This privacy notice covers specific information about how we use, collect and store your personal data if you are a supporter of the hospice. Please see our overarching privacy statement for more information about other ways we use personal data.
As used in this Privacy Notice, “personal data” means any information that relates to, describes, or could be used to identify an individual, directly or indirectly.
Personal data that we collect
- Identifiers, your full name, address, email, company name, company website, telephone number.
- Account Payment Information, your credit/debit card number, signature, bank wire transfer information.
- Internet or Similar Network Activity, information on your interaction with our website.
- Cookies and Other Technologies, website cookies and similar technologies to distinguish you from other visitors and compile information about the usage of our website. For further information, please refer to our website terms and conditions.
How we collect personal data
We use different methods to collect personal data from and about you, not limited to
- giving us information about you by filling in forms,
- accessing or utilising any part of our website,
- making a donation,
- requesting support,
- subscribing to our newsletters,
- requesting information or materials (e.g. fundraising materials),
- registering for events,
- participating in surveys or evaluations,
- submitting questions or comments,
- or by corresponding with us by phone, email or otherwise.
If you are aged 16 or under, you must get your parent/guardian’s permission before you provide any personal information to us.
How we use personal data
We may use the personal data we collect for one or more of the following purposes:
- To fulfill or meet the reason you provided the information and to provide our services.
- To process your donations or product/information requests and to provide appropriate acknowledgement
- To process financial information and payments, including Gift Aid.
- To keep you informed of our work, the latest news and to ask for donations or other fundraising support in accordance with your contact preferences.
- To maintain the safety, security and integrity of our website, services, databases and other technology assets and business.
When building a profile of our supporters, we use a range of profiling and screening techniques using data we have collected directly from you and combine it with:
- information from publicly available sources such as charity websites and annual reviews, corporate websites, public social media accounts, the electoral register and Companies House;
- information from reputable external organisations such as Factary, to provide additional socio-demographic information about our supporter base.
- We want to improve how we talk to you and the information we provide through our website, services, products and information. To do this we sometimes use profiling and screening methods so that we can better understand our supporters and potential supporters, your preferences and needs to provide a better experience for you.
- We may also estimate gift capacity based on visible assets, history of charitable giving and your connection to St Catherine’s Hospice to identify people who may be able to give a larger gift in support of our work.
- We do this because we believe our collection and use of your personal information is necessary and in the best interests of St Catherine’s Hospice, to ensure that we engage with you in the most appropriate and efficient way, ensuring that we use our charitable resources efficiently.
We may utilise AI assistance and integrated AI platforms, such as Thread Fundraising, which will use the information and data provided by you, to assist us in:
- Building and automating our supporter journeys
- Creating personalised communications to our supporters
- Communicate through electronic means (Email, SMS, WhatsApp) – only where we have the appropriate consent or legitimate interest in place
- Integrate with other fundraising platforms, such as Just Giving.
Such AI assistance and platforms will also provide AI assisted support by way of a chatbot integrated into our website.
The use of AI is strictly managed, by ensuring appropriate due diligence checks have been undertaken on the processing of data and that proper information governance frameworks exist to ensure compliance with GDPR provisions.
The legal basis for collecting and using the personal data described above will depend on the personal data concerned and the specific context in which we collect it, including but not limited to: (a) consent to collect and process your personal data; (b) legitimate interest; (c) necessary for compliance with a legal obligation; or (d) performance of a contract.
We rely on the ‘legitimate interest’ for processing where we believe it is in the legitimate interests of you, as the data subject, or of St Catherine’s Hospice, to process your data. When we process your personal information in this way, we also consider and balance any potential impact on you and your rights under data protection laws. We will not use your personal information for activities where our interests are overridden by the impact on you, for example where collection and use of your information would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law).
We will only use your information in accordance with the purposes described in this notice. We consider our legitimate interests to include the following activities carried out by St Catherine’s Hospice:
- Where you have signed up to fundraise for us at an event, to contact you about the event and support you in your fundraising journey. We may also share your personal information with the third-party organiser (where applicable) so they can administer the event.
- To update your address using third party sources if you have moved house.
- To thank next of kin for donations collected in memory of a loved one.
- To contact prospective company supporters by email, phone or post to find out about their giving policies, make them aware of the hospice and talk about opportunities to support us.
- To contact prospective Trust funders by email, phone or post to find out more about their giving criteria and to apply for funds.
- To contact prospective supporters by post where information in the public domain suggests that they may be interested in supporting the hospice.
- To contact people who have previously supported the charity where we believe they will be interested in supporting us again.
- To use publicly available information, giving history and third-party organisations to identify supporters who could potentially give a larger gift to the hospice.
- To track whether you open/forward/click through email/digital campaigns in order to send you the most relevant information in the future.
- To maintain consent selections for supporters/individuals who have requested not to be contacted by the hospice to prevent unwanted communications in the future.
- To send direct marketing material to supporters by post for fundraising purposes.
- Taking and using photos and/or films of event participants and attendees.
- Promoting St Catherine’s Hospice on social media, Google, YouTube and other online platforms
With the introduction of the Data (Use and Access) Act, we are able to utilise “Soft Opt-In” for email marketing. Similarly to legitimate interests, this allows St Catherine’s Hospice to send electronic mail marketing to people whose personal information is collected when they support, or express an interest in, our work, unless they object (Opt-Out).
How we share personal data
We will not share, sell or rent your personal information to any third party for marketing purposes, or any other commercial reason. We may disclose your personal data to a third party* for a business purpose, including those described in the “How we use personal data” section above.
St Catherine’s Hospice may share your personal data in the following ways:
- to fulfill the purpose for which you provide it and to enable relevant employees to undertake their specific duties (limited to the need for processing)
- with your consent
- for payment processing (donations, subscriptions etc.)
- to provide services, products and/or information requested by you (e.g. this would include third parties who fundraise on our behalf or administer our lotteries and raffles)**
- to better understand our supporters through socio-demographic data and other publicly available information
- for the purposes of events that you have registered to attend
- for the purposes of fraud and credit risk reduction
- where we are under a duty to disclose or share your personal information to comply with any legal obligation or to enforce or apply the terms of a legal agreement
- with analytics and search engine providers that assist us in the improvement and optimisation of our website if they need to fix software bugs or develop new features for our internal systems; and if we carry out marketing or client care surveys to gain feedback and improve our services and products.
- to protect the rights, property, or safety of St Catherine’s Hospice, our employees, our patients, or others.
*Please note that we do not control the privacy or security practices of these third parties.
**As of September 2026, our hospice lottery is provided and run by the Local Hospice Lottery. They are the data controller and are responsible for managing your lottery account, processing payments and responding to queries. To find out more information about how they protect your data and how to contact them, please read the Local Hospice Lottery Privacy Policy.
We will act as Joint Data Controller with the Local Hospice Lottery for any member data they share with us on a monthly basis. This data will include confirmation of whether or not St Catherine’s Hospice will have a valid and legal basis (legitimate interest or a valid opt-in) for sending lottery members marketing communications in relation to St Catherine’s Hospice.
How we store your information
The personal information that we collect from or about you may be transferred to, and stored at, a destination outside the European Economic Area (EEA) (e.g. fundraising events that are outside the EEA, or in order to process credit/debit card transactions, the bank or card processing agency may require verification of your personal details for authorisation outside the EEA).
By submitting your personal information, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with this privacy notice.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our website; any transmission is at your own risk. Once we have received your personal information, we will use strict procedures and security features to try to prevent unauthorised access.
We will store your data for the periods of time required by law and as set out in our records management policy, a copy of which is available on request.
Data subject rights
You have certain rights regarding our processing of your personal data under UK GDPR. This section describes these rights and how you can exercise them. When you make a request to exercise any of these rights, we may provide more detailed information regarding any exceptions or limitations that apply.
Right to be informed: Individuals have the right to be informed about the collection and use of their personal data.
Right of access: Individuals have the right to access and receive a copy of their personal data, and other supplementary information.
Right to rectification: The UK GDPR includes a right for individuals to have inaccurate personal data rectified or completed if it is incomplete.
Right to erasure: The UK GDPR introduces a right for individuals to have personal data erased.
Right to restrict processing: Individuals have the right to request the restriction or suppression of their personal data.
Right to data portability: The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.
Right to object: The UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances.
Rights related to automated decision making including profiling:
The UK GDPR has provisions on:
- automated individual decision-making (making a decision solely by automated means without any human involvement); and
- profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.
You have the right to access personal information we hold about you. If you would like a copy of your personal information, believe that any personal information we are holding on you is incorrect or incomplete, or have any other data protection related issues or queries, please contact us at privacy@stch.org.uk.
In order to maintain the accuracy of our supporter database, you can update your consent/contact preferences by writing to us, calling and speaking to one of our Supporter Services team on 01293 447360 or by emailing supporterservices@stch.org.uk.
You have the right to ask us not to process your personal information for marketing purposes. We will usually inform you (before collecting your personal information) if we intend to use your personal information for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your personal information. You are also free to exercise this right at any time by contacting us as per the above.
Please note that we may need certain information to enable us to provide you with the services and/or information you ask for, so changes you make to your preferences or restrictions you ask us to make on how we use your personal information may affect what services and information we can provide.
Changes to this Privacy Notice
We may update this Privacy Notice from time to time. When we do so, we will post the updated Privacy Notice on our website and update the Privacy Notice’s Effective Date.
Version 4 – Reviewed July 2026
