Privacy Notice for Supporters and Customers
Willen Hospice and Willen Hospice Ventures Ltd
Who we are
Willen Hospice is a registered charity that provides specialist care for people whose illness no longer responds to curative treatment (also known as specialist palliative care). We provide specialist end-of-life care for adults, focusing on four key areas: specialist symptom control, emotional support, spiritual support and care for carers.
Willen Hospice (also known as the Hospice of Our Lady and St John) is registered under charity No. 270194 and is a company registered in England and Wales with Company No. 1231909.
Willen Hospice Ventures Limited is the trading company of Willen Hospice incorporating shops, warehouse, lottery, challenges and events. It is a company registered in England and Wales with Company No. 1231909.
Willen Hospice Ventures Limited is a subsidiary of Willen Hospice therefore the Data Controller in respect of all personal data collected by us, whether it is collected when you use this website, make a donation, make a purchase in our shops, participate in one of our events or otherwise engage with us in fundraising and volunteering, is Willen Hospice.
Our contact details
Address: Willen Hospice, Milton Road, Willen Village, Milton Keynes, MK15 9AB
Personal data is any information that can be used to identify you. It can include name, address, phone number, email address, credit card details and purchase history. The processing of personal data by organisations is governed by the Data Protection Act 2018 and the EU 2016/679 General Data Protection Regulation (GDPR). Collectively we call these two ‘Data Protection Legislation’.
We take your privacy seriously and we will only use the information we collect about you lawfully. This Privacy Notice sets out how we use your personal data.
What information we collect and how we collect it
We will collect personal data from you directly when you interact with us.
Example. If you support us by making a donation, registering for one of our events or make a purchase from our eBay shop, we will collect your name and contact details.
Some personal data is termed special category data and we may ask you to provide this in certain circumstances. We will always ask for your consent to process this data.
Example. If you register for one of our challenges, such as a Tandem Skydive, we will ask for health information, to ensure fitness to participate.
We sometimes collect data from other independent organisations. These organisations should only share your details with us when you have given them permission to do so. You should check their Privacy Notice when you provide your information to them, to ensure you fully understand what they will do with your personal data.
Example. You may participate in an event such as the London Marathon and nominate us as your chosen charity. We may receive your name and contact details from the organiser.
We may receive personal information about you from one of the on-line giving platforms, such as Virgin Money or Just Giving.
Example. You undertake a sponsored walk and nominate Willen Hospice as your chosen charity and set up a Just Giving page. We receive your name and contact details as well as the names of those that have donated money through your page.
In some cases we use on-line directories to research organisations that may be able to support the work of Willen Hospice.
Example. You may be a Trustee for a fund that supports charities such as Willen Hospice. Your name may be taken by us from an on-line Trust directory and stored on our systems prior to contacting you. You may ask us to stop processing your personal data at any time.
What do we use your data for?
We may use your information to send you updates about the work of the Hospice.
Example. We produce a newsletter twice per year containing Hospice and community news. We will send this by email if we have you email address (and you have consented to receive emails from us) or by post to you if we only have a postal address, unless you have asked us not to do so.
We may send you information about fundraising events that we believe will interest you.
Example. You take on a challenge such as our ‘Abseil for Willen’. We will send you information and news about future similar challenges.
We may use your information for administration purposes.
Example. If you are a volunteer in one of our shops we will use your personal information to manage the staffing rota.
How do we process your data?
Typically we store your personal data in a database. We record all personal information you have given us such as name, contact details, medical information (if applicable) and your preferences regarding how you wish to be contacted. We may also add information such as the events you have participated in, whether you are a Willen Lottery player and how much you may have raised for us or given to us.
We may use your personal information to create a profile of you based on what you have told us about your interests and preferences, so we can contact you with information relevant to you. We may also make use of additional information about you, including demographic information and measures of affluence, when it is available from external sources, to help us do this more effectively. This helps us understand our supporters and helps us to make appropriate requests for gifts to supporters who may be able and willing to give more than they already do.
The lawful bases of our processing
Data protection law sets out a number of reasons, or lawful bases, for which organisations may collect and process personal data. The law allows for six different lawful bases in total but only three are relevant to the type of activities undertaken by Willen Hospice.
1. Personal data is processed on the basis of it being in the Legitimate Interests of Willen Hospice.
Example. It is a Legitimate Interest of Willen Hospice to raise money to further our work and we believe it is necessary to inform supporters about that work and fundraising opportunities. If you have provided your contact details to us, we may send a newsletter by post, containing updates of our work and new opportunities to support us. You may ask us to stop sending you such material at any time.
2. Personal data is processed in line with a Contractual relationship
Example. You become of our Lottery players. As you are entering into contractual relationship with us, we will process your personal data and communicate with you for the purpose of lottery administration.
3. Personal data is processed on the basis of an individual’s Consent.
Example. You may have made a donation to us at one of our memorial services by completing a donation form. We will ask on that form if you would like to receive fundraising information from us. If you agree, having given your explicit consent, we will send regular updates by email. You may ask us to stop sending information to you at any time.
In some cases different types of your personal data are processed under different lawful bases.
Example. When you sign up for one of our more physically demanding challenges, such as our Tandem Skydiving event, we will ask you for certain medical information, such as your weight. Under data protection law, the processing of health information requires us to give you an additional level of protection. Therefore your medical information will be held on the basis of your consent and your other personal information will be processed on the basis of a contractual relationship.
Your rights in relation to the personal information we hold about you
Data protection law gives you certain rights over the personal data held by organisations.
1. Right to be informed. You have the right to be told how your personal information will be used. This Privacy Notice, and shorter summary statements used in our communications, provide you with information regarding the type of personal data we collect, how we collect it and how we use it. If you would like further information please email firstname.lastname@example.org
2. Right of access. You may contact us to ask what personal information we are holding about you and to request a copy of that information. You must provide proof of your identity by sending us two pieces of approved identification. We have 30 days to comply with your request once we are satisfied that you have the right to see the requested records and have successfully confirmed your identity.
3. Right of rectification. You may ask us to correct any personal data where it is incomplete, incorrect or where it is out of date.
4. Right of erasure. You may request that we delete the information we hold about you. If there is no overriding legal reason why we cannot do that (for example, if you are a lottery player, the Gambling Commission requires us to keep records for a certain length of time) we will delete your record. We may suggest keeping basic details for a suppression list, to prevent us contacting you again, rather than complete deletion.
5. Right to restrict processing. In some situations you have the right to ask for the processing of your personal data to be restricted, perhaps because you disagree with its accuracy or legitimate usage. We will still hold the data, but will not use it, until the restriction is lifted following the resolution of the disagreement.
6. Right to data portability. This right is mainly applicable to service providers, so that people may move from one service to another and so does not apply to any of the personal data held by Willen Hospice.
7. Right to object. You may object to the processing of your information for direct marketing purposes.
8. Right to automated decision making. Willen Hospice does not process information in way that would allow this right, therefore this does not apply to personal data held by us.
Who do we share your information with?
A limited amount of your personal data may be shared between Willen Hospice and Willen Hospice Ventures Limited.
Example. If you make a purchase through our eBay shop, your contact details will be sent by Willen Hospice Ventures Limited to Willen Hospice for accounting purposes.
We share personal data with other organisations where we are required to do so by law.
Example. Where you have completed a Gift Aid declaration, we will pass your name and amount you have donated to HMRC in order to recover the Gift Aid amount from the government.
We share personal data with other organisations where it is necessary to provide the service you have requested.
Example. Where you have purchased an item from our eBay shop, we will collect your name and address and pass that information to a courier for delivery of the item.
Example. If you join one of our challenge events, these may be organised on our behalf by a third party, such as The Different Travel Company for our Borneo Trek. Your details will be passed to such third parties to allow them to manage the challenge.
We share personal data with an event management company when we organise training courses.
Example. If you sign up for one of our training courses, you will do this through Eventbrite who will use your details to provide course administration services.
We share data with payment processing companies to enable payments to be received.
Example. Where you have donated to us by credit or debit card, or purchased from us through our website, we pass your card details securely to our card processing company as part of the payment process.
If you use your credit or debit card to donate to us, buy something, or pay for a registration online or over the phone, we will ensure this is done securely and in accordance with the Payment Card Industry Data Security Standard. You can find out more information about PCI DSS here.
We do not store your credit or debit card details at all following the completion of your transaction. All card details are securely destroyed once the payment or donation has been processed. Only staff authorised and trained to process payments will able to see your card details.
We never sell or otherwise provide your personal data to any other third party organisations.
Retention period for your personal data
The law requires that we keep your personal data for no longer than necessary. The length of time each category of data is held by us varies according to the purpose for which it was collected.
Sometimes there are legal reasons that state a specific period of time.
Example. The Gambling Commission requires lottery player information to be kept for a period of three years. After that time we will remove your personal data in relation to the lottery from our systems. Note that you may still receive marketing materials from us but you can ask us to stop at any time.
Other data is removed from our systems in line with our retention policy.
Example. You kindly donate a sofa to us and provide your name and address so that we can collect it. We will remove your name and address from our systems after six months.
If you are a supporter we will continue to process your information for as long as you are willing to hear from us.
Example. We will send you a newsletter by post or, if you have consented, by email.
We will do this until you tell us to stop. Once we have stopped we will delete your personal data after 3 years.
The security of your data
We maintain a high level of physical and electronic security in relation to the collection, storage and processing of your personal data. We constantly review security measures and update where necessary. Personal data in our databases is only accessible by appropriately trained employees and volunteers who need to access your personal data as an essential part of their role. All access is tracked through individual login credentials.
Our supporter databases are based in secure facilities within the UK, with robust back-up and business continuity plans.
We are committed to protecting the privacy of the young people who engage with us through our website and at fundraising events. If you are a child under the age of 18 we request your age and you must obtain parental or guardian permission before participating.
If you are under the age of 18, bookings must be completed by your parent or guardian. During the application process, certain personal information will be requested. This information will be processed by us under the lawful basis of a Contractual relationship (see ‘The lawful bases of our processing’ above). If you’re under the age of 16, all event related correspondence is made with the person that gave permission and there is no communication made directly to you.
Example. You’re aged 8 and want to participate in our Scooterthon. One of your parents (or a guardian) will need to give written permission for you to take part. As you are taking part in one of our events, you are entering into a contractual relationship with us, and we will process personal data, such as your name and address, to tell you about that event. We will send that information to the adult that gave you permission.
If you’re aged between 16 and 18 we may contact you if your parent or guardian has provided your email or mobile number.
Example. You’re aged 17 and you’re participating in our Midnight Moo Event. One of your parents (or a guardian) has given written permission for you to take part and provided us with your email address. We will use that address to send you information directly about that event.
If you are under the age of 18 and you participate in one of our events, the adult that gave you permission will also be asked if they want your details, and theirs, to be kept so that we can contact you about future events. In this case the lawful basis of processing is Consent. As before, no correspondence is sent directly to you, only to the person that provided the consent.
Example. You’re aged 15 and participate in our Cycling Sportive. If one of your parents (or a guardian) has given consent for us to contact you again about future events, we will let you know when we are running a similar event. We will send that information to the adult that gave consent.
In the first instance please talk to us so that we can try and resolve the problem. If you wish to complain about the way we collect, store or use your personal data, please write to us:
If we are unable to resolve your complaint you may contact the Fundraising Regulator using their online complaints form or by calling the Regulator on 0300 999 3407.
Changes to this Privacy Notice
We review and improve our procedures regularly and may update this Privacy Notice from time to time. We encourage you to check this page for any changes in order for you to stay informed about how we are protecting the personal information you have entrusted to us. If there are significant changes in the way we process your personal information, we will contact you as well as placing a prominent notice on our website.
This Privacy Notice was last updated on 18 January 2019 (v3.0).