Privacy Notice

How we collect information about you

We collect personal information in different ways, depending on how you interact with us:

Information you provide to us directly

You may give us your information in order to sign up for one of our events, make a donation, shop in our stores, register as a volunteer, provide feedback, join in one of our Hubs or otherwise communicate with us.

• Website and online activity: We gather non-identifiable general information when you use our website, such as pages visited and areas that are of most interest to users through a Google Analytics cookie. We use this information to improve our website and make it a better experience for everyone. For more information on the cookies we use, and how you can change your cookie preferences at any time, please visit https://www.hokh.org/cookies/
• Phone and voicemail: If you leave us a voicemail, we may store and review it to respond to your enquiry, provide support, and improve our services. We only keep voicemails for as long as needed for these purposes unless the law requires us to keep them longer. Our phone and voicemail services are managed by trusted third-party providers. They are contractually required to keep your information safe and handle it in line with data protection laws.

Information you provide to us indirectly

• Visitors and premises: If you stay at or visit our premises, including the hospice, our Inpatient Unit, our grounds and car parks, or one of our charity shops, we may record your image on CCTV. Our CCTV and video surveillance section below explains what we record, why, how long we keep it and what your rights are.

Information we receive from third parties

Your information may also be shared with us by third parties, for example:

• if a friend or family member signs you up for one of our events;
• professional fundraising agencies;
• independent event organisers, for example the London Marathon or fundraising sites like Enthuse, JustGiving or Facebook donations;
• if you sign up as a volunteer for us through an external volunteering website;
• if you are a healthcare professional and your information is shared with us by the organisation you work for.

We also may receive data about you from subcontractors acting on our behalf who provide us with technical, payment or delivery services, and from business partners, advertising networks and search or analytics providers used on our website.

You should check any privacy notice provided to you where you give your data to a third party.

Information from other sources

• Social media: Communication, engagement and actions taken through external social media platforms that we participate on are subject to the terms and conditions as well as the privacy policies held with each social media platform respectively. Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp or X, you might give us permission to access information from those services, for example when you publicly tag us in an event photo. We rely on our legitimate interests to view or interact with content you have made public or shared with us. You are advised to use social media platforms wisely and communicate and engage upon them with due care and caution in regard to your own privacy and personal details.
• Information available publicly: We supplement information on our supporters with information from publicly available sources such as charity websites and annual reviews, corporate websites, public social media accounts, the electoral register and Companies House in order to create a fuller understanding of someone’s interests and support of Heart of Kent Hospice. We rely on our legitimate interest in fundraising and supporter engagement for this type of research.

What personal information we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We collect, store and use the following kinds of personal information:

• your name;
• your contact details (including postal address, telephone number, email address and/or social media identity);
• your date of birth;
• your gender;
• your bank or credit card details where you provide these to make a payment (we collect this information for its one-time use, we do not store this information);
• if you volunteer for us or apply for a job with us, information necessary for us to process these applications and assess your suitability (which may include things like employment status, previous experience depending on the context, as well as any unspent criminal convictions or pending court cases you may have);
• information about your activities on our websites or social media platforms when you interact with us, and about the device you use to access these, for instance your IP address and geographical location;
• images and, where relevant, vehicle registration marks recorded on CCTV at our premises;
• information about events, activities and products which we consider to be of interest to you;
• information relating to your health (for example if you are taking part in or attending an event for health and safety purposes, as well as where you share your experiences with us);
• where you have left us a gift in your will, any information regarding next of kin with which you may have provided us to administer this;
• information as to whether you are a taxpayer to enable us to claim Gift Aid;
• age, nationality and ethnicity information for monitoring purposes; and
• any other personal information you provide to us.

Certain types of personal information are in a special category under data protection laws, as they are considered to be more sensitive. Examples of this type of sensitive data (known as “special category data”) would be information about health, race, religious beliefs, political views, trade union membership, sex life or sexuality or genetic and biometric information.

We only collect this type of information about our supporters to the extent that there is a clear reason for us to do so, for example asking for health information as a patient under our care. If you are under our care, we will record personal information (for example name, contact details, diagnosis, symptoms and clinical history; medication, allergies and treatment plans; notes from doctors, nurses and therapists involved in your care) either directly from you when you are referred or enquire about our services, or from referring organisations.

Other possibilities for asking for health information might include if you are taking part in a sporting event, or where we ask for information for the purpose of providing appropriate facilities or support. We will also collect this type of information if you make it public or volunteer it to us.

Wherever it is practical for us to do so, we will make clear why we are collecting this type of information and what it will be used for.

How we use this information

The ways that we use your personal data will largely be defined by why you are providing it.

We use your personal information to give you the information, support, services or products you ask for. We also use your personal information to thank you for your previous support or invite you to an event, for example if you have made a donation or have previously taken part in one of our events. We will ensure that we know how you prefer us to contact you, where you have provided this information.

Examples of where we may use your personal information include:

• providing and personalising our care and support services;
• recording and managing relevant health and care information to deliver safe, effective and coordinated care;
• dealing with your enquiries, requests, complaints and investigations;
• processing your donations;
• providing you with information about our work, activities, educational programmes, events and services;
• complying with our legal obligations, policies and procedures including protection of our colleagues in the workplace;
• fulfilling management, governance and statutory responsibilities and obligations;
• fundraising;
• recruitment, training analysis, quality improvement and management responsibilities;
• identifying any issues in our processes with a view to improving them;
• fulfilling orders for goods or services;
• keeping people and our premises safe and secure, and preventing, detecting and investigating crime and other incidents; and
• helping us respect your communication choices and preferences. For example, if you ask not to receive marketing material, we will keep a record of this.

Sometimes, when we are communicating with large numbers of people, from any area of the hospice, we may work with external organisations. This is the quickest and most cost-effective way of communicating with high volumes of people. On these occasions your details will be shared with the appointed agency for the purposes of contacting you. These agencies act only on our instructions. We have signed agreements from each agency we use that they delete the information we share with them as soon as the activity is complete.

Automated decision-making

We do not make decisions about you using automated processing alone that produce legal effects or similarly significantly affect you. Where we use software that generates content automatically, a member of our team reviews it before it is used. Our CCTV does not use facial recognition, number plate recognition or other automated analysis.

Legal basis for processing

Public task, health and social care

We use personal information, including health and care information, because it is necessary for us to provide and manage our health and social care services. This includes delivering safe and effective care to patients, coordinating with healthcare professionals and social care partners, and managing health and social care systems and services.

We may share relevant personal information between hospice teams and committees, and with healthcare partners such as GPs, hospitals, community nurses or social care professionals involved in your care. This helps us ensure that your care is joined up, safe and well coordinated.

We also maintain records about the healthcare professionals and partner organisations we work with, so that we can manage referrals, coordinate care, and audit the quality and safety of our services.

We handle all health and care information with strict confidentiality and only share it with people directly involved in your care or where required by law.

Consent

We will ask for your consent where we wish to use your information for a purpose that is optional and not part of providing our core care or support services (for example, to send you marketing material via post, phone, text or email, or to use your story, image or testimonial in our communications). Where we rely on consent, you have the right to withdraw consent at any time. This will not affect the care or services we provide to you.

Legal obligation

We use your personal information where we need to do so to comply with a legal or regulatory obligation. This includes obligations under charity, healthcare, employment, tax, safeguarding and health and safety law.

For example, we may need to share your information with regulators, such as the Charity Commission, Fundraising Regulator, Information Commissioner or Gambling Commission. We may also need to use or share information to comply with legal duties relating to patient safety, safeguarding, or serious incident reporting.

Performance of a contract, or steps before entering a contract

We use your personal information where it is necessary to perform a contract with you, or to take steps at your request before entering into one. For example, to administer your employment and pay, to fulfil an order for goods or services, to manage your lottery membership and payments, or to manage our relationship with our suppliers.

Vital interests

In limited situations, we may use your personal information where it is necessary for us to protect someone’s life or health. For example, in a medical emergency affecting individuals at one of our events, or in a safeguarding situation where we need to contact or share information with the emergency services or relevant authorities. This lawful basis is used only in rare and urgent circumstances, when no other lawful basis is appropriate.

Legitimate interests

We use your personal information where it is necessary for our legitimate interests (or those of others), provided that these interests are fair, balanced and do not override your rights and freedoms.

This basis mainly applies to our fundraising, marketing, security and general business administration activities. For example:

• analysing and profiling our supporters or potential supporters to better understand engagement;
• updating contact details using reputable third-party sources when people move house;
• monitoring the use of our website for technical or security purposes;
• maintaining internal records of our supporters, donors, suppliers and volunteers;
• operating CCTV to keep people safe, protect our premises and charitable assets, and prevent, detect and investigate crime and other incidents; and
• where you have signed up with us for a charity place in a third-party event (for example, a sponsored run not organised by the hospice), sharing relevant contact details with the event organiser to administer the event.

We do not rely on legitimate interests to process health or care information about our patients or service users.

Before relying on legitimate interests, we carry out a balancing test to make sure our interests do not override your rights or interests.

How we keep your information safe

Heart of Kent Hospice is committed to protecting your privacy and confidentiality. We comply with UK GDPR, DPA 2018 and NHS information governance and security standards. We have robust technical and organisational systems and measures in place to keep personal information secure. These measures include data encryption, up to date security software and controls to guard against unauthorised access, unlawful processing, accidental loss, damage or destruction.

We take great care to ensure that your data is kept secure at all times. Access to personal data is restricted to trained colleagues and volunteers who need it to perform their duties, and all colleagues receive regular data protection and confidentiality training.

We adopt appropriate data collection, storage and processing practices, including the use of multi-factor authentication for remote access, to safeguard your personal and transactional data from unauthorised access, alteration, disclosure or destruction on our website and systems.

We have security procedures, rules and technical measures in place to protect your data. Your data will be kept in a secure environment with access restricted to a need-to-know basis. We do not keep your data for longer than is required by law or necessary for the purpose for which it was obtained, in accordance with our data retention schedule.

Databases

We use secure computer systems to manage the information we hold. These include patient record systems for clinical care, people management systems for colleagues and volunteers, and fundraising databases for supporters and donors. Each system is designed for its specific purpose and protected with appropriate security measures.

How long we keep your information

We keep personal information only for as long as it is needed for the purpose for which it was collected, to meet legal, regulatory or operational requirements.

Retention periods vary depending on the type of data. For example:

• Patient records: retained in line with the NHS records management code of practice (currently 8 years after last contact, or longer if required for clinical reasons).
• Colleagues, volunteers and trustees: retained for the duration of employment or volunteering plus statutory retention (typically 6 years).
• Supporters and donors: kept while the relationship remains active, and for up to 6 years after last interaction for tax and audit purposes.
• Suppliers: kept for up to 7 years for accounting and contract purposes.
• CCTV footage: kept for 30 days and then automatically overwritten. Footage exported for an investigation, insurance matter or legal case is kept only for as long as that purpose requires, reviewed at least every six months, and securely deleted.
• Marketing preferences: maintained until you withdraw consent or opt out.

After the relevant period, information is securely deleted or anonymised.

If you would like more information about how long we keep specific types of records, please contact us at enquiries@hokh.co.uk or by using the contact details at the end of this notice.

International transfers

Most of the information we store and process about you stays within the UK.

In limited cases, some personal information may be transferred to or stored in countries outside the UK or the European Economic Area. This may occur if, for example, one of our trusted partners or service providers hosts data on servers located overseas. Some of these countries may not have similar data protection laws to the UK; however, when this occurs, we take steps to ensure your information remains protected by using appropriate safeguards (such as UK adequacy regulations, UK international data transfer agreements, or Standard Contractual Clauses), with the aim of ensuring your privacy continues to be protected as outlined in this privacy notice.

CCTV footage is held on equipment at the site where it is recorded. It is not stored in the cloud and is not transferred outside the UK.

CCTV and video surveillance

We use CCTV at Preston Hall and at most of our charity shops. Heart of Kent Hospice is the operator of these systems.

Where our cameras are

At Preston Hall, cameras cover entrances, the grounds, car parks and the external access route to the mortuary. Cameras near the mortuary do not record inside it, or the care of anyone who has died.

In our shops, cameras cover the shop floor and our donation and stock areas. Not all of our shops have CCTV.

We do not place cameras in clinical areas, personal care areas, bedrooms, bathrooms, toilets, changing areas, rest rooms, prayer rooms, quiet rooms, counselling rooms or bereavement rooms.

Signs are displayed at or before the entrance to every area we monitor. They identify us as the operator, explain why we are recording and tell you how to find out more.

What we record

We record images of people, vehicles and registration marks in our car parks, and the date, time and location. We do not record sound.

We do not use facial recognition, number plate recognition or any other automated analysis of footage, and we could not introduce them without Board approval, a new data protection impact assessment and advice from our Data Protection Officer.

Our cameras may incidentally capture information from which sensitive details could be inferred, such as apparent disability, religious dress or visible ill health. We do not use CCTV to identify, classify or draw conclusions about people on that basis. If we ever needed to use footage in a way that revealed something of that kind, we would identify and record an additional lawful condition before doing so.

Why we use CCTV, and our lawful basis

We use CCTV to support the safety and security of people and our premises, to protect charitable assets, and to prevent, detect and investigate crime and other security incidents. We may also use footage, where it is necessary and proportionate, to support authorised investigations, insurance matters, legal proceedings and disclosures to law enforcement.

Our lawful basis is our legitimate interests. Where a court order or legal power requires us to disclose footage, we rely on our legal obligation. Where footage is needed to protect someone’s life, we rely on vital interests.

We do not use CCTV for routine monitoring of our colleagues’ or volunteers’ performance, productivity or timekeeping.

Who can see footage, and how long we keep it

Nobody watches our cameras continuously and there is no control room. Recorded footage is looked at only in response to a reported incident or another approved request.

Recordings are kept for 30 days and are then automatically overwritten. This period gives enough time for an incident to be identified, reported and investigated, including where it is not immediately apparent.

Only a small number of named, authorised colleagues may view footage. Every viewing must be approved in advance, must be limited to the minimum footage needed, and is recorded in a log. Viewing takes place on hospice equipment in a private area. Our colleagues are not permitted to view, download or share CCTV footage on personal phones or through unapproved apps.

If we export footage, only a named system administrator may do so, on approval, to encrypted hospice storage. We include only the minimum necessary and blur or crop other people where we can.

Sharing footage

We do not publish CCTV footage or share it more widely than necessary.

A request from the police does not automatically mean that we will hand footage over. We assess each request individually, check the identity and authority of the person asking, decide whether disclosure is necessary and proportionate, record our reasons and the lawful basis, and share only the minimum footage needed. We assess requests from landlords, shopping centres, insurers and members of the public in the same way.

Our maintenance contractor may see footage when configuring, maintaining or repairing a system. They act under a written contract that requires them to protect it, their access is requested for each visit, supervised and logged, and they do not hold permanent accounts.

Your rights in relation to CCTV

You can ask for a copy of footage of yourself. Please ask as soon as you can, because recordings are overwritten after 30 days. Where we can identify the footage you have asked for, we will preserve it while we deal with your request.

Where footage shows other people, we will consider whether we can edit it so that we can share it with you without affecting their privacy. Some of our older equipment cannot produce footage in a format that can be edited, and where that is the case we will explain the position and look at other ways of giving you access.

You can also object to being recorded, and ask us to restrict or erase footage. We will always tell you our decision and our reasons.

To make a request, or to raise a concern about our use of CCTV, please contact us using the details in the “How to make a complaint” section below. We will acknowledge a CCTV complaint within 30 days.

Patients and significant persons

If you are referred to one of our clinical services, we will collect personal information directly from you and may also receive information from, and where necessary share it with, other healthcare providers or services involved in your care.

To provide complete care, we may also collect limited information about your loved ones or carers, for example to involve them in your care or offer support. Information may be shared internally with other hospice teams when necessary (for example, with our Family Support Team when a patient dies to offer bereavement support, or with our Communications Team to ensure we do not continue to send mailings to the deceased). Only the information necessary for these purposes is shared.

What information we collect about patients and carers

We collect and use personal information to provide safe, effective and compassionate care.

For patients, this may include:

• personal details such as name, address, telephone number, email address, date of birth and NHS number;
• details of your GP and other healthcare professionals involved in your care;
• information about your health, diagnosis, treatment, medical history, medications and care plans;
• clinical photographs for medical purposes (with your prior consent), for example to assess and monitor pressure ulcers;
• information about your next of kin and other contacts you wish us to involve in your care; and
• any other information necessary to provide and coordinate your care and support.

For carers or significant persons, this may include:

• contact details such as name, address, telephone number and email address; and
• information needed so that we can communicate with you, involve you in the patient’s care (where appropriate), and offer support services such as carer or bereavement support.

We may also contact other agencies involved in your health or social care (for example, NHS trusts, GP practices, or local authority social care teams) to obtain relevant information that helps us deliver joined-up, high-quality care.

How we use your information

We use your personal information to provide and manage our services effectively. This includes using and sharing information within the hospice and with other healthcare professionals involved in your treatment and support.

We may use your information for a range of purposes, including:

• sharing information about your diagnosis, treatment and care across our multi-disciplinary hospice teams to ensure all professionals involved in your care are updated;
• communicating with patient representatives or loved ones, where appropriate;
• sharing relevant information with external healthcare professionals such as your GP, hospital teams or our contracted pharmacy;
• using anonymised information for medical research, training and educational purposes; and
• reviewing our services and identifying ways to improve how we support patients, carers and families.

From time to time, we may also contact patients, their families and supporters with general hospice information or to ask for feedback. As our beneficiaries, we believe it is important to communicate with our patients and their loved ones.

We may contact you about hospice news, events and ways to support our charity. We will only do this where you have given us your consent, or by post where we rely on our legitimate interests. You can change your communication preferences or opt out at any time.

The legal basis for collecting and using your information

For the provision of care and support, the main lawful basis we rely on is our public task in providing health and social care services. For health and care information (known as special category data), we rely on the condition that it is necessary for the provision and management of health and social care.

We may also need to use or share your information in other limited situations, for example:

• when we are required to do so by law, such as reporting certain infectious diseases or safeguarding concerns;
• when it is necessary to comply with a legal obligation, such as statutory reporting or audit requirements; or
• when it is clearly in the public interest, for example sharing limited information with public authorities in response to a serious incident.

We never share, sell, swap or rent your information to third parties for marketing purposes.

Sharing information with others

Kent and Medway Care Record (KMCR)

Heart of Kent Hospice is one of the partner organisations to the Kent and Medway Care Record (KMCR). The KMCR is an electronic care record which links your health and social care information held in different provider systems to one platform. This allows health and social care professionals who have signed up to the KMCR to access the most up to date information to ensure you receive the best possible care and support. In order to enable this sharing of information, organisations who use the KMCR have agreements in place that allow the sharing of personal and special category data.

Further information about the Kent and Medway Care Record and the ways in which your data is used for this system is available on the KMCR website.

GP Connect

We use the NHS England service GP Connect to support your direct care. GP Connect allows authorised clinicians (such as GPs, NHS 111, colleagues, hospital teams, care home nurses and social care clinicians) to securely access relevant parts of your GP record when needed to provide you with safe and effective care. GP Connect is not used for any purpose other than direct care.

Through GP Connect, we may process and share information such as your name, NHS number, date of birth, contact details, GP details, and relevant health or social care information. This ensures that all professionals involved in your care have access to the most up-to-date information.

The legal basis we rely on for using GP Connect is public task, and for health information we rely on health and social care purposes. This means we are allowed to share relevant information with other authorised professionals involved in your treatment so that they have the most accurate and up-to-date details.

In some situations, we may also need to process your information for other reasons. For example, if you give us your consent to share details for continuing healthcare and support, or if the law requires us to report certain matters such as infectious diseases. In rare cases, we may also share information where it is clearly in the public interest or where we are required to do so by law enforcement.

We never use GP Connect information for marketing purposes, nor do we sell, swap or rent this information to third parties.

Job Applicants, colleagues, volunteers, and trustees

Depending on your role with us, we may collect, through our Talos applicant tracking system, and use the following information about you:

• name;
• date of birth;
• address;
• phone number;
• emergency contact details;
• National Insurance number;
• a copy of your passport or immigration document;
• your skills, knowledge, experience and qualifications where applicable;
• industry or professional body registration details where applicable;
• contact details for referees;
• information to complete pre-employment checks including right to work checks;
• information to evidence full employment history; and
• equality and diversity information.

During the course of employment or volunteering, we will also collect performance information including probation, training and appraisal information, as well as reasons for sickness absence. This information will be stored in line with statutory retention requirements. We may also collect information to enable re-checks of information when determined appropriate, for example renewal of professional licences.

If you hold an account on any of the business systems we use, that system will hold your account details and a record of your use of it. We explain this in more detail, including the suppliers involved, in the privacy notice we provide to colleagues and volunteers.

What happens to the information we collect

• Unsuccessful applicants: if you are unsuccessful in your job application to join the hospice, we hold your personal information for up to six months after we have finished recruiting the post you applied for. After this date, we will destroy or delete your information.
• Employees and volunteers: if you are offered employment or engagement as a volunteer, in keeping with our regulatory requirements electronic records are held within our specialist People Services systems.
• During employment or volunteering: we will maintain your record with updates such as training, performance, sickness absence, and payroll and expenses (where applicable).
• After leaving: once you stop working or volunteering for us, we will keep this file according to our record retention guidelines.

Confidential data is protected to ensure it can only be accessed by designated colleagues and volunteers for the duration of your engagement with the hospice.

You can contact us if you would like further details about how long specific types of records are kept, or if you wish to exercise your data protection rights.

Apprenticeship training and funding

We process personal data relating to apprenticeship training to deliver, manage and fund apprenticeship programmes and to meet our legal and regulatory obligations.

This may include contact details, employment information, training and assessment records, attendance and progress data, and national learner identifiers. Where necessary, we may also process equality, health or learning support information, with appropriate safeguards in place.

We use this data to deliver and manage apprenticeship training and assessment, monitor progress and achievement, comply with apprenticeship, education and funding requirements, and meet audit, inspection and regulatory obligations.

Our lawful basis for processing apprenticeship data is legal obligation and public task, where processing is required by apprenticeship and funding rules, and legitimate interests, where processing is necessary to manage employment and training relationships.

We may share relevant data with our appointed training provider, assessment and awarding organisations, and government bodies such as the Department for Education and the Education and Skills Funding Agency. We only share the minimum data required and expect all recipients to protect it appropriately.

Apprenticeship data is normally processed within the UK or EEA. We retain data only for as long as necessary to meet training, legal and funding requirements. Individuals have rights under data protection law, although some rights may be limited where processing is required by law.

The legal basis for collecting and using this information

• Employees: we process your personal data because it is necessary to take steps at your request before entering into a contract, and to perform our contractual obligations once you are employed (for example, to administer pay, pension and benefits); and because it is necessary to comply with our legal obligations, such as those relating to tax, National Insurance, payroll, safeguarding and employment law.
• Volunteers and trustees: we process your personal data because we have a legitimate interest in managing your role, ensuring safety and wellbeing, and maintaining effective communication about hospice activities.

We also process special category data (for example, health or equality and diversity information) where it is necessary to meet our obligations in employment, social protection or equality law.

Your information may be shared with others where necessary, for example government bodies such as HMRC for tax purposes and the Department for Work and Pensions for National Insurance purposes; payroll, pension and benefits providers who support the administration of remuneration and colleague benefits; and authorised internal managers for employment, volunteering and governance purposes.

How we protect your information

We apply the same organisational and technical security measures described in the “How we keep your information safe” section. Access to colleague and volunteer data is restricted to authorised managers and People Services personnel only.

Donors, fundraisers, supporters

As a charity, we rely on donations and other support to provide our specialist palliative and end-of-life care.

We may collect information from you directly. For example, when you make a donation, sign up to a fundraising activity, buy a product online or if you Gift Aid donations, including in our shops. Sometimes, this information is collected by an organisation working on our behalf, but we are responsible for your data at all times.

We use social media platforms, such as Facebook, Instagram, LinkedIn and X. As a result, we collect information from social media where you have given us permission to do so, or if you post on one of our social media pages. Please note that these platforms have their own privacy policies.

Sometimes we collect information shared with us by third party organisations (Britevox, Bottomline, Sterling, Secure Collections, and third party platforms, including but not limited to JustGiving, Enthuse, Big Give and Much Loved). These third parties will only share your information with us when you have given permission for them to do so.

We currently work with Britevox, a professional fundraising agency, to carry out door-to-door fundraising on our behalf. This helps us recruit regular givers who support our work through ongoing donations. Britevox fundraisers may collect personal information such as your name, contact details, donation preferences and communication preferences. They act as a data processor under UK GDPR, and we remain the data controller. All Britevox fundraisers are trained in data protection and follow strict protocols to ensure your information is handled securely and respectfully. You can opt out of this processing at any time by contacting us.

From time to time we engage specialist agencies such as Prospecting for Gold to gather information about you from publicly available sources, for example Companies House, the electoral register, company websites, “rich lists”, social networks such as LinkedIn, political and property registers and news archives.

From time to time, we may carry out limited research or “wealth screening” under our legitimate interests, to identify individuals who may wish to support our work or to provide a more personalised experience for our existing supporters.

Sometimes we carry out research using publicly available information to identify individuals who may have an affinity to our cause but with whom we are not already in touch. This may include people connected to our current major supporters, trustees or other lead volunteers.

We also use publicly available sources to carry out due diligence on donors in line with our charity’s Gift Acceptance Policy and to meet money laundering regulations.

This research helps us to understand more about you as an individual so we can focus conversations we have with you about fundraising and volunteering in the most effective way, and ensure that we provide you with an experience as a donor or potential donor which is appropriate for you.

We will only contact you about our work, events or fundraising activities with your consent, or by post under our legitimate interests if you have not opted out. You can update your communication preferences or withdraw your consent at any time. If you would prefer us not to use your data in this way, please email us at preferences@hokh.co.uk or call us on 01622 790195.

What information we collect about supporters and donors

The information we collect depends on how you support us, but may include:

• names;
• addresses;
• significant other;
• family, friend or business connections;
• contact details;
• dates of birth, so we can send you timely appropriate communications, perhaps around your birthday or other occasions, and to help us to understand and communicate with you better;
• workplace;
• interests and other charitable support;
• communication preferences and information you have shared, such as your experience of the hospice or why you have chosen to support our work; and
• Gift Aid declarations for taxpayers who can make tax effective financial donations and donations of items to our charity shops.

When taking part in a challenge event, you may also be asked for health information and emergency contact information for health and safety reasons.

Use of stories, photos and testimonials

If you choose to share your story or experience with us, or allow us to take your photograph, we will always ask for your explicit consent before using this in our communications or marketing. You can withdraw your consent at any time, and we will stop using your story or image in new materials. Please note that we may not be able to remove content that has already been published (for example, printed newsletters or digital posts that have been shared), but we will not use it in any future publications once you withdraw consent.

How we use supporters’ and donors’ information

• Processing donations and requests: we may use your information to process your donations or product and information requests, acknowledge your support, and claim Gift Aid where applicable. Where you are kind enough to donate to us, we use third party donation platforms to process your donations, including but not limited to Secure Collections, JustGiving, MuchLoved, Make a Will Online and Enthuse. We do not store any information about your bank accounts, even if you make a regular donation. We will, however, keep a record of your relationship with the hospice and how you would like us to communicate with you.
• Research and analysis: we carry out internal research and analysis to understand the effectiveness of our campaigns and appeals, improve supporter engagement, and identify trends and patterns in giving. This helps us make Heart of Kent Hospice a stronger, more effective and efficient organisation. Understanding our supporters, their interests and what they care about also helps us provide a better experience, for example through tailored communications that are more relevant.
• Anonymised information: we may aggregate and anonymise personal data so that it can no longer be linked to any particular person. We use anonymised information to help recruit new supporters, evaluate our work, and improve our services, campaigns and materials.
• Marketing communications: we may use your contact details to keep you informed about our work, fundraising activities and the impact of donations. We will only send marketing by email, SMS or phone where we have your consent or where the “soft opt-in” applies. You can change your preferences or opt out at any time. We rely on our legitimate interests to send you newsletters and other updates by post. You can also ask us to stop sending postal communications at any time.

Supporters making wills through Make a Will Online

When you use Make a Will Online to make a will and choose to leave a gift to us, Make a Will Online may share your details with us, only if you have given them consent to do so. The information we receive may include your name, contact details (email and postal address), year of birth, and details of any gift you have chosen to leave, together with your communication preferences.

We use this information to thank you for your support and to manage your communication preferences. Make a Will Online remains the data controller for the will-writing service. You can view their privacy notice at https://www.makeawillonline.co.uk/data-handling-policy/

What do we mean by “marketing”?

Marketing does not just mean offering things for sale, but also includes news and information about:

• our charity, campaigns and our services;
• educating the public on the need for our services;
• volunteering opportunities and how you can help us with our work;
• our events, activities and local groups and partnerships;
• appeals and fundraising (including donations and promotions); and
• leaving the hospice a legacy.

To make sure we only contact people who want to hear from us, we use a trusted data cleansing agency to help us keep our records accurate and up to date. This includes removing duplicate records and identifying changes such as people who have moved house or sadly passed away. We also check our database against the Fundraising Preference Service to ensure we respect any preferences you have registered there.

We may send marketing to you by post on the basis of our legitimate interests, but you can ask us to stop at any time. For email, SMS or telephone marketing, we will only contact you where we have your consent.

Where you have agreed to receive marketing by email, we use Mailchimp to send our newsletters and updates. This means that we share limited information about you (such as your name and your email address) with Mailchimp, which is based in the United States. We ensure that robust contractual arrangements are in place to allow the transfer of this limited information to the USA. You can update your communication preferences or opt out of marketing at any time.

We strive to be clear, honest and transparent about how and when we collect and use your personal data. We make it easy for you to tell us how you want us to communicate with you and include information on how to select your communication preferences when we send you marketing and communication material.

The legal basis for collecting and using information from donors and supporters

When you sign up to our fundraising activities or events, we may ask you for relevant information to ensure it is safe for you to participate. We process this information where it is necessary for health and safety purposes.

We rely on legitimate interests to contact you about the impact of your donations, and to ask you to consider making or increasing your donations, supporting different fundraising activities, or if you are eligible for Gift Aid.

For email, SMS or phone marketing, we only do this where you have given consent. You can change your preferences or opt out at any time. For communications by post, we rely on our legitimate interests, but you can also ask us to stop at any time.

We may also have a legal obligation to share your donation information with HMRC, for example to process Gift Aid.

How we protect information from donors and supporters

We keep your information on a secure database because this enables us to manage your data safely and effectively.

When a supporter passes away, or if you let us know that you no longer want to receive any information from us, we will make your record inactive. This means we retain only the minimal information needed to make sure we do not contact you again by mistake. We do this because permanently deleting all records could result in your details being re-added unintentionally.

You have the right to request that we erase your information in line with data protection law. In some cases, we may need to keep limited details (for example, to comply with HMRC rules on Gift Aid or to maintain a suppression record of your marketing preference). Where this applies, we will explain it clearly to you.

Our shops and selling donated items online

Our charity shops raise money that pays for our care. When you donate goods, shop with us, or Gift Aid your donated items, we handle your information as described elsewhere in this notice.

Selling donated items online

We sell some donated items online, including on eBay.

To create a listing, we photograph the item and use software that drafts the listing from the photograph, including the title, description, category and a suggested price. This software uses artificial intelligence. We are currently trialling software from two providers so that we can decide which, if either, to adopt. A member of our team checks and edits every draft before it is published, and each listing tells you that the description was produced with AI assistance.

We photograph the item only, not people. Our colleagues are asked to check items and images before uploading them, and to remove anything that identifies a person.

Occasionally a donated item may carry information about someone, for example a name or address inside a book, on a garment label or on paperwork left in a pocket or bag. If you believe one of our listings shows information about you, please contact us using the details at the end of this notice and we will remove the listing and the image.

When you buy from us through eBay, eBay is responsible for your buyer, payment and delivery information under its own privacy notice. Our listing software is limited to creating listings and managing stock, and does not have access to buyer, order or payment information.

We completed a data protection impact assessment for each provider before using it. We will review those assessments at least once a year, and again before we decide which provider to continue with.

Gift Aid on donated goods

If you Gift Aid the items you donate to our shops, we will collect your name, address and confirmation that you are a UK taxpayer, so that we can claim Gift Aid on the sale and tell you what your items raised. We rely on your consent for the Gift Aid declaration itself and on our legal obligation to keep the records HMRC requires.

Lottery players

Heart of Kent Hospice operates a weekly lottery to help raise vital funds for our services.

The lottery is managed in partnership with Sterling, our External Lottery Manager, and CRS-EPOS, who manage our retail till systems. Working with these trusted partners allows us to run a secure and reliable weekly draw that complies with the Gambling Commission’s requirements.

What information we collect from lottery players

When you play the lottery, we collect personal information such as your:

• forename and surname;
• address and postcode;
• date of birth;
• telephone number and email address; and
• bank account details (for Direct Debit payments only).

This information is collected via online and offline lottery entry forms.

Sterling manages the lottery on our behalf, including the weekly draw, lottery microsite and payment processing. They store and use player contact and payment details solely for the purpose of administering the lottery.

CRS-EPOS sell single lottery tickets through our retail shops; no personal details are captured at the point of sale.

We may also use trusted mailing and fulfilment agencies to send lottery-specific communications. These agencies act under our instructions and do not retain your data for any other purpose.

Heart of Kent Hospice has access to player contact information so that we can communicate with you about your support, but we do not store or access your payment details.

How we use your information when you play the lottery

We use your information to administer your lottery entry and payments, confirm your details and eligibility, process winnings and maintain records required by law, and contact you with service updates or administrative information.

We process this information because it is necessary for the performance of a contract with you, and to meet our legal obligations under gambling and financial regulations.

With your consent, we may also contact you with marketing communications, for example to share the impact of your support, invite you to events, or tell you about other ways to get involved. You can choose how we contact you and opt out of marketing at any time.

Responsible gambling

You may wish to limit gambling-related adverts from your social media feeds; guidance is available at BeGambleAware. For more detailed information, please view our full Lottery Privacy Policy.

Stories and Testimonials

Sometimes we may ask patients or loved ones if they are willing to share their personal story or experience of the hospice. These stories help us to raise awareness of our services and demonstrate the difference we make to people’s lives.

If you agree, we may record your story using an audio device to ensure we capture it accurately and sensitively. We will always ask for your consent before recording.

• How we use your story: recordings are only used to prepare a written version of your story. Audio files are stored securely and deleted once transcribed, normally within a few days. Your written story will only be shared publicly (for example on our website, social media or in printed materials) with your explicit written consent.
• What information is collected: your story may include personal information about you and your family and may also contain sensitive health information. We will only use this type of information with your explicit consent.
• Withdrawing consent: you can withdraw your consent at any time, and we will stop using your story in any new materials. Please note we may not be able to remove items already published, for example in printed newsletters or shared online by others.

Suppliers

We collect and store contact and payment information about our suppliers in a secure accounting system. This enables us to place orders, manage contracts and process payments efficiently.

We process supplier information where it is necessary to perform a contract and to comply with our legal obligations for financial record-keeping. Payment information may be shared securely with our banking provider to facilitate online transactions.

Access to supplier information is restricted to authorised members of the hospice finance team.

Paper records relating to orders are kept for seven years in line with financial regulations and then securely destroyed. Electronic records are retained for one year after completion of the contract and then securely deleted.

Digital communications

When you visit our website or interact with our social media pages, certain information may be collected automatically through cookies, tags, pixels or similar technologies (known collectively as tracking technologies). This may include details such as your IP address, browser type, and information about how you use our website. We use this information to help us understand how people engage with our content and to improve the experience we provide.

Cookies and analytics

Our website uses cookies to make it work properly and to help us understand how it is used. Cookies are small text files placed on your device that collect information about your browsing activity.

• Strictly necessary cookies are used to enable basic website functions, such as security and accessibility. These are essential and cannot be switched off.
• Analytics and performance cookies help us measure how visitors use our website and identify areas for improvement.
• Advertising and social media cookies may be used to personalise content and provide relevant marketing on other platforms.

You can control which cookies are used by setting your preferences in our cookie banner or through your browser settings. If you choose to block or delete cookies, some parts of the website may not function properly.

We rely on legitimate interests to use cookies that are strictly necessary for our website to operate. For analytics and advertising cookies, we rely on your consent under UK GDPR and PECR, which you can withdraw at any time by changing your cookie settings.

Meta and Google remarketing and lookalike audiences

This section explains how we use Meta (Facebook) and Google services to support our fundraising, awareness and outreach efforts.

What is remarketing? Remarketing allows us to show relevant ads to individuals who have previously visited our website. These ads may appear on platforms such as Facebook, Instagram, Google Search, YouTube, and across the Google Display Network. This helps us reconnect with supporters and share updates about our services, events and campaigns.

What are lookalike audiences? Lookalike audiences are groups of people who share similar characteristics with our existing supporters. This helps us reach new individuals who may be interested in supporting our care, attending events, or learning more about our services.

To create these audiences, we may securely upload a database of supporter details, such as names and email addresses, to Meta. This data is used solely for advertising purposes and is never shared or sold.

Meta uses a process called hashing to encrypt this data before it is matched with user profiles. Hashing converts personal information into anonymised strings of code, so that your data remains protected and unreadable during the matching process. Once matched, Meta helps us build audiences of people with similar traits, interests or behaviours, without revealing any personal information to us or to other advertisers. You can read more about how Meta handles customer data in its Privacy Centre at https://www.facebook.com/privacy/policy/?locale=en_GB

How we use Meta and Google services

• Meta remarketing and lookalike audiences: we use the Facebook Pixel to understand how visitors interact with hokh.org. This data enables us to deliver tailored ads and build lookalike audiences on Facebook and Instagram based on shared interests, location and engagement patterns.
• Google remarketing and similar audiences: we use Google Ads and Google Analytics to collect data about your visit. Google may use this data to create “similar audiences”, individuals who resemble our website visitors, and show them relevant ads across Google’s platforms.

What data is collected? This may include pages visited and actions taken (for example donations or event registrations); device and browser information; IP address and general location; and time spent on site and referral source. This data is collected via cookies, pixels and similar technologies. We do not share personally identifiable information with Meta or Google unless you have explicitly provided it and consented to its use.

Managing your preferences. You can opt out of personalised advertising and audience targeting. For Google, visit Google Ads Settings or use the Network Advertising Initiative opt-out. For Meta, adjust your ad preferences in your Facebook settings. You can also manage cookies through your browser settings or use tools like Your Online Choices for broader control.

Telephone Systems

We use a managed cloud-based telephone system to handle incoming and outgoing calls across all departments of the hospice. This system stores colleague details (such as names, email addresses and department) to enable internal communications. It also generates call logs (such as date, time, duration and phone number) for operational and security purposes.

If you leave us a voicemail, please do not include any health or other sensitive information. Voicemails are retained for no longer than 30 days, unless required for operational follow-up.

We process this information to enable effective communication across the hospice. For our colleagues, this is necessary for the performance of their employment contracts. For members of the public, supporters, patients, families and suppliers, we rely on our legitimate interests in managing and responding to routine enquiries and communications efficiently.

We do not record telephone calls. If this changes in the future, we will update this privacy notice and carry out a data protection impact assessment before implementing any recording.

Your rights

We aim to ensure that all information we hold about you is accurate and kept up to date. If you notice that any of your details are incorrect, please let us know and we will uUnder data protection law you have the following rights. Some of them apply only in certain circumstances, and we will always explain our decision and our reasons.

• The right to be informed about how we use your personal information, which is what this notice is for.
• The right of access to the personal information we hold about you.
• The right to rectification if the information we hold is inaccurate or incomplete.
• The right to erasure of your information in certain circumstances.
• The right to restrict processing of your information in certain circumstances.
• The right to data portability, to receive information you gave us in a portable format.
• The right to object to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time.
• Rights relating to automated decision-making and profiling. We do not make decisions about you by automated means alone that have a legal or similarly significant effect.
• The right to withdraw consent at any time, where we rely on your consent.

To exercise any of these rights, please contact us using the details below. We will not charge you, and we will respond within one calendar month.

How to change your preferences

We aim to ensure that all information we hold about you is accurate and kept up to date. If you notice that any of your details are incorrect, please let us know and we will updWe aim to ensure that all information we hold about you is accurate and kept up to date. If you notice that any of your details are incorrect, please let us know and we will update them without undue delay, and no later than one month after receiving your request (or within three months in complex cases). Please note that you may still receive communications that were already scheduled before your update is processed.

You can also tell us if you would like to change how we contact you, what you hear about, or if you prefer not to receive any further communications from us. You can:

• update your contact preferences (for example, mail, email or phone);
• choose which types of information or appeals you would like to receive; or
• opt out of all future communications if you wish.

You can change your preferences or unsubscribe at any time by:

• clicking the “unsubscribe” link in our marketing emails;
• calling our Fundraising Team on 01622 790195;
• emailing preferences@hokh.co.uk; or
• writing to Data Protection Officer, 31 Rooksmead, Bedford, MK41 7QX.

We will update your records promptly to reflect your choices.

How to access your information

You have the right to request access to the personal information that Heart of Kent Hospice holds about you. This is known as a subject access request.

If you would like to make a request, please write to:

Director of Patient Services (Caldicott Guardian) Heart of Kent Hospice, Preston Hall, Aylesford, ME20 7PU

Alternatively, you may email enquiries@hokh.co.uk or call us on 01622 792200.

We may ask you to provide proof of identity before releasing any information, to ensure we protect your privacy. We will respond to your request within one calendar month of receipt. In some circumstances, this may be extended by up to two further months if the request is complex; if so, we will let you know within the first month.

Requests for access to patient records will be reviewed on a case-by-case basis by the Caldicott Guardian in line with NHS and data protection requirements. If you are asking for CCTV footage, please tell us the date, time and location, and ask as soon as you can, because recordings are overwritten after 30 days.

How to make a complaint

If you are unhappy with how your data has been used, we encourage you to contact us in the first instance so we can try to resolve your concern quickly.

You can:

• complete our online feedback form;
• contact the manager of the department your experience relates to; or
• email enquiries@hokh.co.uk or call 01622 792200 if you need help reaching the right person.

If you are still dissatisfied, you can follow the hospice’s formal complaints procedure, which is available on our website.

You can also contact our Data Protection Officer, Data Privacy Simplified Ltd, by emailing dpo@dataprivacysimplified.co.uk with any queries or complaints you may have in relation to this privacy notice or your privacy rights as an individual.

If you are not satisfied with our response, you have the right to raise your concern with the UK’s data protection regulator:
Website: Data protection and personal information complaints tool | ICO
ICO’s Phone: 0303 123 1113
ICO’s Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF