Privacy policy and use of Cookies

Last updated January 2026.

Please read this policy carefully to understand how we collect, use and store your personal data.

Introduction

St Catherine’s Hospice (Lancashire) Ltd is a charitable company registered in England and Wales with registered company number 01602467 and registered charity number 512186.

We take your privacy very seriously and are committed to protecting your personal information.

This privacy statement explains how we, St Catherine’s (Lancashire) Ltd, and our affiliated trading company St Catherine’s Trading, our lottery company St Catherine’s Promotions and The Mill (St Catherine’s Social Enterprise) may collect and use the information you give us. Herein referred to as St Catherine’s.

If you have any questions regarding our privacy statement, please write to:

The Quality Standards Officer

The contact details are St Catherine’s Hospice, Lostock Lane, Lostock Hall, Preston
PR5 5XU or call on: 01772 629171.

Contents

1. WHO ARE WE
2. HOW AND WHY, WE PROCESS YOUR PERSONAL DATA
3. OUR LAWFUL BASIS FOR PROCESSING YOUR PERSONAL DATA
4. WHO WE SHARE YOUR PERSONAL DATA WITH
5. HOW LONG WE KEEP YOUR PERSONAL DATA
6. HOW WE KEEP YOUR DATA SAFE AND WHO HAS ACCESS TO IT
7. YOUR RIGHTS
8. WITHDRAWING CONSENT
9. CHILDREN’S DATA
10. COMPLAINTS
11. CHANGES TO THIS PRIVACY STATEMENT
12. REVIEW
13. DOCUMENT CONTROL
14. POLICY REVIEWERS
15. REVISION HISTORY

1.     WHO ARE WE

St Catherine’s Hospice (Lancashire) Ltd (SCH) is a charitable company registered in England and Wales with registered company number 01602467 and registered charity number 512186.

We take your privacy very seriously and are committed to protecting your personal information. Please read this notice carefully to understand how we collect, use, and store your personal data.

This privacy statement explains how we, St Catherine’s (Lancashire) Ltd, and our affiliated trading company St Catherine’s Trading, our lottery company St Catherine’s Promotions and The Mill (St Catherine’s Social Enterprise) may collect and use the information you give us. Herein referred to as SCH.

       How to contact us:

If you have any questions regarding our privacy statement, or wish to exercise your data protection rights,  please write to the Quality Standards Officer using the contact details below or for patient privacy concerns download our Factsheet ‘How & why, we process your data’ (see point 2) or please contact the Caldicott Guardian.

The contact details are St Catherine’s Hospice, Lostock Lane, Lostock Hall, Preston, PR5 5XU or call on: 01772 629171.

2.     HOW AND WHY, WE PROCESS YOUR PERSONAL DATA

Below is a list of the different ways in which we may process personal data. For more information about how and why we process data in this way, please click here for our: Factsheet: How & why we process personal data                                                                                                                                                                      

1. When making a donation or a payment to SCH
2. When enquiring about our activities or services
3. When we send administrative communications to you
4. When we send marketing communications to you
5. When you visit our websites
6. When you fundraise, take part in an event, or meet with us
7. When you volunteer with us
8. When responding to a complaint
9. Internal audits
10. When responding to a safeguarding concern
11. Supporter Analysis, Profiling (and Wealth Analysis)
12. When you provide personal data indirectly
13. When you have given other organisations permission to share it
14. When you use social media
15. When we guess business e-mail addresses
16. When we administer legacies
17. When we create promotional material
18. When we process Special Category Data
19. When you apply for a job with SCH
20. When we keep your information accurate and up to date

3.       OUR LAWFUL BASIS FOR PROCESSING YOUR PERSONAL DATA

Data privacy law requires us to have one or more lawful grounds to process your personal information. The following grounds are relevant to our use of your information:

• Although in many cases we will seek consent to process your personal data, in some instances we may process your information without consent when we are legally allowed to do so. This will only be where it is in our legitimate interests to do so and where we are confident that such processing is not likely to prejudice your legitimate interests or rights and freedoms.

Where we are processing your personal data on the basis of consent that you have given us, you are entitled to withdraw that consent at any time such that we can no longer rely on it as a basis for continuing to process your personal information.

• To protect your vital interests, e.g. to ensure you get urgent medical assistance if needed when taking part in a fundraising event.
• Where we have a contractual relationship with you. Though the majority of our relationships are voluntary, if we enter into a contract with you (such as when you purchase something from one of our shops) we will process information to administer that contract.
• Legal obligations. We will sometimes pass on personal information to comply with legal obligations such as providing tax and gift aid information to HMRC.
• “Legitimate Interests.” Where it is appropriate we rely on the processing being in our legitimate interests, provided we are confident that such processing is not likely to override your own legitimate interests or rights and freedoms. For example, sending you marketing and fundraising post, provided this is done in an unobtrusive manner.

SCH’s legitimate interests are ultimately in pursuit of our charitable objectives, including:

• Governance and operational management, such as statutory reporting and intergroup transfers with our trading companies, and employee and volunteer administration and management
• Publicity and income generation such as marketing, fundraising, and events.
• Sending key administrative communications to keep supporters informed and up to date
• Taking and using photos and/or films of event participants and attendees
• Recruiting and managing volunteers
• Safeguarding
• Performing supporter analysis and profiling (and wealth screening) to maximise charitable income and ensure we understand the demography of our supporters and contact them in appropriate ways
• Carrying out background research on potential high net-worth donors or business partners

4.      WHO WE SHARE YOUR PERSONAL DATA WITH

We do not sell any of your personal data to third parties for marketing purposes. We will only share your data in order provide our services to you, in order to enhance our services, or in accordance with a legal obligation. Please see below for more details of the different groups we may share personal data with:

• We may share patient data with other healthcare providers with the patient’s consent.
• We may sometimes also be legally required to share it with local authorities and our regulators, such as the Information Commission, the Integrated Care Board (ICB), the Charity Commission, the Care Quality Commission (CQC), and the Fundraising Regulator.
• SCH may, however, share your information with our trusted partners and suppliers who work with us or on our behalf to deliver our services, but processing of this information is always carried out under our instruction. We make sure that they store the data securely, delete it when they no longer need it and never use it for any other purposes. Some examples of where we may share your information are with our fulfilment partners who help to create and send information to you to reduce our costs and with our partners who help us to process donations and claim Gift Aid.
• SCH may sometimes use external organisations to process personal data on our behalf – for example suppliers and subcontractors, payment providers, mailing houses and legacy administrators. Before working with these companies, we perform due diligence checks to ensure they provide appropriate safeguards in respect of your personal data and treat it in accordance with the law. We always ensure we have a contract in place with these third-party suppliers, and those contracts include robust data protection requirements.
• We may occasionally use the services of a supplier based outside the European Economic Area (EEA), which in turn might lead to your personal information being transferred, processed, and stored outside the EEA.

We enter into contracts with these service providers that require them to comply with Data Protection Laws (such as UK GDPR and Data Protection Act, 2018) and ensure that they have appropriate controls in place to secure your information.

5.      HOW LONG WE KEEP YOUR PERSONAL DATA

• We will hold your personal information on our systems for as long as is necessary for the relevant activity, for example we will keep a record of any donations you have made for at least six years.
• After such a period, within our database, we anonymise records so we can reference behavioural patterns in our data analytics, but the information is no longer personal to you.
• We may however keep certain data for a longer period, such as data in connection to Legacy Gifts or Safeguarding. Legacy income is vital to sustaining SCH’s work. We may keep data you provide to us indefinitely, both to administer legacy gifts and to communicate effectively with the families of people leaving us legacies. This also enables us to identify and analyse the source of legacy income we receive.
• If you ask us to stop sending you marketing materials, we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.
• Where you contribute material to us, e.g. through user generated content or in response to a particular campaign, we will generally only keep your content for as long as is reasonably required for the purpose(s) for which it was submitted, unless otherwise stated at the point of collection.

6.     HOW WE KEEP YOUR DATA SAFE AND WHO HAS ACCESS TO IT

• We place great importance on the security of your personal information and will always try to take appropriate precautions to protect it.
• We ensure that there are appropriate technical controls in place to protect your personal details. For example, we use encryption technology on our websites and carry out regular security reviews on our network.
• We always ensure only authorised personnel have access to your information i.e. SCH staff, volunteers, or contractors and that they are appropriately trained to manage your data.

Despite all of our precautions however, no data transmission over the internet can be guaranteed to be 100% secure. So, while we strive to protect your personal information, we cannot guarantee the security of any information you disclose to us online, and you must understand that you do so at your own risk. However, any payment card details (such as credit or debit cards) we receive through our website are passed securely to our payment processing providers who meet the required Payment Card Industry (PCI) Security Standards. You can find out more information about PCI DSS here.

7.     YOUR RIGHTS

Under UK GDPR, individuals have the right to object to the processing of their personal data in certain circumstances:

1. The right of access: To request a copy of the personal data we process regarding you. Please note that we will seek proof of your identity before proceeding with an access request.
2. The right to rectification: To have personal information amended if it is inaccurate or incomplete. You can ask us to check the personal data that we hold about you if you are unsure.
3. The right to erasure: To request the erasure of your personal data. Please note that the right to erasure is not an absolute right, but we will erase your data where we are processing it under the basis of your consent, your information is being unlawfully processed, or it is no longer necessary for us to process it.
4. The right to data portability. Where we are processing your information on the basis of consent you can request it to be transferred from one service provider to another in a suitable format.
5. The right to object. You can ask us to stop processing your personal information in certain circumstances, including an absolute right to ask us to stop processing for direct marketing.
6. The right to restrict processing. If there is any disagreement about the accuracy or legitimate usage of your personal information, you can ask us to “hold” it but not use it further, whilst the issue is resolved.
7. You also have rights in relation to “automated decision making.” SCH does not currently undertake this activity, which involves complex computerised processes which produce legal effects.

If you want to enforce any of these rights in respect to your personal information, please contact St Catherine’s Hospice on 01772 629171.

8.      WITHDRAWING CONSENT

Where we are processing your personal data with your consent (e.g. to send you event information via email, post, or telephone call) then please be advised that you can withdraw this at any time. If you would like to withdraw your consent, then please call us on 01772 629171.

If you do ask us to stop sending marketing communications, please note that we will continue to send you administrative communications as needed, and that we may be unable to stop some marketing communications that you had been selected for prior to you withdrawing consent.

Should you no longer want your healthcare data shared with other health professionals, then you can request to ‘share out’ by contacting a member of our Clinical Team at St Catherine’s Hospice on 01772 629171.

9.     CHILDREN’S DATA

Children’s health data – where we collect children’s personal data, we usually require consent from a parent or guardian for children under thirteen and we will make reasonable efforts to verify their identity.

For those aged thirteen and over who may consent for themselves, we will make reasonable efforts to verify they are old enough to do so.

However, if a child under sixteen is assessed as competent, they can give consent, and their wishes can be respected even if their parents disagree. In these situations, we consider the Gillick Competency[1] principles.

SCH will protect the child’s information, and staff are trained on the importance of confidentiality.

Safeguarding – In the event of a safeguarding concern, information may be shared with other professionals without consent if there is a concern for a child’s safety or the safety of others, as we have a legal obligation to do so. Refer to the section 10 on ‘When responding to a safeguarding concern’ within the Factsheet.

Supporters – while we do not actively collect information from children (under-16s), we appreciate that our supporters are of all ages. Where appropriate, we will always ask for consent from a parent or guardian to collect information about children.

All SCH events will have clear rules on whether or not children can take part, and the collection of data will be managed in accordance with each individual event, with appropriate safeguards in place.

10.  Use of Artificial Intelligence (AI)

We may use an AI system or a service that includes AI functionality.

AI has the potential to make SCH more efficient, effective and innovative and we will implement appropriate measures dependent on the nature, scope, context and purpose of any processing we intend to do using AI to ensure we identify the risks to people’s data protection rights associated with those processing activities.

Where AI is integral to a service we use or a process we follow and that element is outside our control, but necessary to reach our aim to provide care for patients and families across Chorley, Preston and South Ribble who are affected by life-shortening conditions we will adhere to the AI guidance provided by the Information Commissioner who in turn is delivering the UK government’s vision of a pro-innovation approach to AI regulation and more specifically its intention to embed considerations of fairness into AI.

For more information click here: Guidance on AI and data protection | ICO

11.  COMPLAINTS

• If you would like to make a complaint about how we process your personal data, please click here for our ‘How to make a complaint’ leaflet or call us on 01772 629171. You can read our Complaints policy here.
• Please note that you can also register with the following services to stop receiving unsolicited marketing communications from a selected charity or charities:
  • The Mail Preference Service (MPS), in relation to postal communications.
  • The Telephone Preference Service (TPS), in relation to phone calls.
  • The Fundraising Preference Service (FPS), in relation to email, telephone, addressed post and/or text messages.

12.  CHANGES TO THIS PRIVACY STATEMENT

• This policy may change from time to time. If we make any significant changes to this policy, we will publicise these changes clearly on our website or contact you directly with more information.
• This Privacy Policy was last updated in November 2024
• Please revisit this policy each time you consider giving your personal information to SCH.

13.  REVIEW

 In order to ensure that the Privacy Statement continues to meet SCH’s aims and complies with the objectives, the document(s) will be monitored and reviewed on an annual basis or earlier if there is significant change to relevant law or working practices.

[1] Gillick competency is a legal principle in the UK that determines if a child under 16 has the capacity to consent to their own medical treatment without parental permission. To be considered Gillick competent, a child must be mature enough to understand the nature, purpose, risks, and implications of the proposed treatment. SCH use this principle to balance a child’s autonomy with their safety, and it is applied in situations where the child seeks treatment without their parents’ knowledge or against their parents’ wishes.

Cookies

Analytical Cookies