Privacy Policy

Bolton Hospice is a charity funded hospice based in the North West of England and provides Palliative Care services for patients across Bolton, including inpatient, outpatient and community services. In order for us to provide our services, it is necessary for us to process both personal and confidential information about you. Processing can mean any of the following:

Collecting
Accessing
Recording
Holding
Viewing
Analysing
Storing
Adapting
Altering
Deleting
Disclosing

Within the context of this policy ‘we’, ‘us’ and ‘our’ refers to Bolton Hospice and our subsidiaries:

• Bolton Hospice registered charity number 518704

• Bolton Hospice Support Ltd registered company number 03228227

• Bolton Hospice Lottery Ltd registered company number 04143584

Bolton Hospice uses both paper and electronic systems to process the information of our patients, staff, volunteers, donors, supporters and visitors. As an organisation, we comply with the Data Protection Act 2018 and General Data Protection Regulations to ensure that your information is kept secure, that its integrity is maintained and that it is available when we/you need it. In line with the legislation, it is Bolton Hospice’s policy to:

Process your personal information fairly and in accordance with applicable laws;
Tell you about how we will use your personal information;
Only collect personal information from you when we need it for legitimate purposes, or legal reasons;
Ensure that your personal information is adequate, relevant and not excessive for the purpose for which we collect it;
Not keep your personal information for longer than we need to;
Keep your personal information secure, and limit the people who can access it;
Ensure that you know how to access your personal information and exercise your rights in relation to it, including being able to keep it accurate and up-to-date; and
Ensure that any third parties we share your personal information with take appropriate steps to protect it.

In order to protect the information that we collect, we have developed an Information Governance Management Framework around the 10 National Data Guardian standards. We perform an annual assessment to ensure that our systems meet the same high standard as the NHS (through the Data Security Protection Toolkit). This means that we have:

Policies and procedures for processing personal and confidential information
Specified staff responsibilities relating to data security and protection. Data protection and confidentiality clauses are also included in staff, volunteer and third party contracts
Annual training for all staff relating to data security and protection
Restricted access to physical and electronic sources of personal information
Regular audits against our policies and procedures to ensure compliance
Internal reporting systems to record and react to incidents. Serious incident will be reported to the Information Commissioner’s Office
Continuity planning to ensure that we can retrieve/maintain service levels in the case of an incident or event
Robust IT protection systems to identify and respond to cyber threats
Standard contracts to ensure that our suppliers are able to offer the same level of data security and protection as we do

This is our Privacy Notice, which informs you how and why we process your personal information. We will also provide examples of the information, uses and organisations who we work with but please note: the lists are not exhaustive so may change from time to time. Click the relevant links below to find out more, alternatively, you can contact our Data Protection Officer using the following e-mail address: dpo@boltonhospice.org

BOLTON HOSPICE RESPONSE TO THE COVID-19 PANDEMIC

What information do we collect?

As part of our response to the COVID-19 pandemic, we may collect personal data through, staff and volunteer risk assessments, patient, client, staff and volunteer testing programs and the vaccination program. Details of the information we process include, but are not limited to:

Your name and contact details e.g. address, phone number and e-mail address
Your date of birth and ethnicity
Details of your health status, risk factors and COVID-19 test results
Evidence of your vaccination or exemption status

Why do we process your information?

Your information is used to:

To assess risk to you and others relating to COVID-19
To support you in the workplace (if you are a member of staff or volunteer)
To protect our staff and patients (if you visit one of our hospice sites)
To help support infection prevention and control
To demonstrate the COVID-19 vaccination status of our staff and volunteers, in line with the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014
To support the national effort to manage the COVID-19 pandemic

We may also use your information for other purposes:

To manage and audit our services
To provide important statistical information to commissioners and partners.
For research and planning purposes – to support the wider NHS in managing the pandemic.

Please note: Bolton Hospice will not use your sensitive/personal identifiable information unless it is absolutely essential. This means that when we are processing your information for non-direct care purposes, we will endeavour to either anonymise it which means that all personal identifiable information is removed with no possibility of tracing the information back to you in the future; or pseudonomise it which means that all personal identifiable data is replaced, and highly restricted access is applied to the pseudonimisation code.

We may share your information with other organisations when we are required to do so by law, for example:

If we are sent a request from the Police under the Crime and Disorder Act 1998
If we receive a formal order from a court acting in their judiciary capacity
If there is a public health need such as preventing the spread of infectious diseases
If there is a safeguarding need (adults or children at risk)

How do we process your information lawfully?

In the Data Protection Act 2018 and the UK General Data Protection Regulation, processing of your personal information must be done fairly, lawfully and transparently. Bolton Hospice will only process information relating to you as long as there is a lawful basis in line with the legislation and it is necessary for us to do so. The following legal bases are commonly relied upon for the delivery of direct care:

Public Interest – to process and share personal information in response to the pandemic. This is underpinned by the Health Service (Control of Patient Information) Regulations 2002, which allows patient information to be shared in the event of a pandemic.
To process data in the field of Public Health/Occupational Health – to process your sensitive personal information (e.g. medical information, race, religion) in response to pandemic
Legal Obligation – to keep records of staff and volunteer vaccination or exemption status, in line with the Health and Social Care Act 2008 (Regulated Activities) Regulation 14, and to manage our records in line with data protection legislation and the NHSX - Records Management Code of Practice.

Which other organisations do we work with?

In order for Bolton Hospice to operate, we need to engage with other organisations for the provision of some services. All third party contracts are assessed to ensure compliance with the UK General Data Protection Regulation. Examples of contracted services includes:

Occupational Health service – we will share staff and volunteer risk assessments, test results and vaccine details with Bolton NHS Foundation Trust Occupational Health service to ensure our staff and volunteers are supported appropriately.
Track and Trace – we will share data with the local government for Track and Trace purposes.
Continuous Improvement – we work with other healthcare providers e.g. the NHS to help with identifying areas for improvement and future investment.

PATIENTS & CLIENTS

What information do we collect?

We collect your information from you, your family members, close friends and carers who attend our services, for example you may be listed as Next of Kin or an Emergency Contact. We keep records about you and our contact with you both on paper and electronically. Details of the information we process include, but are not limited to:

Your name and contact details e.g. address, phone number and e-mail address
Your date of birth and ethnicity
Your medical records including assessments, diagnosis, treatment, services attended, status and care planning
Your holistic care needs including spiritual, social and psychological needs, assessments and services attended
Information about your next of kin, close family, friends and carers
National Insurance number and bank details (Macmillan Cancer Information and Support Service only, and only in cases where we are claiming a benefit on your behalf).

Why do we process your information?

Your information is used for direct care purposes:

To invite you to and to assess suitability of our services for you and your support network
To provide you and the people that care for you with our care and support services
To ensure that we records of the care provided to you; this helps your direct care team stay up to date with the care that has been provided to you

We may also use your information for purposes that are not related to your direct care:

To investigate queries, complaints or legal claims
To manage and audit our services
To provide important statistical information to commissioners and partners for funding and management purposes
For research and planning purposes. Your personal information will not be used for this purpose if you have signed up to the National Data Opt Out. For more information, relating to the National Data Opt Out, click the following link:

https://digital.nhs.uk/services/national-data-opt-out

Please note: Bolton Hospice will not use your sensitive/personal identifiable information except when it is absolutely essential. This means that when we are processing your information for non-direct care purposes, we will endeavour to either anonymise it which means that all personal identifiable information is removed with no possibility of tracing the information back to you in the future; or pseudonomise it which means that all personal identifiable data is replaced, and highly restricted access is applied to the pseudonimisation code. In addition, we never share, sell, swap or rent your data to third parties for marketing purposes.

We may also share your information with other organisations when we are required to do so by law, for example:

If we are sent a request from the Police under the Crime and Disorder Act 1998
If we receive a formal order from a court acting in their judiciary capacity

If there is a public health need such as preventing the spread of infectious diseases

If there is a safeguarding need (vulnerable adults or children)

How do we process your information lawfully?

In the Data Protection Act 2018 and the General Data Protection Regulations, processing of your personal information must be done fairly, lawfully and transparently. Bolton Hospice will only process information relating to you as long as there is a lawful basis in line with the legislation and it is necessary for us to do so. The following legal bases are commonly relied upon for the delivery of direct care:

Public Interest – to process personal information to deliver our care and support services. This is underpinned by the Health and Social Care Act 2012.
Provision of Health and Social Care Services – to process your sensitive personal information (e.g. medical information, race, religion) to deliver our care services. This performed under our contracts with NHS Clinical Commissioning Groups.
Legal Obligation – to manage your personal records in line with data protection legislation and NHSX - Records Management Code of Practice.
Consent – when you join one to one or group video consultation sessions.

You can withdraw consent at any time by leaving the video consultation.

Which other organisations do we work with?

In order for Bolton Hospice to operate, we need to engage with other organisations for the provision of some services. All third party contracts are considered to ensure compliance with the General Data Protection Regulation. Examples of contracted services includes:

Data Management – all patient health and social care records and related reporting/correspondence are managed through an electronic database called I-Care.
Record Retention – Paper copies of medical records are archived securely both at the Hospice and off site. The off-site storage is managed by Restore.
Accident, Incident and Near Miss Reporting together with Complaints (Formal and Informal) are recorded on electronic data base – Sentinel which is hosted by Vantage.
Insurance Claims – we work with a company called D.E. Ford Ltd to manage insurance claims.
Audits – we work with other organisations who audit our systems to ensure that we are complying with our legal, regulatory and internal requirements. For example, the Care Quality Commission and MHA Moore and Smalley.
Continuous Improvement – we work with other healthcare providers e.g. the NHS to help with identifying areas for improvement and future investment.
Group Video Classes – we use web-based applications to provide group video conferencing for example, FaceTime and Microsoft Teams. The third party organisations will process your personal information to provide the video conferencing services, and may collect your information for their own legitimate interests. More detail can be found in the service provider’s Privacy Notices.
Audio Recordings – we work with Reliance High-tech Ltd who provide our staff with a lone worker device for the health and safety of our staff.
Feedback collection – we use the online survey website Survey Monkey to collect feedback from service users. This is collated, analysed and used for reporting purposes and to improve our services.

The accuracy of your information

HEALTH AND SOCIAL CARE DATA SHARING

Bolton Hospice shares personal information with other NHS organisations, non-NHS organisations and Local Authorities who are involved in providing health and social care to you. By sharing information in this way, we are able to work as multi-disciplinary teams to ensure that your health and social care needs are being met.

When we plan to share large amounts of sensitive personal information with other organisations, we complete a thorough Data Protection Impact Assessment. Bolton Hospice will only commence sharing your information once a data sharing agreement is in place and we have assurance that the other organisation is able to offer the same high level of protection for your information as we do. If during the impact assessment process, we are unable to mitigate against a high risk to the security of your information, we will submit the assessment to the Information Commissioner’s Office for assessment and will not progress until our planned activities have been approved.

An example of how data is shared between health and social care networks is through the Greater Manchester Care Record. More information about the Greater Manchester Care Record can be found here: https://healthinnovationmanchester.com/thegmcarerecord/

A copy of the Greater Manchester Care Record Privacy Notice can be found here: https://healthinnovationmanchester.com/the-gm-care-record-privacy/

STAFF, VOLUNTEERS, TRUSTEES AND CONTRACTORS

What information do we collect about you?

When you apply for a role (staff, volunteer, trustee, bank or contract), we can collect your information from a number of sources. This will depend on how you have submitted your interest in working with us. The source of your information can be you, an online job website that you have signed up to, your recruitment consultant or referees that you have supplied for your application. We will keep records of your application and personal information in either paper or electronic forms. Details of the information we process include, but are not limited to:

Name and contact details e.g. address, telephone number and e-mail
Date of Birth
Education and employment history
References and their contact details
Ethnicity, nationality, country of birth and gender for equal opportunities monitoring purposes.

If you have submitted a speculative application, we will retain your data for 6 months. If your application is unsuccessful, a copy of your application and supporting information will be retained for 12 months.

If your application is successful, a copy of your application, supporting information and interview notes will be included in your HR file. At the time of job offer, we will also collect further information from you and hold it on your HR file, for example:

Forms of Identification
Proof of eligibility to work in the UK
Disclosure and Barring Service Checks
Credit and Fraud Checks
Occupational Health Assessments
Driving licence, vehicle registration and insurance documents
Equal Opportunities information
Emergency contacts
Bank details
National Insurance / Social Security Numbers
Pension details

At the start of your employment/service, you may be assigned user accounts that are required for your role; logs of your account details and some activities within systems will be held by Bolton Hospice relating to your:

E-mail accounts
Telephone numbers
Application software accounts
Hardware assigned

During the term of your employment/service, information will be added to your HR records relating to your attendance, occupational health, professional development, performance management and conduct (including findings from investigation/grievance/disciplinary events should they occur).

Why do we process your information?

Your information is used for administration, management and organisational purposes, for example:

To keep a record of your application process, including screening and interviews to assess your suitability for the role and right to work in the UK
To be able to contact you throughout your application and term of employment/service
To send your contract and other necessary correspondence
To provide you with access to systems that are needed for your role
To locate staff and volunteers who are Lone Workers, using GPS devices
To be able to contact someone in the case of an emergency
To arrange workplace rotas
To pay you and provide you with benefits (if applicable)
To record your development, training, qualifications and professional registrations
To review your performance against organisational objectives
To provide any necessary support that you may need in order to perform your role
To perform budgeting and other general workforce management activities

We also need to process your information to ensure that we are complying with our legal obligations as an organisation, for example:

For proof of eligibility to work in the UK
To ensure the safety and security of our patients, staff/volunteers and the organisation, as we are working with vulnerable individuals
For financial audit purposes in line with the Companies Act 2006
For taxation purposes
For insurance purposes
For compliance with the Equality Act 2010

We may also share your information with other organisations when we are required to do so by law, for example:

If we are sent a request from the Police under the Crime and Disorder Act 1998
If there is a need to protect and safeguard children and adults at risk
If we receive a formal order from a court acting in their judiciary capacity

How do we process your information lawfully?

Contract – to provide you with an employment contract.
For the assessment of your working capacity and occupational health in line with our contracts with NHS Clinical Commissioning Groups.
Consent – to process your personal information when you apply to/and volunteer for Bolton Hospice or when you complete our equal opportunities forms to help us monitor compliance and the Equality Act 2010.

You have the right to withdraw consent at any time and we will stop processing your data in an identifiable format.

Legal Obligation -
- To ensure all staff are eligible to work in the UK in line with the Home Office Code of Practice on Preventing Illegal Working 2019
- To ensure compliance with the Safeguarding Vulnerable Groups Act 2006
- To ensure compliance with the Income Tax Act 2007
- To ensure compliance with the Companies Act 2006
- To ensure compliance with the Equality Act 2010
- To manage your personal records in line with the NHSX - Records Management Code of Practice and the Data Protection Act 2018 and General Data Protection Regulation.

Which other organisations do we work with?

In order for Bolton Hospice to operate, we need to engage with other organisations for the provision of some services. All third party contracts are assessed to ensure compliance with the General Data Protection Regulation. Examples of contracted services includes:

Occupational Health – we will work with Royal Bolton NHS Foundation Trust for Occupational Health services to ensure that our staff are happy, healthy and supported in a great place to work.
HR Services – the Staff Care HR database is used to store personal information, manage annual leave and attendance.
Staff Conduct Checks – we work with the Disclosure and Barring Service during the recruitment process for the assessment of applicants. The hospice renews the checks every 3 years for staff and volunteers.
Payroll and other payments – Sage Payroll is used to process your monthly payments. We also work with Charities Trust and Charities Aid Foundation to process payments.
Life Insurance – we work P. W. Financial Management to provide you with Life Insurance.
Insurance Claims – we work with a company called D.E. Ford Ltd to manage insurance claims.
Audits – we work with other organisations who audit our systems to ensure that we are complying with our legal, regulatory and internal requirements. For example, MHA Moore and Smalley.
Financial Auditing - MHA Moore and Smalley perform annual financial audits, which include auditing Payroll accounts.
Employment Services – we sometimes work with ACAS to resolve disciplinary, grievance or other employment related disputes.
Training – we work with a learning provider for mandatory training called Blue Stream. Staff also access e-Learning for Healthcare (e-LfH) which is a Health Education England programme, working in partnership with the NHS and professional bodies, to support patient care by providing e-learning to educate and train the health and social care workforce.
Pensions – we work with other organisations to enrol you in pension schemes for example, NHS pension and P. W. Financial Management.
Incident Reporting – all incidents are recorded in an electronic database called Sentinel which is hosted by Vantage.
Remote Working – we work with other organisations to provide you with the ability to work remotely, for example, Microsoft Office 365 (Outlook and Teams) and Virgin Media (our internet provider who enables remote access. Access for home working is via a Terminal Server based at Bolton Hospice and currently secured utilising multifactor authentication.

STUDENTS, PLACEMENTS AND COURSE ATTENDEES

What information do we collect about you?

When you apply to attend a course or placement at Bolton Hospice, we can collect your information from a number of sources. This will depend on how you have submitted your interest in the courses or placements that we offer. The source of your information can be you, your organisation, school or referees that you have supplied for your application. We will keep records of your application and personal information in either paper or electronic forms. Details of the information we process include, but are not limited to:

Name and contact details e.g. address, telephone number and e-mail
Contact details for people within your education services or employment
Employment and Education information
References and their contact details

Disclosure and Barring Service Checks
Medical questionnaire
Emergency contacts

Why do we process your information?

Your information is used for administration, management and organisational purposes, for example:

To keep a record of your attendance and provide you with certificates and course evaluation material
To be able to contact you throughout the course or placement
To be able to contact someone in the case of an emergency
To record your development, training, qualifications and professional registrations
To provide any necessary support that you may need in order to access and complete the course or placement

We also need to process your information to ensure that we are complying with our legal obligations as an organisation, for example:

To ensure the safety and security of our patients, staff/volunteers and the organisation, as we are working with vulnerable individuals

We may also share your information with other organisations when we are required to do so by law, for example:

If we are sent a request from the Police under the Crime and Disorder Act 1998
If there is a need to protect and safeguard vulnerable children and adults
If we receive a formal order from a court acting in their judiciary capacity

How do we process your information lawfully?

Contract – to provide you with a placement or course.

For the assessment of your working capacity and occupational health

Legal Obligation - to ensure compliance with the Safeguarding Vulnerable Groups Act 2006

Which other organisations do we work with?

In order for Bolton Hospice to operate, we need to engage with other organisations for the provision of some of our training and development services. All third party contracts are assessed to ensure compliance with the General Data Protection Regulations. Examples of contracted services includes:

Training – we work with a learning provider for mandatory training called Blue Stream. Staff also access e-Learning for Healthcare (e-LfH) which is a Health Education England programme, working in partnership with the NHS and professional bodies, to support patient care by providing e-learning to educate and train the health and social care workforce.

External training – we work with other organisations who provide training in areas that we are unable to deliver in house.
Incident Reporting – all incidents are recorded in an electronic database called PRIME, which is hosted by Acclaim Safety Systems Ltd.

ENQUIRERS, DONORS AND SUPPORTERS (INCLUDING LOTTERY MEMBERS AND SHOP CUSTOMERS)

What information do we collect about you?

We collect your personal information when you ask about our activities, take part in our events, make donations, play our lottery, buy items from our shops or online platforms or sign up to our newsletters and updates. We may also collect information about organisations and prospective contacts from publicly available sources of information. We will keep records of your personal information in either paper or electronic forms. Details of the information we may process include, but are not limited to:

Name, address, telephone number, email address, age / date of birth and gender
Dietary Requirements (if applicable to the event)
Payment information and donation history (including whether you are a UK taxpayer, so that we can claim gift aid on your donations)
Records of consent and correspondence between you and Bolton Hospice
Photographs, quotes, or video footage when you have taken part in our events

You might also provide us with feedback or information about your experience of fundraising for or donating to Bolton Hospice that we may use to improve them or for marketing purposes.

We might collect this information from you in person, over the phone, by post, email, SMS or through our website or social media pages.

Please note: Bolton Hospice will collect children’s data with the consent of a parent or guardian and will only correspond with the parent or guardian. The information of children will not be shared and we do not correspond with children under the age of 18.

Why do we process your information?

The information that you provide is used to provide you with our fundraising activities, or retail / lottery goods and services:

To manage the fundraising activity
To keep a record of who has signed up to the activity
To provide relevant information and resources to supporters
To provide a safe environment for our events to take place
To process income from the fundraising activities
To enter you into our lottery
To sell and deliver items from our online sales and charity shops
To collect items that you have kindly donated
To process income from your lottery membership and purchases

We may also process your information for purposes that are not linked to specific fundraising activities, goods and services:

To provide a transparent audit trail for income received
To claim gift aid on donations from the HMRC with your consent
To ensure compliance with Gambling Commission regulations
To keep current and potential supporters informed about fundraising, retail and lottery activities that may be of interest
Where you have provided consent, we may use photographs, videos and quotes of/from you to publicise the Hospice and our activities
To keep a log of supporter/customer preferences to help us understand specific interests and trends in monies raised
To provide a transparent audit trail for income received in line with the Fundraising Regulations for the receipt of income

We may also share your information with other organisations when we are required to do so by law, for example:

If we are sent a request from the Police under the Crime and Disorder Act 1998
If there is a need to protect and safeguard vulnerable children and adults
If we receive a formal order from a court acting in their judiciary capacity

How do we process your information lawfully?

Contract – to process your information in order to perform our contract with you, for example when you sign up to our fundraising events / lottery, make a donation or buy items from our shops.
Legitimate interest – to send you direct marketing by post. You are able to object to this at any time and we will stop immediately.
Consent – To send you information relating to our fundraising via electronic means, in line with Privacy and Electronic Communications Regulations.
Legal obligation – to comply with the law, for example when we keep a record of donations and Gift Aid for the purpose of financial audit in line with The Companies Act 2006 and HMRC requirements.

Please note: If you have given consent you have the right to withdraw that consent at any time, this will not affect the legality of activities that used the information before the withdrawal.

The accuracy of your information

We aim to ensure that all information we hold about you is accurate and, where necessary, kept up to date. If any of the information we hold about you is inaccurate and either you advise us or we become otherwise aware of this, we will ensure it is amended and updated as soon as possible. This includes occasions where we are made aware via verified press or social media reports that someone whose information we hold has died.

Which other organisations do we work with?

In order for Bolton Hospice to operate, we need to engage with other organisations for the provision of some services. All third party contracts are assessed to ensure compliance with the General Data Protection Regulations. Examples of organisations we may share your data with and the reasons why include:

Organisation / Category

Reason we may share your data

Our bank (Royal Bank of Scotland)
So that they can process your payment or donation to us (e.g. a cheque or debit card payment).

HMRC
To allow us to claim gift aid on your donations where you have declared you wish us to do so.

Payment processing companies (Bottomline Technologies, PayPal, Worldpay, Stripe, Secure Collections, Sumup)
To process a payment, donation or Direct Debit you have instructed us to make from your bank account, such as an online donation, your weekly lottery membership or a regular donation.

Database software provider (Donorflex)
So that they can provide us with our database software. Their access to any personal information will be restricted and on a need to know basis.

Retail software provider (Kudos)
So that they can provide us with our database software. Their access to any personal information will be restricted and on a need to know basis.

Mailing house, delivery and courier companies (Cheshire Laser Mail, Fretwells, Evri)
To allow them to send our mailings (e.g. our supporter newsletter) or products you have bought from us to you.

Email and text services (Mailchimp, MailerLite,Textlocal)
To send marketing by email & SMS (text message), when you have opted in to receiving them.

Data cleansing company (BRG Direct)
So they can tell us if someone on our database has died. This stops us wasting money but also prevents us causing distress to the deceased’s next of kin by continuing to phone, email or write to them after they have died.

Data analysis service (Dataro)

We use artificial intelligence (AI) powered propensity modelling software to identify which supporters we should send fundraising campaigns to. This ensures we are asking the right supporters at the right time, enables us to send less mailings, and saves costs.

Event venues and delivery partners (Rivington Hall Ball, Bolton Whites Hotel, Bolton Golf Club, Mersey Medical, Raynet, Bolton Security, Wingwalk Displays Ltd)
So that they can effectively deliver the service we have asked them to provide to you (e.g. catering to your dietary requirements or providing emergency aid based on medical conditions you have told us about).

Lottery member recruitment company (SEC Fundraising)
So that they can carry out lottery member recruitment on our behalf.

Online meeting/event software provider (Zoom)
So that we can hold video meetings with you or so that you can attend our virtual events.

Online trading, ticketing and fundraising sites (Ebay, Squarespace, Tito, Facebook, Give Panel, Much Loved, Rally Up, JustGiving)
So that we can sell items online to raise funds, sell tickets to our events and raise funds online.

Please note: Some of the organisations that we work with will process your data outside of the European Economic Area. More information can be found in the ‘TRANSFERING YOUR INFORMATION OUTSIDE OF THE EUROPEAN ECONOMIC AREA’ section of this privacy notice.

WHEN YOU COME TO BOLTON HOSPICE PREMISES

What information do we collect about you?

When you come to Bolton Hospice or Giles House sites as a member of volunteer, trustee, contractor, client, student/trainee or guest/visitor you will be required to complete a signing in via the iPad to register your attendance. Personal information that we will collect will include:

Name
CCTV video recordings*

*We operate CCTV systems in areas that are used by staff (for example kitchen corridor) and areas that are used by members of the public, there are notices displayed to inform the subjects of the recording.

Why do we process your information?

The information that you provide is used for ensuring the safety and security of our patients, staff, volunteers, visitors and property, and to facilitate the detection and prevention of crime.

How do we process your information lawfully?

In the Data Protection Act 2018 and the General Data Protection Regulations, processing of your personal information must be done fairly, lawfully and transparently. We will only process information relating to you as long as there is a lawful basis in line with the legislation and it is necessary for us to do so. The following legal bases are commonly relied upon:

Legitimate interest –
- To help us ensure the safety of our patients, staff, volunteers, visitors and property, and to facilitate the detection and prevention of crime.

Which other organisations do we work with?

We may share your information with other organisations when we are required to do so by law, for example:

If we are sent a request from the Police under the Crime and Disorder Act 1998
If we receive a formal order from a court acting in their judiciary capacity

You have the right to see CCTV images of yourself and be provided with a copy subject to certain criteria. We will not release images of other people to you. If you are involved in an incident whilst on our premises, we will record details of the incident in an electronic database called Sentinel, which is hosted by Vantage.

VISITORS TO OUR WEBSITE OR SOCIAL MEDIA SITES

What information do we collect about you?

In order for us to provide a high quality website and social media service, Bolton Hospice needs to collect and process personal information about you, for example:

Cookies - the name of the domain from which you access the Internet, the date and time you access our site, and the Internet address of the website from which you linked to our site
Your name and contact details, and other persons involved in queries/correspondence
Your name and contact details, and other persons involved in complaints

Why do we process your information?

We will use your information to provide a relevant and efficient web and social media service:

Cookies measure the number of visits to the different sections of our site, and to help us make our site more useful to visitors. Guidance for managing cookies through your browser can be found at the following website: https://www.aboutcookies.org/
To correspond with you relating to your query or complaint

Cookies Notice

We use cookies to collect information when you visit our website. Some cookies are essential to make our website work, while others help us to improve your experience by providing insights into how the site is being used. We only store the information you’ve given us permission to and don’t use it to identify you personally.

Necessary Cookies

Necessary cookies enable core functionality such as page navigation and access to secure areas. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.

Analytics

Analytical cookies help us to improve our website by collecting anonymous information on how people use it.

Marketing

We use marketing cookies to help improve the relevancy of advertising campaigns you receive. By accepting our marketing cookies, you give third parties such as Google Analytics and Google Ads permission to gather information to help us improve the relevancy of advertising campaigns. They may also send information to our social media channels for marketing purposes.

Some pages of our website may contain ‘web beacons’ such as Meta pixel. We, and other third parties, use these cookies to make sure that we show you relevant advertising. These cookies collect information about your browsing habits. This may also include your use of social media sites, e.g. Facebook, or how you interact with our website, which is then used to show you relevant content elsewhere on the internet. These may also be used to remarket to you.

If you are a web visitor from the United Kingdom, you can manage your cookie preferences at any time through your web browser. To amend or delete your cookie preferences, guidance can be found at the following website: https://www.aboutcookies.org/

In addition to the browser-based controls, you can manage third party cookies by visiting aboutads.info/choices/ and youronlinechoices.eu/.

How do we process your information lawfully?

Consent – to collect cookie data
Legitimate interest:
- To process your data to help us improve our website and social media sites
- To respond to your queries or complaints

Which other organisations do we work with?

In order for Bolton Hospice to operate our website, we need to engage with other organisations for the provision of:

Website Publishing – we use an organisation called Drupal to publish the content of our website.
Website and Social Media Monitoring – we work with Google Analytics & Adwords, X, Instagram, TikTok, LinkedIn and Meta to collect standard user and internet log information and details of visitor behaviour patterns. You cannot be identified from this information.
Website Maintenance – we work with Creative Concern to maintain the website; this includes:
- Daily back-ups of the site
- Managed hosting in fully secure and resilient data-centres
- Firewall protection: multiple powerful firewalls between our data and threats

Please note: Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy policy. You should exercise caution and look at the privacy policy or statement applicable to the website in question.

Our website also contains a Google Translate widget to enable users to quickly and easily translate some of the content on our website into a number of alternative languages. Please be advised that this should not be considered an exact translation and may include inaccuracies, or lose the full meaning of the original content.

TRANSFERING YOUR INFORMATION OUTSIDE OF THE EUROPEAN ECONOMIC AREA

Bolton Hospice do not transfer Health or Social Care records outside the European Economic Area, all data is hosted within the UK and Republic of Ireland.

Bolton Hospice uses third party organisations to help with fundraising and marketing services. Some of the providers will transfer your personal data to countries outside of the European Economic Area, mainly to the USA. Examples of this include:

When you sign up to an event through Tito
When you pay Bolton Hospice through the online Stripe or Merchant Service platforms
When you attend a Zoom video conference call
When we send direct marketing via email through Mailchimp
When we utilise software (Dataro) to optimise our mailings

If your information is to be processed outside of the European Economic Area, it will only be processed once we have confirmation that the recipient is subject to equivalent data protection legislation, and that your information will remain secure. The third party organisation’s standard terms will apply, and, there may also be an individual Data Processing contract in place, which will specify what the data is to be used for. If you would like to see evidence of the Standard Contract Clauses that we have in place with the above third party organisations, please forward an email to admin@boltonhospice.org.

HOW LONG WILL BOLTON HOSPICE RETAIN YOUR INFORMATION?

At Bolton Hospice we will only retain your information for as long as we need it and our policies regarding this are based on the NHSX – Records Management Code of Practice - for detail of the healthcare retention schedules that we follow, please click the below link:

https://www.nhsx.nhs.uk/information-governance/guidance/records-management-code/

Volunteer records are kept for a period of 6 years after the end of your volunteering with us.

YOUR RIGHTS

Under the Data Protection Act 2018 and the GDPR, you have the following rights relating to personal information that we process about you:

Right to Access (Subject Access Request / Access to Health Records)
Right to Rectification
Right to Erasure (Right to be forgotten)
Right to Object
Right to Restrict Processing
Right to Data Portability
Right not to be subject to automated decision making including profiling

* Please note: not all rights may apply to your individual circumstances. An example of this could be when you would like to have your records erased, but they have been collected in order to meet a legal obligation, or if you request access to records that would cause serious physical or mental harm to you or others.

Complaints

We take any complaints we receive about the collection and use of personal information very seriously. We would encourage you to bring it to our attention if you think that our collection or use of information is unfair, misleading or inappropriate. You can make a complaint at any time by contacting us (see Queries section below).

If you think our collection or use of personal information is unfair, misleading or inappropriate or if you have concerns about the security of your personal information, you also have the right to make a complaint to the Information Commissioner’s Office. You can contact the Information Commissioner’s Office at the following address:

Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF.

Queries

If you have any queries about this policy please call 01204 663 066 or email admin@boltonhospice.org.

We may change this policy from time to time to ensure it is up to date and in line with current legislation. You can check our current privacy policy on this page at any time and we recommend you do this periodically.

This policy was last updated on 6th June 2024.