Privacy Policy

For all personal information we hold we undertake to:

• Tell you about how your data is used, either at the time we collect it (if we collect it directly from you) or as soon as is practical afterwards (if we collect it from a third party).
• Keep it securely and make it available only to those within the organisation who need to see it. Where we share data with other organisations, we will tell you first wherever possible (sometimes there may be legal reasons not to).
• Where your data is processed by other organisations on our behalf, make sure that the processing is clearly defined, secure and governed by a contract.
• Respect your rights over your personal data.
• Inform you about major changes to this policy.

This policy is effective from 4 March 2024.

Who is NHS Charities Together?

NHS Charities Together is an organisation which represents, supports and champions NHS Charities in all four nations of the United Kingdom. Our legal name is The Association of NHS Charities. We are a charitable company limited by guarantee with registration number 12325259. We are registered with the Charity Commission for England & Wales registration number 1186569 and SC050716 (Scotland).  Our notification number with the Information Commissioner is ZA437958.

In 2020 we became one of the primary national focusses for receiving gifts from the public and from companies and charitable trusts to support the work of the NHS Charities through the Covid-19 pandemic.

Why do we process your personal information?

We process your data in order to fulfil our purpose in supporting NHS charities and, where required, in order to fulfil legal or other obligations such as regulatory, audit, gift aid and anti-money laundering requirements.

Whose personal information do we process?

If you give to us, directly or via a partner, or if you are associated with an organisation which gives to us, or if we think that you or your organisation might give to us then we will process your data in accordance with this notice.

We will process personal information about you in the following circumstances:

• If you make an enquiry to us via this website or by email, phone, post or some other method.
• If you make a gift directly to NHS Charities Together (e.g. into our bank account, or via PayPal).
• If you are asked by a partner website whether you agree to receive further fundraising contact from NHS Charities Together by any specific method which, in law, requires consent (e.g. email, text message etc.) and you do agree to such contact, then we will record your consent as well as your contact and giving information.
• If you volunteer directly for us.
• If we think that you may be interested in supporting NHS Charities Together, even if we have not yet been in touch with each other. Our work in this group is likely to extend only to those people who can make especially large gifts.
• If you work for an organisation which is supporting us and we need to be in contact with you to achieve our purposes. Such organisations might include companies and other commercial organisations, charitable trusts and other funders, government agencies etc.

From where do we get your personal information?

In some circumstances we receive personal information directly from you, while in other cases we receive it from you via a third party, or from other information that is publicly available.

Directly from you

We obtain information from you if you make an enquiry on our website or by some other means, if you give directly to NHS Charities Together, or if you contact us directly in some other way.

From other publicly available information

We sometimes add extra data to the information you have already given us. We do this for purposes which are described in the section “What we do with your data”. Such data may be obtained or derived from public records (e.g. Companies’ House) or from organisations such as the Royal Mail which maintains the National Change of Address database, or from information such as that published in newspapers.  Where we use such data we are careful to check the integrity of the data source and the accuracy of information provided.

What we do with your data. And how do we make sure it is lawful?

Data Protection Laws require us to identify which legally defined “ground for processing” we will use for anything we do with your personal information. We have grouped the things we do with your information into sections for each “ground for processing”. We have done this because you have different rights depending on which of these “grounds” is being used.

Consent

Explanation: Where we use “consent” to process your information, we can only do this with your permission, and you have the right to withdraw your permission, without detriment to you, at any time. Please bear in mind that if you like receiving news about us by one of the methods listed below, and you withdraw your consent, we will no longer be able to send it to you.

If, and only if, you have consented, we may use your personal information to:

• send you messages and material which promote the programme by email, SMS, direct social media messages

If you are asked by a partner website or other giving platform whether you agree to receive further fundraising contact from us by any specific method which, in law, requires consent (e.g. email, text message etc.) and you do agree to such contact, then we will receive that information from our partner and record your consent to be contacted by that method. In these circumstances our partner will always pass your contact and giving information to us.

Legal Obligation

Explanation: Sometimes we are legally required to process your data because of our nation’s laws or some other regulatory obligation. In most cases we have no choice about this, and although you can object, we may not be able to stop using any or all of your information for any of these purposes.

The following circumstances create a legal obligation for us to process your data:

• If you allow us to claim Gift Aid then we have to keep records and pass them to Her Majesty’s Revenue and Customs
• For auditing and accounting purposes
• In respect of some gifts, there is a requirement to carry out anti-money laundering activity
• To comply with the charity regulators’ requirements to safeguard the reputation of the charity
• To comply with the legal requirement to record details of complaints about fundraising.

Legitimate Interests

Explanation: Some aspects of our work cannot be done without using your personal data, but do not fall into the group of activities where consent is required by law, nor will they be subject to a contract or a legal obligation. In most of these cases we use the “Legitimate Interests” ground for processing. This means that we must balance the benefit we get from using your data to pursue our own lawful interests against any negative impact on your rights and freedoms which might happen as a result. (If we think that there is too much negative impact then we would ask for your consent instead.) You have a right to ask us to stop using your data if we are using “Legitimate Interests” as our ground for processing.

We will use the Legitimate Interests ground for processing in circumstances such as the following:

• Putting your personal data on our database or any other form of organised filing system which we use.
• To carry out general administrative matters, both internally and to communicate with you.
• To respond to general enquiries that you might make of us, for example via our website, or by phoning, emailing, writing to us etc.
• To understand the way in which you read, or do not read, any e-newsletters we may send, or the way in which you navigate around our website.
• To update your address and other contact information where you have initially provided it and if we find that it is out of date. We only obtain data from sources (like the Royal Mail National Change of Address database) where you have consented for that organisation to pass it on to others or where there is some other lawful basis for our obtaining the data.
• Using information about your giving, together with that of others, to develop our fundraising and supporter engagement strategies.

What data do we use?

We are likely to hold the following information if you have supported us, signed up to receive marketing communications from us and / or been in touch with us:

• Your name and contact details, including some combination of email, mailing address, and telephone number(s)
• Details of the country from which you made the gift (we need this for anonymous Charity Commission reporting requirements)
• Details of when you gave to us, how much you gave and what prompted the gift
• Whether or not you have Gift Aided your donation(s)
• Whether or not you have consented to hear further from us by methods which require consent
• The method by which your data came initially to us
• Your responses to correspondence and communications between us
• Details of any enquiries you have made of us
• Details of any volunteering you have carried out for us
• Details of any fundraising pages or campaigns you have established to support us.

Who we share your data with

When considering how we share your data with another organisation, we ask ourselves whether or not we would lose control of your data by doing so. Losing control would mean that the new organisation could decide what to do with your data. We only share your data in this way if we have your consent, or if we are legally obliged to do so.

In practice this means we pass your data to others in the following limited circumstances:

• If you have given us permission to share your data with local NHS Charities
• To HMRC in order to claim Gift Aid
• To statutory bodies, for example the Charity Commission, the Information Commissioner or the Police, if they had obtained the relevant powers to require us to pass your data to them.

We may also pass your data, but not control of your data, to organisations which help us to manage our own work. These are known as Data Processors and are bound by a contract with us. They are not allowed to do anything with your data that we have not authorised, and they may not use your data for their own purposes, nor can they keep it. Examples of data processors include a mailing house which prints letters for us and our database supplier which hosts our donor database in a secure encrypted “cloud” environment.

How long do we keep your data?

NAHN will retain your data whilst you are an active member of the network. 

For more information about NHS Charities Together data retention policy please see their full privacy policy.

Your rights

The law covering privacy, which are the European General Data Protection Regulation until the end of the Brexit Transition period, and the Data Protection Act 2018 give you certain rights which you can exercise by contacting us.

These are:

• You can ask for a copy of all the data we hold about you.
• You can tell us to stop activity related to direct marketing.
• You can tell us to correct information we have about you.
• You can ask us to stop using your information. This is not an absolute right, and in certain circumstances we may have an obligation (e.g. for audit purposes) to keep at least some of your data.
• You can tell us not to include you in any profiling activity.
• You can withdraw your consent at any time for any activity which relies on consent to be lawful.
• You can ask us to stop using your data if our use falls in the Legitimate Interests category.
• You can complain to us about the use of your data, or you can complain to the Information Commissioner’s Office.

Contact details

You can contact NAHN info@nahn.org.uk

You can contact NHS Charities Together via

Suite 68, Lake View House Wilton Drive Warwick CV34 6RG

E: hello@anhsc.org.uk T: 0300 303 5748  

You can complain to the Information Commissioner via information at http://ico.org.uk or by telephoning 0303 123 1113.