Birmingham Women’s and Children’s Hospital Charity Privacy Policy

A crucial element of the trust we hope to earn from our supporters, members of the public, or any other individuals who engage with us, comes from being open, honest and lawful in the way we process personal data. This policy explains how we (Birmingham Women’s and Children’s Hospital Charity) collect, use and store your personal data.

For families using NHS services, Birmingham Women’s and Children’s NHS Foundation Trust has its own privacy policy.

We may change this policy from time to time by updating this page. You should check this page periodically to see the latest version of our policy. This policy is effective from 1st August 2018.

Introduction

Birmingham Women’s and Children’s Hospital Charity (“we” and “us”) promises to respect any personal data you share with us, or that we get from other organisations and keep it safe. We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect. 

In carrying out our day-to-day activities we are required by law to adhere to, amongst other things, the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. We take our responsibilities under these Regulations very seriously and we aim to ensure the personal information we obtain is held, used, transferred and otherwise processed in accordance with the law. 

Who we are

The data controller is Birmingham Women’s and Children’s Hospital Charity, a registered charity in England and Wales (1160875) and a Company Limited by Guarantee (09404174). You may deal with us through our Birmingham Children’s Hospital Charity or Birmingham Women’s Hospital Charity brands, and you may purchase goods from our wholly owned trading subsidiary, Red Balloon Trading CIC, which is a community interest company registered in England and Wales (05996296). 

The bch.org.uk and bwh.org.uk websites are operated by Birmingham Women’s and Children’s Hospital Charity.

How do we collect information?

When you provide it to us directly

You may provide personal information by electronic means (email and website), by letter, by phone, or in person. Examples include when you call Birmingham Women’s and Children’s Hospital Charity regarding our activities, register online to participate in a fundraising event, or make a donation at our Fundraising Hub inside the Children’s Hospital. 

When you provide it to us indirectly

We may receive information about you from third parties – but only if you’ve given them permission to share your information with us. 

Examples include your information being shared with us by independent event organisers, for example the London Marathon or sites like JustGiving. These independent third parties will only do so when you have indicated you wish to support Birmingham Women’s and Children’s Hospital Charity and with your consent. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.

From third party organisations

We may also receive data which you have agreed to share with charities, or you have submitted to receive another service and have agreed for the information be shared with others. Examples of this include using the Royal Mail National Change of Address Update service, where you request your mail to be redirected and for organisations who contact you to be updated with your new address details. 

When you have made your information available publicly  

Like most websites, we use cookies to help us make our site – and the way you use it – better. A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site.

Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. 

Our cookies contain no data specific to an individual, so your privacy remains protected. They contain neither your email address, nor do they tell us who you are.

We use cookies to help track the success of our online advertising and monitor how people use our websites, to assess the success of different email communications and for our web analytics. 

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. 

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website. 

We use web visitor analytics (e.g. Google Analytics) to understand how people use our website so we can make it more effective. Web analytics tools collect anonymous information about what people do on our website, where they’ve come from and whether they’ve completed any tasks on the site, for example, signing up to volunteer or donating. We also gather information such as pages most visited, the events or activities of most interest and products purchased, to help improve our website and activities. 

Analytics tools track this information using cookies which are text files placed on your computer. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by internet companies on servers that may be outside the EU. This information is used for the purpose of evaluating your use of the website and compiling reports on website activity. Wherever possible, we keep this information anonymous so it will not identify you as an individual visitor to our website. 

All but essential cookies require your consent to be placed on your device and you will be asked if you would like to consent every time you visit our website through our cookie banner. If you do not want cookies to be stored on your PC it is possible to disable this function without affecting your navigation around the site although some of the functionality of our website may be affected.

We also use data from Interest-based advertising or third party audience data (such as age, gender, and interests) with our web analytics. 

What personal information we collect  

The type and quantity of information we process and how we use it depends on why you are providing it to us. Examples include making a donation, submitting an enquiry, or making a complaint.

Information we collect may include;

• Your name
• Your contact information including address, email address, telephone numbers
• Your date of birth
• Your bank account or debit/credit card details, for making donations or purchases
• Other pertinent information which you have freely provided to us in conversations or correspondence

Where appropriate we may also collect 

• Information relating to your health, for example if you are taking part in a high-risk event
• Why you have decided to donate to us, if you are comfortable telling us this.

For families using NHS services Birmingham Women’s and Children’s NHS Foundation Trust has its own privacy policy, which can be found on the Trust website. As part of this, you can choose to opt out of sharing your confidential patient information for research and planning. To find out more visit nhs.uk/your-nhs-data-matters or call 0300 303 5678. 

Special Category Data 

Certain types of personal information are in a special category under data protection laws, as they are considered to be more sensitive. Examples of this type of sensitive data would be information about health, race, religious beliefs, political views, trade union membership, sex life or sexuality or genetic/biometric information. 

We only collect this type of information about our supporters when there is a clear reason for us to do so, for example asking for health information if you are taking part in an event. We may also collect this type of information if you make it public or volunteer it to us – for instance if you tell us your medical history as part of a conversation about your experiences with Birmingham Women’s and Children’s NHS Foundation Trust. 

We do not process special category data on a large or organised scale, for example in the scenario above, we may use this special category data to inform our relationship or conversations with you, but we will never use it for marketing purposes either on an individual or mass basis. 

How we will use your personal data 

We will only ever use your personal information for the purpose(s) originally intended, those which you agree to, or those which you would reasonably expect us to.

Below are some examples of how we may use your personal information 

• To provide you with the services, products or information you have requested
• To process any donation(s) we may receive from you
• To provide you with information about our work or our activities, including asking you to help us raise money or donate money to our charity, but always in accordance with how you have agreed to be contacted
• To ensure we know how you prefer to be contacted
• To send you items you have ordered through our shop
• To invite you to participate in surveys or research
• To show you adverts online and on social media about our campaigns, projects etc we think they may be interested in
• To publicise your story and experiences of Birmingham Women’s or Birmingham Children’s Hospital to raise awareness of our work. This will only happen after discussions with you, and with your expressed consent. We keep you updated about when and where we use your story
  
• For administration purposes e.g. we may contact you about a donation you have made or event you have expressed an interest in or registered for
• For internal record keeping, such as the management of feedback or complaints
• To analyse and improve the services we offer
• The use of IP addresses to block disruptive use, to record website traffic or to personalise the way our information is presented to you to identify your approximate location
• Where it is required or authorised by law
• For the purposes of credit risk reduction or fraud prevention (regrettably some people target charities for illegal purposes such as money laundering and, quite rightly, we are required to monitor financial activity and report suspected fraud to the appropriate authorities)

Building profiles of supporters and targeting communications

Profiling means gathering information about individuals and analysing their characteristics and behaviour patterns to place them in a certain category to help inform the efficiency of our fundraising activity or to help identify possible new supporters.

It’s a procedure that involves processing personal information using a series of statistical deductions to make predictions about people, which makes an inference based on the qualities of others who appear statistically similar to the individual whose personal information is being processed. 

We use profiling and screening techniques to ensure our fundraising activity and marketing communications are relevant and timely and to provide an improved experience for our supporters.  

We want to send you the most relevant information and only promote donation opportunities we believe you’re most likely to be interested in, or potential supporters who have similar characteristics to you.  

Profiling also allows us to target our resources effectively, which supporters tell charities is a key priority for them. We do this because it allows us to understand the background of the people who support us and helps us to make appropriate requests to supporters who may be able and willing to give more than they already do. Importantly, it enables us to raise more funds, sooner and more cost-effectively, than we otherwise would. 

When building a profile we may analyse geographic, demographic and other information relating to you in order to better understand your interests and preferences in order to contact you with the most relevant communications. In doing this, we may use additional information from third party sources when it is available, as detailed earlier in this Policy. 

Social Media 

We use social media to communicate with you and share information about campaigns or events. Currently we use Facebook, LinkedIn, Twitter and Instagram. We do this through advertising on your social media or through posting messages and information on our own social media pages which you may choose to “like”, “follow” or interact with.  

We participate in Facebook’s Custom Audience and Lookalike Audience programs, which enable us to display our content to our existing or potential supporters on Facebook. We provide personal information such as your email address or phone number to Facebook which securely encrypts it. That personal information is then deleted by Facebook if it does not match with a Facebook account or once they confirm you have an account. We will only do this if you have already consented to us sending you marketing via email and where we believe the marketing communication may be of interest to you.  

For more information, please see facebook.com/business/help/744354708981227 and facebook.com/business/help/365463786964246. If you do not want your information to be used in this way, please contact us. 

The legal basis for processing your information 

Data protection laws mean we must have a legal basis to process personal information. The relevant legal bases set out under the GDPR, are listed below, where we also detail examples of our activities which we process under each basis. 

Specific Consent 

Consent is where we ask you if we can use your information in a certain way, and you agree to this. For example, any time we send you marketing via electronic means – that is SMS or email – we will only do so when we have clear and unambiguous consent from you. You have the right to withdraw consent for any future use of your information for these purposes at any time. 

Legal Obligation 

We have a basis to use your personal information where we need to do so to comply with a legal or regulatory obligation. For example, in some cases we may need to share your information with a regulator such as the Information Commissioner or Fundraising Regulator. 

Performance of a contract or taking steps at your request to prepare for entry into a contract 

We have a basis to use your personal information where we are entering into a contract with you or performing our obligations under that contract. Examples of this would be if you are buying something from us, for instance purchasing merchandise through our online shop, or if you are applying to work or volunteer with us. 

Vital Interests 

We have a legal basis to use your personal information where it is necessary for us to protect life or health; these are examples of your vital interest. For instance, if there were to be an emergency impacting individuals at one of our events which required us to contact people unexpectedly or share their information with emergency services. 

Legitimate interests 

We have a basis to use your personal information if it is reasonably necessary for us (or others) to do so, this means it’s in our or their legitimate interests – provided the reason your information is used for is fair and does not unduly impact your rights. 

We consider our legitimate interests to include all of the day-to-day activities Birmingham Women’s and Children’s Hospital Charity carries out with personal information. Some examples of where we rely on legitimate interests are: 

• Analysis and profiling of our supporters using personal information we already hold
• Updating your address using third party sources if you have moved house (please see the “How do we collect information?” section above for details of this) 
• Use of personal information when we are monitoring use of our website or apps for technical purposes 
• Use of personal information to administer, review and keep an internal record of the people we work with, including supporters, volunteers and researchers 
• Use of personal information to communicate with you via social media or via Google ads
• Sharing of personal information between relevant teams within Birmingham Women’s and Children’s Hospital Charity, and between our trading subsidiaries 
• Where you have signed up with us on a charity place for a third party event, for example a sponsored run not organised by us, we may share personal information with the third party event organiser so they can effectively administer the event 

When using legitimate interests, we assess any potential impact on you, whether it is intrusive from a privacy perspective and whether it is aligned your rights under data protection laws.

When we process sensitive personal information, known as Special Category data, (please see the “What personal information we collect” section above), we require an additional legal basis to do so under data protection laws, so will either do so on the basis of your explicit consent or another route available to us at law for using this type of information (for example if you have made the information manifestly public or have freely provided this information to us). We do no process Special Category data on a large or organised scale. 

How we protect your personal information 

We follow best practice for web and data security. Although we cannot 100% guarantee the security of any information you give us, we enforce strict physical, electronic and managerial measures to ensure we keep your information secure, accurate and up-to-date and we only keep it as long as is reasonable and necessary.
 

We undertake regular reviews of who has access to information we hold, to ensure your information is only accessible by appropriately trained staff, volunteers and contractors. 

Links to other websites 

Our website may contain links to other websites belonging to third parties and we sometimes choose to participate in social networking sites including but not limited to YouTube, Facebook, Twitter and Instagram. We may also include content from sites such as these on our website, however, once you have used these links to leave our site, you should note we do not have any control over the privacy practices of these other websites. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question. 

Will we disclose the information we have collected to outside parties? 

Birmingham Women’s and Children’s Hospital Charity does not rent, swap or sell personal details to any third party. 

Some of the systems operated by Birmingham Women’s and Children’s Hospital Charity are provided by third party service providers including fully hosted IT solutions, for example Direct Debit payment processing, at remote sites and accessed via the internet. 

In addition we may use external companies to assist with fundraising activities such as newsletter production and mailing house services, supporter recruitment and management, lottery and data analytics. 

Where these services are provided, personal information may be released to the third party organisation under an agreed contract, which will stipulate how data is to be transferred, secured and destroyed and the purpose for which it may be used. 

Birmingham Women’s and Children’s Hospital Charity remains responsible for the data and ensuring it is processed in accordance with GDPR. 

We take all reasonable steps to ensure any third party processing data on our behalf adheres to our data protection principals highlighted in this policy by undertaking a due diligence review of the data protection policies of the proposed data processor to ensure as far as reasonably practicable the safety, security and availability of data. 

Some of our suppliers may run their operations outside the European Economic Area (EEA). Although they may not be subject to same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK and EU law. By submitting your personal information to us you agree to this transfer, storing or processing at a location outside the EEA.

We may need to disclose your details if required to the police, regulatory bodies or legal advisors.
We will only ever share your data in other circumstances if we have your explicit and informed consent.

Your rights to see what we know about you, to make changes, to ask us to stop processing your data, and to ask us to delete information we hold. 

You have a right to ask us to stop processing your personal data, and if it’s not necessary for the purpose you provided it to us for (e.g. processing your donation or registering you for an event) we will do so.

You have the right to request a copy of the personal information relating to you which is held by Birmingham Women’s and Children’s Hospital Charity. 

You also have the right to request all data held by us to be deleted. There may be some circumstances where this is not possible, for example if we need to keep the data to comply with a legal obligation.