Privacy

Section 1

What information do we collect and how do we use it.

This section sets out how we gather personal data from our service users and supporters and how this information is used.

1.1 Clinical Service Users

A service user is anyone who;

• is currently receiving support or care from one of our services;
• has previously received support or care from one of our services;
• someone who has made an enquiry and/or has been referred to the hospice but is yet to receive support;
• someone who has previously been referred to the hospice for support or care however did not receive a service from us.

What information do we collect?

The types of information that we might hold include:

• Title and full name;
• Postal address;
• Date of Birth;
• Contact details including email and telephone number;
• Next of kin and family information;
• Your doctor’s contact details;
• Family connections of others service users;
• As we use Closed Circuit Television (CCTV) for security purposes at our buildings, your image may appear in still images and video footage.

In addition to the above, we may hold sensitive personal information about you which could include:

• Notes and reports about your health, treatment and care, including:
• your medical conditions;
• results of investigations, such as x-rays and laboratory tests;
• future care you may need;
• personal information from people who care for and know you, such as relatives and health or social care professionals;
• other personal information such as smoking status and any learning disabilities.
• Your religion and ethnic origin.
• Whether or not you are subject to any protection orders regarding your health, well-being and human rights (safeguarding status).

It is important for us to have a complete picture of you as this will assist staff to deliver appropriate treatment and care plans in accordance with your needs.

You are not obligated to provide your personal information to Farleigh Hospice, however, as this information is required for us to provide you with our services we will not be able to offer our services without it.

How do we collect information?

• Directly from you (e.g. during assessments or conversations)
• From referrals by healthcare or social care professionals
• From third-party systems (e.g. NHS databases)
• Through CCTV systems at our premises

How do we use this information?

Your personal data is used to:

• Deliver and manage your care and treatment
• Ensure staff have accurate and up-to-date information
• Coordinate care with other healthcare providers
• Monitor and improve the quality of our services
• Support funding and commissioning of care
• Conduct audits, research, and service planning (using anonymised data)
• Comply with legal and regulatory obligations
• Contact you about appointments, care updates, or satisfaction surveys

Your records are used to directly, manage and deliver healthcare to you to ensure that:

• The staff involved in your care have accurate and up to date information to assess and provide advice on the most appropriate care for you;
• Staff have the information they need to be able to assess and improve the quality and type of care you receive;
• Appropriate information is available if you see another healthcare professional, or are referred to a specialist or another social care or health provider.

We may need to share relevant personal information with other healthcare organisations. For example, we may share your information for healthcare purposes with health authorities such as NHS England, Public Health England, NHS trusts, general practitioners (GPs), ambulance services, primary care agencies etc. We will also share information with parts of the NHS and those contracted to provide services to the NHS in order to support your healthcare needs.

We may need to share information from your health records with other non-NHS organisations from which you are also receiving care, such as Social Services, other hospices or private care homes. However, we will not disclose any health information to any other third parties without your explicit consent unless there are circumstances, such as when the health or safety of others is at risk or where current legislation permits or requires it.

Any personal information we hold about you is processed for the purposes of ‘provision of health or social care or treatment or the management of health of social care systems and services’ under chapter 2, section 9 of the Data Protection Act 2018.

The personal information we collect about you may also be used to:

• Remind you about your appointments and send you relevant correspondence;
• review the care we provide to ensure it is of the highest standard and quality, e.g. through audit or service improvement;
• support the funding of your care, e.g. with commissioning organisations;
• prepare statistics on our performance to meet the needs of the population or for the Department of Health and other regulatory bodies;
• help to train and educate healthcare professionals;
• report and investigate complaints, claims and untoward incidents;
• report events to the appropriate authorities when we are required to do so by law;
• contact you with regards to patient satisfaction surveys relating to services you have used within our hospital so as to further improve our services to patients.

For statistical and reporting purposes your information will be anonymised and it will not be possible to identify you. This information may be shared with NHS and other care agencies as well as with Clinical Commissioning Groups and Lead Care Providers where a legal basis for processing permits us to do so.

We process your data under the lawful basis of:

• Article 6(1)(e) – performance of a task carried out in the public interest
• Article 9(2)(h) – provision of health or social care or treatment

You are not legally required to provide your personal data, but without it, we may be unable to provide you with appropriate care and support.

1.2 Supporters

This section applies to individuals who engage with Farleigh Hospice in a non-clinical capacity, including supporters, donors, event participants, and volunteers.

When do we collect your information?

We collect personal data when you:

• Make a donation (including one-off, regular, or in-memory donations)
• Contact us with an enquiry or request
• Attend or register for an event
• Fill in online or paper forms
• Subscribe to our communications (e.g. newsletters, appeals)
• Volunteer with us or express interest in volunteering
• Interact with us via social media or third-party fundraising platforms
• Visit our premises (via CCTV)

What information do we collect?

We may collect and process the following types of personal data:

General Personal Data:

• Full name and title
• Postal address;
• Date of birth
• Email address and telephone number
• Communication preferences
• Records of correspondence and interactions with us
• Donation history and Gift Aid declarations
• Event participation and fundraising activity
• Volunteering history and availability
• Family links (e.g. next of kin, in-memory donations)
• CCTV footage (for security and safety)

Financial Data:

• Payment details (e.g. bank or card information for donations or event fees)
• Transaction records (processed securely via third-party payment providers)

Special Category Data (only where relevant and with consent):

• Health or accessibility requirements (e.g. for event participation or volunteering)
• Equality and diversity monitoring data (e.g. ethnicity, disability status)

How do we collect this information?

• Directly from you (e.g. forms, conversations, emails)
• Through third-party platforms (e.g. JustGiving, Eventbrite, CAF)
• From social media interactions
• From public sources (e.g. Companies House, obituaries, press)
• Via CCTV systems at our premises

How do we use this information?

We use your personal data to:

• Process and acknowledge donations
• Administer events and fundraising activities
• Manage volunteering opportunities and communications
• Respond to enquiries and provide information you’ve requested
• Keep you informed about our work, events, and ways to support us (if you’ve opted in)
• Comply with legal and regulatory obligations (e.g. HMRC for Gift Aid)
• Improve our services and supporter experience
• Ensure the safety and security of our premises and people

Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR:

• Consent – where you have opted in to receive marketing or communications
• Contract – where processing is necessary to fulfil a request or agreement (e.g. event registration)
• Legal obligation – for compliance with laws (e.g. Gift Aid, financial records)
• Legitimate interests – to pursue our charitable aims, manage supporter relationships, and ensure effective operations, provided your rights and freedoms are not overridden

Withdrawing Consent and Managing Preferences

Where we rely on your consent, you may withdraw it at any time. You also have the right to object to processing based on legitimate interests.

You can update your communication preferences or request to stop receiving communications by:

• Emailing: communications@farleighhospice.org
• Writing to: Communications Team, Farleigh Hospice, North Court Road, Chelmsford, CM1 7FH
• Calling: 01245 457394

We will always respect your preferences and ensure your data is handled securely and lawfully.

1.3 Applicants – Staff and Volunteers

This section applies to all individuals who are employed by or volunteer with Farleigh Hospice, including permanent, temporary, bank, agency, and honorary staff, as well as trustees and student placements.

What information do we collect?

We may collect and process the following categories of personal data:

General Personal Data:

• Full name and title
• Contact details (address, phone number, email)
• Date of birth
• National Insurance number
• Emergency contact details
• Employment or volunteering history
• Education and qualifications
• Professional registrations and memberships
• Right to work documentation (e.g. passport, visa)
• Bank details (for payroll or reimbursement purposes)
• CCTV footage (for security and safety)

Special Category (Sensitive) Data:

• Health information (e.g. medical conditions, disability status, occupational health assessments)
• Criminal records (Disclosure and Barring Service checks)
• Ethnicity, religion, sexual orientation (for equal opportunities monitoring)
• Safeguarding concerns or disclosures
• Trade union membership (if applicable)
  

How do we collect this information?

• Directly from you (e.g. application forms, interviews, onboarding)
• From third parties (e.g. referees, DBS, professional bodies)
• From internal systems (e.g. HR, payroll, learning and development platforms)
• CCTV systems at our premises

How do we use this information?

We use your personal data to:

• Manage recruitment, onboarding, and induction
• Administer contracts of employment or volunteer agreements
• Ensure legal compliance (e.g. right to work, safeguarding)
• Manage payroll, pensions, and benefits
• Monitor training, development, and performance
• Support health, safety, and wellbeing at work
• Investigate complaints, grievances, or disciplinary matters
• Maintain accurate records for audit and regulatory purposes
• Ensure equality, diversity, and inclusion in the workplace
• Provide access to IT systems and facilities
• Communicate with you about your role and responsibilities

We process your data under the lawful bases of:

• Article 6(1)(b) – necessary for the performance of a contract
• Article 6(1)(c) – necessary for compliance with a legal obligation
• Article 6(1)(f) – legitimate interests of the organisation
• Article 9(2)(b) and (h) – employment and occupational health purposes

We may share your data with:

• HMRC, pension providers, and payroll processors
• Regulatory bodies (e.g. CQC, Charity Commission)
• Training and accreditation providers
• IT and system support providers
• Legal or professional advisors (where necessary)

We will not share your data with third parties for marketing purposes and will not transfer your data outside the UK or EEA unless appropriate safeguards are in place.

Where we process special category data (e.g. health information, ethnicity) or criminal offence data (e.g. DBS checks) in relation to staff and volunteers, we do so in accordance with Article 9 and Article 10 of the UK GDPR and Schedule 1 of the Data Protection Act 2018.

Farleigh Hospice has an Appropriate Policy Document (APD) in place which outlines our procedures for securing and retaining this data. This document is reviewed regularly and is available upon request from the Data Protection Officer.

For the purpose of promoting our careers and job adverts, as well as application services and applicant management, Farleigh Hospice uses a third party provider, Volcanic.

All data entered by the user on the https://careers.farleighhospice.org subdomain is stored and processed by 360Resourcing, on behalf of Farleigh Hospice, in order to use their services. Users should review 360Resourcing's privacy policy before continuing.

You can view our Recruitment Privacy Notice here.

Section 2

2.1 Storage and Security of Personal Data

Farleigh Hospice is committed to ensuring that all personal data—whether relating to service users, staff, volunteers, or supporters—is stored securely and handled in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We implement a range of technical and organisational measures to protect your data from loss, misuse, unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of data at rest and in transit, ensuring only authorised personnel can access it
• Access controls based on the principle of least privilege, ensuring staff and volunteers only access data necessary for their role
• Multi-factor authentication for access to sensitive systems
• Regular security audits and access reviews
• Mandatory annual data protection and information governance training for all staff and volunteers
  
• Secure disposal of physical and digital records when no longer required
• Business continuity and disaster recovery plans to ensure data resilience
• Regular patching and updates to IT systems and software to address vulnerabilities

2.2 Data Location and International Transfers

Your personal data will be stored within the United Kingdom (UK) or the European Economic Area (EEA). If it becomes necessary to transfer your data outside of these regions, we will ensure that:

• The destination country has been deemed to provide an adequate level of protection by the UK Government or European Commission; or
• Appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs)

We will always inform you if your data is to be transferred internationally and explain the safeguards in place.

3. 2.2 Links to External Websites, Providers, and Services

Our website and communications may contain links to third-party websites, platforms, or services (e.g. fundraising platforms, social media, event registration tools). While we aim to link only to reputable sources, we do not control these external sites and are not responsible for their privacy practices or content.

We recommend that you review the privacy policies of any third-party websites you visit. Farleigh Hospice cannot accept liability for any loss, misuse, or unauthorised access to your data once you leave our digital environment.

Section 3

3.1 Right of access and changing your personal information

Under the UK General Data Protection Regulation (UK GDPR), you have a number of rights in relation to your personal data. These rights apply to all individuals whose data we process, including service users, staff, volunteers, and supporters.

You have the right to:

• Access the personal data we hold about you and receive a copy of it
• Be informed about how your data is collected, used, and shared
• Rectify inaccurate or incomplete personal data
• Erase your personal data (the “right to be forgotten”) where there is no legal basis for its continued processing
• Restrict the processing of your data in certain circumstances (e.g. if you contest its accuracy)
• Object to the processing of your data where we rely on legitimate interests or direct marketing
• Data portability, allowing you to obtain and reuse your personal data across different services (where applicable)
• Withdraw consent at any time, where processing is based on your consent
• Not be subject to automated decision-making, including profiling, that has legal or similarly significant effects

To exercise any of these rights, or to make a data protection enquiry, please contact our Data Protection Officer:

Email: DPO@farleighhospice.org

We will respond to your request within one calendar month, in accordance with data protection law. In some cases, we may need to verify your identity.

3.2 Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, contractual, or operational requirements.

Retention periods vary depending on the nature of the data and the context in which it was collected. For example:

• Clinical records are retained in accordance with NHS and health sector retention schedules
• Employment and volunteer records are retained in line with employment law and safeguarding guidance
• Financial and donation records are retained for a minimum of 6 years for HMRC and audit purposes
• Marketing preferences are retained until you withdraw consent or object to processing
• When data is no longer required, it is securely deleted or destroyed in accordance with our data disposal procedures.
• If you request to stop receiving marketing communications, we will retain minimal information (e.g. your name and contact details) to ensure we respect your preferences and do not contact you again in error.

Section 4

4.1 Changes to our Privacy Notice

We keep our Privacy Notice under regular review and will update this Notice from time to time. This Privacy Notice was last updated in July 2025.

Section 5

5.1 Cookies and Visitor Data Usage

Do you have a cookie policy?

Yes, you can view our cookie policy as well as amend your communications preferences by clicking here.

What data is collected from the cookies on our website?

We use cookies in the everyday functioning of our website to help us provide you with a better, more user friendly experience. Other cookies, however, help us to gain important usage statistics/data from our users - much like any other website. All data is completely anonymised and usually collected through cookies relating Google Analytics, Facebook and Twitter. The types of data that we collect include, but is not necessarily limited to: IP address, visit date, visit length, pages visited, location (from IP), the browser you’re using, the device type you’re using, the operating system you’re using and if logged into one of the platforms mentioned above some anonymised lifestyle and demographic data such as gender, age and interests.

How do we use the data collected from cookies?

Any data collected in this method is kept, in an anonymised form on the servers of the specified service (e.g. Google, Facebook etc.) from which it was collected. Data is only transferred to Farleigh Hospice systems in its anonymised and bulk numerical form for routine analysis, planning and strategy purposes, helping us build a better service for our community. Some data may be used for advertising and marketing targeting across all of our online platforms. This may include, but is not limited to: location data, push notifications, device types, log-in/visitation time, pages visited and interests (if you’re using services such as Google+, Facebook or Twitter for example). Only selected and trained members of our staff have access to our anonymised statistical web data, which is kept and used in accordance with any service specific privacy policies and the data protection precautions outlined in other areas of this policy.

What if I have a concern or issue with my data being collected and used in this way?

If you have any concerns regarding our use or potential use of your data please contact the data controller/officer in the first instance at DPO@farleighhospice.org. Please remember that your problem may relate to the service or platform you are using and may not be under the control of Farleigh Hospice. We take all concerns seriously and will always endeavour to help you to the best of our ability, however, should you feel this is insufficient please use the complaints process outlined in other areas of this policy document.

5.2 Media Permissions

What are media permissions?

When an individual signs a media permissions form/waiver they allow us to use media featuring them, such as imagery, video and audio recordings in any of our communications both internal and external. This includes, but is not limited to our website, intranet, social media, radio, TV, video and print media.

Who might need to sign a media permissions form?

Any individual who is featured in a photo or video, for example, taken by or on behalf of Farleigh Hospice will need to sign a media permissions form. This could include members of the public who attend an event, volunteers and other people working on behalf of Farleigh Hospice. There is no obligation to sign a media permissions form and any media/imagery will not be used without the explicit consent of the individual(s).

What kind of data is included on a media permissions form and is it kept safely and securely?

The standard information required to be completed on one of our media permissions forms includes: name, address, telephone number, email, your signature and the date it was signed. All forms are stored securely in an electronic format on Farleigh Hospice systems and access is restricted to only the specially trained staff who process them. Original paper copies may be kept for a short period of time before being securely destroyed.

I no longer want to be included in any Farleigh Hospice media, how can I revoke my permissions?

Anyone can at any time revoke their media permissions. We will always assist you to the best of our ability to remove all content in which you feature in an expedited time frame. It is important to note that other organisations, publications or similar may share or repost any material that we place into the public domain while your media permission is still active. Should you wish to revoke your permissions in this instance Farleigh Hospice will endeavour to have any such content removed, but can take no responsibility for the actions of organisations not under our control.

Section 6

6.1 How to contact us

General Information:

Farleigh Hospice, North Court Road, Chelmsford, Essex CM1 7FH
Email: info@farleighhospice.org
Phone: 01245 457300

Data Protection:

Data Protection Officer, Farleigh Hospice, North Court Road, Chelmsford, Essex CM1 7FH
Email: DPO@farleighhospice.org
Phone: 01245 457300