St Wilfrid's Hospice Privacy Notice – Non-clinical (including Income Generation)
St Wilfrid's Hospice is committed to being fair, open, honest and transparent in relation to the collection, processing and sharing of your personal data - in full accordance with the UK General Data Protection Regulation (UKGDPR) and the Data Protection Act 2018.
This privacy notice covers all non-clinical/non-counselling data processing (with the exception of data relating to employees, volunteers and applicants which is in a separate document) and includes areas such as donations and income generation (fundraising/retail).
Contact details
Post: St Wilfrids Hospice (Eastbourne), 1 Broadwater Way, Eastbourne, East Sussex, BN22 9PZ
Phone: 01323 434200
eMail: Any Patient related enquiries should be via email to stwh.spcreferrals@nhs.net.
If you have any non-patient related questions or concerns about how we use your personal information, please contact us via email to Hospice@stwhospice.org
What information we collect, use, and why
We will normally keep your information in an electronic format. This includes:
Personal details, such as:
- Name,
- Home address
- email address (if you agree to contact via this method)
- Home and/or mobile telephone number
- Event photographs or CCTV Video recordings of public areas (including indoor and outdoor spaces)
- Website user information (including user journeys and cookie tracking) and IP address
- Information relating to compliments, complaints or concerns
- Marketing preferences
- Information relating to health and safety (including incident investigation details)
Financial information (where you have shared this with our fundraising team), such as:
- Payment details (including card or bank information for transfers and direct debits)
- Donation history
- Financial transaction information
For supporters - we collect personal data when you ask us to send you publications or newsletters, order products and services from us, make a donation to us, sign up for Gift Aid, fundraise on our behalf, or otherwise give us information. We can then ensure that we send information which matches personal interests (eg social or sporting fundraising events and campaigns).
Our fundraising team will ask supporters for their communication preferences. We usually contact you by post, occasionally by phone and, where you have specifically agreed to this, by email*.
*Note that under the Data (Use and Access) Act 2025 the "soft opt-in" for charities will allow charities to send direct marketing emails to individuals who have previously engaged with the charity or expressed an interest in their work, without needing explicit consent for each communication. This means charities can contact individuals who have previously donated, volunteered, or signed up for newsletters, provided they offer an opt-out facility in every communication.
We also collect information about your use of our website, including your Internet Protocol (IP) address, how much time you spend on the site, and what you like or view on our site.
If you use our main hospice premises your image may be captured on CCTV and if you take part in one of our events your image may also be captured unless you have asked to be excluded from any photography/filming.
How we use your information
We use data in many ways. A list of our reasons for processing data is shown below:
- For supporter/donor administration (thank you letters etc ) and agreeing regular giving registrations
- To claim Gift Aid from Her Majesty’s Revenue and Customs (HMRC) where you have signed a declaration
- For direct marketing (where you have consented*) eg appeals, hospice updates and newsletters
- For the administration of an estate in order to obtain a legacy payment
- To log sales of donated items where Gift Aid process applies
- For the administration of a fundraising event (event pack)
- For processing in the Hospice Lottery (eg to remind you when a subscription is due)
- To discuss regular giving options such as direct debit arrangements, where existing supporters have not registered with the TPS
- To plan for our future by carrying out internal analyses, reporting and monitoring
- To satisfy Charity Commission and Companies House statutory requirements
- For the administration of training and education provision.
- To monitor and analyse the use of our website
- For contacting trustees for governance admin arrangements (board papers etc)
- CCTV for the purposes of crime prevention, security and public safety
- To look into and respond to any complaint or concern that has been raised
- To respond to your general enquiries and messages
- To carry out appropriate governance of any accident, injury or near miss (AIMN)
- For the administration of room hire and associated bookings ( eg Counselling room bookings)
- To facilitate collection or delivery of customer goods by our retail company
- To facilitate Community Links communications
- To provide data required in a 3rd party SAR
- To address any safeguarding concerns raised.
If your information is to be collected and used for any other purposes in the future, we will tell you about it and confirm our legal basis for processing that information.
Lawful basis for processing
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
We ask for your consent to the processing, such as:
- Joining the Hospice Lottery
- When submitting a Gift Aid declaration or donating items, where sales will go through the Gift Aid process.
- External booking of a counselling room
Sometimes it is necessary to process your data for us to comply with our legal obligations, such as:
- Sending Gift Aid information to HMRC
- Statutory requirements to register Trustees with the Charity Commission or Companies House
The hospice will process certain information under the basis of ‘legitimate interests’ in circumstances where any individual would reasonably expect us to be using their information. St Wilfrid’s Hospice will still protect your rights and interests, ensuring that processing remains lawful, fair, and necessary, without causing harm and where there is no less intrusive way to achieve the same result. Examples include:
- Responding to a general enquiry.
- Responding to a complaint or concern.
- Inviting people to remembrance services.
- Holding contact details of those sponsoring a fundraiser on our behalf.
- Holding contact details of trustees for governance arrangements (board papers etc)
- Sending you direct marketing in relation to donations and fundraising events in cases where you have supported us previously and are happy to continue receiving communications from us.
- To contact donors or regular givers to discuss direct debit arrangements, if happy to receive calls and not listed on the Telephone Preference Service (TPS)
- To allow families/next of kin to know what the organisation does and how they can get involved.
- CCTV for the purposes of crime prevention, security and public safety
- Room hire booking
- Requesting some form of training or education
The hospice will carry out a Legitimate Interest Assessment (LIA) for cases where legitimate interest is being used as the basis for processing information.
Where we get personal information from
- Directly from you
- Family members
- CCTV footage or other recordings
- Publicly available sources
Are you required to provide data and what happens if you don’t?
For donors, you are not required to provide personal data to us. However, if you don’t provide personal data this may affect our ability to provide the services you request. For example, we may not be able to receive a donation from you if you do not provide your payment information and we would be unable to claim the potential addition of Gift Aid funding.
For general enquiries and complaints we need a minimum of contact name, contact number and/or email address in order to respond to you.
Further processing of your data
When you give us your personal information in connection with making a donation, we will also use this information, apart from your financial information, for internal reporting and analysis.
We also engage third parties to provide us with data that helps us understand how we can provide the best experience for our supporters, how to best connect with them, and to give us insight so that we can provide supporters with information about topics which may be of interest. For example, we use a postcode profile classification system and may look at previous events that you have taken part in, sporting interests and information from trade directories and public records to create a profile of your interests and preferences. This information may be added to you supporter record accordingly. To opt out of profiling – please contact us.
Who we share information with
Fundraising is essential to our organisation’s survival. To help us fundraise more efficiently (leaving us with more time and resources for the important work we do), we engage third party onboarding platforms for some event campaigns and other 3rd parties to improve our address data e.g. to identify missing postcodes or to correct partial addresses.
We will never sell, rent, or trade your personal data.
The details of those joining the Hospice Lottery are shared with Local Hospice Lottery Ltd (who run the lottery on our behalf.)
Donors making Gift Aid declarations will have their details passed to HMRC in order for us to claim these funds.
Those making a regular donation will have the details of their standing order passed to our bank.
During certain campaigns we may engage APT Telemarketing to contact a proportion of existing supporters who have given us their marketing preferences and are not registered with the Telephone Preference Service (TPS) and are happy to continue receiving communications from us.
For certain fundraising events our supporters will be directed to a 3rd party microsite web platform operated by Funraisin, with servers based in the EU (Dublin) which hosts event registration and integrates with our donor/supporter database.
In some cases we use Enthuse as an additional 3rd Party cloud-based event management system (UK/EU servers) to process registration data and create fundraising support pages for the individuals taking part. Data is then exported and uploaded into supporter database RaisersEdge for donor management.
In some cases we use DotDigital email marketing campaign tool to engage with existing supporters who have opted-in to receive communications*.
In order to satisfy statutory requirements of the Charity Commission and Companies House the hospice will pass on details of Trustees and Company Directors.
In the event of an incident captured on CCTV - we may be requested to appropriately share the CCTV video evidence (eg. to the police or a motor insurer handling a claim).
Holding and protecting your data
Everyone working at St Wilfrid’s Hospice has a legal and professional duty to keep information about you confidential. We follow strict guidelines about how information is collected, stored and shared.
Your information is further protected by St Wilfrid’s Hospice’s compliance with the requirements of the:
- Data Protection Act (2018) / UK General Data Protection Regulation (UKGDPR)
- Data (Use and Access) Act 2025
- Regulators Code of Fundraising Practice (2016)
- Care Quality Commission
- Access to Health Records Act 1990
Our donor/supporter data is managed at a hosted datacentre in the EU(Amsterdam) by Blackbaud, the world’s largest cloud software company supporting non-profit organisations. Blackbaud, Inc. is the parent company of Blackbaud Europe Ltd. The terms and policy referring specifically to the relationship between Blackbaud and St Wilfrid’s Hospice’s, where Blackbaud is the data processor, can be found under the Business Solutions Agreement, with further specific detail under the Hosting Services agreement: https://www.blackbaud.com/terms
How long do we hold your data for?
We follow national guidance or best practice (sources such as the Records Management Code of Practice ) and as such, retention periods will vary according to the nature of the record.
Our full record retention schedule sits within our Data Retention Policy which includes the following examples:
- Finance records - 7 years
- Declarations of Gift Aid transactions - 6 years + current year
- Legacy letters or copies of wills - 14 years
- Donation letters/event forms/raffle tickets etc - 7 years
- Customer details for collection/delivery by retail team - 3 months
- Complaints - 10 years
Your rights
Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
- Right of Access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
- Right to Rectify - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
- Right of Erasure - You have the right to ask us to delete your personal information
- Right to Restrict Processing - You have the right to ask us to limit how we can use your personal information
- Right of Portability - You have the right to ask that we transfer the personal information you gave us to another organisation
- Right to Object - You have the right to object to the processing of your personal data
- Right not to be Profiled - Not be subject to a decision based on automated processing.
- Right to Withdraw Consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time
- Right to Complain - to us, the Information Commissioners Office or the Fundraising Preference Service
If you make a request, we must respond to you without undue delay and in any event within one month.
Where we process data with your consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object.
Where we process your data as a Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Where we process your data under Legitimate interests – we’re collecting or using your information because it benefits you and our organisation without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability
What should I do if I have concerns?
If you have any non-patient related questions or concerns about how we use your personal information please contact us via email to Hospice@stwhospice.org or via telephone ( 01323 434200). Note that patient-related enquiries should be via email to stwh.spcreferrals@nhs.net
Comments, complaints, compliments and general enquiries can also be registered via our Contact Us web-form on the website https://www.stwhospice.org/about-us/contact-us/ Complaint outcomes will be made without undue delay. If you remain unsatisfied with the outcome of our handling of a complaint, you can then escalate it to the Information Commissioners Office. https://ico.org.uk/make-a-complaint/data-protection-complaints/
Subject Access Requests (SAR) for requesting access to your personal data/records can be made via stwh.spcreferrals@nhs.net for the attention of Tara Schrikker – Registered Manager / Associate Director for Quality & Governance. Completion and submission of one of the corresponding SAR request forms is helpful for us to understand exactly what information you are trying to obtain. These can be downloaded from the SAR page on our website: https://www.stwhospice.org/information/subject-access-requests/
Whilst St Wilfrid’s Hospice is not currently required to appoint a legally defined role of Data Protection Officer, we continue to demonstrate our strong commitment to data protection, security and confidentiality with the following key IG roles in place:
Dr David Barclay – Caldicott Guardian
Darren Mackenzie – Senior Information Risk Owner (SIRO)
Steve Clarke – IG Lead
For specific queries in relation to any donor and fundraising data concerns, you can write to Caroline Stevens - Database and Supporter Development Manager at the address below, by email to individualgiving@stwhospice.org, or by calling 01323 434220.
Supporter Development and Database Manager, St Wilfrid’s Hospice, 1 Broadwater Way, Eastbourne, East Sussex BN22 9PZ
For queries relating to our trading company you can email to retail@stwhospice.org
Changes to this information notice
Our privacy notices are reviewed a minimum of every 2 years and updated when there is a known change to our systems or processes. This information notice was last updated July 2025.
