Privacy Notice

How we collect information about you

We collect personal information in different ways, depending on how you interact with us:

Information you provide to us directly

You may give us your information in order to sign up for one of our events, make a donation, shop in our stores, register as a volunteer, provide feedback, join in one of our Hubs or otherwise communicate with us.

• Website and online activity: We gather non-identifiable general information when you use our website, such as pages visited and areas that are of most interest to users through a Google Analytics cookie. We use this information to improve our website and make it a better experience for everyone. For more information on the cookies we use please visit https://www.hokh.org/cookies/. Information on how you can change your cookie preferences at any time is included on https://www.hokh.org/cookies/

• Phone and voicemail: If you leave us a voicemail, we may store and review it to respond to your inquiry, provide support, and improve our services. We only keep voicemails for as long as needed for these purposes unless the law requires us to keep them longer. Our phone and voicemail services are managed by trusted third-party providers. They are contractually required to keep your information safe and handle it in line with data protection laws.

Information you provide to us indirectly

• Visitors and premises: If you stay at or visit our premises, including the hospice, our Inpatient Unit or one of our charity shops, we may record your image on CCTV. We rely on our legitimate interests in ensuring the safety and security of our premises, colleagues, and visitors. CCTV images are retained for 30 days after which they are automatically overwritten. However, there may be, on occasion, a need to supply footage to prevent criminal activity in which case the files would be passed on to the necessary authorities.

Information we receive from third parties

Your information may also be shared with us by third parties, for example:

• if a friend or family member signs you up for one of our events
• professional fundraising agencies;
• independent event organisers, for example the London Marathon or fundraising sites like Enthuse, Just Giving, Facebook donations;
• if you sign up as a volunteer for us through an external volunteering website;
• if you are a healthcare professional and your information is shared with us by the organisation you work for.

We also may receive data about you from subcontractors acting on our behalf who provide us with technical, payment or delivery services, and from business partners, advertising networks and search/analytics providers used on our website

You should check any privacy notice provided to you where you give your data to a third party.

Information from other sources

We also use information from the following sources:

• Social Media: Communication, engagement and actions taken through external social media platforms that we participate on are subject to the terms and conditions as well as the privacy policies held with each social media platform respectively. Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp or X, you might give us permission to access information from those services, for example when you publicly tag us in an event photo.
We rely on our legitimate interests to view or interact with content you have made public or shared with us. You are advised to use social media platforms wisely and communicate / engage upon them with due care and caution in regard to your own privacy and personal details.

• Information available publicly: We supplement information on our supporters with information from publicly available sources such as charity websites and annual reviews, corporate websites, public social media accounts, the electoral register and Companies House in order to create a fuller understanding of someone’s interests and support of Heart of Kent Hospice.

We rely on our legitimate interest in fundraising and supporter engagement for this type of research.

What personal information we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We collect, store and use the following kinds of personal information:

• your name;
• your contact details (including postal address, telephone number, e-mail address and/or social media identity);
• your date of birth;
• your gender;
• your bank or credit card details where you provide these to make a payment (we collect this information for its one time use, we do not store this information);
• if you volunteer for us or apply for a job with us, information necessary for us to process these applications and assess your suitability (which may include things like employment status, previous experience depending on the context, as well as any unspent criminal convictions or pending court cases you may have);
• information about your activities on our website(s) or social media platforms when you interact with us, and about the device you use to access these, for instance your IP address and geographical location;
• information about events, activities and products which we consider to be of interest to you;
• information relating to your health (for example if you are taking part in or attending an event for health and safety purposes, as well as where you share your experiences with us);
• where you have left us a gift in your will, any information regarding next of kin with which you may have provided us to administer this;
• information as to whether you are a taxpayer to enable us to claim Gift Aid;
• age, nationality and ethnicity information for monitoring purposes; and
• any other personal information you provide to us.

Certain types of personal information are in a special category under data protection laws, as they are considered to be more sensitive. Examples of this type of sensitive data (known as “special category data”) would be information about health, race, religious beliefs, political views, trade union membership, sex life or sexuality or genetic/biometric information.

We only collect this type of information about our supporters to the extent that there is a clear reason for us to do so, for example asking for health information as a patient under our care. If you are under our care, we will record personal information (e.g. name, contact details, diagnosis, symptoms and clinical history; medication, allergies and treatment plans; notes from doctors, nurses and therapists involved in your care) either directly from you when you are referred or enquire about our services, or from referring organisations.

Other possibilities for asking for health information might include if you are taking part in a sporting event, or where we ask for information for the purpose of providing appropriate facilities or support. We will also collect this type of information if you make it public or volunteer it to us.

Wherever it is practical for us to do so, we will make clear why we are collecting this type of information and what it will be used for.

How we use this information

The ways that we use your personal data will largely be defined by why you are providing it.

We use your personal information to give you the information, support, services or products you ask for. We also use your personal information to thank you for your previous support or invite you to an event, for example if you have made a donation or have previously taken part in one of our events. We will ensure that we know how you prefer us to contact you, where you have provided this information.
Examples of where we may use your personal information include:

• Providing and personalising our care and support services
• Recording and managing relevant health and care information to deliver safe, effective, and coordinated care
• Dealing with your enquiries, requests, complaints, and investigations
• Processing your donations
• Providing you with information about our work, activities, educational programmes, events, and services
• Complying with our legal obligations, policies and procedures including protection of our colleagues in the workplace
• Fulfilling management, governance and statutory responsibilities and/or obligations
• Fundraising
• Recruitment, training analysis, quality improvement and management responsibilities
• Identifying any issues in our processes with a view to improving them
• Fulfilling orders for goods or services
• Helping us respect your communication choices and preferences. E.g. if you ask not to receive marketing material, we’ll keep a record of this.

Sometimes, when we are communicating with large numbers of people, from any area of the hospice, we may work with external organisations. This is the quickest and most cost-effective way of communicating with high volumes of people. On these occasions your details will be shared with the appointed agency for the purposes of contacting you. These agencies act only on our instructions. We have signed agreements from each agency we use that they delete the information we share with them as soon as the activity is complete.

Legal basis for processing

Public Task / Heath and Social Care

We use personal information, including health and care information, because it is necessary for us to provide and manage our health and social-care services. This includes delivering safe and effective care to patients, coordinating with healthcare professionals and social-care partners, and managing of health and social-care systems and services.

We may share relevant personal information between hospice teams and committees, and with healthcare partners such as GPs, hospitals, community nurses or social-care professionals involved in your care. This helps us ensure that your care is joined up, safe and well-coordinated.

We also maintain records about the healthcare professionals and partner organisations we work with, so that we can manage referrals, coordinate care, and audit the quality and safety of our services.

We handle all health and care information with strict confidentiality and only share it with people directly involved in your care or where required by law.

Consent

We will ask for your consent where we wish to use your information for a purpose that is optional and not part of providing our core care or support services (for example, to send you marketing material via post, phone, text or e-mail, or to use your story, image or testimonial in our communications). Where we rely on consent, you have the right to withdraw consent at any time. This will not affect the care or services we provide to you.

Legal obligation

We use your personal information where we need to do so to comply with a legal or regulatory obligations. This includes obligations under charity, health-care, employment, tax, safeguarding and health-and-safety law.

For example, we may need to share your information with regulators, such as the Charity Commission, Fundraising Regulator, Information Commissioner or Gambling Commission.

We may also need to use or share information to comply with legal duties relating to patient safety, safeguarding, or serious-incident reporting.

Performance of a contract/preparedness for entering a contract

We use your personal information where we need to do so to comply with a legal or regulatory obligations. This includes obligations under charity, health-care, employment, tax, safeguarding and health-and-safety law.

For example, we may need to share your information with regulators, such as the Charity Commission, Fundraising Regulator, Information Commissioner or Gambling Commission.
We may also need to use or share information to comply with legal duties relating to patient safety, safeguarding, or serious-incident reporting.

Vital interests

In limited situations, we may use your personal information where it is necessary for us to protect someone's life or health. For example, in a medical emergency affecting individuals at one of our events, or in a safeguarding situation where we need to contact or share information with the emergency services or relevant authorities. This lawful basis is used only in rare and urgent circumstances, when no other lawful basis is appropriate.

Legitimate Interest

We use your personal information where it is necessary for our legitimate interests (or those of others), provided that these interests are fair, balanced and do not override your rights and freedoms.
This basis mainly applies to our fundraising, marketing and general business-administration activities. For example:

• analysing and profiling our supporters or potential supporters to better understand engagement;

• updating contact details using reputable third-party sources when people move house;

• monitoring the use of our website for technical or security purposes;

• maintaining internal records of our supporters, donors, suppliers and volunteers; and

• where you have signed up with us for a charity place in a third-party event (for example, a sponsored run not organised by the hospice), sharing relevant contact details with the event organiser to administer the event.

We do not rely on legitimate interests to process health or care information about our patients or service users.

Before relying on legitimate interests, we carry out a balancing test to make sure our interests do not override your rights or interests.

How we keep your information safe

Heart of Kent Hospice is committed to protecting your privacy and confidentiality. We comply with UK GDPR, DPA 2018 and NHS information-governance and security standards. We have robust technical and organisational systems and measures in place to keep personal information secure. These measures include data encryption, up to date security software and controls to guard against unauthorised access, unlawful processing, accidental loss, damage, or destruction.

We take great care to ensure that your data is kept secure at all times. Access to personal data is restricted to trained colleagues and volunteers who need it to perform their duties, and all colleagues receive regular data-protection and confidentiality training.

We adopt appropriate data collection, storage, and processing practices, including the use of multifactor authentication for remote access, to safeguard your personal and transactional data from unauthorised access, alteration, disclosure, or destruction on our website and systems.

We have security procedures, rules and technical measures in place to protect your data. Your data will be kept in a secure environment with access restricted to a need-to-know basis. We do not keep your data for longer than is required by law or necessary for the purpose for which it was obtained, in accordance with our data-retention schedule.

Databases

We use secure computer systems to manage the information we hold. These include patient record systems for clinical care, people management systems for colleagues and volunteers, and fundraising databases for supporters and donors. Each system is designed for its specific purpose and protected with appropriate security measures.

How long we keep your information

We keep personal information only for as long as it is needed for the purpose for which it was collected, to meet legal, regulatory, or operational requirements.
Retention periods vary depending on the type of data. For example:
• Patient records: retained in line with NHS records management code of practice (currently 8 years after last contact, or longer if required for clinical reasons).
• Colleagues, volunteers, and trustees: retained for the duration of employment or volunteering plus statutory retention (typically 6 years).
• Supporters and donors: kept while the relationship remains active, and for up to 6 years after last interaction for tax and audit purposes.
• Suppliers: kept for up to 7 years for accounting and contract purposes.
• Marketing preferences: maintained until you withdraw consent or opt out.

After the relevant period, information is securely deleted or anonymised.

If you would like more information about how long we keep specific types of records, please contact us at enquiries@hokh.co.uk or by using the contact details at the end of this notice.

International transfers

Most of the information we store and process about you stays within the UK.

In limited cases, some personal information may be transferred to or stored in countries outside the UK or the European Economic Area. This may occur if, for example, one of our trusted partners’ service providers hosts data on servers located in overseas. Some of these countries may not have similar data protection laws as the UK; however, when this occurs, we take steps to ensure your information remains protected by using appropriate safeguards (such as UK adequacy regulations, UK international data transfer agreements, or Standard Contractual Clauses), with the aim of ensuring your privacy continues to be protected as outlined in this privacy policy.

Patients and significant persons

If you are referred to one of our clinical services, we will collect personal information directly from you and may also receive information from, and where necessary share it with, other healthcare providers or services involved in your care.

To provide complete care, we may also collect limited information about your loved ones or carers, for example to involve them in your care or offer support. Information may be shared internally with other hospice teams when necessary (for example, with our Family Support Team when a patient dies to offer bereavement support, or with our Communications Team to ensure we do not continue to send mailings to the deceased). Only the information necessary for these purposes is shared.

What information we collect about Patients and Carers

We collect and use personal information to provide safe, effective and compassionate care.
For patients, this may include:

• personal details such as name, address, telephone number, email address, date of birth and NHS number;
• details of your GP and other healthcare professionals involved in your care;
• information about your health, diagnosis, treatment, medical history, medications and care plans;
• clinical photographs for medical purposes (with your prior consent), for example to assess and monitor pressure ulcers;
• information about your next of kin and other contacts you wish us to involve in your care; and
• any other information necessary to provide and coordinate your care and support.

For carers or significant persons, this may include:

• contact details such as name, address, telephone number and email address; and
• information needed so that we can communicate with you, involve you in the patient’s care (where appropriate), and offer support services such as carer or bereavement support.

We may also contact other agencies involved in your health or social care (for example, NHS trusts, GP practices, or local authority social-care teams) to obtain relevant information that helps us deliver joined-up, high-quality care.

How we use your information

We use your personal information to provide and manage our services effectively.

This includes using and sharing information within the hospice and with other healthcare professionals involved in your treatment and support.

We may use your information for a range of purposes, including:

• sharing information about your diagnosis, treatment and care across our multi-disciplinary hospice teams to ensure all professionals involved in your care are updated;
• communicating with patient representatives or loved ones, where appropriate;
• sharing relevant information with external healthcare professionals such as your GP, hospital teams or our contracted pharmacy;
• using anonymised information for medical research, training and educational purposes;
• reviewing our services and identifying ways to improve how we support patients, carers and families.

From time to time, we may also contact patients, their families and supporters with general hospice information or to ask for feedback.

As our beneficiaries, we believe it is important to communicate with our patients and their loved ones.

We may contact you about hospice news, events and ways to support our charity. We will only do this where you have given us your consent, or by post where we rely on our legitimate interests. You can change your communication preferences or opt out at any time.

The legal basis for collecting and using your information

For the provision of care and support, the main lawful basis we rely on is our public task in providing health and social care services. For health and care information (known as special category data), we rely on the condition that it is necessary for the provision and management of health and social care.

We may also need to use or share your information in other limited situations, for example:

• when we are required to do so by law, such as reporting certain infectious diseases or safeguarding concerns;
• when it is necessary to comply with a legal obligation, such as statutory reporting or audit requirements; or
• when it is clearly in the public interest, for example sharing limited information with public authorities in response to a serious incident.

We never share, sell, swap, or rent your information to third parties for marketing purposes.

Sharing information with others

Kent and Medway Care Record (KMCR)

Heart of Kent Hospice is one of the partner organisations to the Kent and Medway Care Record (KMCR). The KMCR is an electronic care record which links your health and social care information held in different provider systems, to one platform. This allows health and social care professionals who have signed up to the KMCR to access the most up to date information to ensure you receive the best possible care and support by those supporting you. In order to enable this sharing of information, organisations who use the KMCR have agreements in place that allow the sharing of personal and special category data.

For further information about the Kent and Medway Care Record and the ways in which your data is used for this system please click here.

GP Connect

We use the NHS England service GP Connect to support your direct care. GP Connect allows authorised clinicians (such as GPs, NHS 111, colleagues, hospital teams, care home nurses, and social care clinicians) to securely access relevant parts of your GP record when needed to provide you with safe and effective care. GP Connect is not used for any purpose other than direct care.

Through GP Connect, we may process and share information such as your name, NHS number, date of birth, contact details, GP details, and relevant health or social care information. This ensures that all professionals involved in your care have access to the most up-to-date information.

The legal basis we rely on for using GP Connect is public task, and for health information we rely on the health and social care purposes. This means we are allowed to share relevant information with other authorised professionals involved in your treatment so that they have the most accurate and up-to-date details.

In some situations, we may also need to process your information for other reasons. For example, if you give us your consent to share details for continuing healthcare and support, or if the law requires us to report certain matters such as infectious diseases. In rare cases, we may also share information where it is clearly in the public interest or where we are required to do so by law enforcement.

We never use GP Connect information for marketing purposes, nor do we sell, swap, or rent this information to third parties.

Job Applicants, colleagues, volunteers, and trustees

Depending on your role with us, we may collect, through Talos ATS system, and use the following information about you:

• Name
• Date of birth
• Address
• Phone number
• Emergency contact details
• National Insurance Number
• A copy of your passport or immigration document
• Your skills, knowledge, experience and qualifications where applicable
• Industry/ professional body registration details where applicable
• Contact details for referees
• Information to complete pre-employment checks including Right to Work checks
• Information to evidence full employment history
• Equality and Diversity information

During the course of employment or volunteering, we will also collect performance information including probation, training and appraisal information as well as reasons for sickness absence, this information will be stored in line with statutory retention requirements.

We may also collect information to enable re-checks of information when determined appropriate, e.g. renewal of professional licences.

What happens to the information we collect about job applicants, colleagues, volunteers and trustees

• Unsuccessful applicants: If you are unsuccessful in your job application to join the hospice, we hold your personal information for up to six months after we have finished recruiting the post you applied for. After this date, we will destroy or delete your information.

• Employees and volunteers: If you are offered employment or engagement as a volunteer, in keeping with our regulatory requirements electronic records are held within our specialist People Services systems.

• During employment or volunteering: We will maintain your record with updates such as training, performance, sickness absence, and payroll/expenses (where applicable).

• After leaving: Once you stop working/volunteering for us, we will keep this file according to our record retention guidelines.

Confidential data is protected to ensure it can only be accessed by designated colleagues and volunteers for the duration of your engagement with the hospice.

You can contact us if you would like further details about how long specific types of records are kept, or if you wish to exercise your data protection rights.

Privacy Notice Update

Apprenticeship Training and Funding

We process personal data relating to apprenticeship training to deliver, manage and fund apprenticeship programmes and to meet our legal and regulatory obligations.
This may include contact details, employment information, training and assessment records, attendance and progress data, and national learner identifiers. Where necessary, we may also process equality, health or learning support information, with appropriate safeguards in place.

We use this data to:
• Deliver and manage apprenticeship training and assessment
• Monitor progress and achievement
• Comply with apprenticeship, education and funding requirements
• Meet audit, inspection and regulatory obligations

Our lawful basis for processing apprenticeship data is legal obligation and public task, where processing is required by apprenticeship and funding rules, and legitimate interests, where processing is necessary to manage employment and training relationships.

We may share relevant data with our appointed training provider, assessment and awarding organisations, and government bodies such as the Department for Education and the Education and Skills Funding Agency. We only share the minimum data required and expect all recipients to protect it appropriately.

Apprenticeship data is normally processed within the UK or EEA. We retain data only for as long as necessary to meet training, legal and funding requirements.
Individuals have rights under data protection law, although some rights may be limited where processing is required by law.

For more information or to exercise your rights, please contact dpo@dataprivacysimplified.co.uk

The legal basis for collecting and using information from job applicants, colleagues, volunteers and trustees

We collect and use personal information for employment, volunteering and governance purposes, depending on your relationship with Heart of Kent Hospice.

• Employees: for employees, we process your personal data because it is necessary to take steps at your request before entering into a contract, and to perform our contractual obligations once you are employed (for example, to administer pay, pension and benefits); and necessary to comply with our legal obligations, such as those relating to tax, National Insurance, payroll, safeguarding and employment law.

• Volunteers and Trustees: For volunteers and trustees, we process your personal data because we have a legitimate interest in managing your role, ensuring safety and wellbeing, and maintaining effective communication about hospice activities.

We also process special category data (for example, health or equality and diversity information) where it is necessary to meet our obligations in employment, social protection or equality law.
Your information may be shared with others where necessary, for example:

• government bodies such as HMRC for tax purposes and the Department for Work and Pensions (DWP) for National Insurance purposes;
• payroll, pension and benefits providers who support the administration of remuneration and colleague benefits; and
• authorised internal managers for employment, volunteering and governance purposes.

How we protect your information

We apply the same organisational and technical security measures described in the ‘How we keep your information safe’ section. Access to colleague and volunteer data is restricted to authorised managers and HR personnel only.

Donors, fundraisers, supporters

As a charity, we rely on donations and other support to provide our specialist palliative and end-of-life care.

We may collect information from you directly. For example, when you make a donation, sign up to a fundraising activity, buy a product online or if you gift aid donations, including in our shops. Sometimes, this information is collected by an organisation working on our behalf, but we are responsible for your data at all times.

We use social media platforms, such as Facebook, Instagram, LinkedIn and X. As a result, we collect information from social media where you have given us permission to do so, or if you post on one of our social media pages. Please note that these platforms have their own privacy policies.

Sometimes we collect information shared with us by third party organisations, (Britevox, Bottomline, Sterling, Secure Collections, and third party platforms, including but not limited to; JustGiving, Enthuse, Big Give and Much Loved). These third parties will only share your information with us when you have given permission for them to do so.

We currently work with Britevox, a professional fundraising agency, to carry out door-to-door fundraising on our behalf. This helps us recruit regular givers who support our work through ongoing donations. Britevox fundraisers may collect personal information such as your name, contact details, donation preferences, and communication preferences. They act as a data processor under UK GDPR, and we remain the data controller. All Britevox fundraisers are trained in data protection and follow strict protocols to ensure your information is handled securely and respectfully. You can opt out of this processing at any time by contacting us.
From time to time we engage specialist agencies such as Prospecting for Gold to gather information about you from publicly available sources, for example, Companies House, the Electoral Register, company websites, ‘rich lists’, social networks such as LinkedIn, political and property registers and news archives.

From time to time, we may carry out limited research or “wealth screening” under our legitimate interests, to identify individuals who may wish to support our work or to provide a more personalised experience for our existing supporters.

Sometimes we carry out research using publicly available information to identify individuals who may have an affinity to our cause but with whom we are not already in touch. This may include people connected to our current major supporters, trustees or other lead volunteers.
We also use publicly available sources to carry out due diligence on donors in line with our charity’s Gift Acceptance Policy and to meet money laundering regulations.
This research helps us to understand more about you as an individual so we can focus conversations we have with you about fundraising and volunteering in the most effective way, and ensure that we provide you with an experience as a donor or potential donor which is appropriate for you.

We will only contact you about our work, events, or fundraising activities with your consent, or by post under our legitimate interests if you have not opted out. You can update your communication preferences or withdraw your consent at any time. If you would prefer us not to use your data in this way, please email us at preferences@hokh.co.uk or call us on 01622 790195.

What information we collect about supporters and donors

The information we collect depends on how you support us, but may include:

• Names
• Addresses
• Significant other
• Family/friend/business connections
• Contact details
• Dates of birth – so we can send you timely appropriate communications maybe around your birthday or other occasions and to help us to understand and communicate with you better
• Workplace
• Interests and other charitable support
• Communication preferences and information you have shared such as your experience of the hospice or why you have chosen to support our work.
• Gift aid declarations for taxpayers who can make tax effective financial donations and donations of items to our charity shops

When taking part in a challenge event, you may also be asked for health information and emergency contact information for health and safety reasons.

Use of stories, photos and testimonials

If you choose to share your story, experience with us, or allow us to take your photograph, we will always ask for your explicit consent before using this in our communications or marketing. You can withdraw your consent at any time, and we will stop using your story or image in new materials. Please note that we may not be able to remove content that has already been published (for example, printed newsletters or digital posts that have been shared), but we will not use it in any future publications once you withdraw consent.

How we use supporters and donors information

We use your information in different ways, depending on how you support us:

• Processing donations and requests: We may use your information to process your donations or product/information requests, acknowledgement your support, and claim gift aid where applicable.

Where you are kind enough to donate to us, we use third party donation platforms to process your donations, including but not limited to; Secure Collections, JustGiving, MuchLoved, Make a Will Online and Enthuse.

We do not store any information about your bank accounts, even if you make a regular donation, we will however, keep a record of your relationship with the hospice and how you would like us to communicate with you (your contact preferences).

Supporters Making Wills through Make a Will Online

When you use ‘Make a Will Online’ to make a will and choose to leave a gift to us, Make a Will Online may share your details with us (only if you have given them consent to do so). The information we receive may include your name, contact details (email and postal address), year of birth, and details of any gift you have chosen to leave, together with your communication preferences.

We use this information to thank you for your support and to manage your communication preferences. Make a Will Online remains the data controller for the will-writing service. You can view their privacy notice here https://www.makeawillonline.co.uk/data-handling-policy/.

• Research and analysis: We carry out internal research and analysis to understand the effectiveness of our campaigns and appeals, improve supporter engagement, and identify trends and patterns in giving.

This help us making Heart of Kent Hospice a stronger, more effective and efficient organisation. Understanding our supporters, their interests and what they care about also helps us provide a better experience (e.g. through tailored communications that are more relevant.)

• Anonymised information: We may aggregate and anonymise personal data so that it can no longer be linked to any particular person. We use anonymised information to help recruit new supporters, evaluate our work, and improve our services, campaigns and materials.

• Marketing communications: We may use your contact details to keep you informed about our work, fundraising activities, and the impact of donations. We will only send marketing by email, SMS, or phone where we have your consent or where the “soft opt-in” applies. You can change your preferences or opt out at any time. We rely on our legitimate interests to send you newsletters and other updates by post. You can also ask us to stop sending postal communications at any time.

What do we mean by 'marketing'?

Marketing does not just mean offering things for sale, but also includes news and information about:

• Our charity, campaigns and our services;
• Educating the public on the need for our services;
• Volunteering opportunities and how you can help us with our work;
• Our events, activities and local groups and partnerships;
• Appeals and fundraising (including donations and promotions);
• Leaving the hospice a legacy.

To make sure we only contact people who want to hear from us, we use a trusted data cleansing agency to help us keep our records accurate and up to date. This includes removing duplicate records and identifying changes such as people who have moved house or sadly passed away. We also check our database against the Fundraising Preference Service (FPS) to ensure we respect any preferences you have registered there.

We may send marketing to you by post on the basis of our legitimate interests, but you can ask us to stop at any time. For email, SMS, or telephone marketing, we will only contact you where we have your consent.

Where you have agreed to receive marketing by email, we use Mailchimp to send our newsletters and updates. This means that we share limited information about you (such as your name and your email address) with Mailchimp, which is based in the United States. We ensure that robust contractual arrangements are in place to allow the transfer of this limited information to the USA. You can update your communication preferences or opt out of marketing at any time.

We strive to be clear, honest and transparent about how and when we collect and use your personal data. We make it easy for you to tell us how you want us to communicate with you and include information on how to select your communication preferences when we send you marketing and communication material.

The legal basis for collecting and using information from donors and supporters

When you sign up to our fundraising activities or events, we may ask you for relevant information to ensure it is safe for you to participate. We process this information where it is necessary for health and safety purposes.

We rely on legitimate interest to contact you about the impact of your donations, and to ask you to consider making or increasing your donations, supporting different fundraising activities, or if you are eligible for Gift Aid.

For email, SMS or phone marketing, we only do this where you have given consent. You can change your preferences or opt out at any time.
For communications by post, we rely on our legitimate interests, but you can also ask us to stop at any time.

We may also have a legal obligation to share your donation information with HMRC in order, for example, to process Gift Aid.

How we protect information from donors, supporters

We keep your information on a secure database because this enables us to manage your data safely and effectively.

When a supporter passes away, or if you let us know that you no longer want to receive any information from us, we will make your record inactive. This means we retain only the minimal information needed to make sure we do not contact you again by mistake. We do this because permanently deleting all records could result in your details being re-added unintentionally.

You have the right to request that we erase your information in line with data protection law. In some cases, we may need to keep limited details (for example, to comply with HMRC rules on Gift Aid or to maintain a suppression record of your marketing preference). Where this applies, we will explain it clearly to you.

Lottery Players

Heart of Kent Hospice operates a weekly lottery to help raise vital funds for our services.

The lottery is managed in partnership with Sterling, our External Lottery Manager, and CRS-EPOS, who manage our retail till systems. Working with these trusted partners allows us to run a secure and reliable weekly draw that complies with the Gambling Commission’s requirements.

What information we collect from lottery players

When you play the lottery, we collect personal information such as your:

• forename and surname
• address and postcode
• date of birth
• telephone number and email address
• bank account details (for Direct Debit payments only)

This information is collected via online and/or offline lottery entry forms.

Sterling manages the lottery on our behalf, including the weekly draw, lottery microsite, and payment processing. They store and use player contact and payment details solely for the purpose of administering the lottery.

CRS-EPOS sell single lottery tickets through our retail shops; no personal details are captured at the point of sale.
We may also use trusted mailing and fulfilment agencies to send lottery-specific communications. These agencies act under our instructions and do not retain your data for any other purpose.

Heart of Kent Hospice has access to player contact information so that we can communicate with you about your support, but we do not store or access your payment details

How we use your information when you play the lottery

We use your information to:
• administer your lottery entry and payments;
• confirm your details and eligibility;
• process winnings and maintain records required by law; and
contact you with service updates or administrative information.

When you play the lottery, we may contact you for administrative purposes, such as confirming your details, or processing a payment. We do this because it is necessary to perform a contract with you, or to meet our legal obligations.

We process this information because it is necessary for the performance of a contract with you, and to meet our legal obligations under gambling and financial regulations.

With your consent, we may also contact you with marketing communications (for example, to share the impact of your support, invite you to events, or tell you about other ways to get involved). You can choose how we contact you and opt out of marketing at any time.

Responsible Gambling

You may wish to limit gambling-related adverts from your social media feeds; guidance is available at BeGambleAware. For more detailed information, please view our full Lottery Privacy Policy.

Stories and Testimonials

Sometimes, we may ask patients or loved ones if they are willing to share their personal story or experience of the Hospice. These stories help us to raise awareness of our services and demonstrate the difference we make to people’s lives.

If you agree, we may record your story using an audio device to ensure we capture it accurately and sensitively. We will always ask for your consent before recording.

• How we use your story: Recordings are only used to prepare a written version of your story. Audio files are stored securely and deleted once transcribed (normally within a few days). Your written story will only be shared publicly (e.g. website, social media, printed materials) with your explicit written consent.

• What information is collected: Your story may include personal information about you and your family and may also contain sensitive health information. We will only use this type of information with your explicit consent.

• Withdrawing consent: You can withdraw your consent at any time, and we will stop using your story in any new materials. Please note we may not be able to remove items already published, for example, in printed newsletters or shared online by others.

Suppliers

We collect and store contact and payment information about our suppliers in a secure accounting system to enables us to place orders, manage contracts, and process payments efficiently.

We process supplier information where it is necessary to perform a contract and to comply with our legal obligations for financial record-keeping. Payment information may be shared securely with our banking provider, Sterling Bank, to facilitate online transactions.

Access to supplier information is restricted to authorised members of the Hospice finance team.

Paper records relating to orders are kept for seven years in line with financial regulations and then securely destroyed. Electronic records are retained for one year after completion of the contract and then securely deleted.

Digital communications

When you visit our website or interact with our social media pages, certain information may be collected automatically through cookies, tags, pixels, or similar technologies (known collectively as tracking technologies). This may include details such as your IP address, browser type, and information about how you use our website. We use this information to help us understand how people engage with our content and to improve the experience we provide.

Cookies and Analytics

Our website uses cookies to make it work properly and to help us understand how it is used. Cookies are small text files placed on your device that collect information about your browsing activity.

• Strictly necessary cookies are used to enable basic website functions (such as security and accessibility). These are essential and cannot be switched off.

• Analytics and performance cookies help us measure how visitors use our website and identify areas for improvement.

• Advertising and social media cookies may be used to personalise content and provide relevant marketing on other platforms.

You can control which cookies are used by setting your preferences in our cookie banner or through your browser settings. If you choose to block or delete cookies, some parts of the website may not function properly.

We rely on legitimate interests to use cookies that are strictly necessary for our website to operate. For analytics and advertising cookies, we rely on your consent under UK GDPR and PECR, which you can withdraw at any time by changing your cookie settings.

Meta & Google Remarketing & Lookalike Audiences

This section explains how we use Meta (Facebook) and Google services to support our fundraising, awareness, and outreach efforts.

What Is Remarketing?

Remarketing allows us to show relevant ads to individuals who have previously visited our website. These ads may appear on platforms such as Facebook, Instagram, Google Search, YouTube, and across the Google Display Network. This helps us reconnect with supporters and share updates about our services, events, and campaigns.

What Are Lookalike Audiences?

Lookalike audiences are groups of people who share similar characteristics with our existing supporters. This helps Heart of Kent Hospice reach new individuals who may be interested in supporting our care, attending events, or learning more about our services.

To create these audiences, we may securely upload a database of supporter details — such as names and email addresses — to Meta (Facebook). This data is used solely for advertising purposes and is never shared or sold.

Meta uses a process called hashing to encrypt this data before it is matched with user profiles. Hashing converts personal information into anonymised strings of code, ensuring that your data remains protected and unreadable during the matching process. Once matched, Meta helps us build audiences of people with similar traits, interests, or behaviours — without revealing any personal information to us or to other advertisers.

You can read more about how Meta handles customer data securely in their Privacy Centre https://www.facebook.com/privacy/policy/?locale=en_GB

How We Use Meta & Google Services

• Meta (Facebook) Remarketing & Lookalike Audiences: We use the Facebook Pixel to understand how visitors interact with hokh.org. This data enables us to deliver tailored ads and build lookalike audiences on Facebook and Instagram based on shared interests, location, and engagement patterns.

• Google Remarketing & Similar Audiences: We use Google Ads and Google Analytics to collect data about your visit. Google may use this data to create “similar audiences” — individuals who resemble our website visitors — and show them relevant ads across Google’s platforms.

What Data Is Collected?

This information may be collected:
• Pages visited and actions taken (e.g., donations, event registrations)
• Device and browser information
• IP address and general location
• Time spent on site and referral source

This data is collected via cookies, pixels, and similar technologies. We do not share personally identifiable information (PII) with Meta or Google unless you have explicitly provided it and consented to its use.

Managing Your Preferences

You can opt out of personalised advertising and audience targeting:
• Google: Visit Google Ads Settings or use the Network Advertising Initiative opt-out.
• Meta: Adjust your ad preferences in your Facebook settings.

You can also manage cookies through your browser settings or use tools like Your Online Choices for broader control.

Telephone Systems

We use a managed cloud-based telephone system to handle incoming and outgoing calls across all departments of the hospice. This system stores colleague details (such as names, email addresses and department) to enable internal communications. It also generates call logs (such as date, time, duration, and phone number) for operational and security purposes.

If you leave us a voicemail, please do not include any health or other sensitive information. Voicemails are retained for no longer than 30 days, unless required for operational follow-up.

We process this information to enable effective communication across the hospice:

• For our colleagues, this is necessary for the performance of their employment contracts.

• For members of the public, supporters, patients, families, and suppliers, we rely on our legitimate interests in managing and responding to routine enquiries and communications efficiently.

We do not record telephone calls. If this changes in the future, we will update this privacy notice and carry out a Data Protection Impact Assessment (DPIA) before implementing any recording.

How to change your preferences

We aim to ensure that all information we hold about you is accurate and kept up to date. If you notice that any of your details are incorrect, please let us know and we will update them without undue delay, and no later than one month after receiving your request (or within three months in complex cases). Please note that you may still receive communications that were already scheduled before your update is processed.

You can also tell us if you would like to change how we contact you, what you hear about, or if you prefer not to receive any further communications from us. You can:

• update your contact preferences (for example, mail, email, or phone);
• choose which types of information or appeals you would like to receive; or
• opt out of all future communications if you wish.
  You can change your preferences or unsubscribe at any time by:
• clicking the “unsubscribe” link in our marketing emails;
• calling our Fundraising Team on 01622 790195;
• emailing preferences@hokh.co.uk; or
• writing to Data Protection Officer, Heart of Kent Hospice, 31 Rooksmead, Bedford, MK41 7QX.

We will update your records promptly to reflect your choices.

How to access your information

You have the right to request access to the personal information that Heart of Kent Hospice holds about you. This is known as a Subject Access Request under data protection law.

If you would like to make a request, please write to:
Director of Patient Services (Caldicott Guardian)
Heart of Kent Hospice, Preston Hall, Aylesford, ME20 7PU

Alternatively, you may email enquiries@hokh.co.uk or call us 01622 792200.

We may ask you to provide proof of identity before releasing any information, to ensure we protect your privacy. We will respond to your request within one calendar month of receipt. In some circumstances, this may be extended by up to two further months if the request is complex; if so, we will let you know within the first month.

Requests for access to patient records will be reviewed on a case-by-case basis by the Caldicott Guardian in line with NHS and data-protection requirements.

How to make a complaint

If you are unhappy with how your data has been used, we encourage you to contact us in the first instance so we can try to resolve your concern quickly.

You can:
• Complete our online feedback form (Feedback - Heart of Kent Hospice)

• Contact the manager of the department your experience relates to; or

• Email enquiries@hokh.co.uk or call 01622 792200 if you need help reaching the right person.

If you are still dissatisfied, you can follow the hospice’s formal complaints procedure which can be found here.

You can also contact our Data Protection Officer (DPO), Data Privacy Simplified Ltd., by emailing dpo@dataprivacysimplified.co.uk with any queries or complaints you may have in relation to this privacy statement or your privacy rights as an individual.

If you are not satisfied with our response, you have the right to raise your concern with the UK’s data protection regulator:
Information Commissioner’s Office (ICO)
Website: Data protection and personal information complaints tool | ICO
ICO’s Phone: 0303 123 1113
ICO’s Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF