Guy’s and St Thomas’ Privacy Statement
Our supporters are incredibly important to us. Without your help, we simply wouldn’t be able to support the amazing work our hospitals carry out every day. The Fundraising Team is here to raise money to fund the work we do – but we can’t do it without you. However you choose to help, we’ll always respect your rights and your choices.
We promise to respect any personal data you share with us and keep it safe. We aim to be clear when we collect your personal information and not do anything you wouldn’t reasonably expect. Here we tell you what we will and will not do with your personal data.
- Who we are
- Our duty
- Legal basis for processing
- How will we collect information on you?
- How will we use your personal information?
- Who has access to your personal information?
- How will we keep your personal information secure?
- How long will we hold your personal information for?
- Your choices
- Your right to be forgotten
- Keeping your information up-to-date
- Your rights
- Children and privacy
- Vulnerable circumstances policy
- Complaints, compliments or comments
- Changes to our Privacy Statement
If you have any questions about our privacy statement then please do contact a member of the team who will be happy to talk you through it.
Our contact details are:
Guy’s and St Thomas’ Fundraising Team
Virginia Woolf Building
London WC2B 6LE
Telephone: 020 7848 4701
Who we are
We are the Fundraising and Supporter Development Team (FSD) at King’s College London (KCL). Back in 2011 a decision was taken by Guy’s and St Thomas’ Charity to merge their fundraising function for Guy’s and St Thomas’ Hospitals with King’s College London.
The Fundraising and Supporter Development Team fundraise on behalf of Guy’s and St Thomas’ Charity to raise money for the benefit of Guy’s and St Thomas’ NHS Foundation Trust amongst other activities which service the Charity’s purpose. Evelina London Children’s Hospital is part of Guy’s and St Thomas’ NHS Foundation Trust.
We fundraise for pioneering research projects, innovative treatments and life-saving equipment, along with lots of smaller, personal touches that make patients’ time in our hospitals much more bearable.
Guy’s and St Thomas’ Charity are the data controllers and King’s College London are the data processors for the Charity’s fundraising activities. This means both organisations have access to, and management of how your personal and financial data is collected, used and stored.
Guy's and St Thomas' Charity Registered Charity No. 1160316 Company limited by guarantee registered in England and Wales No. 9341980
In carrying out our day to day activities we process and store personal information relating to our supporters and we are therefore required to adhere to the requirements of the Data Protection Act 2018. We take our responsibilities under this act very seriously and we ensure the personal information we obtain is held, used, transferred and otherwise processed in accordance with that Act and all other applicable data protection laws and regulations including, but not limited to, the EU General Data Protection Regulation (2016/679), Data Protection Act 2018 and the Privacy and Electronic Communication Regulations 2003 ('Data Protection Laws').
Legal basis for processing
Data Protection Laws require us to outline the lawful grounds on which we collect and process your personal data. Personal data is information you provide or we collect where you can be identified as an individual.
When we process your personal data we rely on one or more of the following grounds:
We may process your personal data where it is within our legitimate interests to do so to enable us to effectively fundraise, administer and further the fundraising ambitions of Guy's and St Thomas' Charity. To meet these objectives we may:
• Send direct marketing material to supporters by post for fundraising purposes
• Conduct research to better understand who our supporters are and more efficiently target our fundraising activity
• Measure, analyse and understand how our supporters respond to a variety of marketing activity so we can ensure our future activities are well targeted, relevant and effective
• Supporter analysis and profiling to allow us to tailor the supporter experience and communications to ask for support in an appropriate way
• Process and acknowledge donations
• Administer events and support your fundraising efforts
• Keep a record of your communications with us
• Volunteer management
• Take and use photos and/or films of event participants and attendees
• Manage feedback and complaints
We will always seek to pursue these legitimate interests in a way that does not unduly infringe on other legal rights and freedoms and your right of privacy. We will always aim to process your data in a manner that you would reasonably expect, carefully balancing your interests against our interests when deciding whether it is appropriate.
Consent is where we ask you if we can use your personal data for specific purposes (having informed you of those purposes), and you freely and unambiguously agree to such use. You have the right to withdraw your consent at any time.
We have a legal basis to use your personal information where we need to comply with one of our legal or regulatory obligations. This might include an order from a court regulatory authority, or holding donor transactional details for Gift Aid or accounting/tax purposes.
Additionally, in line with the Fundraising Regulator’s Code of Fundraising Practice and the Charity Commission’s ‘Know your Donor’ policy, we are required by law to protect against the possibility of charitable donations being used as part of criminal activity such as fraud or money laundering, which would need to be reported to the authorities. Such instances are rare but where a risk is highlighted, we are required to process personal data in order to carry out due diligence in order to be confident in accepting legitimate offers of support.
Performance of a contract
In order to process donations we may need to collect bank details and financial information alongside contact details. We rely on these details to be able to fulfil a contract with you and service your financial transactions i.e. Direct Debits.
Sensitive personal information
Please also note that some of the personal information you supply and that we process may include what is known as 'special category' or 'sensitive' data about you, for example, information regarding your ethnic origin or political, philosophical and religious beliefs, health or sex life. We will only process such information with your explicit consent; or, where you have already publicised such information; or, where we need to use such sensitive data in connection with a legal claim that we have or may be subject to.
How will we collect information on you?
We collect personal information from you when you enquire about our activities, register for an event, make a donation, sign up to an event, volunteer, engage with our social media channels or otherwise provide us with your personal information.
The personal information that we may request might include your name, your age, gender, location and/or country information, and possibly other information, as well as credit card or other financial information needed to process donations or event fees. We may also ask you if you are a UK tax payer so that we can claim Gift Aid (please rest assured that we do not collect information about your actual tax payments, just whether you are a tax payer). We may ask you about what motivates you to support our work, or whether there is a particular area of the hospital you are interested in to help us tailor our communications to you, however these questions will always be optional. We will never request specific information about your health or the health of your family members or friends unless we inform you how that information will be used and receive your express consent for such use i.e. for a case study story.
Your information may be shared with us by independent event organisers, for example London Marathon Events Ltd or fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so when you have indicated that you wish to support Guy’s and St Thomas’ Charity and with your consent. You should check their Privacy statement/policy when you provide your information to understand fully how they will process your data.
We use third parties to collect data on our behalf to support our activities. This might include running raffles, event registrations, setting up Direct Debits and processing your donations, and ensuring our records are as up to date as possible through running address and detail verification through sources that are deemed acceptable by the Information Commissioner’s Office.
We may also receive information about you from other sources, which include publicly available data. Please see the How will we use your personal information section below for more details.
To increase our fundraising reach we research information in the public domain on local organisations, companies and schools to find contact details to get in touch about our latest activities and appeals. We will not call any company or organisation registered with the Corporate Telephone Preference Service.
If you have provided your consent, by responding to a mailing, for Guy’s and St Thomas’ NHS Foundation Trust to pass your details to the Charity, we will contact you to keep you up-to-date about fundraising and what’s happening at Guy’s and St Thomas’. Please rest assured that we do not have access to confidential patient data.
Cookies are text files, which identify a user's computer to our server. Cookies in themselves do not identify the individual user, just the computer used. The Support Guy's and St Thomas' website uses persistent cookies - these are used to track returning visitors. They expire after 12 months and enable us to compare website traffic from month to month.
Cookies help us identify which pages are most visited and which events or activities are of most interest. This information can be used to help us improve our website and services and ensure we provide you with the best service. Wherever possible, the information we use for this purpose will be aggregated or anonymised i.e. it will not identify you as an individual visitor to our website.
This website uses Google Analytics tracking codes to measure performance enabling us to enhance and improve services for our audiences. However, we do not collect personally-identifiable information (PII) as all data collected is anonymous. For full details on how Google Analytics works, please visit Google Analytics Terms of Service. If you do not want Google Analytics to use your data, then please visit Google Analytics opt-out browser add-on.
How will we use your personal information?
We may use your information for a number of purposes including the following:
- To provide you with direct marketing communications about what we are doing and/or campaigns which may be of interest to you by post or phone. If required under applicable law, where we contact you by email, social media and/or any other electronic communication channels for direct marketing purposes, this will be subject to you providing your express consent. You can object or withdraw your consent to receive direct marketing from us at any time, by contacting us using the contact details below.
- If you have donated to one of our Special Purpose Funds, you may be sent marketing communications with specific information about how your support has made a difference. For more information on our Special Purpose Funds, please see the ‘Who has access to your personal information?’ section below.
- For administration purposes e.g. we may contact you about a donation you have made or event you have expressed an interest in or registered for
- To ask you to help us raise money or donate money to our Charity, but always in accordance with the fundraising promise.
- To create an account for you if you register with us
- To process entries into a prize draw or raffle
- For internal record keeping, including the management of any feedback or complaints
- To use IP addresses to identify your approximate location, to block disruptive use, to record website traffic or to personalise the way our information is presented to you
- To analyse and improve the services offered on our sites to make it as user-friendly as possible
- To use anonymised personal data to benchmark our activity with other relevant organisations, including the Association of NHS Charities
- To transfer to HM Revenue and Customs in respect of any Gift Aid claims
- For statutory and regulatory compliance
- To assess your personal information for the purposes of credit risk reduction or fraud prevention.
Research and profiling
In addition to this we may use your data for wealth screening, research and profiling. Philanthropy is vital to Guy’s and St Thomas’ Charity to ensure we can continue to provide the best care for our patients and undertake translational research which goes above and beyond to find cures to life-limiting conditions. Wealth screening, research and profiling are activities which enable Guy’s and St Thomas’ Charity to achieve this as they allow us to gain a better understanding of how we should engage with you and tailor our communications more effectively and appropriately. This also helps us make informed decisions about our fundraising strategy and ensure our internal resources and investments are used as effectively as possible. Our objective is to ensure any approaches we make to you are respectful, professional and are based on evidence that you might be interested in our work, providing you with the best experience we can. Please read below for more information:
- Research - could include research on financial, business, philanthropic, biographical and demographic information sourced from publicly available data, such as Companies House, the Charity Commission and the media. We may also look at professional networks such as LinkedIn, and process special category data if it has been made manifestly made public by you; for example, through an interview or a publicly directed social media post. In addition, we may combine the data you provide us with, such data as your address, the name of your bank, or where you previously went to school, with data we obtain from other sources. We use this data both to verify we have the correct information, but also to assess whether it would be appropriate to approach you directly about philanthropic opportunities at Guy’s & St Thomas’. Mostly this work is carried out manually in-house, but occasionally it is carried out by a trusted third-party supplier and entails using information such as your name, postcode and data on your existing relationship with us to identify whether it is appropriate to approach you about higher level giving. This is known as wealth screening and is a tool which helps us to better understand who to approach about fundraising and volunteering opportunities in an appropriate way and therefore generate funds cost-effectively.
- Profiling – this could include analysis of financial, philanthropic and other personal data we hold on you to assess the likelihood that you might wish to engage with us, as well as broader data analysis. This analysis helps us to gain a better understanding of how to approach you, of your interests, and of broader demographic, geographic and engagement trends amongst our supporters. This process is not solely automated processing and always contains manual assessment to ensure we are making correct assumptions from the analysis.
- If you do not wish your data to be used in any of the ways listed above or have questions about this, you have the choice to change your privacy options and can notify us using the contact details at the top of this page. If you are unsure and have further queries on how we might use your data, please get in touch and we’ll be happy to answer your questions.
- In order to comply with our legal obligations and Charity regulations such as the Charity Commission’s CC20 and ‘Know Your Donor Policy and the Fundraising Regulator’s Code of Practice, we may also undertake due diligence research to assess the source of funds for donations and to ensure that we are robustly considering ethical and reputational risks to our organisation. As above, we consider this processing to be a legal obligation and thus are relying on this as a lawful basis for processing data under Data Protection Act 2018.
Who has access to your personal information?
Your personal information is stored on our database which is password protected and access is limited to staff working in Fundraising and Supporter Development, Guy’s and St Thomas’ Charity and some trusted subcontracted parties. Additionally, fundholders and administrators of Special Purpose Funds (funds set up to support a specific purpose within Guy’s and St Thomas’ Charity’s purpose) such as MPN Voice, may be given access to your data to support the administration of that fund.
Anyone who works outside of the Fundraising Team or the Charity will be required to sign a non-disclosure and/or confidentiality agreement before we share any personal data or confidential information with them.
We may pass your information to our third party service providers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf (for example to process donations and send out mailings). When we use third party service providers, we only disclose information necessary to deliver that service and there will always be a contract in place to ensure your information is kept secure. We will not share or sell your data to third parties to use for their own purposes unless we are required to do so by law, for example, by a court order or for the purposes of prevention of fraud or other crime.
Although most of the information we store and process stays within the UK, some information may be transferred to countries outside the European Economic Area (EEA). This may occur if, for example, one of our trusted partner’s servers are located in a country outside the EEA. These countries may not have similar data protection laws to the UK; however, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law by the use of EU model contract clauses or for organisations we work with who process personal information in the USA verification that their data processing standards meet the EU-US Privacy Shield. By submitting your personal information to us you agree to this transfer, storing or processing at a location outside the EEA.
How will we keep your personal information secure?
We ensure that there are appropriate technical controls in place to protect your personal details; for example our online forms are always encrypted and our network is protected and routinely monitored.
We use a secure server when you enter into any money transaction from our website. We also take appropriate measures to ensure that the information disclosed to us is kept secure, accurate and up to date and kept only for so long as is necessary for the purposes for which it is used. We do not store any credit card details.
Any payment details on paper donation forms are destroyed once the donation has been processed.
We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff and contractors.
How long will we hold your personal information for?
We will keep your information active for as long as required to enable us to operate our services, but we will not keep your information active for any longer than is necessary. We will take into consideration our legal obligations and tax and accounting rules when determining how long we should keep your information active.
In most cases, this will mean your data remains active for two years after your last interaction with us. An interaction could be making a donation, attending an event, contacting our office, or opening an email from us – anything that implies that you are still interested in our fundraising. After this time, we will cease to use your data to contact you.
However, in some cases there will be reasons for your data to remain active after this time, for example; if you have claimed Gift Aid and we need to hold your details for tax purposes. In this case, we will cease to send you marketing communications after the initial two year period since your last interaction with us, and will only continue to use your data for administrative purposes.
If you have pledged a legacy gift, it will be necessary to retain your data until your gift is received, so that we can identify your gift against the pledge.
You have a choice about whether or not you wish to receive information from us. If you do not want to receive direct marketing communications from us about the vital work we do for the hospital and our events and activities then please let us know at any time by contacting our Supporter Care Team on 020 7848 4701 or firstname.lastname@example.org.
We will not contact you for marketing purposes by post, email, and phone or text message if you have told us you do not want to hear from us by any of those channels. If the telephone number we hold for you is registered with the Telephone Preference Service (TPS) then we will not contact you on that phone number except for administrative purposes.
If you choose to send a donation or communication to us by text message we promise to make it clear about any charges, and will not contact you further by SMS unless you provide your explicit consent.
If you unsubscribe from communications from us from any or all of the communication channels mentioned above, then we will update our records to stop further communication as quickly as we can. Due to some communications already being in progress at the point you opt out please be aware that it can take up to six weeks for your preferences to be fully implemented.
We will only ever share your data in other circumstances if we have your explicit and informed consent.
Your right to be forgotten
If you choose to opt out of receiving our communications, your data will be retained and marked to prevent you from receiving any communications. If you want your data to be deleted from the database entirely, in most cases we will delete it. However by deleting your data, we will be unable to guarantee that you will not receive communications in the future, because we will have no record of past requests from you. If you want to guarantee you will not receive communications from us, it is in your best interest for your data to be retained on our system so that your contact preference is recorded and adhered to.
In some cases, we will be required to keep some or all of your data on record for legal or accounting reasons. For example, if you have made a donation, we will be required to keep the donation details for a minimum of seven years after the donation. If you have completed a Gift Aid declaration, we will be required to keep your details in order to claim the Gift Aid on your donation. In these cases, we will anonymise as much of your data as possible until it can be deleted.
Keeping your information up-to-date
The accuracy of your information is important to us. You can update your information with us, including your address and contact details at any time. If you would like to change your preferences or update the details we hold about you, please contact our Supporter Care Team on 020 7848 4701 or email@example.com.
You have the right to:
• request a copy of the information we hold about you
• update or amend the information we hold about you if it is wrong
• change your communication preferences at any time
• ask us to remove your personal information from our records
• object to the processing of your information for marketing purposes
• raise a concern or complaint about the way in which your information is being used
If you wish to talk through anything in our privacy statement, find out more about your rights, or obtain a copy of the information we hold about you, please contact our Supporter Care Team who will be happy to help:
Guy's and St Thomas' Fundraising Team Virginia Woolf Building 22 Kingsway London WC2B 6LE
Tel: 020 7848 4701 Email: firstname.lastname@example.org
Children and privacy
We take the protection of children very seriously. To that end, we require that children under 18 do not submit any information to our website without a parent's or guardian's consent. We will not knowingly request or collect from a child any information online that can be traced to the child, such as an email address, name, or information about the child's family. Unless a parent or guardian consents to such use in advance, we will not knowingly use information that a child provides to us for any fundraising or promotional purpose.
Vulnerable circumstances policy
We recognise the importance of protecting our vulnerable supporters and follow the guidance issued by the Institute of Fundraising on treating donors fairly. We believe this helps to support our staff and fundraisers who come into contact with supporters in providing high quality customer care, ensuring anyone donating to the Charity is in a position to make a free and informed decision.
Access the Institute of Fundraising’s website - for more guidance.
Complaints, compliments or comments
If you are unhappy with our work or something that we have done or failed to do, we want to know about it. We also welcome your views on what we do well. Your comments enable us as an organisation to learn and continuously improve our services. If you would like to make a complaint, compliment or comment then please get in touch with our Supporter Care Team:
Guy's and St Thomas' Fundraising Team Virginia Woolf Building 22 Kingsway London WC2B 6LE
Tel: 020 7848 4701
The Fundraising Team are available to help Monday to Friday, 9am – 5pm.
Changes to our Privacy statement
We may change this Privacy statement from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on the Support GSTT and Support Evelina websites or by contacting you directly.
Privacy statement updated September 2019