospice receptions/entrances or any of our CHSW shops you will be made aware through visible signage that we operate CCTV cameras. These are present to support the prevention and detection of crime and to support public and staff safety.  

CHSW CCTV uses automatic number plate recognition (ANPR) as well as other Artificial Intelligence (AI) processing to retrieve footage from the cloud-based system.  This may include recognition of colours and types of vehicles, clothing and face recognition.  

Recorded images and stills will normally be kept for a maximum of 30 days from the date of capture. If recorded images and stills are required as part of an ongoing investigation, they may be kept for a longer period of time until the investigation has been concluded and in line with our Data Retention Policy.    

Automatic erasure/overwriting takes places after 30 calendar days unless otherwise authorised by the CHSW Data Protection Officer.  

For more information you may request a copy of our CCTV policy.  

Using your information for marketing and advertising 

CHSW believes that our individual supporters should only receive marketing communications from us if they have actively told us they want to, such as email, direct mail, SMS and phone calls. We will only send marketing communications to those who have consented/opted in to receive this. Our marketing communications contain news about our hospices, fundraising activities and campaigns and other ways that you can help make a difference to short and precious lives. On your first contact with us we will offer you the opportunity to consent to receiving marketing communications from us. 

Social Platforms

Children’s Hospice South West uses social media platforms to promote our vital care and services and support of our vital care and services. We have online accounts with Facebook, X (Twitter), Linked In, Pinterest, Discord, You Tube and Instagram. We collect donations through Facebook Fundraisers, Facebook Donate and Instagram. Where members of the public engage with our posts or publish content relevant to our work we may like the posts, follow them, reply, repost or email them/send direct mail. If you are a social platform user, we will use social platform tools as part of our relationship with you. These tools include Facebook Custom and Lookalike audiences. Through using these tools, we will provide some of your data to the social media platform to allow them to identify your social media profile. You will then be shown advertising relating to Children’s Hospice South West which we think you will be interested in seeing. The social media platform will also use your profile to identify those with similar characteristics to you who we think may also be interested in finding out more about the work we do. These individuals will then be shown advertising about Children’s Hospice South West. You can object to your information being shared with social media platforms. Please contact us at website@chsw.org.uk

How else might we use your personal data?

Occasionally we may undertake segmentation or profiling analysis of our database to improve the effectiveness of our marketing and communications. For example, we may look at information such as the postcodes of our supporters, their age (if known) and whether donations have been given regularly. This helps us to provide our supporters with the most relevant marketing communications and allows us to ensure that we are using our charitable resources efficiently for marketing purposes. This analysis is only done based on information that you give us, either directly or that we receive through a fundraising tool (for example, JustGiving) and where you have given your permission for us to receive that data. This work will be undertaken by CHSW, or a carefully selected third party organisation working for us and adhering to our high standards of data protection. At all times CHSW will remain the Data Controller.  

You can change how you receive marketing communications at www.chsw.org.uk/preferences or by calling us on 01271 325 270.  

If you tell us that you are happy to receive marketing communications then we will consider that this consent is valid for up to 3 years since you were last considered to be an active supporter. This might be when you last made a donation to us, supported us as a volunteer or took part in an event or activity for example. After this time, we may contact you to renew your consent. You may withdraw your consent earlier than this by using the details above or for example, when you register for a new event; we will always use your most recent preferences.  

We will never give, personal information to any other organisations for their own marketing purposes, without your prior explicit consent.  

Young people’s data

We are committed to protecting the privacy of the babies, children and young people who engage with us. If you are under 18, please obtain permission from a parent/ guardian before providing your personal information to us. When we receive the details of a young person who is under 18, we will add them to our database to record and administer their contact with us. However, it is our policy to not send marketing communications to any of our supporters who are under 18, where known to us.

Contacting businesses and community groups

CHSW has many strong partnerships with a variety of organisations within our communities. If you are a business or community group (e.g. Scout group or sports club) then we may contact you by post or phone about ways that your organisation can get involved with CHSW, without your prior consent. This is because we believe that we have a legitimate interest in doing so. We will do this in the following circumstances:  

Across the South West, our dedicated Friends Groups, who are volunteers, undertake their own fundraising activities on behalf of Children’s Hospice South West or may assist us at events by accepting a donation on our behalf. They independently collect and manage their own supporter contact records and communications. If you wish to contact a Friends Group or have question about their use of your personal data then please either use their contact details as shown on their correspondence to you or contact us so we can put you in touch with them via your local fundraiser.   

Contacting trusts, grant providers, foundations and major donors

We may contact organisations who provide grants, or who operate as Trusts or Foundations where we have a legitimate interest to do so and where we do not infringe on the rights of the individuals who are part of the Trust or Foundation.

We also want to ensure that we communicate appropriately with individuals who support us with major personal gifts. During the course of our preparations to meet with such supporters, or any potential future supporters, we may undertake research to determine their charitable and professional interests and their capacity to donate. This helps us make our contact as appropriate, effective and professional as possible and assists us in determining the likely match between their charitable ambitions and the work we do at CHSW.

This research is only carried out using information that is freely available in the public domain and where the individual may expect that this information is read by the public. An individual can object to this processing at any time using the contact details in this policy. 

Third parties we use to provide us with business services

We may use a mailing house to process our postal marketing. We also use a third party to fulfil some of our product orders, for example to dispatch our Christmas cards.  

We may use a company to periodically cleanse our data to check for essential updates to our records. We only use this to remove records (for example to prevent us from contacting a supporter who is deceased) and do not use this as a source of additional or new information about supporters.  

We use a third party provider, Campaign Monitor, to deliver emails on our behalf. We gather information about the level of supporter interaction with these emails, such as when an email is opened or a link followed. This helps us to improve our email communications.  

These third parties cannot use your information for any other purpose than as prescribed by us and we always ensure that these third parties comply with all relevant data protection regulations.  

In exceptional circumstances we may be required to share your information with a third party for purposes outside of marketing and advertising as described in this policy – for example if we are required to do so by for legal and regulatory obligations and to prevent, detect and report crime.  

How we store your personal data

CHSW is committed to ensuring the security of your information. We have strict physical, electronic and managerial procedures in place to secure and store your personal information.  

The information that we collect from you is stored on our databases (Salesforce, Retail EPOS system, Sterling, Care databases and Cascade). These databases hold and store all information within the European Economic Area.  

It is acknowledged that the transmission of information via the internet is not always completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to a website; any transmission is at your own risk.  

We use Opayo and World Pay to securely process card payments. We require our payment providers to be compliant with the Payment Card Industry’s Data Security standards (PCI-DSS). We store the last four digits of your card number in our secure supporter database as a record of your transaction. 

Keeping your information

CHSW will retain the information that you provide to us for as long as it is needed to administer the relationship we have with you and for the purposes for which it was originally intended.  All data held is protected using up to date industry standard procedures to keep it safe and secure and to prevent loss or unauthorised access. In some cases, we will need to retain your details to meet legal requirements, such as the records we are required by law to keep regarding Gift Aid. When we do not require your information anymore, it will be disposed of securely.   

Children and family personal information 

Why we collect personal information about you 

The staff caring for you / your child need to collect and maintain information about your / your child’s medical condition, treatment, and care, so that we can give the best possible care. On acceptance of the child/young person for the hospice services we will seek written consent for holding and sharing of information and we will also seek consent on an annual basis thereafter.  

At Children’s Hospice South West your confidentiality is important to us and we understand this builds a relationship of trust which is essential for us to provide services to you and your family. We operate following national guidance and follow the principle of ‘no surprises’ – we want you to be aware of what information we hold about you, why, how and when this might be shared.   

What is our legal basis for processing personal information about you?  

Any personal information we hold about you is processed for the purposes of ‘provision of health or social care or treatment or the management of health of social care systems and services’ under the Data Protection Act 2018.  

How we obtain personal information and why we might share it 

In order to provide the best and safest care, we collect information about you/your child’s health and wellbeing in order to manage your/your child’s care needs. This may include details about diagnosis, medical history, medication, test results and notes from other care providers about the care and support they have given you/still providing for you.    

This information is usually provided to us by other care providers who have referred you to our services. When you start accessing our services, we check this information with you to make sure it is accurate, and we ask your permission to continue sharing your health information with other care providers into the future, so that everyone involved in your holistic care has accurate details about you and enables us to work together to support you.  

The types of care providers we normally share with include GPs, hospitals, community nursing services, counsellors, therapists, and social workers. We may also need to share some of your details with local NHS partners, such as Clinical Commissioning Groups, to support planning of local health services and funding. Where possible, information shared with NHS partners will be anonymised or pseudonymised to protect your privacy.   

We will likely hold the following personal information:  

• Your name/your child’s name  
• Home address (including correspondence)
• Contact details (telephone numbers/email)  
• Date of birth  
• National/local identification e.g. NHS number, Hospital number  
• Your religion and ethnic origin  
• Parent/next of kin/Guardian names and contact details  
• Sibling names and ages  
• Who lives at home  
• Information you have shared about people important in your child’s life  
• School or other health/care/education provision accessed  
• Any significant information about parent/sibling that has been shared with us for example it is important that we know if a parent has a hearing deficit, so we can make the necessary modifications to be able to communicate effectively
• Medical, nursing and social information to support care provision e.g. as detailed in the care plan.  

In addition to the above, we may hold sensitive personal information about you/your child which could include:    

• Whether or not you are subject to any protection orders regarding your health, wellbeing and human rights (safeguarding status)
• Where relevant (and shared by you or your child/young person) to individual children/young people specialist personal information for example genetic information or information about sexuality
• Information you have shared with us that is sensitive in nature and confidential.  

It is important for us to have a complete picture of you/your child as this will assist staff to deliver appropriate treatment and care plans in accordance with your needs. You are not obligated to provide your/your child’s personal information to CHSW, however, as this information is required for us to provide you with our services we may not be able to offer our services without it.

What we may do with your personal information

Your personal information will always be treated with the utmost respect, following confidentiality requirements. It will only be accessed and shared on a need to know basis ensuring any information shared is justified, compliant with the law and the minimum required for the purpose.  

In addition to helping us provide care, the personal information we collect about you may also be used to:  

• Keep in contact with you
• Review the care we provide to ensure it is of the highest standard and quality, e.g. through audit or service improvement
• Support the funding of your care, e.g. with commissioning organisations  
• Prepare data on our performance that are required by regulatory organisations such as the Care Quality Commission  
• Help to train and educate healthcare professionals  
• Report and investigate complaints, claims and untoward incidents
• Report events to the appropriate authorities when we are required to do so by law  
• Send you marketing/fundraising information if you have separately opted in to receive this information from us.

Where possible, we will always look to anonymise/pseudonymise your personal information so as to protect confidentiality, unless there is a legal basis that permits us to use it and we will only use/share the minimum information necessary.  

In rare circumstances, we may be obliged to share your information without forewarning. For example, if we believe you may be at risk of harm or there is a public health risk, we may have a legal or professional duty to share information about you with the authorities. In all such cases, the sharing will be reviewed by our Caldicott Guardian[1] and will only happen if they believe it is absolutely necessary (a check is undertaken to assure that not only can we legally share – should we share and if so what is shared) and we will make every effort to ensure you are informed of the sharing.  

How we maintain your records  

This personal information can be held in a variety of formats, including paper records, electronically on computer systems, in video and audio files. We hold this information securely and with restricted access for a minimum of 8 years and maximum of 25 years depending on the individual circumstances as they constitute healthcare records. All CHSW staff are required to protect personal information and are bound by strict rules of confidentiality.  

A third party may be involved in the storage or destruction of the records. For example, we may use a company to bring shredding equipment to the hospice for secure disposal of paper records in bulk. Whenever we use a third party, the companies are vetted and are bound by contracts containing strict confidentiality and data protection requirements.  

What are your rights? 

If we need to use your personal information for any reasons beyond those stated above, we will discuss this with you and ask for your explicit consent. The Data Protection Act 2018 gives you certain rights, including the right to:  

• Request access to the personal data we hold about you, e.g. in health records
• Request the correction of inaccurate or incomplete information recorded in our health records, subject to certain safeguards
• Refuse/withdraw consent to the sharing of your health records: Under the Data Protection Act 2018, we are authorised to process, i.e. share, your health records ‘for the management of healthcare systems and services’. Therefore, your consent will only be required if we intend to share your health records beyond these purposes, as explained above (e.g. research). Any consent form you will be asked to sign will give you the option to ‘refuse’ consent and will explain how you can ‘withdraw’ any given consent at a later time. The consent form will also warn you about the possible consequences of such refusal/withdrawal  
• Request your personal information to be transferred to other providers on certain occasions.   

National Data Opt Out 

Your rights 

The UK General Data Protection Regulation (UK GDPR) ensures that all individuals have the following rights:  

• The right to be informed  
• The right of access  
• The right to rectification  
• The right to erasure  
• The right to restrict processing  
• The right to data portability  
• The right to object  
• Rights in relation to automated decision making and profiling.  

Please contact us if you feel that any information that we have about you is inaccurate and needs to be corrected. You can contact us if you wish to object to the way that your data is being processed, to withdraw your consent for processing, to make a complaint about the use of your data or to request that your data is deleted. You have the right to ask for a copy of the information that we hold about you. This is known as a Subject Access Request and you can contact us to request this via enquiries@chsw.org.uk. We will need to verify your identity in order to provide this information to you.  

To contact us, please call 01271 325 270 or email enquiries@chsw.org.uk

If you have ‘opted in’ to receive news updates, and information about fundraising activities and campaigns and wish to change your contact preferences, then you can do this at any time by visiting www.chsw.org.uk/preferences or by calling us on 01271 325 270.  

Complaints 

If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter.  

Data Protection Officer  

Little Bridge House, Redlands Road, Fremington, Devon EX31 2PZ  

Tel: 01271 325 270

If you are not satisfied with any response we give to your concerns about how we process your data, or believe that your data has been processed unlawfully, then you can contact the Information Commissioners Office and find out more on their website https://ico.org.uk/concerns/

Privacy Policy: Policy History

Privacy Notice Date: May 2018 V1

Summary of Change:

• Initial Privacy Policy in line with GDPR added to website

Contact: Jessica Patel, Marketing and Communications

Version/Date: May 2018

Review Date: October 2019

Privacy Notice Date: October 2019 V2

Summary of Change: 

• Addition of section on Friends Groups
• Minor amends to section on Trusts, Grants, Foundations and Major Donors to make contact and use of data more explicit
• Using information from third parties – minor amends for clarity
• Consent period – minor amends to make consent length clearer

Contact: Jessica Patel, Marketing and Communications

Version/Date: October 2019

Review Date: October 2020

Privacy Notice Date: June 2021 V3 

Summary of Change: 

• Minor amends to wording throughout for clarity 
• New section on Children and Family Information we hold to support the delivery of care 
• Additional information on Next of Kin details added to the section ‘Supporter information we receive indirectly) 

Privacy Notice Date: June 2023 V4 

Summary of Change:  

• Minor amends to wording throughout for clarity  
• Inclusion of CCTV within the policy 
• Review of accuracy of all sections of the policy 

Read our full Data Protection Policy

The UK GDPR (General Data Protection Regulation) January 2021

The UK GDPR is a UK law that regulates the protection of personal data and the free movement of such data.

Post Britain leaving the European Union, on the 1st January 2021 UK GDPR (UK General Data Protection Regulation) came into force to ensure the GDPR principles remained in UK Law, and work effectively domestically, and the UK has the independence to keep the framework under review.

The UK GDPR aims to maintain a Europe-wide standard and introduce stronger legislation on the handling of personal data. It sits alongside an amended version of the Data Protection Act 2018. However, there are implications for the rules on transfers of personal data between the UK and the EEA. The EU GDPR still applies to this processing, but the way organisations interact with European data protection authorities has changed.

The UK GDPR outlines the main principles, rights, obligations and requirements which have remained the same, and which CHSW must follow in processing UK residents’ personal data.

Organisations must have a valid reason for having personal data and the data should not be held for any longer than necessary. The UK GDPR is concerned with the rights of individuals when processing their information. This is achieved by being open and honest with applicants about the use of information about them and by following good data handling procedures. The regulation is mandatory and all organisations that hold or process personal data must comply.

Under the UK GDPR Children’s Hospice South West (CHSW), Little Bridge House, Redlands Road, Fremington, Barnstaple EX31 2PZ is a data controller, registered with the Information Commissioners Office (ICO). CHSW collects and processes personal data relating to its applicants to manage the recruitment processes. CHSW is committed to being transparent about how it collects and uses the data and to meeting its data protection obligations.

What information does CHSW collect?

CHSW collects and processes a range of information about you. This includes:

• your title, name, address and contact details, including email address and telephone number;
• details of your qualifications including certificates, skills, education, training and development, experience and employment history, including start and end dates, with previous employers;
• information about your current level of remuneration, including HMRC Starter Checklist and benefit entitlements if appropriate and NI Number;
• supporting statements and interview notes as part of the recruitment process;
• whether or not you have a disability for which CHSW needs to make reasonable adjustments during the recruitment process;
• information about your nationality and entitlement to work in in the UK
• information about your professional membership, proof of registration and fitness to practice where appropriate;
• information about your criminal record;
• information about County Court Judgement’s as part of the recruitment process;
• equal opportunities monitoring information including, information about your ethnic origin, sexual orientation and religion or belief;
• if your role includes driving, we will ask to see and retain copies of your Driving Licence, MOT and Insurance documents. This information will not be shared with any other parties;
• CHSW might also review publicly available information.

CHSW may collect this information in a variety of ways. For example, data might be collected through application forms or CVs; from your passport or other identity documents such as your driving licence, copies of which may be retained on file; from correspondence with you; or through interviews, meetings or other assessments including online assessments e.g. personality profiles and management testing.

In some cases, CHSW may collect personal and/or Special Category data about you from third parties, such as references supplied by former employers, and information from criminal records checks permitted by law, medical advice or records. CHSW will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so.

Data will be stored in a range of different places, as appropriate, including in your application record, in the organisation's HR management systems and in other IT systems (including the organisation's email system).

Why does CHSW process personal data?

CHSW needs to process data to support a thorough recruitment process and prior to entering into a contract with you.

In some circumstances, CHSW needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check a successful applicants eligibility to work in the UK before employment commences.

CHSW has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows CHSW to manage the recruitment process, assess and confirm an applicant’s suitability for employment and to decide to whom to offer a job. CHSW may also need to process data from job applicants to respond to and defend against legal claims and comply with legal and regulatory obligations and to prevent, detect and report crime.

CHSW may process special categories of personal data, such as information about ethnic origin, sexual orientation or religion or belief, to monitor recruitment statistics. It may also collect information about whether or not applicants are disabled to make reasonable adjustments for candidates who have a disability. In addition, for some roles, CHSW is obliged to seek information about criminal convictions and offences. Where CHSW seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment.

Where CHSW processes other special categories of personal data, such as information about ethnic origin, sexual orientation, religion or belief, this is done to monitor recruitment statistics. Data that the organisation uses for these purposes is anonymised or is collected with the express consent of its Applicants, which can be withdrawn at any time. Applicants are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

CHSW will not use your data for any other purpose other than the recruitment exercise for which you have applied unless your application is successful.

Who has access to data?

Your information may be shared internally for the purposes of the recruitment process, including with members of the HR teams, managers within the respective business area in which you have applied for a post, IT and other staff if access to the data is necessary for performance of their roles or business requirement.

CHSW shares your data with a number of third parties for recruitment purposes including to obtain pre-employment references from other employers, obtain necessary criminal records checks from the Disclosure and Barring Service, and obtain results of on-line personality and management testing.

CHSW also shares your data with third parties that process data on its behalf including for the purposes of hosting online applications e.g. Hireful

CHSW will not transfer your data to countries outside the European Economic Area (EEA) without undertaking a Transfer Risk Assessment to ensure appropriate safeguards are in place.

How does CHSW protect data?

The organisation takes the security of your data seriously. The organisation has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. These include: Data Protection; Privacy; Recruitment and Selection; Retention Policies; Use of IT Policy; Social Media; Professional Boundaries; Confidentiality; Consent; Health Records - Access for Children and Families and Creation Management Storage Destruction etc.

Where CHSW engages third parties to process personal data on its behalf, they are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

For how long does CHSW keep data?

If your application for employment is unsuccessful, CHSW will hold your data on file for 6 months after the end of the relevant recruitment process.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in the relevant privacy notice.

Your rights

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data on request;
• require the organisation to change incorrect or incomplete data;
• require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing;
• request that information you have provided to be given to you in a portable format.

If you would like to exercise any of these rights, please contact the appropriate Senior Management Team member or your local HR Advisor.

If you believe that CHSW has not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to CHSW during the recruitment process. However, if you do not provide the information, CHSW may not be able to process your application properly or at all.

Automated decision-making

Recruitment decisions are not based solely on automated decision-making.

It’s likely that we will need to update this Privacy Notice from time to time, so please check back occasionally.  The most recent version will always be available on the CHSW website.

Latest Version: February 2024 V5

For more information regarding the GDPR please contact the Local HR Office for a copy of CHSW’s Data Protection Policy and/or review the Privacy Policy on the CHSW website www.chsw.org.uk.

Applicant Privacy Notice: Policy History

UK General Data Protection Regulation (GDPR) January 2021

The UK GDPR is a UK law that regulates the protection of personal data and the free movement of such data.

Post Britain leaving the European Union, on the 1st January 2021 UK GDPR (UK General Data Protection Regulation) came into force to ensure the GDPR principles remained in UK Law, and work effectively domestically, and the UK has the independence to keep the framework under review.

The UK GDPR aims to maintain a Europe-wide standard and introduce stronger legislation on the handling of personal data. It sits alongside an amended version of the Data Protection Act 2018. However, there are implications for the rules on transfers of personal data between the UK and the EEA. The EU GDPR still applies to this processing, but the way organisations interact with European data protection authorities has changed.

The UK GDPR outlines the main principles, rights, obligations and requirements which have remained the same, and which CHSW must follow in processing UK residents’ personal data.

Organisations must have a valid reason for having personal data and the data should not be held for any longer than necessary. The UK GDPR is concerned with the rights of individuals when processing their information. This is achieved by being open and honest with volunteers about the use of information about them and by following good data handling procedures. The regulation is mandatory and all organisations that hold or process personal data must comply.

Under the UK GDPR Children’s Hospice South West (CHSW), Little Bridge House, Redlands Road, Fremington, Barnstaple EX31 2PZ is a data controller, registered with the Information Commissioners Office (ICO). CHSW collects and processes personal data relating to its volunteers to support and manage the relationship. CHSW is committed to being transparent about how it collects and uses the data and to meeting its data protection obligations.

What information does CHSW collect?

As a Volunteer with CHSW supporting the work of the hospices and retail shops across the South West, we collect and process a range of information about you. This includes:

• your title, name, address and contact details, including email address and telephone number, date of birth and gender;
• your completed registration form, with personal information including experience and interests;
• your Volunteer Agreement as part of the Volunteer Handbook and Policies;
• your informal discussion notes which form part of the selection process;
• information about your emergency contacts;
• information about your referees, to take up references;
• information about your nationality and entitlement to volunteer in the UK;
• information about your criminal record;
• details of your days/hours volunteering;
• details of any training you have undertaken;
• information about medical or health conditions, including whether or not you have a disability so that we can make adjustments if necessary;
• equal opportunities monitoring information including information about your ethnic origin, sexual orientation and religion or belief;
• other information relating to your volunteer registration e.g. health and safety records, leaver details, training records;
• if your volunteering role includes driving, we will ask to see and retain copies of your Driving Licence, MOT and Insurance documents on an annual basis. This information will not be shared with any other parties;
• CHSW might also review publicly available information about you;
• CHSW may hold profile pictures
• CCTV footage as set out in our CCTV policy.

CHSW may collect this information in a variety of ways for example, data may be collected through registration forms; obtained from your passport or other identify documents such as your driving licence copies of which may be retained on file; from correspondence with you; or through meetings and volunteer feedback.

In some cases, CHSW may collect personal and/or Special Category data about you from third parties, such as references supplied by former employers, and information from criminal records checks permitted by law, medical advice or records, parent/guardian consent and through Volunteer Recruitment Websites, who will pass on your information to us including your contact details and additional information, such as your experience and interests.

Data will be stored in different places, including your volunteer records, in the CHSW’s HR management system and in other CHSW IT systems.

Why does CHSW process personal data?

CHSW processes this data on the legal basis of a legitimate interest. The legitimate interest of CHSW is to support the work of the hospices and retail shops across the South West with the use of volunteers.
Processing personal data allows the organisation to:

• maintain accurate health and safety records and contact details to ensure we meet our obligations, complies with health and safety laws and meets our duty of care to volunteers;
• maintain accurate and up to date volunteer records and contact details (including details of who to contact in an emergency), to allow us to manage volunteer services;
• ensure effective general volunteer and business administration;
• provide references on request for current and former volunteers;
• respond to and defend against legal claims; and
• comply with legal and regulatory obligations and to prevent, detect and report crime.

Where CHSW processes other special categories of personal data, such as information about ethnic origin, sexual orientation, religion or belief, this is done for the purposes of equal opportunities monitoring. Data that CHSW uses for these purposes is anonymised or is collected with the express consent of volunteers, which can be withdrawn at any time. Volunteers are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

Who has access to your data?

CHSW will never share your data or personal information with any external organisation, nor will it transfer any personal data outside of the European Economic Area (EEA) without undertaking a Transfer Risk Assessment to ensure appropriate safeguards have been established.

Your information may be shared internally, including with members of the Volunteer and HR teams, your CHSW contact, managers in the business area in which you volunteer, IT and other staff if access to the data is necessary for the performance of their roles or business requirement.

CHSW may also share your data with third parties in the context of statutory reporting e.g. safeguarding, to comply with legal obligations e.g. insurance claims. Personal data may also be accessible to external IT support services as necessary. In those circumstances the data will be subject to confidentiality arrangements.

CHSW will not further process your personal data for any other purpose unless you have specifically consented to us doing so prior to your information being used.

How does CHSW protect data?

CHSW takes the security of your data seriously. CHSW has internal policies and controls in place to try to ensure your data is not lost, accidentally destroyed, misused or disclosed and is not accessed except by its employees in the performance of their duties. For example, the Data Protection, Use of IT, Social Media and Confidentiality Policies.

Where CHSW engages third parties to process personal data on its behalf, they are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

For how long does CHSW keep data?

CHSW will keep your data for six months from the point at which you confirm you have ceased volunteering with us, either by verbal or written confirmation. After six months your data will be securely destroyed.

For more information on records and retention please refer to CHSW’s Record Retention Policy which can be accessed via the intranet under HR Policies.

Your rights

As a data subject, you have a number of rights in relation to your personal data. You can:

• access and obtain a copy of your data on request;
• require CHSW to change incorrect or incomplete data;
• require CHSW to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where CHSW is relying on its legitimate interests as the legal ground for processing;
• request that information you have provided to us be given to you in a portable format;

If you would like to exercise any of these rights, please contact your CHSW Contact, Volunteer Advisor or local HR Advisor.

If you believe that CHSW has not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

You have some obligations under your Volunteer Registration/Agreement to provide the organisation with data. Certain information, such as contact details, your right to volunteer in the UK, for Disclosure and Barring Service checks (where applicable) to enable the organisation to enter into a volunteer agreement with you. If you do not provide the information, the organisation may not be able to process your registration properly or at all.

Automated decision-making

CHSW does not use your data to make any automated decisions about you.

It’s likely that we will need to update this Privacy Notice from time to time.  The most recent version will always be available on the CHSW website.

Latest Version: February 2024 V5

For more information regarding the GDPR please refer to CHSW’s Data Protection Policy available from your CHSW contact or the HR Team and the Privacy Policy/Notice on the CHSW website at www.chsw.org.uk.

Volunteer Privacy Notice: Policy History

UK General Data Protection Regulation (GDPR) January 2021

The UK GDPR is a UK law that regulates the protection of personal data and the free movement of such data.

Post Britain leaving the European Union, on the 1st January 2021 UK GDPR (UK General Data Protection Regulation) came into force to ensure the GDPR principles remained in UK Law, and work effectively domestically, and the UK has the independence to keep the framework under review.

The UK GDPR aims to maintain a Europe-wide standard and introduce stronger legislation on the handling of personal data. It sits alongside an amended version of the Data Protection Act 2018. However, there are implications for the rules on transfers of personal data between the UK and the EEA. The EU GDPR still applies to this processing, but the way organisations interact with European data protection authorities has changed.

The UK GDPR outlines the main principles, rights, obligations and requirements which have remained the same, and which CHSW must follow in processing UK residents’ personal data.

Organisations must have a valid reason for having personal data and the data should not be held for any longer than necessary. The UK GDPR is concerned with the rights of individuals when processing their information. This is achieved by being open and honest with events Volunteers about the use of information about them and by following good data handling procedures. The regulation is mandatory and all organisations that hold or process personal data must comply.

Under the UK GDPR Children’s Hospice South West (CHSW), Little Bridge House, Redlands Road, Fremington, Barnstaple EX31 2PZ is a data controller, registered with the Information Commissioners Office (ICO). CHSW collects and processes personal data relating to its events volunteers to support and manage the relationship. CHSW is committed to being transparent about how it collects and uses the data and to meeting its data protection obligations.

What information does CHSW collect?

As an Events Volunteer with CHSW supporting the work of the Events and Fundraising Teams across the South West, we collect and process a range of information about you. This includes:

• your title, name, address and contact details, including email address and telephone number, and gender;
• your completed registration form, with personal information including experience and interests;
• information about your emergency contacts;
• information about your nationality and entitlement to volunteer in the UK;
• information about your criminal record;
• information about medical or health conditions, including whether or not you have a disability so that we can make adjustments if necessary;
• other information relating to your events volunteer registration e.g. health and safety records,
• if your volunteering role includes driving, we will ask to see and retain copies of your Driving Licence, MOT and Insurance documents on an annual basis. This information will not be shared with any other parties;
• CHSW might also review publicly available information about you;
• CHSW may hold profile pictures

CHSW may collect this information in a variety of ways for example, data may be collected through registration forms; obtained from your passport or other identify documents such as your driving licence copies of which may be retained on file; from correspondence with you; or through meetings and volunteer feedback.

In some cases, CHSW may collect personal and/or Special Category data about you from third parties, such as information from criminal records checks permitted by law, medical advice or records.

Data will be stored in different places, including your events volunteer records, in the CHSW’s HR management system and in other CHSW IT systems.

Why does CHSW process personal data?

CHSW processes this data on the legal basis of a legitimate interest. The legitimate interest of CHSW is to support the work of the Events and Fundraising Teams across the South West with the use of events volunteers.

In some cases, CHSW needs to process data to ensure that it is complying with its legal obligations for example health and safety laws.

Processing personal data allows the organisation to:

• maintain accurate health and safety records and contact details to ensure we meet our obligations, complies with health and safety laws and meets our duty of care to volunteers;
• maintain accurate and up to date volunteer records and contact details (including details of who to contact in an emergency), to allow us to manage events volunteer services;
• ensure effective general events volunteer and business administration;
• respond to or defend against legal claims; and
• comply with legal and regulatory obligations, such as those in relation to employees with disabilities.

Who has access to your data?

CHSW will never share your data or personal information with any external organisation, nor will it transfer any personal data outside of the European Economic Area (EEA) without undertaking a Transfer Risk Assessment to ensure appropriate safeguards have been established.

Your information may be shared internally, including with members of the Events Volunteer, Events and Fundraising teams, your CHSW contact, managers in the business area in which you volunteer, IT and other staff if access to the data is necessary for the performance of their roles or business requirement.

CHSW may also share your data with third parties in the context of statutory reporting e.g. safeguarding, to comply with legal obligations e.g. insurance claims. Personal data may also be accessible to external IT support services as necessary. In those circumstances the data will be subject to confidentiality arrangements.

CHSW will not further process your personal data for any other purpose unless you have specifically consented to us doing so prior to your information being used.

How does CHSW protect data?

CHSW takes the security of your data seriously. CHSW has internal policies and controls in place to try to ensure your data is not lost, accidentally destroyed, misused or disclosed and is not accessed except by its employees in the performance of their duties. For example, the Data Protection, Use of IT, Social Media and Confidentiality Policies.

Where CHSW engages third parties to process personal data on its behalf, they are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

For how long does CHSW keep data?

CHSW will keep your data indefinitely, unless:

• you chose not to be kept updated by CHSW with news about our hospices, fundraising activities and campaigns and other ways you can help make a difference to short precious lives,
• your services are not utilised for a 3 year period
• you have ceased volunteering with us either by verbal or written confirmation

at which point your record will be deleted and securely destroyed.

Your rights

As a data subject, you have a number of rights in relation to your personal data. You can:

• access and obtain a copy of your data on request;
• require CHSW to change incorrect or incomplete data;
• require CHSW to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where CHSW is relying on its legitimate interests as the legal ground for processing;
• request that information you have provided to us be given to you in a portable format;

If you would like to exercise any of these rights, please contact your CHSW Contact, or local HR Advisor.

If you believe that CHSW has not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

You have some obligations under your Events Volunteer Registration to provide the organisation with data. Certain information, such as contact details, your right to volunteer in the UK, for Disclosure and Barring Service checks (where applicable) to enable the organisation to enter into an events volunteer arrangement with you. If you do not provide the information, the organisation may not be able to process your registration properly or at all.

Automated decision-making

CHSW does not use your data to make any automated decisions about you.

It’s likely that we will need to update this Privacy Notice from time to time, so please check back occasionally. The most recent version will always be available on the CHSW website.

Latest Version: Feb 2024 V4

For more information regarding the UK GDPR please refer to CHSW’s Data Protection Policy available from your CHSW contact or the HR Team and the Privacy Policy/Notice on the CHSW website at www.chsw.org.uk.

Event Volunteer Privacy Notice: Policy History