Association of NHS Charities Privacy Notice

Introduction

The purpose of this privacy notice is to explain how NHS Charities Together uses data about living people in order to further its mission and purpose in respect of fundraising and supporter engagement. Separate privacy notices are provided for the organisation’s own staff and for those who work for its member organisations.

In this notice NHS Charities Together is referred to as “we”, or “our” and individuals whose data is processed are referred to as “you” or “your”.

Who is NHS Charities Together?

NHS Charities Together is an organisation which represents, supports and champions NHS Charities in all four nations of the United Kingdom. Our legal name is The Association of NHS Charities. We are a charitable company limited by guarantee with registration number 12325259. We are registered with the Charity Commission for England & Wales registration number 1186569 and SC050716 (Scotland).  Our notification number with the Information Commissioner is ZA437958.

In 2020 we became one of the primary national focusses for receiving gifts from the public and from companies and charitable trusts to support the work of the NHS Charities through the Covid-19 pandemic.

Details of how to contact us appear at the end of this privacy notice.

What are NHS Charities?

There are more than 230 NHS charities across the UK. They focus on helping our hospitals, mental health trusts, community health trusts and ambulance trusts do more. Collectively these charities give £1 million every day to the NHS so that people can stay well for longer and get better faster. They also play a key role in mobilising volunteers to support NHS staff. These vital funds and services are above and beyond what the NHS alone can provide, touching lives and making a huge difference to millions of people when they are at their most vulnerable.

Why do we process your personal information?

We process your data in order to fulfil our purpose in supporting NHS charities and, where required, in order to fulfil legal or other obligations such as regulatory, audit, gift aid and anti-money laundering requirements.

Whose personal information do we process?

If you give to us, directly or via a partner, or if you are associated with an organisation which gives to us, or if we think that you or your organisation might give to us then we will process your data in accordance with this notice.

We will process personal information about you in the following circumstances:

• If you make an enquiry to us via our website or by email, phone, post or some other method.
• If you set up a Fundraising Page on one of our partner websites e.g. Virgin Money Giving, JustGiving.
• If you make a gift directly to us (e.g. into our bank account, or via PayPal).
• If you make a gift via one of our partner sites or organisations e.g. Virgin Money Giving, JustGiving, OpenCreates (who operate our facility to give by text message), CAF America (for giving by United States taxpayers) etc. Most partners tell us your identity and all give us information about your gift. We collect this data to satisfy anti-money laundering, audit and governance requirements, to understand the behaviour of those who support us and to contact you unless such contact requires consent. Details of what data is passed to us by each partner is subject to the decisions you make on the partner website and to their own privacy notice because you provide your data first to them when you make a gift.
• If you are asked by a partner website whether you agree to receive further fundraising contact from us by any specific method which, in law, requires consent (e.g. email, text message etc.) and you do agree to such contact, then we will record your consent as well as your contact and giving information.
• If you volunteer directly for us.
• If we think that you may be interested in supporting us, even if we have not yet been in touch with each other. Our work in this group is likely to extend only to those people who can make especially large gifts.
• If you work for an organisation which is supporting us and we need to be in contact with you to achieve our purposes. Such organisations might include companies and other commercial organisations, charitable trusts and other funders, government agencies etc.
• If you are a beneficiary of a grant or some other kind of support from one of our member organisations and if you have agreed with the member organisation that we may have your information.

Information on children and those under 18

We don’t actively collect data on children. However we know that some are kind enough to fundraise for us. If we capture children’s data through our giving platforms, we’ll ensure parental consent is in place for anyone under 13 years old. We do not actively market to under 18s. If we want to store a photograph of someone under 18 we will seek their consent if they are 13 or over and that of their parent or guardian if they are younger.

From where do we get your personal information?

In some circumstances we receive personal information directly from you, while in other cases we receive it from you via a third party, or from other information that is publicly available.

Directly from you

We obtain information from you if you make an enquiry on our website or by some other means, if you give directly to us, or if you contact us directly in some other way.

From third parties

We receive information from our partners (e.g. Virgin Money Giving, JustGiving, OpenCreates, CAF America).

From other publicly available information

We sometimes add extra data to the information you have already given us. We do this for purposes which are described in the section “What we do with your data”. Such data may be obtained or derived from public records (e.g. Companies’ House) or from organisations such as the Royal Mail which maintains the National Change of Address database, or from information such as that published in newspapers.

Where we use such data we are careful to check the integrity of the data source and the accuracy of information provided.

What we do with your data. And how do we make sure it is lawful?

Data Protection Laws require us to identify which legally defined “ground for processing” we will use for anything we do with your personal information. We have grouped the things we do with your information into sections for each “ground for processing”. We have done this because you have different rights depending on which of these “grounds” is being used.

Consent

Explanation: Where we use “consent” to process your information, we can only do this with your permission, and you have the right to withdraw your permission, without detriment to you, at any time. Please bear in mind that if you like receiving news about us by one of the methods listed below, and you withdraw your consent, we will no longer be able to send it to you.

If, and only if, you have consented, we may use your personal information to:

• send you messages and material which promote our charity by email, SMS, direct social media messages
• telephone you to ask for your support on private telephone numbers registered on the telephone preference service
• send you promotional messages by similar means on behalf of our member charities
• share your data with our member charities
• publish personal information about the nature of your support for us.

If you are asked by a partner website or other giving platform whether you agree to receive further fundraising contact from us by any specific method which, in law, requires consent (e.g. email, text message etc.) and you do agree to such contact, then we will receive that information from our partner and record your consent to be contacted by that method. In these circumstances our partner will always pass your contact and giving information to us.

Legal Obligation

Explanation: Sometimes we are legally required to process your data because of our nation’s laws or some other regulatory obligation. In most cases we have no choice about this, and although you can object, we may not be able to stop using any or all of your information for any of these purposes.

The following circumstances create a legal obligation for us to process your data:

• If you allow us to claim Gift Aid then we have to keep records and pass them to Her Majesty’s Revenue and Customs
• For auditing and accounting purposes
• In respect of some gifts, there is a requirement to carry out anti-money laundering activity
• To comply with the charity regulators’ requirements to safeguard the reputation of the charity
• To comply with the legal requirement to record details of complaints about fundraising.

Contract

Explanation: If you and we enter into some kind of binding agreement, for example to sell you a ticket for an event, then the ground for processing will be “Contract”. You do have the right not to give us your data, but we will probably not be able to complete the transaction with you if you do not let us use your data.

The following circumstances will result in using your information for the purposes of administrating a contract:

• Providing you with a ticket for an event, training course, and processing your registration for that ticket or event.
• Using your data to communicate with you in respect of grants or gifts we have made or received where that grant or gift is subject to a contract between us and you or an organisation with which you are connected.

Legitimate Interests

Explanation: Some aspects of our work cannot be done without using your personal data, but do not fall into the group of activities where consent is required by law, nor will they be subject to a contract or a legal obligation. In most of these cases we use the “Legitimate Interests” ground for processing. This means that we must balance the benefit we get from using your data to pursue our own lawful interests against any negative impact on your rights and freedoms which might happen as a result. (If we think that there is too much negative impact then we would ask for your consent instead.) You have a right to ask us to stop using your data if we are using “Legitimate Interests” as our ground for processing.

We will use the Legitimate Interests ground for processing in circumstances such as the following:

• Putting your personal data on our database or any other form of organised filing system which we use.
• Sending you messages about the impact of your giving and / or fundraising, and inviting you to support us now or in a legacy in your will or to renew your support (unless the law requires your consent first – these circumstances are described under “consent” above).
• Sending messages to you on behalf of member charities (unless the law requires your consent first – these circumstances are described under “consent” above).
• To carry out general administrative matters, both internally and to communicate with you. Examples include if a direct debit were to cease due to a change of bank account, or to ask you to consider completing a Gift Aid form.
• To respond to general enquiries that you might make of us, for example via our website, or by phoning, emailing, writing to us etc.
• To understand the way in which you read, or do not read, any e-newsletters we may send, or the way in which you navigate around our website.
• To update your address and other contact information where you have initially provided it and if we find that it is out of date. We only obtain data from sources (like the Royal Mail National Change of Address database) where you have consented for that organisation to pass it on to others or where there is some other lawful basis for our obtaining the data.
• Using information about your giving, together with that of others, to develop our fundraising and supporter engagement strategies. This could involve the construction of “donor segments” stratified, for example, by the amount of your giving or fundraising for us, or its frequency, or other factors which help us to fundraise efficiently. We may use software to help us analyse this information and to generate our segmentation. This activity is likely to fit the legal description of “profiling” and you have a right to tell us not to do this.
• To add data from third party sources (as described in “From where do we get your personal information?” above) to help us to organise our fundraising as efficiently as we can. This may include the use of indicators of wealth, disposable income, history of giving to other organisations, social media comments you yourself have made public (e.g. a public Twitter feed) and other similar data which help us use our limited fundraising resources well. The effect of this is to ensure that as far as possible we ask wealthier people for larger gifts and less wealthy people for smaller ones, and spend more resources on those who are most likely to give, and minimise resources spent on those who are unlikely to give. This may involve comparing your name and contact details with a list of names and contact details on other databases. The owners of those databases will not gain access to your data for their own purposes. This activity is likely to fit the legal description of “profiling” and you have a right to tell us not to do this.

What data do we use?

It is unlikely that we would use all the data detailed in this section about every person on our database. The more comprehensive and complex your relationship with us, the more likely we are to use a wider set of data. We are likely to hold the following information if you have supported us and / or been in touch with us:

• Your name and contact details, including some combination of email, mailing address, and telephone number(s)
• Details of the country from which you made the gift (we need this for anonymous Charity Commission reporting requirements)
• Details of when you gave to us, how much you gave and what prompted the gift and any particular fundraising campaign (e.g. Clap for our Carers, Captain Tom Moore’s walk)
• Whether or not you have Gift Aided your donation(s)
• Whether or not you have consented to hear further from us by methods which require consent
• The method by which your data came initially to us (e.g. JustGiving, directly, via an SMS donation etc.)
• Your responses to correspondence and communications between us
• Details of any enquiries you have made of us
• Details of any volunteering you have carried out for us
• Details of any fundraising pages or campaigns you have established to support us.

Additionally, we may hold some (or, very rarely, all) of the information detailed below. The extent of this will depend on the nature of your connection or possible connection with us. This data could include:

• Details of your correspondence and communications we have sent to you and between us
• Details of any enquiries you have made of us
• Which local hospital charities you may be connected with
• Messages which you have entered into a website or smartphone app to be passed to fundraisers on fundraising pages or local NHS Charities
• Details of the extent to which you may have opened emails or other messages we have sent to you
• Organisations or other people with whom you are connected, as an employee, trustee or some other formal or voluntary connection
• Details of any our events to which you may have been invited or attended
• Details of any intention to leave a legacy of which you may have notified us
• Our donor segmentation data – for example dividing donors into those who have given recently or less recently, or once or on multiple occasions
• Our understanding of the extent to which you may be able or likely to make a larger than average gift (our average gift at 5^th May 2020 was around £70 per donor). This may include an estimate of how much we think you might be able to give.
• Other information which is freely available in the public domain about you, e.g. public social media account names and content, details of directorships from Companies’ House, publicly available information about other charities you may have supported
• Details of any complaint you may have made to us about our fundraising.

There are specific laws concerning data on racial or ethnic origin, political opinions, religious and philosophical beliefs, trades union membership, genetic or biometric data and data concerning health or sexuality. This is called Special Category Data and in most circumstances we would need your consent to use it. Exceptions include a situation where a person has made such information public themselves.

We only process special category data where is has been made public or in respect of health information (e.g. if you have had Covid-19), with your consent.

Who we share your data with

When considering how we share your data with another organisation, we ask ourselves whether or not we would lose control of your data by doing so. Losing control would mean that the new organisation could decide what to do with your data. We only share your data in this way if we have your consent, or if we are legally obliged to do so.

In practice this means we pass your data to others in the following limited circumstances:

• If you have given us permission to share your data with local NHS Charities
• To HMRC in order to claim Gift Aid
• To statutory bodies, for example the Charity Commission, the Information Commissioner or the Police, if they had obtained the relevant powers to require us to pass your data to them.

We may also pass your data, but not control of your data, to organisations which help us to manage our own work. These are known as Data Processors and are bound by a contract with us. They are not allowed to do anything with your data that we have not authorised, and they may not use your data for their own purposes, nor can they keep it. Examples of data processors include a mailing house which prints letters for us and our database supplier which hosts our donor database in a secure encrypted “cloud” environment.

How long do we keep your data?

NHS Charities Together is currently developing its data retention policy. The huge influx of donations in response to the Covid-19 pandemic has changed dramatically the number, origin and intention of the population of those who support us. Unlike most charities, therefore, we do not have any history to rely on in respect of how long people usually continue to be supporters, the proportion of people who remember us in their wills and so on.

We do know that many charity supporters regard their support as a long-term expression of things that they hold to be important. There is plenty of evidence in the charity sector of people who support charities over a whole lifetime. Giving in wills tells us that many people decide to support a charity with a legacy many years before their death.

With this in mind, and because the vast majority of people who support us have done so because of our work with NHS Charities in respect of Covid-19, we have set a tentative retention period of a minimum of five years beyond that time at which normal social and economic life returns following the Covid-19 pandemic. We will review this retention policy at that time at the latest, and possibly earlier as circumstances develop.

Your rights

The law covering privacy, which are the European General Data Protection Regulation until the end of the Brexit Transition period, and the Data Protection Act 2018 give you certain rights which you can exercise by contacting us. These are:

• You can ask for a copy of all the data we hold about you.
• You can tell us to stop activity related to direct marketing.
• You can tell us to correct information we have about you.
• You can ask us to stop using your information. This is not an absolute right, and in certain circumstances we may have an obligation (e.g. for audit purposes) to keep at least some of your data.
• You can tell us not to include you in any profiling activity.
• You can withdraw your consent at any time for any activity which relies on consent to be lawful.
• You can ask us to stop using your data if our use falls in the Legitimate Interests category.
• You can complain to us about the use of your data, or you can complain to the Information Commissioner’s Office.

Contact details

You can contact us at

NHS Charities Together Suite 68, Lake View House Wilton Drive Warwick CV34 6RG

E: hello@anhsc.org.uk T: 0300 303 5748  

You can complain to the Information Commissioner via information at https://ico.org.uk or by telephoning 0303 123 1113.