Privacy Notice for Applicants, Employees and Volunteers

Last updated:  July 2025

1. Who we are

St Wilfrid’s Hospice is a registered charity based at: 1 Broadwater Way, Eastbourne, East Sussex BN22 9PZ. We provide specialist palliative and hospice care throughout East Sussex. All personal data is processed in accordance with the Data (Use & Access) Act 2025, UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Purpose of this notice

This notice explains what personal data we collect about applicants, employees and volunteers, why we collect it, how we use it, who we share it with, how long we keep it and the rights you have over it.

• Our legal basis – legitimate interests

We rely primarily on legitimate interests (Article 6(1)(f) UK GDPR) when processing personal data about applicants, employees and volunteers. Our legitimate interest is to recruit, engage, support and manage a safe and effective workforce and volunteer team so we can deliver high-quality palliative care. This includes activities such as workforce planning, training, payroll and volunteer coordination. Whenever we process special category data (for example, health information) we also rely on the employment and social care conditions in Article 9(2)(b) and (h) and Schedule 1 of the Data Protection Act 2018.

3. What data we collect and when

We only collect data that we need for clearly defined purposes and retain it no longer than necessary.

Stage	Typical data items	Why we collect / use it	Main legal bases**
Application	• Name & contact details • Experience, qualifications, referees • Equal opportunities‑ data (optional)	Assess suitability and contact you	Art 6(1)(b) contract (pre‑contract steps); Art 6(1)(f) legitimate interests (workforce planning); Equal opportunities‑ data: Art 6(1)(a) & Art 9(2)(a) explicit consent
Shortlisting	Anonymised application data	Fair, unbiased selection	Art 6(1)(f) legitimate interests
Assessment / Interview	Test results; interview/assessment notes	Select the best candidate	Art 6(1)(f) legitimate interests
Conditional offer / Pre‑employment	• Proof of identity & right-to-work • Criminal records‑ declaration / DBS • References • (Employees) occupational health‑ questionnaire; bank details; pension choice	Verify identity, integrity, fitness to work; set‑up contract & pay	Art 6(1)(c) legal obligation (RTW, DBS); Art 6(1)(b) contract; Health & DBS data: Art 9(2)(b,h) & DPA 2018 Sch. 1; Art 10 (criminal data)
During employment / volunteering	• Updated contact & bank details • Sickness & vaccination information (employees) • Professional memberships, training & performance records • Emergency contacts	Administer contract/volunteer agreement; pay & insure you; ensure health, safety & competence	Art 6(1)(b) contract; Art 6(1)(c) legal obligation; Art 6(1)(f) legitimate interests; Health data: Art 9(2)(b,h)

 

We rely principally on legitimate interests (see section 2.1). Where special category or criminal offence data is processed we rely on the additional grounds shown. Where we rely on consent you may withdraw it at any time.

4. Special category & criminal offence data

We process health data to assess fitness for work and make reasonable adjustments. Criminal offence data is processed to safeguard vulnerable people, relying on Schedule 1 DPA 2018 (employment, regulatory and social care purposes).

5. How we use your data

• Recruitment & selection
• Pre‑employment / volunteering checks
• Payroll, pensions & benefits administration
• Sickness and leave management
• Regulatory and safeguarding obligations
• Equal opportunities monitoring (statistics only)

We do not use your data for marketing.

6. Data sharing

• Internal sharing

Data is shared only with staff who need it to perform their role (e.g. HR, hiring managers, line managers).

• External processors

We use trusted third-party suppliers under written contracts that require them to keep your data secure, act only on our instructions and provide their own privacy information. The key processors we use are listed below.

Processor	Purpose	Retention	Privacy notice
CIPHR HRIS & Payroll	Employment records & payroll	Employment period + 6 years	https://www.ciphr.com/privacy-notice
iRecruit (CIPHR)	Applicant tracking	12 months (unsuccessful)	https://www.ciphr.com/privacy-notice
Better Impact	Volunteer database	Duration of volunteering + 6 years	https://www.betterimpact.com/privacy-policy-uk
uCheck (MG Care Executive Ltd)	DBS checks	6 months (certificate data)	https://www.ucheck.co.uk/wp-content/uploads/uCheck_Client_Privacy_Policy_v1.6.pdf
Occupational Health – Alliance for Better Care	Fit for work assessments	As advised by provider	https://allianceforbettercare.org/privacy/
Occupational Health – Smart Clinic	Fit for work assessments	As advised by provider	https://smartclinic.com/wp-content/uploads/2023/12/Data-Policy-2024.pdf
NHS Pensions	Pension administration	Scheme specific	https://www.nhsbsa.nhs.uk/our-policies/privacy
People’s Pension	Pension administration	Scheme specific	https://thepeoplespension.co.uk/privacy/
AIG (Life Assurance)	Life‑assurance cover	Policy duration	https://www.aig.co.uk/privacy-policy

 

Addresses for these organisations and additional contact details can be found within their linked privacy notices or are available on request.

Some volunteer data is stored in Better Impact servers located in Canada. Data is protected by UK adequacy regulations and standard contractual clauses.

7. Automated decision making

We do not make solely automated decisions that have legal or similarly significant effects without human involvement. If this changes, you will be notified and may request human review.

8. Data retention

Record	Retention period
Unsuccessful applications	12 months after campaign close
Employee / volunteer file	Employment / volunteering period + 6 years
Equal opportunities data	12 months

 

9. Your rights

You have the right to: access, rectify, erase, restrict or object to processing, data portability, withdraw consent, and not be subject to automated decisions. To exercise any right, use the contact details below.

10. Accessing your data (Subject Access Requests)

Write to The Registered Manager at the address above or email stwh.spcreferrals@nhs.net. We will respond within one month (extendable to two months for complex requests) and do not normally charge a fee. Further information and optional SAR request forms can be found at https://www.stwhospice.org/information/subject-access-requests/

 

11. Complaints

If you have concerns about how we handle your data, please email the People Director at HR.Team@stwhospice.org. You may also complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

12. Key information governance roles

Role	Name
Caldicott Guardian	Dr David Barclay
Senior Information Risk Owner	Darren Mackenzie
Information Governance Lead	Steve Clarke

 

13. Changes to this notice

We review this notice at least every two years or sooner if our processes change. The current version is always available at www.stwhospice.org.

This privacy notice does not provide exhaustive detail of all aspects of St Wilfrid’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to HR.Team@stwhospice.org