The South East Cancer Help Centre (“SECHC” or the “Centre”) is a registered charity (1011509) based in Purley, CR8 2HA.
Our mission is to provide complementary therapies, counselling and other therapeutic activities within a caring, friendly, environment, resourced by professional therapists and counsellors and otherwise predominantly by volunteers for the purpose of helping anyone affected by cancer cope with their situation.
Our membership is drawn from the London Borough of Croydon, neighbouring London boroughs and the county of Surrey and we welcome both cancer patients and their close family as members.
2. Your Right
SECHC is fully committed to respecting and protecting your information, using it reasonably and in line with the General Data Protection Regulation (GDPR) that came into force on 25th May 2018. When you choose to provide us with personal information, it will only be used to support your relationship with SECHC and in line with this policy.
Under GDPR, you have a number of rights in relation to your personal data, which we recognise and will act upon accordingly. These are as follows:
- right to be informed of why, where and how we use your information
- request access to your personal information
- have your personal information corrected if it is inaccurate or incomplete
- have your personal information erased from our systems where we have no legitimate interest for continuing to hold such information.
- restrict the use of your information, where you have previously provided us with your consent
- ask us to transfer your personal information to another person or organisation
- object to how your information is used.
- Where you have provided consent to be contacted or to receive a service, you have the right to withdraw that consent at any time.
Once we have received notification that you have withdrawn your consent, we will no longer process your personal information, except where legally required and subject to our retention policy, we will dispose of your data securely.
3. Where and how we collect your information
The vast majority of information collected by the Centre is provided knowingly by our members and supporters. We rarely seek personal data from third party organisations but some might be provided to us in the normal course of our business relationships with companies or organisations.
For people directly involved with the SECHC (employees, volunteers, members etc), we will ask you to provide personal information to us through the completion of an application form to establish that relationship.
Where you make an online donation either through our website or through a third party provider such as a credit card company or JustGiving, Virgin Money Giving etc, they may provide the details necessary for us to record your donation and say thank you.
Where you wish to support the Centre, you may be asked to provide contact details so we can keep you informed with what’s happening. Where you make a donation and provide a Gift Aid declaration, we will need to maintain that information in our records for HMRC disclosure, if necessary to justify our gift aid claim.
4. What information we collect, why and how we use it
The type of information we collect and retain and how we use it will depend on your relationship with the SECHC. More details on each type of relationship are shown below but in summary we will:
- Collect personal data that will consist mainly of contact details but for members using our services and in some other cases we will collect more detailed information.
- Retain the personal data provided on paper application forms securely and transfer the information to our central database maintained on a secure server. All information received by other means will be transferred to our central database when we have your consent to store that information.
- Occasionally we receive your personal information through external event organisers or through third party websites such as VirginMoneyGiving or Eventbrite. Such information will be treated as if it was received from you directly and only used with your consent.
- Use your personal data to contact members and others to offer our services and information regarding SECHC events. We will only contact you if you have provided your consent to be contacted on these matters.
- Each communication from us will either have an “unsubscribe” option and/or tell you how to contact us to request to amend your consents in order to prevent further contact from us for all or some of our communications. In addition, we are also registered with the Fundraising Regulator and use the Fundraising Preference Service (FPS), which is a service that allows people to opt out of fundraising communications from charities. We receive regular updates from the FPS so if you opt out that way, we will remove you from our email, phone, text, and postal communications.
Members are asked to complete an application form that is needed by us to run the operations of the charity and for which there is a valid lawful basis. For certain of our services chosen by the member, we may need to obtain up-to-date medical information from their GP or hospital in order to provide a safe and effective service suitable for a member’s particular medical condition.
This information will be recorded in the SECHC central database, with paper copies retained securely. The information will then be used to offer, provide, and monitor your use of our services. By signing the application form, you will be consenting to our collecting, storing and using your data for this purpose.
We would also like to contact you using the information you have provided to us with our periodic general and fundraising newsletters as well as specific information on certain events and information that we think you might be interested in. We will not do so without having first received your specific consent to receiving these. Any contact made by us will be in the manner you tell us is acceptable.
Once your time as a member finishes, we will need to retain your information for a period of at least two years. The information will be used to analyse our services in order to make our offer to our members more effective. We would then move your relationship with us to “supporter” and using any consents already provided to us, process your data to contact you as set out below for our other supporters.
b. Staff, Volunteers including Trustees.
Before any new person joins the SECHC team, they will have completed a confidential application form.
In the course of our activities and legal obligations as an employer and volunteer centre we will process personal data (which may be held on paper, electronically, or otherwise) about our applicants; and we recognise the need to treat it in an appropriate and lawful manner, in accordance with GDPR.
We process the personal information you provide to us when you apply for a job or to volunteer with us. We may also receive personal data from third parties such as an independent recruitment agencies.
We use this information to assess your suitability for the role applied for and where applicable during the interview process.
We only request information from you that is required to satisfy legitimate recruitment information, to satisfy relevant health and safety requirements and to satisfy relevant equal opportunities legislation. It will also be used to obtain third party references or to meet statutory obligations.
Contact details only will be stored in our central database with all the other information kept securely in confidential electronic and paper files. The sensitive data stored will rarely need to be processed and will only be done so as part of our normal employment checks and for subsequent personnel matters such as payroll once employment has commenced.
Our supporters come in many guises including individual and business donors, fundraisers and people interested in the charity and what we do in the local community and for our members. It is important to us to have as many supporters as possible on our database to help spread awareness of our services among cancer patients. In the majority of cases, we will just receive normal contact details consisting of some or all of name, address, telephone number(s) and email address. For donors, our database will record when and how we have received your donation. Historically, we have retained a paper-based record of donations. These records are required for audit purposes.
Credit card details are never retained in paper or electronic form and will only be taken to be input into any credit card facility at that time. Any written record will then be securely destroyed.
If you provide us with a Gift Aid declaration, the information will be transferred to our database and will, if requested be provided to HMRC. We will need to retain the database information for as long as HMRC rules dictate.
We will only use your contact details in a way that you have consented to or where the contact is a legitimate part of the contact between us. We would obviously like to contact you with regular updates about our services and with information on events and fundraising campaigns, but only if we have received your consent to do so.
5. How we keep your personal data secure
All personal data held in paper form are retained in a locked cabinet with access controlled by the Centre Manager or, in their absence, their deputy. Access is strictly limited to those with a legitimate requirement.
Electronic records of personal data are held securely on the Microsoft Office 365 Cloud. Access to such records is strictly limited to those with a legitimate requirement.
6. Sharing your personal data with third parties
We will only share your personal data with certain third parties:
- where it is a necessary for SECHC to provide its services for an appointment with a therapist, counsellor or a group activity leader;
- where we use a third party to process the data on our behalf. This will normally involve use of their software or hardware and includes credit card operators, MailChimp etc;
- where we have a legal obligation to do so. For example, auditing of our accounts or provision of information to HMRC for Gift Aid purposes;
- where you have given your consent for us to do so.
7. How long we keep your data
We hold your personal data for as long as necessary to fulfil the purpose it was collected or the relationship with you is ongoing and then a reasonable retention period afterwards to ensure we can maintain accurate records of our services and your preferences. Where we have had no contact from you for three years, we will normally contact you one further time to seek your consent to future communications. If we do not receive any response, we will then remove your personal data from our records, unless we have a legal obligation to retain your information for a longer period,