Our Privacy Policy

The information you share with us shapes and guides our future activities, such as events and appeals.

It allows us to provide the greatest benefit to patients and staff across the five hospitals of Oxford University Hospitals NHS Foundation Trust - the John Radcliffe, the Churchill, the Oxford Children's Hospital, the Nuffield Orthopaedic Centre and the Horton General.

We endeavour to ensure all our communications include information that is of interest to you, of the projects that have been made possible, our future plans and fundraising activities - and that we contact you through your preferred channel(s) - email, post, SMS or phone.

At any time, you can request to change your contact preferences by contacting us at:

Oxford Hospitals Charity

Wood Centre for Innovation

Quarry Road

Oxford

OX4 8SB

Tel: 01865 743 444

Email: [email protected]

This Privacy Policy explains:

- What personal information do we capture?
- How do we capture your information?
- How do we tailor your supporter experience?
- What do we do with your personal information and what's the legal basis for processing?
- Do we collect any personal information about children?
- How do we store that information?
- Who do we share your information with?
- Your choices about the information we hold.

What information do we capture?

Personal information is any information that could be used to identify you.

This includes things such as your name, email address, postal address or telephone number, financial information such as credit or debit card details, as well as your reasons for supporting our charity and/or information relating to your health, such as the experience you, or someone close to you, have had in the hospital.

As a hospital charity, many of our supporters' reasons for giving are related to their own experience or the experience of someone they love in our hospitals. Any personal information relating to your health is defined as 'Special Categories of Personal Data'.

If you choose to share that information with us, including through online giving pages, we will record it as part of our relationship with you so we can fully understand the context of your relationship with us.

How do we capture your information?

When you donate, participate in one of our fundraising activities or want to learn more about our work, we collect some of this personal information from you.

You share some of this personal information with us directly, by email, post, or phone. On other occasions, this information is shared with us through a third party - for instance, an event provider or an online giving platform, such as JustGiving.

Sometimes, we will obtain personal information about you from other sources, for example, if someone contacts us on your behalf, if you are taking part in a fundraising activity as part of a team, or if you are introduced to the charity by a friend or family member.

How do we tailor your supporter experience?

Our hospitals were founded through charitable giving, and fundraising continues to make a significant impact today. The support of our community is invaluable, so to make sure we have a tailored and appropriate relationship with you, we use analysis, profiling and screening techniques. This helps us ensure our fundraising is cost-effective and our communications are relevant and timely, providing you with the best possible supporter experience.

Profiling and analysis is primarily based on information that you have given us through previous interactions. This may include broad information relating to you, such as geographic and socio-economic data (such as your postcode etc), as well as specific information about how you have interacted with us in the past and the channels you used. If you have made a gift to us, we would bear in mind its value, your giving patterns and the campaigns you supported. We track emails which we have sent to you to see which messages have the highest response rates and whether there are messages that resonate with particular groups of people. We do this by logging whether emails we send have been opened, deleted and interacted with (for example, by clicking on links within the emails).

We may also gather information about you that is in the public domain, for example, from media articles or Companies House, to help us understand more about you as a donor and your ability to support Oxford Hospitals Charity.

We undertake this analysis, profiling and screening in order to have a better understanding of your potential interests and preferences. It helps us to be as relevant as we can be to you and only contact you with relevant communications and fundraising asks.

What do we do with your personal information, and what is our legal basis for processing?

We process the following information under Legal Obligation:

Fulfil our legal obligations in meeting our audit and internal administrative requirements.
Where appropriate, claim Gift Aid on your donation.

We process the following information under Legitimate Interest:

Support you as a donor - to process your donation, thank you for your gift, sign you up for an event or register you as a volunteer.
Keep a record of your relationship with us, ensure we understand your personal interests and wishes in your interactions.
Send you postal communications about our work, the difference your donations and fundraising make and future appeals.
Ensure that our charity is meeting the needs and wishes of our supporters in providing the greatest benefit to patients and staff across Oxford University Hospitals NHS Foundation Trust by being an effective and efficient organisation.
Promote the charity's work across multiple media platforms, including the press, social media, and fundraising events.
Tailor our campaigns to the profiles of our supporters.
Analyse the patterns and trends of our supporters to determine the success of our campaigns and appeals.
Understand where you live or your networks to assess your interest in supporting the charity. This way, we can ensure that we have focused conversations with you about the parts of our hospitals that interest you most.
Contact you after a significant period since your last communication or donation to us to update you about the work you funded or to enquire whether you are still interested in hearing from us.

We process the following information using your specific consent as our legal basis:

Send you communications about our work, the difference your donations and fundraising make, and future appeals.
Capture photos, video, and audio from events, appeals, and campaigns for future marketing materials.

Do we collect any personal information about children?

If you are under the age of 18 and you choose to fundraise for us, take part in an event or donate, we will collect personal information about you. We will ask you or your parent/guardian for consent to use this information about you.

Our events have specific rules about whether children can participate, and we'll ensure age-appropriate advertising for those events.

How do we store your information?

The information you share with us can be categorised in the following ways, which we store as follows:

Personal data: Including name, contact details, communications with the charity, date of birth and personal interests. This information is stored on a secure database that only charity employees can access.
Financial information: Credit card or cheque details or gift details. Credit and debit card details are destroyed as soon as the donation has been processed. Transactional information in hard copy is kept for seven years to satisfy our audit requirements.
Video, photos, and media files: This information is stored on a secure cloud-based server that only charity employees can access.
Archive: We also store an archive of media material in hard copy to highlight the charity's activities and achievements over its history.

For the most part, your data will be stored in the UK or within the European Union (EU). Some of our third party suppliers (data processors) are based outside of the EEA, in countries such as Australia. In that case, we will only allow data transfers outside of the EEA when there are legally appropriate safeguards and/or contracts in place to ensure that your data is adequately protected in accordance with EU privacy standards.

We operate a process for assessing, managing and protecting new and existing systems which ensures that they are up to date and secure against the cyber security threats. Our Data Protection Impact Assessments consider security and privacy in detail. Our staff complete mandatory data protection training upon employment, to underline the responsibilities and requirements set out in our data protection policies.

At any time, you can request to see the information we hold on you by contacting us at 01865 743 444 or emailing [email protected]

Who do we share your information with?

We never sell or swap your details to anyone else.

As part of our day to day work, we may send your data outside of the charity when we use a third party supplier (data processors) to help deliver one of our activities. For example, companies that provide: direct mailing or marketing services that send material to you by post, email or text message, customer analysis, assessment and profiling. We may also use third party organisations (again processing data under our instructions) to carry out fundraising on our behalf, for example, using a company to call supporters who have agreed to be contacted by phone about a campaign, appeal or donations.

In these circumstances, they will only have access to the personal information they need to fulfil that service and will only use that information for the purposes for which they have been instructed by us. We are very careful to only partner with organisations whose data protection compliance reaches the high standards we set for ourselves and we never share sensitive information, like your credit card details.

Your rights

At any time, you can request to change your contact preferences, ask for a copy of your personal data, limit processing and in some circumstances ask us to delete your data. You can do this by contacting us at: