Privacy Policy
This privacy statement was last updated in July 2025 and applies to citizens and legal permanent residents of the United Kingdom.
St Mary’s Hospice (SMH) is committed to protecting the privacy of everyone who uses our services or supports our work through fundraising, retail or lottery activities. This privacy notice explains what we do with your personal data, whom we share it with, and why we do so. If you have any questions about this privacy notice or our information security and data processing in general, please contact our Chief Executive Officer using the contact details given below.
What is personal data?
By personal data we mean information that might allow you to be identified, such as your name, address, date of birth, credit card details, I.P. address, photo or video image or voice recording. For patients, some of this data may be sensitive as it relates to their health and wellbeing, ethnicity and religious views. This is called special category personal data.
Who are we?
We are St Mary’s Hospice (Charity No. 517738) a charity supporting people with advancing or terminal illness in the South Cumbria and Furness area. Our registered office address is Ford Park Crescent,
Ulverston, LA12 7JP.
Email: info@stmaryshospice.org.uk
Tel. 01229 580305
How do we collect personal data from you?
We may collect personal information about you when you sign in to the Hospice or Compassionate Communities buildings, take part in one of our fundraising events or challenges, make a donation, play our lottery or raffles, sign up to Gift Aid or join our Loyalty Scheme in our shops or use our website. If you are referred to one of our clinical services, we will collect data from you and may also receive it from other healthcare providers. You should be aware that if you send us data through your own email account it cannot be guaranteed secure and you do so at your own risk.
Why we collect information about you
If anyone can be identified by any information that we collect, this information is called ‘personal data’. Data protection law says that St. Mary’s Hospice must have a reason or ‘purpose’ for collecting and using personal data.
Our purposes are to:
Keep you informed by email, via our website and by post of our services, events, competitions etc..
Provide our services
Sell you products through our shop or online
Enable donations to be made
Manage our relationship with you
Keep internal records
How we ensure that the processing we do is lawful
St. Mary’s Hospice cannot use your personal data for any reason unless we have a lawful basis to do so.
Those that we use are:
The processing is necessary to undertake a public task
The data subject has given his or her consent to the processing
The processing is necessary for compliance with any legal obligations to which the data controller is
subject, other than an obligation imposed by contract.
We have a legitimate interest in using your information. This information is retained whilst working
with clients and kept to allow us to have a record of your requirements, communicate with clients
should they wish to use our services again or should we feel that a service may be of interest to
them. We may also use the contact details of those who have made enquiries for this purpose.
The processing is necessary – for the performance of a contract to which the data subject is a party, or for the taking of steps at the request of the data subject with a view to entering into a contract.
The processing is necessary for compliance with any legal obligations to which the data controller is subject, other than an obligation imposed by contract.
We have a legitimate interest in using your information. We believe that charitable giving
strengthens personal values and beyond the benefits to the individual, strengthens our community and enables the continuation of our services.
The processing is necessary for compliance with any legal obligations to which the data controller is subject, other than an obligation imposed by contract.
We have a legitimate interest in using your information. This information allows us to process
queries effectively and improve delivery of our services to you. We may use feedback given to us.
The processing is necessary for compliance with any legal obligations to which the data controller is subject, other than an obligation imposed by contract.
We have a legitimate interest in using your information. We will already have a relationship with you and believe that informing you of such information will be of benefit to both parties.
special category and sensitive types of data
Data protection law considers some types of personal data as special category. This includes information about race, ethnic origin, religion, health, sex life and sexual orientation.
These types of personal data require additional protection. This is because use of this data could create significant risks to an individual’s fundamental rights and freedoms.
The presumption is that this type of data needs to be treated with greater care because collecting and using it is more likely to interfere with these fundamental rights or open someone up to discrimination.
Where we process special category data we do so because:
- The data subject has given explicit consent to the processing of the personal data for one or more
specified purposes. - processing is necessary to protect the vital interests of the data subject or another natural person
where the data subject is physically or legally incapable of giving consent - processing is necessary for the purpose of preventative or occupational medicine, the provision of
health or social care or treatment or the management of health or social care systems and services.
If we ask for your consent and you give it, you have the right to withdraw this at any time by contacting us in writing using the address or contact details given in this privacy notice. If withdrawal of consent is going to affect the service that we give you we will tell you about this at the time.
We may need to send you service messages. These are different from marketing emails as they contain information we need to give you to ensure we can provide our services effectively. An example of this is information about changes to our service. You cannot withdraw consent to receive service emails.
If you disagree with us using your personal data for one or more of our legitimate interests let us know in writing and we will stop using it for that purpose.
How long do we keep your information?
Whenever we collect or process your personal data, we’ll only keep it for as long as is necessary for the purpose for which it was collected.
At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.
For retention times please ask for our Retention Schedule.
Who do we share your personal information with?
We sometimes share your personal data with trusted third parties. These are listed below.
When we share your personal data with these third parties who perform services for us, we require them to take appropriate steps to protect your personal information, and only to use the personal information for the purpose of performing those specific services.
*Please be aware that these are data controllers in their own right, and by using them you are subject to their privacy notices.
We will never sell or distribute your personal information to any other third parties or make it public unless we have a legal obligation to do so.
We may need to share some information by law with our regulators or law enforcement authorities. For example Quality Care Commission or the Police.
We do share patient data with other healthcare providers but only with the patient’s consent.
We never sell or swap your details with third parties for marketing purposes.
Transferring personal data outside the European Union
We transfer your personal data outside the EU when we use some of the companies listed above. We have procedures in place to make sure that these restricted transfers are made lawfully. To do this we use either a standard contractual data protection clause that is approved by the Information Commissioner’s Office or rely on an assessment of adequacy where this is appropriate.
What are your rights over personal data?
You have rights in relation to the personal information we hold about you. These are:
The right to be informed about the collection and use of your personal data. We do this by
providing you with this privacy notice.
- The right of access. This is commonly referred to as ‘subject access’. You have the right to make a request to see all the personal data that St Mary’s Hospice holds about you. You can make this request verbally or in writing and we must respond within one calendar month.
- The right to rectification. If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible at the above address and we will promptly record your request and amend our records if required.
- The right to erasure. This is also known as ‘the right to be forgotten’. You can make this request verbally or in writing. This right only applies in certain circumstances.
- The right to restrict processing. This right only applies in certain circumstances. If we agree to restrict your personal data for one or more purposes we will store it but not use it.
- The right to data portability. This allows you to obtain and re-use your personal data for your own purposes across different services. If you would like us to transfer your personal data electronically, we will do this. It only applies to information you have given us, which we hold electronically and where St. Mary’s Hospice is the data controller.
- The right to object. You have the right to object to the processing of your personal data in certain circumstances. You can make an objection verbally or in writing. You have the absolute right to stop your personal data being used for direct marketing.
- Rights in relation to automated decision making and profiling. St. Mary’s Hospice does not use any of your personal data to make automated decisions, however we do create basic profiles of our supporters. You have the right to stop us doing this and can do so by contacting us in writing at the address given.
If we are unable to act upon your request we will explain to you the reasons for this
Using our website
If you use our website, we will store data about your internet browser, I.P. address, the timings of your visits, and a record of which pages you looked at. We only use information to better understand how people use our site.
Use of ‘cookies’
Like many other websites, our website uses ‘cookies’, small files stored on your computer which allow websites to recognise you when you visit. These store data about your browsing history but will not identify you as an individual. This helps us to improve our website and deliver a better more personalised service. You can switch off cookies in your browser preferences but doing so may result in a loss of functionality when using our website. The St Mary’s Hospice website may include links to other sites, not owned or managed by us and cannot be held responsible for the privacy of information collected by websites not managed by us. If you intend to use a link we recommend that you read the relevant privacy notice.
Our website uses cookies. For more information about cookies, please refer to our Cookie Policy.
