Privacy Policy

St Barnabas Hospice is a Lincolnshire based registered charity (Registered Charity Number 1053814) committed to providing compassionate end of life care to those living with a life-limiting or terminal condition.

St Barnabas Hospice is located at 36 Nettleham Road, Lincoln LN2 1RE and can be contacted on 01522 511 566. The Hospice also has a Shops Company, with a range of charity shops across Lincolnshire which is managed by the Retail Headquarters at Cardinal Close Lincoln. Our Lottery and associated products are registered with the Gambling Commission and managed by St Barnabas Promotions Ltd (registered company number: 3201001), 12 Cardinal Close, Lincoln, LN2 4SY, 01522 546 500.

We pride ourselves on being open and transparent with our patients, their families, our supporters, staff and anyone else who comes into contact with the Hospice, about how their personal data is stored and used. This includes the processes we adopt when we ask for donations to support our organisation.

We are only part-funded by the NHS through contracts with the Integrated Care Board (ICB) and we rely heavily on the ability to

fundraise to find the £11.5 million needed each year to keep our services free of charge.

As a registered charity, our Hospice relies on the people living in its local community for support – both financially and in kind. By gathering information about our community we can fundraise more efficiently and get the right information to the right people based on what they want to see. Ultimately this means our Hospice is able to continue to provide excellent care to those who are dying and to support their families and friends.

The UK Data Protection legislation requires every organisation that processes personal information to be registered with the Information Commissioner’s Office. Our registration number is Z1067542 and you can find us on the Information Commissioner’s register by Register of data controllers and searching for us by using our registration number.

This Privacy Policy explains what personal data we may collect about you, how we use it, and the steps we take to ensure that it is kept secure. We also explain your rights and how to contact us.

Unless stated otherwise, St Barnabas Lincolnshire Hospice is the data controller in respect of all personal data collected by us on this website or otherwise. This means that we are responsible for ensuring that we do so in full compliance with The Data Protection Act 2018 and the UK General Data Protection Regulations (GDPR), all other related privacy laws and any codes of practice issued by the Fundraising Regulator or the Information Commissioner.

We are also required to be compliant with NHS and Caldicott Guardian requirements for confidentiality and information security standards.

We will only use your information for the purpose(s) described in this policy as well as for administrative and statistical purposes. To provide you with the information, products or services that you have requested or are referred to St Barnabas Lincolnshire Hospice for to provide care and support tailored to your medical or wellbeing needs, to support your family and friends, further our charitable aims and comply with the law.

We collect information for various reasons:

• We collect and hold information about patients, service users to enable us to give you the correct care and treatment and to contact you and your loved ones. The information is held on computer, paper record or both.
• We collect and hold information about staff and volunteers to communicate and carry out administration, as necessary for your role.
• We collect and hold information from donors, retail customers and supporters in order to make better decisions about how we raise and spend funds.
• We automatically collect technical data from visitors to our website to ensure that content from our website is presented in the most effective manner for you and for your computer.

Individuals who are under the care of St Barnabas Lincolnshire Hospice and in receipt of one or more of our services are patients and clients. The term includes those referred to us but currently not in receipt of care, those who have been in receipt of one or more of our services and their details retained in accordance with national guidance.

The types of information that we might collect or hold on you includes name(s), addresses, date of birth, contact details including email and telephone, your next of kin and family information, your doctor’s contact details. We will also collect information of a sensitive nature relating to your medical history, current medical requirements and information of a sensitive nature including race, religion and ethnicity.

Your information may be sourced directly from you, a loved one, family member or other legal guardian. Information about you concerning your health or that is required to provide you with health and social care services may also be sourced directly or indirectly from your doctor, health professional or from the NHS.

St Barnabas Hospice will rely on several lawful grounds for processing your information contained within the GDPR and will also seek your consent where required by law to do so. If we do not have the ability to process your information this may seriously impact the provision of health and social care services and how we address your care needs.

Information is collected and processed for the purpose and intention of providing one or more of our clinical or support services, the effective provision of personalised care and to comply with clinical reporting requirements.

We may collect personal-sensitive information relating to race, faith, sex, religion, family life, health and care received for statistical and reporting purposes (in this casa your information will be anonymised and it will not be possible to identify you).

Information about patients and clients is held securely on our internal ICT systems and we use a system called SystmOne (which is a Lincolnshire wide patient records system) as your primary care record. This information may be shared with NHS and other care agencies as well as with the Integrated Care Board and Lead Care Providers (who are contracted for care purposes) for the holistic provision of care or for statistical reporting requirements.

Any sharing of information is in compliance with data protection and the GDPR. Where it is possible to minimise the amount of information shared or anonymise records so as not to identify an individual, these precautions will be applied to protect your personal information.

Clinical data is never shared, only approved clinicians can access SystmOne, and only in the case of someone dying would this be shared with our Fundraising team so as to not cause any upset such as contacting someone inappropriately.

Information on service users will be retained in accordance with the national guidance for health and social records starting from the date that the provision of care has ended and in compliance with other regulatory requirements. Information will not be kept outside of this period unless there is another lawful reason for doing so.

Service users may also be a supporter and St Barnabas Lincolnshire Hospice has a legitimate interest in understanding when to stop communications that are no longer required.

The organisation has a Caldicott Guardian who has a particular responsibility for reflecting patients’ interests regarding the use of patient identifiable information. They are responsible for ensuring patient identifiable information is shared in an appropriate and secure manner.

A supporter is defined as any individual (including but not limited to organisations, sole traders, limited companies, schools and colleges, teams, groups, social and fitness clubs) who have made or offered to make a financial or non-financial donation of any sort to St Barnabas Hospice. They may also be individuals who have expressed an interest in supporting our work, have requested information from our fundraising team, completed an event, sponsorship, lottery, raffle or event application form.

Information about supporters is held securely on our customer relationship management system. This system holds all the relevant information about you that relates to donation amounts, events participation, lottery and other details about your interaction with the Hospice.

The types of information that we may collect or hold on you for fundraising and marketing purposes include name, address, contact details including email and telephone, family links and relationship nature, donation amounts, regular gifts by direct debit or standing order, event participation, own place events, community and corporate support, lottery membership, employment or other community and Hospice links, communication preferences and a range of profiles created to understand supporters better or assist with analysis and understanding. We also hold a log of the communications that we have had or sent to you for your communication preferences.

We may obtain personal data face to face, electronically, on paper (such as any form you complete) or verbally (such as during any telephone conversations we have with you). The information may come to us:

• Directly from you such as when you make a donation; when you sign up to an event or activity; when you join our lottery; when you sign up as a Gift Aid donor in one of our shops or when you sign up as a volunteer.
• From another organisation for example, where you use fundraising sites such as Just Giving to fundraise for St Barnabas Hospice. These organisations may share your personal data with us if you allow them to do so.
• From social media sites or apps. If your settings and preferences allow, we may obtain information (including personal data) from social media services such as Facebook, Intstagram and Twitter.

If you provide personal data to us relating to any person other than yourself (for example when giving a donation) you must ensure before you do so that they understand how their personal data will be used and that you are authorised to disclose it to us, and to consent to its use on their behalf.

The type and quantity of personal data we collect and how we use it depends on why you are providing it. If you support us, for example, by making a donation, volunteering, registering to fundraise, signing up for an event or buying something from our shop, we will usually collect your name and your contact details.

Occasionally we may ask for your date of birth, for example, if there is an age restriction on an event or activity you have chosen to take part in (e.g. lottery players must be over 16).

Where it is appropriate we may also ask for:

• Information relating to your health (for example if you are taking part in a high risk event such as one of our treks or skydives).
• How you heard about the event/activity/Hospice.
• Why you have decided to donate to us. We understand that you may have private reasons and we only want to know the answer if you are comfortable telling us.
• Your bank or credit card details (these are used for the single transaction only and are destroyed after use, we do not keep your details on our system).

Occasionally we may work with marketing and other third party agencies to help refine our communications to make them more cost effective and relevant to whom we send them to.

This may be done by enhancing the information that we hold about you or about where you live. For example information from census data such as council tax bands and age.

When we share your information with them we do so securely and we only share the information that is necessary, ensuring compliance with GDPR.  If you would not like us to share your information you can opt out by contacting us.

As a registered charity St Barnabas Lincolnshire Hospice depends heavily on donations to support and fund its health and social care services. We are only part funded by the NHS and must raise £11m every year to keep our services free of charge. The ability to fundraise, levels of care available and the future success of the Hospice is dependent upon the ability to communicate for fundraising purposes.

If the Fundraising and Marketing department were not able to process your information for this purpose it would have a detrimental effect on our ability to raise funds in cost effective ways. It will also mean that we cannot send you the information you want to receive or tell you about how your support is helping others under our care.

The information that we hold, collect or source on supporters is processed only for the purposes of furthering our charitable cause, to raise the income needed to fund the running of the Hospice and to protect the longer term future of our clinical services. This is achieved by keeping supporters up to date with news and developments at the Hospice, to demonstrate the impact that donations have on the lives of those under the care of St Barnabas Hospice, to highlight the many other ways in which you can choose to support our work, to raise awareness of exciting new events and for the purposes of raising funds through direct cash appeals and other ways to generate income and engagement.

This includes processing information for the purpose of fundraising and marketing communications where consent has been provided or where St Barnabas Lincolnshire Hospice is exercising their legitimate interest to contact you.

We are also required by law to process supporters’ information to effectively manage and account for donations, pledges, memberships, event participation, engagement and interactions and to maintain accuracy of records. All processing is pursuant to your rights and our responsibilities within UK Data Protection legislation and GDPR.

Information will also be processed, where required, to comply with any legal obligation such as by Court Order.

St Barnabas Hospice rely on our Legitimate Interest to contact you with matters of a non-marketing nature for example managing gift aid, management of regular giving payments or lottery membership, thanking for support, to maintain accuracy and keep the information up-to-date, to answer your questions queries or requests, for financial analysis and trend performance, profiling and segmentation purposes to satisfy our business and strategic objectives.

We will also seek to rely on our legitimate interest to send communications of a marketing and fundraising nature that may include requests for financial support or to join our lottery membership, to support an appeal, attend an event or purchase raffle tickets and to keep you informed of current events.

The Hospice believes it is in the best interests of the Hospice and local people to raise awareness of its charitable nature, to be open and transparent about how the Hospice is funded and to highlight that the services provided by the Hospice requires local support to provide these services for local people at the end of life. Generating income from charitable donations is the ‘life blood’ of the organisation and both patient care and the ability to provide services to the community would be put at serious risk without this funding. It is in therefore in our legitimate interests to maintain good contact with donors and to keep them informed as to how they can donate or take part in fundraising events, and we have reason to believe donors would reasonably expect to be contacted and the processing of data will have a minimal impact on their privacy.

Principles:

1. We have a valid legitimate interest in doing so and that legitimate interest does not override the rights and interests of the individuals
2. Individuals have a right to object to direct marketing and ‘opt out’ overrides our legitimate interest.
3. We are contacting an individual on the basis that we have advised them we would do so, they are given a clear ‘opt out’ process and it is their reasonable expectations that we will do.

Information about our supporters will be shared with agencies that we rely on to carry out our fundraising activities. For example, the name and address details of individuals that we wish to mail information to must be sent to our print and mailing house to fulfil this purpose.

Any information shared to support and further the work of fundraising is carried out under contract with St Barnabas Hospice remaining in control of your information at all times.

If you use your credit/debit card to donate to us, buy something or make a booking online, we pass your credit/debit card details securely to our payment processing partners, Stripe and WorldPay as part of the payment process. We do this in accordance with the Payment Card Industry Security Standard (PDF download), and don’t store the details on our website.

All online transactions are processed securely using 3D Secure protocols, in line with PCI DSS standards. We do not store your card details on our website or systems.

Information relating to supporters will be retained for no longer than is necessary to meet our legal and regulatory obligations. This will vary depending upon the type of information, for example, lottery information will be held in accordance with the requirements of the gambling commission.

Profiling and insight data will be retained for no longer than five years from your last meaningful interaction with us, unless legally required or you request otherwise.

At St Barnabas Hospice, we are committed to fundraising ethically and respectfully. As part of our legitimate interest in raising the vital funds needed to provide care across Lincolnshire, we may carry out profiling and insight activities to better understand our supporters and tailor our communications accordingly.

To assist us with this, we may:

• Analyse the information you provide to us, along with donation patterns and engagement history;
• Use data enrichment techniques to segment our supporter base and identify trends, using reputable third-party insight partners;
• Use publicly available sources such as charity registers, social media (if public), and published company information to understand potential interest and connections to our cause;
• Group supporters by factors like location, interests, giving history or communication preferences to offer more personalised and efficient fundraising.
• These activities help us make more informed decisions, ensure our communications are relevant, and reduce costs by targeting more effectively. We do not currently undertake third-party wealth screening or purchase external datasets for this purpose

You have the right to:

• Object to this kind of profiling and data analysis;
• Request that we do not use your data in this way;
• Ask for a copy of the data and profiles we hold on you

We will never share your personal data with third parties for their own marketing purposes, and all profiling activity is carried out under strict controls in line with the Data Protection Act 2018, UK General Data Protection Regulation, the Data Use and Access Act 2025 and the Code of Fundraising Practice.

If you would prefer us not to use your information for profiling or insight analysis, please contact our Supporter Care Team at supportercare@stbarnabashospice.co.uk or call 01522 510 300.

St Barnabas Lincolnshire Hospice will communicate with supporters under legitimate interest by their chosen communication preferences only.

You will only be contacted for fundraising and marketing purposes from us for as long as you are happy to receive them. You have the right at any time to request a change in the marketing communications that you receive or to stop them altogether if they’re no longer required.

You can update your preferences at any time by contacting our Supporter Care Team at supportercare@stbarnabashospice.co.uk or call us on 01522 540 300

The Data Use and Access Act 2025 (DUAA) is a new Act of Parliament that updates some laws about digital information matters. The DUAA amends, but does not replace, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR).

In accordance with the DUAA and ‘Soft opt in for charities’  it means that St Barnabas Lincolnshire Hospice can contact you via electronic mail marketing if you have consented to receiving information from us.  If however, you have changed your mind and you do not wish to hear from us you can opt out by contacting us.

Employees are individuals who are or were employed by St Barnabas Hospice. This definition includes contractors, agency staff, freelance and bank staff. It will also include individuals who have expressed an interest in working for St Barnabas Hospice but were unsuccessful or chose not to pursue their application.

Volunteers are individuals who have or do volunteer their time to support St Barnabas Hospice.

The information that we collect is made clear on the application form and may include sensitive details following a DBS (Disclosure and Barring Service) check or Occupational Health Screening.

Information is predominately sourced directly from employees/volunteers and prospective candidates from their application form.

Information on employees and volunteers may be generated under consent from the individual that relates to DBS checks and occupational therapy reports. In addition details may also be obtained and obtained for managerial purposes throughout the course of employment or volunteering at the Hospice and kept on personnel files, for example information from one-to-ones, performance management and appraisals.

There are certain types of information that the organisation must process to comply with employment laws and other regulatory requirements. Processing for these lawful requirements will occur under the organisation’s obligation to comply with such laws.

The consequence of not being able to process information that is not caught by the above paragraph may affect the ability to manage employment opportunities and the provision of organisational benefits.

Any information collected or requested will only be used for the purpose of recruiting, management and dismissal of employees or volunteers. Some examples of processing activities relating to staff are salaries, pensions, insurance, payroll giving, expenses, training, discipline, promotion, illness and return to work.

St Barnabas will process personal data directly for employment purposes under the lawful ground relating to contracts and employment. However, the organisation will rely on its legitimate interest to process personal information about employees and volunteers for purposes that is not directly related to their employment such as for noting long service awards, redeployment or restructuring purposes.

Information relating to employment of staff will only be shared with organisations that support the management of employees. For example organisations that assists with payment of staff salaries, pensions, insurance and tax purposes.

Some information will be shared with Occupational Health for the purposes of determining ability to work and undertake specific tasks.

At all times data minimisation will apply and only the necessary information will be shared to address the purposes required.

Information will be retained on staff for in accordance with national guidelines for Human Resource information, currently 6 years from the end of employment. Details relating to prospective employees that were not taken on will be retained for a period of 6 months before being securely destroyed.

In order to understand how users use this website and our services, we may collect your Internet Protocol addresses (also known as IP addresses). Your IP address is a unique address that computer devices (such as PCs, tablets and smartphones) use to identify themselves and in order to communicate with other devices in the network.

When you visit our website, we ask for your consent before placing non-essential cookies, such as analytics or tracking cookies. You can manage your preferences at any time through our cookie banner or browser settings.

Cookies are small pieces of data which are stored on your computer by your web browser. They are used to improve your online experience by almost every website including ours. This is why we feel it is important that you understand how cookies work, what they are for and when they are being used.

Cookies are small text files stored on your computer, smartphone, tablet or other device used to access the internet. Cookies are useful as they allow a website to recognise the device you are using.

At St Barnabas Hospice we use cookies for a variety of reasons, such as to display our website in different size fonts, to monitor how many people have visited our website or to display YouTube videos and social links such as Facebook.

St Barnabas Hospice does not use cookies to gather contact information about you and we do not share, sell or swap your personal information with any other third party for their marketing or fundraising purposes.

We do use ‘analytics’ cookies to help us make our website better for those who visit it regularly. They help us to work out what visitors like and don’t like and how we can improve things for you.

When we include links to and feeds from other websites, please consider they will have their own privacy and cookie policies that will govern their use of any information you submit. We recommend you read their policies as St Barnabas Hospice is not responsible or liable for their privacy practices.

You can manage your cookie preferences for our website or any other websites by using your browser settings. Your browser’s ‘help’ function will show you how to do this. However, please remember that cookies are often used to enable and improve certain functions on our website. If you choose to switch certain cookies off, it could affect how our website works.

For more information about cookies, visit www.aboutcookies.org.

Please note this website may contain links to other websites that are not controlled by us. These links are provided for your convenience. We are only responsible for our privacy practices and our security. We recommend that you check the privacy and security policies and procedures of each and every other website that you visit and each organisation that holds your personal data.

If we ever need to transfer your personal data to other territories outside of the United Kingdom or the European Economic Area, we will take proper steps to ensure that it is protected in accordance with this Privacy Policy and applicable privacy laws.

Privacy laws and practice are constantly developing and we aim to meet high standards. Our policies and procedures are, therefore, under continual review. We may, from time to time, update our security and privacy policies. If we want to make any significant changes in how we will use your personal data we will contact you directly and, if required, seek your consent.

We will ensure our website has our most up to date policy and suggest that you check this page periodically to review our latest version.

This policy was last updated in June 2025.

We take the security of personal data seriously. We have national Cyber Essentials Plus security accreditation including firewalls, and encryption to safeguard personal data, along with procedures in place to ensure that our paper and computer systems are protected against unauthorised disclosure, use, loss and damage.

Personal data in our computer systems is only accessible by appropriately trained staff and volunteers who need to access your personal data as an essential part of their role. All access is tracked through individual login credentials and audit trails.

We only use third party service providers where we are satisfied that the security they provide for your personal data is at least as stringent as we use ourselves.

Your personal information can only be processed in line with data protection principles and requirements contained within UK Data Protection Legislation and the GDPR. These rights are:

• Right to access information about you, at no charge and it must normally be supplied within 30 days.
• Right to erasure (the right to be forgotten) where there is no compelling reason to keep it.
• Right to rectification of inaccurate or incomplete information
• Right to data portability and to move your data from one environment to
• Right to object to processing for direct marketing
• Right to object to automated decision making and
• Right to restrict processing of personal

The above rights are not all absolute and there are circumstances where St Barnabas may not be able to comply with your request, however, if this is the case you will be informed with 30 days of your request.

Should you wish to exercise any of your rights please contact the Trust.

You also have the right to complain to the Information Commissioner about any of our processing activities. The Information Commissioner is the regulator that governs and controls the use of personal information and enforces your right to privacy and confidentiality.

To complain to the Information Commissioner’s Office. You can find information on how to do this at www.ico.org.uk

You can contact St Barnabas Hospice by writing to us at:

St Barnabas Hospice
36 Nettleham Road
Lincoln
LN2 1RE

Alternatively, you can contact us via telephone:

Or via the website – How to contact us

Should you have any questions regarding the processing of your information you can contact our Data Protection Officer on: DPO@stbarnabashospice.co.uk or 01522 518 200 or write to us at: St Barnabas Hospice, 36 Nettleham Road, Lincoln, LN2 1RE.