We are committed to protecting your personal information and being transparent about what we do with it, no matter how you interact with us. That’s whether you want to use or services, work or volunteer for us, use our services, donate to us, if you want information, training or want to learn more about what we do.
We are committed to using your personal information in accordance with our responsibilities. We won’t do anything with your information you wouldn’t reasonably expect.
We are required to provide you with the information in this Privacy Notice under applicable law which includes (but is not limited to):
• General Data Protection Regulation (EU) 2016/679 (the “GDPR”), and
• the Privacy and Electronic Communications (EC Directive) Regulations 2003.
This Privacy Notice applies to the personal information of individuals who interact with Holding On Letting Go. It does not apply to the families for whom we provide services. This is covered by a separate Privacy Notice which can be obtained using the contact details below.
Processing of your personal information is carried out by Holding On Letting Go which is a charity registered in England with registered charity number 1103835 (“Holding On Letting Go”, “We” or “us”).
If you have any queries about our Privacy Notice, please get in touch
Phone: 03445 611511
Post: Holding On Letting Go, c/o The Wisdom Hospice, High Bank, Rochester, Kent, ME1 2NU
How and when we collect information about you
When you directly give us information We may collect and store information about you when you interact with us. For example, this could be when you:
• get in touch with us via phone, website or other method of communication;
• support our work through a donation
• fundraise on our behalf
• register for an event
• tell us your story
• submit an enquiry
• register for or use our services
• participate in our training
• give us feedback
• make a complaint
• apply for a job
• apply to volunteer with us
When you indirectly give us information When you interact with us on social media platforms such as Facebook, Twitter or LinkedIn we may also obtain some personal information about you. The information we receive will depend on the privacy preferences you have set on each platform and the privacy policies of each platform. To change your settings on these platforms, please refer to their privacy notices.
We may obtain information about your visit to our site, for example the pages you visit and how you navigate the site, by using cookies. Please visit our Cookies Policy for information on this.
When you give permission to other parties to share it with us Your information might be shared with us by independent event organisers, for example the London Marathon or fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so when you have indicated that you wish to support Holding On Letting Go, and only with your consent.
What information we might collect
When you engage with us by phone, mail, in person or online, we may collect information about you (referred to in this Privacy Notice as ‘personal information’). This may include:
iii) email address
iv) telephone number
v) date of birth
vi) job title and details of your education and career
vii) why you are interested in Holding On Letting Go
viii) other information relating to you personally which you may choose to provide to us such as diversity information.
Data protection law recognises that certain types of personal information are more sensitive. This is known as ‘sensitive’ or ‘special category’ personal information and covers information revealing racial or ethnic origin, religion, philosophical beliefs and political opinions, trade union membership, genetics, biometrics (where it is used for ID purposes), information concerning health or data concerning a person’s sexual orientation, or sex life.
Sensitive information will only be collected where necessary, for example, we may need to collect health information from you when you register for a challenge event. Clear notices will be provided at the time we collect this information, stating what information is needed, and why.
In addition, we may process special categories of data, such as information about ethnic origin, sexual orientation or religion or belief. We may also collect information about whether or not applicants are disabled to make reasonable adjustments for candidates who have a disability. We process such information to carry out our obligations and exercise specific rights in relation to employment.
With your explicit consent, we may also collect sensitive personal information if you choose to tell us about your experiences relating to our services for use in a case study.
If you’re 16 or under
If you’re aged 16 or under, you must get your parent/guardian’s permission before you provide any personal information to us.
How and why we use your information
We will use your personal information for the following purposes:
• Donation processing: We will process personal information you provide in order to administer any one-off or on-going donations you make and claim Gift Aid.
• Responding to a request: If you contact us with a query, we may use your personal information to provide you with a response.
• Fundraising or direct marketing: We will only send you marketing information by email, SMS, or phone if you have given us specific consent. If you withdraw your consent and then subsequently opt in to receive marketing information again, then your most recent preference may supersede.
• Monitoring and Evaluating: We may use your information in order to improve current and future delivery of our services. If diversity information is collected on an individual, all reporting will be anonymised.
• Processing an application to work or volunteer with us: We may process your information if you send or fill in an application form or send us your CV or details in respect of an opportunity to work with us in order to evaluate your suitability, respond to you and take steps at your request to possibly enter into a contract with you. If you use Holding On Letting Go’s services or are employed by Holding On Letting Go, please contact us and we will advise you of the applicable Privacy Notice for your situation.
• Using our website: We may use your personal information to help provide you with access to our website, personalise your experience, and improve and develop it further.
• Administration: We may use your personal information to record and deal with a complaint, record a request not to receive further marketing information, record what our counsellors on placement have done for us, and for other necessary internal record keeping purposes.
• Protecting your vital interests: We may process your personal information where we reasonably think that there is a risk of serious harm or abuse to you or someone else.
• Legal, regulatory and tax compliance: Where we are subject to a legal obligation, we may process your personal information to fulfil that obligation. Profiling and analysis: We may occasionally and for the purposes of our legitimate interests use your personal information to conduct profiling of our supporters or potential supporters. This will help us target communications in a more focused, efficient and cost effective way, helping us reduce the chances of supporters and potential supporters receiving inappropriate or irrelevant communications.
You can unsubscribe to such use of your personal information for profiling at any time by contacting us at the details set out at the end of this Privacy Notice in Table 1. Details will also be included with each communication.
Lawful Basis of Us Processing Your Data
Who do we share your information with?
We will only use your information for the purposes for which it was obtained. We will not, under any circumstances, sell or share your personal information with any third party for their own purposes, and you will not receive marketing from any other companies, charities or other organisations as a result of giving your details to us.
We will only share your data for the following purposes:
• Third party suppliers: We may need to share your information with data hosting providers or service providers who help us to deliver our services, projects, or fundraising activities and appeals. These providers will only act under our instruction and are subject to pre-contract scrutiny and contractual obligations containing strict data protection clauses.
• Where legally required: We will comply with requests where disclosure is required by law, for example, we may disclose your personal information to the government for tax investigation purposes, or to law enforcement agencies for the prevention and detection of crime. We may also share your information with the emergency services if we reasonably think there is a risk of serious harm or abuse to you or someone else.
We always aim to ensure that personal information is only used by those third parties for lawful purposes in accordance with this Privacy Notice.
• In the case of people applying for jobs or as volunteers at Holding On Letting Go, applications will be shared with the recruiting managers and interview panels.
Payment Processors: To process some payments (including donations) to Holding On Letting Go, we may need to pass some of your personal information to Worldpay – for credit/debit card payments.
The Holding On Letting Go website may include links to other sites, not owned or managed by us. We cannot be held responsible for the privacy of your personal information collected by these websites not managed by us.
How we protect your information
We use technical and corporate organisational safeguards to ensure that your personal information is secure. We limit access to information on a need-to-know basis and take appropriate measures to ensure that our people are aware that such information is only used in accordance with this Privacy Notice.
We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff or volunteers. Our online forms are always encrypted and our network is protected and routinely monitored.
If you use your credit or debit card to donate to us online, we pass your card details securely to our payment processing partners. We do this in accordance with industry standards and do not store the details on our website.
However, please be aware that there are always inherent risks in sending information by public networks or using public computers and we cannot 100% guarantee the security of data (including personal information) disclosed or transmitted over public networks.
If you suspect any misuse or loss of or unauthorised access to your personal information please let us know immediately.
How long will we keep your information?
We will keep your personal information in respect of financial transactions for as long as the law requires us to for tax or accounting purposes (which may be up to seven years after a particular transaction).
If you request that we stop processing your personal information for the purpose of marketing we may in some instances need to add your details to a suppression file to enable us to comply with our request not to be contacted.
In the case of people applying for jobs or volunteer roles at Holding On Letting Go, all information collected on applicants will be permanently deleted after 6 months from the last application.
All personal data referring to volunteers will be permanently deleted 6 years after they end their time as a volunteer.
Please note that in certain circumstances, we may hold this data for a longer period if for example we believe in good faith that the law or relevant regulators require us to preserve your data.
In respect of other personal information, we will retain it for no longer than necessary for the purposes for which it was collected, taking into account guidance issued by the Information Commissioner’s Office.
Your rights to your personal information
Data protection legislation gives you the right to request access to personal information about you which is processed by Holding On Letting Go and to have any inaccuracies corrected.
You also have the right to ask us to erase your personal information, ask us to restrict our processing of your personal information or to object to our processing of your personal information.
If you wish to exercise these rights, please contact us using the details at the end of this document.
HOW CAN YOU ACCESS, AMEND OR TAKE BACK THE PERSONAL INFORMATION THAT YOU HAVE GIVEN TO US?
One of the GDPR’s main objectives is to protect the rights of individuals with regards to data privacy. Where we hold your personal information, you have various rights in relation to it, which are set out below.
To get in touch about these rights, please contact us, using the details below. We aim to deal with your request without undue delay, and in any event within one month (subject to any extensions to which we are lawfully entitled). Please note that we may keep a record of your communications to help us resolve any issues which may be raised.
The GDPR gives you the following rights in relation to your personal information:
Right to object: this right enables you to object to us processing personal information you give us where we do so for one of the following reasons:
• because it is in our legitimate interests to do so;
• to enable us to perform a task in the public interest or exercise official authority;
• to send you direct marketing materials; or
• for scientific, historical, research, or statistical purposes.
Right to withdraw consent: Where we have obtained your consent to process your personal information for certain activities, you may withdraw all or part of your consent at any time and we will cease to carry out that particular activity unless we consider that there is an alternative lawful basis to justify our continued processing of your data for this purpose, in which case we will inform you of this condition.
Data Subject Access Requests (DSAR): You may ask us to confirm what personal information of yours we hold about you at any time, and request us to modify, update or delete such information. We may ask you for more information about your request. If we provide you with access to the information we hold about you, we will not charge you for this unless your request is “manifestly unfounded or excessive”. If you request further copies of this information from us, we may charge you a reasonable administrative cost. Where we are legally permitted to do so, we may refuse your request. If we refuse your request we will always tell you the reasons for doing so.
Right to erasure: You have the right to request that we “erase” your personal information in certain circumstances. Normally, the information must meet one of the following criteria:
• The data are no longer necessary for the purpose for which we originally collected and/or processed them;
• Where previously given, you have withdrawn your consent to us processing your data, and there is no other valid reason for us to continue processing;
• The data has been processed unlawfully (i.e. in a manner which does not comply with the GDPR);
• It is necessary for the data to be erased in order for us to comply with our obligations as a data controller under EU or Member State law; or
• If we process the data because we believe it necessary to do so for our legitimate interests, you object to the processing and we are unable to demonstrate overriding legitimate grounds for our continued processing.
We would only be entitled to refuse to comply with your request for one of the following reasons:
• To exercise the right of freedom of expression and information;
• To comply with legal obligations or for the performance of a public interest task or exercise of official authority;
• For public health reasons in the public interest;
• For archival, research or statistical purposes; or
• To exercise or defend a legal claim.
When complying with a valid request for the erasure of data we will take all reasonably practicable steps to delete the relevant data.
Right to restrict processing: You have the right to request that we restrict our processing of your personal information in certain circumstances. This means that we can only continue to store your data and will not be able to carry out any further processing activities with it until either: (i) one of the circumstances listed below is resolved; (ii) you consent; or (iii) further processing is necessary for either the establishment, exercise or defence of legal claims, the protection of the rights of another individual, or reasons of important EU or Member State public interest.
The circumstances in which you are entitled to request that we restrict the processing of your personal information are:
• Where you dispute the accuracy of the personal information that we are processing about you. In this case, our processing of your personal information will be restricted for the period during which the accuracy of the data is verified;
• Where you object to our processing of your personal information for our legitimate interests. Here, you can request that the data be restricted while we verify our grounds for processing your personal information;
• Where our processing of your data is unlawful, but you would prefer us to restrict our processing of it rather than erasing it; and
• Where we have no further need to process your personal information but you require the data to establish, exercise, or defend legal claims.
If we have shared your personal information with third parties, we will notify them about the restricted processing unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on processing your personal information.
Right to rectification: You also have the right to request that we rectify any inaccurate or incomplete personal information that we hold about you, including by means of providing a supplementary statement. If we have shared this personal information with third parties, we will notify them about the rectification unless this is impossible or involves disproportionate effort. You may also request details of the third parties that we have disclosed the inaccurate or incomplete personal information to. Where we think that it is reasonable for us not to comply with your request, we will explain our reasons for this decision.
Right of data portability: If you wish, you have the right to transfer your personal information between data controllers. In effect, this means that you are able to transfer the details we hold on you to a third party. To allow you to do so, we will provide you with your data in a commonly used machine-readable format so that you can transfer the data to a third party. Alternatively, we may directly transfer the data for you. This right of data portability applies to: (i) personal information that we process automatically (i.e. without any human intervention); (ii) personal information provided by you; and (iii) personal information that we process based on your consent or in order to fulfil a contract.
Right to lodge a complaint with a supervisory authority: You also have the right to lodge a complaint with your local supervisory authority which is the Information Commissioner’s Office in the UK. You can contact them in the following ways:
• Phone: 0303 123 1113
• Email: firstname.lastname@example.org
• ICO.org.uk via Live chat
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
If you would like to exercise any of these rights, or withdraw your consent to the processing of your personal information (where consent is our legal basis for processing your personal information), please contact us using the details found in Table 1. Please note that we may keep a record of your communications to help us resolve any issues which you raise.
How to make a complaint or raise a concern
If you would like more information, or have any questions about this policy, to make a formal complaint about our approach to data protection or raise privacy concerns please contact us:
Phone: 03445 611511
Post: Holding On Letting Go, c/o The Wisdom Hospice, High Bank, Rochester, Kent ME1 2NU
If you are not happy with the response you receive after making a complaint, then you can raise your concern with the relevant statutory body:
Information Commissioner’s Office:
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Alternatively you can visit their website.
Changes to our Privacy Notice
Our Privacy Notice may change from time to time, so please check this page occasionally to see if we have included any updates or changes, and that you are happy with them.
(Last updated: May 2018)