Addenbrooke's Charitable Trust Logo
Menu

 Privacy statement

Your privacy matters to us, and we are committed to protecting your personal information, and only using it legally and responsibly.

This privacy policy covers details of what information we collect from you (whether online, at the hospital, at an event, by phone, by email or through interaction with a third party); what we do with it, and whom it might be shared with.

If you have any questions about our privacy policy and the way we process personal data, or if you would like to change the way we communicate with you, then please contact us at hello@act4addenbrookes.org.uk, by phone on 01223 217757, or by writing to us Addenbrooke’s Charitable Trust, Box 126, Addenbrooke’s Hospital, Hills Road, Cambridge, CB2 0QQ

You may also like to see our accompanying fundraising promise.

Privacy menu

Who we are

Addenbrooke’s Charitable Trust (ACT) is the only registered charity dedicated to supporting innovation in patient care across Addenbrooke’s and the Rosie hospitals (Cambridge University Hospitals NHS Foundation Trust).

We are the controller of your data and registered with the Information Commissioner’s Office (ICO) under Data Protection Registration Number: ZA232762.

Addenbrooke’s Charitable Trust
Box 126
Addenbrooke’s Hospital
Hills Road
Cambridge
CB2 0QQ

We currently operate the following websites:

https://www.act4addenbrookes.org.uk/ (also accessible via www.helpyourhospital.co.uk)

https://cambridgeghp.org/

Addenbrooke’s Charitable Trust is independent of Cambridge University Hospitals NHS Foundation Trust and is registered with the Charity Commission No.: 1170103, company registration No.: 10469089.

[go to top of page]

How do we keep your information secure?

The security of the data and personal information that we store is important to ACT. We follow strict security procedures in the storage and disclosure of the information which you have given us to try to prevent:

  • Unauthorised access;
  • Improper use or disclosure;
  • Unauthorised modification; and
  • Accidental loss, damage, and destruction

We are required to make sure any transfers of information are carried out securely, in accordance with best practice, and in compliance with Data Protection regulations.

All our staff and data processors who have access to, and are associated with the processing of, personal information are legally obliged to respect the confidentiality of the personal information of our supporters, volunteers, staff and all those who engage with us.

Transfers of data outside the UK

In some cases, some of the services we provide or some of the processes we use may involve personal information being transferred outside the UK, for example where any data processors’ servers are located in Europe or elsewhere .

If you access our website or use any of the services we provide while you are outside of the UK, your information may be transferred outside the UK to provide you with those services.

If we do transfer personal data outside the UK, it will only be done where one of the following applies:

  • The transfer is to a recipient in a country or territory covered by UK Adequacy Regulations – in particular, those approved by the European Commission as providing an adequate level of protection for personal data.
  • The transfer is undertaken with appropriate safeguards – for example, the recipient has entered European Commission Standard Contractual Clauses (SCCs) with us.
  • You have explicitly consented to the transfer.

Links to other websites

This privacy notice does not apply to third-party websites you are directed to from our website. We encourage you to read the privacy statements on the other website that you visit.

[go to top of page]

What rights do you have in relation to your personal information?

You have certain rights in relation to your personal information. They are:

  • The right to obtain confirmation that we are processing your personal information;
  • The right to access your information;
  • The right to have your personal information rectified if it is incomplete or inaccurate;
  • The right to have your personal information removed or deleted in certain circumstances, for example when you have withdrawn consent for it being processed and we have no other legal basis for processing it;
  • The right to restrict the processing of your personal information in certain circumstances;
  • The right to object to certain processing including the right to not be subject to an automated decision making and the right to object where we are processing your information on the basis of our legitimate interest;
  • Where you have provided your consent to the processing, the right to withdraw consent to the processing of your data (without affecting the lawfulness of the processing based on consent before its withdrawal); and
  • The right to require us not to send you marketing communications.

Please note that some of the above rights are not absolute, and requests may be refused where exceptions apply – where this is the case, we will always share the reason behind a decision and offer the right to appeal the decision.

For a more detailed explanation of these rights, please see the Information Commissioner’s guidance

[go to top of page]

Subject Access Request

You can ask us to confirm if we are keeping any personal information about you and you can also request to receive a copy of that personal information – this is called a Subject Access Request.

To make a Subject Access Request you will need to provide adequate proof of identity such as a copy of your passport, driving licence or birth certificate before your request can be processed. Please try to be as clear as possible about the information you are seeking, as this will help us respond to your request more efficiently. Once we have received your Subject Access Request and proof of identity, you will receive a response from us within one month.

If you would like to submit a Subject Access Request or exercise any of the other rights referred to above, please email hello@act4addenbrookes.org.uk with Subject Access Request in the subject line, or you can write to us Data Protection Lead, c/o Addenbrooke’s Charitable Trust, Box 126, Addenbrooke’s Hospital, Hills Road, Cambridge, CB2 0QQ

If you are not happy with how we handle any of your requests, queries, or concerns, you can contact the Information Commissioner’s Office (www.ico.org.uk), which oversees the protection of personal information in the UK.

Changes to the Privacy Policy?

We may be required to update the terms of this policy from time to time. We will notify you about any significant changes in the way we treat personal information, usually by sending a notice to the primary email address or postal address you have provided, or by placing a prominent notice on our website(s).

This Privacy Policy was last updated on 19 March 2021

How to contact us?

If you have any queries about our Privacy Policy, or want to raise a concern about how we process the information we hold about you, please email hello@act4addenbrookes.org.uk with Data Protection Enquiry in the subject line, or write to Data Protection Lead, Addenbrooke’s Charitable Trust, Box 126, Addenbrooke’s Hospital, Hills Road, Cambridge, CB2 0QQ

[go to top of page]

Further Reading

The following sections give information that is specific to our different audiences, if you fall into one (or more) of these categories then the general privacy information above will also apply to you.

1.    What this means if you are a donor, fundraiser, member of the Friends, 1766 or Lottery

Addenbrooke’s Charitable Trust raises crucial income from its fundraising activities, and fundraised income is central to helping make Addenbrooke’s even better.

What personal information do we collect about our donors, fundraisers, members of the Friends and 1766 club, and Lottery players?

ACT collects personal information that is necessary to carry out our fundraising activities, process donations, and keep you informed about the work that ACT carries out to make Addenbrooke’s even better.

The personal information we collect from you may include:

  • Name, title, gender, and date of birth
  • Email address, phone number(s) and postal address(es)
  • Current interests and preferences
  • Event registrations and attendances
  • Donations you have made to ACT.
  • Credit card or other payment information (we only store this for as long as is necessary to process the payment)
  • Contact preferences.
  • Bank details (if setting up a regular direct debit)
  • Gift Aid declaration
  • Details of correspondence sent to you, or received from you.
  • Any other information provided by you to ACT (where we have a legitimate reason or consent to retain that information)
  • Images captured on film or photography at our events, or in an arranged photo shoot.

In addition to the above, when you visit our website we use cookies to improve your experience. See our cookies policy for more information.

We also, on occasion, collect additional information from public sources (see below ‘Analysis and Research of our supporters and potential supporters’)

Special Categories of personal data

Under data protection law, certain categories of personal information are recognised as sensitive, including health information and information regarding race, religious beliefs, and political opinions (‘special category data’) and personal data relating to criminal convictions and offences. We only collect such information about donors, fundraisers, members of the Friends and 1766, Lottery players and potential supporters in very limited cases, and only where there is a clear reason for doing so, such as accessibility or dietary requirements for events, or where you have given us explicit consent to record that information.

How do we collect your personal information as a donor, fundraiser, member of the Friends and 1766, or a Lottery player?

Information you provide

We collect personal information that you may provide to us; Addenbrooke’s Charitable Trust (ACT), a charity registered in the UK, when you:

  • Donate (including for a regular Direct Debit) or complete a Gift Aid declaration
  • Complete a joining or renewal form for either the Friends, 1766 or the ACT Lottery
  • Respond to an invitation to attend an ACT event, or
  • Are in correspondence or verbal conversation about a donation or ACT related project with a member of ACT’s staff.

Information we collect from your use of our website(s) and services.

We collect information about the services you use and how you use them in several ways, including:

  • When you visit our website, including using cookies. See our cookies policy for more information.
  • When you view and interact with our emails, advertisements, and content.
  • Information about contact you have with us as a supporter of ACT.

Information we collect from publicly available sources

In relation to some supporters and potential supporters we may collect publicly available information about you to assist us with our activities (See below ‘Analysis and research of our supporters and potential supporters’)

How do we use your information as a donor, fundraiser, member of the Friends or 1766, or as a Lottery player?

We will only process your information if we have a legal basis for doing so under UK data protection legislation, including:

  1. Processing your information because it is necessary for the performance of a contract with you or to take steps at your request prior to entering a contract, for example:
    1. To process payments
    2. In relation to donations, to credit you in whatever way we have agreed to do.
  2. Where we are required by law to process your information, for example:
    1. To make a Gift Aid claim
  3. Where we have your consent to process your information, for example:
    1. Where you have agreed to receive email invitations in relation to ACT events

Where you have given consent to the processing of your personal data, you may withdraw that consent at any time. See our General Privacy Information for further details.

  1. Where processing your information is necessary for our legitimate interests, for example:
    1. When we carry out analysis and research of our supporters and potential supporters to gain a better understanding of our existing and potential supporters. This enables us to raise funds for our charitable purposes more effectively and efficiently and allows us to approach supporters in a focussed and informed way about projects or activities they may be interested in supporting. See below ‘Analysis and research of our supporters and potential supporters’.
    2. When we carry out due diligence in advance of soliciting or accepting major donations to make sure we do not accept gifts from sources which could harm the reputation of ACT or Cambridge University Hospitals, or in any way contradicts ACT’s charitable objects.
    3. Where (from time to time) we (or a third party) carry out filming, including interviews or filming/photographing of talks or events. Where areas of the hospital or events are going to be used for filming or photography, we will always flag this in advance with clear signage or otherwise make you aware of the filming in advance, so that you can avoid being filmed or photographed.

Where we are relying on this basis of processing you have the right to object to this. See our General Privacy Information for further details.

  1. We may process special category data (for example health data) based on additional grounds, including where it is necessary to protect a person’s vital interests (for example, where you have an accident at an ACT event, and we process your personal data to ensure you receive appropriate medical attention)

Analysis and research of our supporters and potential supporters

By building a picture of those who support, or could potentially support ACT, we are able to improve the level of service that we provide, and better understand your interests and preferences so that we are talking to you about what interests you – this in turn means we can fundraise more efficiently and make sure your donation has the greatest possible impact on making Addenbrooke’s even better.

When we build a picture of our supporters we may use:

  • Your donation history with ACT
  • Geographic, demographic, and other information you have provided to ACT.
  • Publicly available information, including Companies House, 192.com, and information that has been published in newspapers/articles.

We also carry out due diligence in advance of asking supporters for major donations. Before seeking or accepting large donations we are required to conduct checks, including reviewing publicly available data relating to criminal convictions and offences, to ensure that by accepting the donation we are not risking the reputation of either ACT or the hospital.

Click here to read our Fundraising Promise.

Our communications with you as a donor, fundraiser, member of the Friends or 1766, or as a Lottery player

We are committed to communicating with donors, fundraisers, members of the Friends and 1766, and Lottery players using an approach that is right for you. This means we carefully manage the communications we send you to ensure that we are contacting you in the most relevant way.

If you are an email subscriber, see the section ‘What this means for visitors to our website or e-news subscribers’.

If you have agreed to receive email invitations to events from ACT, you can change your email preferences at any time by:

  • Indicating that you do not wish to receive our emails by clicking the ‘unsubscribe’ link at the end of our marketing emails or by emailing hello@act4addenbrookes’org.uk, or by calling 01223 217757.

If you have provided us with your postal address, we may send you direct mail about our work or invitations to our events, unless you have told us that you do not want to receive such information via this channel. You may change your direct mail preferences at any time by contacting us at hello@act4addenbrookes.org.uk

What other organisations do we share your information with?

We will not sell your personal information to any third parties or external organisations.

Sharing your information with our service providers/external data processors

We may share some of your personal information with our service providers/external data processors, to carry work out on our behalf. Examples of such service providers/data processors include:

  • MailChimp, our email marketing service provider
  • GoCardless, the bureau responsible for lodging and collecting our Direct Debits.

Any such companies are acting as our data processors and the contracts we enter with them require them to comply with UK data protection laws; to process your information only for the purposes we specify, and to make sure they have the appropriate controls in place to protect the security if your information.

Sharing your information with Cambridge University Hospitals (Addenbrooke’s and the Rosie)

Where you have donated or supported ACT in some way and indicated that this support is a result of the care you have received from the hospital, we may share limited information with the relevant department/clinical staff, unless you tell us that you would prefer that we did not. This information might include:

  • Name
  • Donation amount
  • The names of any specific staff mentioned at the time of donating.
  • Any messages or comments that might accompany a donation or act of support.

Sharing your information with our charity and fundraising partners

Some of the projects that ACT fundraises for, such as large-scale capital fundraising projects, are often carried out in partnership with other charities, such as Cambridge University Development Office, or Head-to-Toe Charity. Where a project is being fundraised for by a partnership of organisations, we will endeavour to make these relationships clear, and provide details of any data sharing that might take place as part of that relationship. Personal information is shared with partners in these circumstances to achieve the most effective and efficient fundraising, and to ensure that no two organisations approach the same individual with the same fundraising ask. Examples of personal information that might be shared includes:

  • Name and contact details
  • Whether a supporter or potential supporter is someone that has indicated they are grateful to the hospital for previous or ongoing care. We will never share the details of any conditions, treatments or specific wards or departments visited, and fundraising partners will not store this information on their systems.

Where ACT enters a fundraising partnership with other charities or organisations, each partner will share a data sharing agreement that ensures each partner understands their obligation under UK Data Protection legislation.

How long do we keep your information?

We will retain your information for as long as is necessary for the purposes set out in this privacy notice, to fulfil our contractual obligations to you, and to comply with legal requirements, tax, and accounting rules for charity record-keeping purposes. The retention period will vary according to the nature of the purposes under which the information is held. For example:

  • We retain Gift Aid declarations in accordance with HMRC guidance, which in the case of a one-off donation is generally six years from the end of the accounting period in which the donation is received; the period is longer in the case of a declaration which applies to a series of donations or if an HMRC query is received during the normal retention period.
  • Records of donations (credit card and bank details are redacted) are kept for a period of seven years in line with the charity Statement of Recommended Practice (SORP).

Patient Data

We do not and cannot have access to patient data.

The hospital does sometimes contact patients on our behalf, asking if they would like to hear more from the charity. At no point does ACT see any patient data. We will only contact patients directly if they explicitly opt-in to hear from ACT. Funds are not diverted from patient care for this or any other activity that ACT carries out.

The accuracy of your data

We ask that you please let us know when you moved to a new house or changed your contact details, then we can keep our records up to date. If mail (postal or electronic) addressed to you is returned to us as ‘moved away’ (or something similar), or the contact details we hold are incomplete, then we may use publicly available sources, such as the Post Office’s National Change of Address database, to double check and update your details.

[go to top of page]

2.    What this means for our e-news subscribers

This section contains information which is specific to our email (e-news) subscribers. If you fall into this category you should also see our General Privacy Information.

You can sign up for our email updates via our website, by contacting ACT directly, or using a paper form at an ACT event.

What personal information do we collect about our email subscribers?

We collect information that is necessary to keep you informed about ACT and its activities, and that helps us understand which email, articles and link where of interest to you. The personal information we collect from you as an email subscriber may include your:

  • Email address
  • Name
  • Country of residence (based on the server your internet is logged into)
  • Which emails you have opened, and which links or articles within an email you have clicked on

In addition to the above, when you visit our website, we use cookies to improve your experience and personalise the service you receive. See our cookies policy for more information.

Under data protection law, certain categories of personal information are recognised as sensitive, including health information and information regarding race, religious beliefs, and political opinions (‘special category data’). We do not collect special category personal data about email subscribers, although a general interest in a subject or area might be inferred from the articles or emails that you choose to open.

How do we collect your personal information as an email subscriber?

Information you give us

We collect personal information that you may provide to us, including when you:

  • Sign up to our email updates.
  • Complete a survey or enter a competition.
  • Register for an event or other service from ACT.

Information we get from your use of our website(s) and services

We collect information about the services you use and how you use them in several ways, including when you:

  • Visit our website, including using cookies (see of cookies policy for more information)
  • View and interact with our emails, advertisements, and content.

Information from third parties

We may also receive information about you from third parties, for example when you:

  • Follow ACT’s social media channels, subject to your privacy settings on those channels, or
  • Make a purchase from the ACT online shop, the platform for which is currently provided by Shopify.

How do we use your information as an email subscriber and what is our legal basis for processing it?

We will only use your information to communicate with you by email with your consent. Our email updates may include:

  • Monthly newsletters, with articles and links to events, projects we have or are fundraising for, news from the hospital itself, and surveys.
  • Letting you know about our latest fundraising appeals or priority projects.
  • Events and news about the projects we are fundraising for, including equipment, research, treatment and care, or our global health partnerships programme.

Where processing your information is necessary for our legitimate interests

We are committed to communicating with you using an approach that is right for you. This means we carefully manage the communications we send you to make sure that we are contacting you in the most relevant way.

To do this, we may combine the information we collect about you and analyse what we know about your interests, preferences, and interactions with our website(s) and marketing emails to create a profile, so we can contact you in the most appropriate way, and with the most relevant information.

You do have the right to object to us combining and analysing information in this way, and can let us know by contacting us at hello@act4addenbrookes.org.uk

Changing your email update preferences

You can change your email preferences or unsubscribe at any time by:

  • Indicating that you do not wish to receive our emails by clicking the ‘unsubscribe’ link at the end of our emails.
  • Contacting us at hello@act4addenbrookes.org.uk, or at 01223 217757

What other organisations do we share your information with?

We will not sell your personal information to any third parties or external organisations.

Sharing your information with our service providers/external data processors

We may share some of your personal information with our service providers/external data processors, to carry work out on our behalf. Examples of such service providers/data processers include our email distribution service provider who sends out and helps us tailor our emails. We currently use MailChimp for this purpose, and you can read more about what they do to protect your personal information here.

Any such companies are acting as our data processors and the contracts we enter with them require them to comply with UK data protection laws, to process your information only for the purposes we specify, and make sure they have the appropriate controls in place to protect the security of your information. Where ACT does enter a contract with a company that acts as a data processor on our behalf, we will monitor such companies and their activities with regard to the processing they are carried to ensure they are compliant with UK data protection laws and are acting within the limits of any contract in place between ACT and that company.

How long do we keep your information?

Generally, we will only keep information about you for as long as you subscribe to our emails. However, we are required to keep a minimal amount of your personal information (your name and email address) if you indicate that you do not wish to be contacted by email communications purposes. These details are kept securely on a suppression list to help us make sure that we do not continue to contact you for marketing purposes.

[go to top of page]

3.    As a visitor to our website

If you do nothing other than read pages or download information while using this website, we will capture and store information about your visit. However, we will not be able to identify you by name from this; we will know the following (i) the Internet domain and IP address from which you access the website (ii) the type of browser and operating system you use (iii) the date and time of your visit, (iv) the pages you visit, and (v) the address of the website from which you linked to us (if applicable).

We collect this information to make each visit more rewarding, and to provide us with information to help improve our service.

How we use ‘cookies’

Like most websites, we use ‘cookies’ to help make our site, and the way we use it, better. Cookies mean that a website will remember you. They are small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier. We also collect this information so we can see what type of device and operating system you are using to access our website. This helps us optimise our website for the most frequently used devices. Cookies collected include:

ASPXANONYMOUS

This is a cookie that stores a unique ID for users for which you can use to track data against for individual users.

um_IsMobile – Detects if the web browser is on a mobile device. Google Analytics for website usage analysis.

ASP.NET_SessionId – A cookie that ASP.NET uses to store a unique identifier for your session.

Language – Allows the language to be set according to a cookie.

__utmt – Google Analytics – Used to throttle request rate.

__utma – Used to distinguish users and sessions.

__utmb – Used to determine new sessions/visits.

__utmc – Not used in ga.js. Set for interoperability with urchin.js. Historically, this cookie operated in conjunction with the __utmb cookie to determine whether the user was in a new session/visit.

__utmz – Stores the traffic source or campaign that explains how the user reached your site.

[go to top of page]

4.    What this means for supporters of our Children’s Hospital capital campaign, including Ambassadors and campaign board members

Some of the most significant ways in which ACT helps to make Addenbrooke’s an even better hospital is through its fundraising support of major capital campaigns, such as the new Children’s Hospital. The new Children’s Hospital is only possible because of fundraising, and in particular major donations and philanthropic support.

What personal information do we collect about our Children’s Hospital supporters, ambassadors, and campaign board members?

We collect personal information that is necessary to carry out our fundraising activities, process donations, and keep you informed about the Children’s Hospital and associated projects.

If you are a Children’s Hospital Ambassador then please also read the section What this means if you are an ACT Volunteer

The personal information that we collect from you may include:

  • Name, title, gender, and date of birth
  • Email address, phone number, postal address
  • Family and spouse/partner details, relationships with other campaign fundraising partner organisations
  • Current interests and preferences
  • Event registrations and attendances
  • Donations you have made to ACT and the Children’s Hospital campaign
  • Credit card or other payment information (we only store this for as long as we need to process payment)
  • Contact preferences.
  • Bank details (if setting up a regular direct debit)
  • Gift Aid declaration
  • Details of correspondence sent to you, or received from you.
  • Any other information provided by you to ACT.
  • Images captured on film or photography taken at the hospital or at an event.

In addition to the above, when you visit our website we use cookies to improve the experience and personalise the service you receive. See our cookies policy for more information.

We also, on occasion, collect additional information from public sources. (See below ‘Analysis and research of our supporters and potential supporters’).

Special Categories of personal data

Under data protection law, certain categories of personal information are recognised as sensitive, including health information and information regarding race, religious beliefs, and political opinions (‘special category data’) and personal data relating to criminal convictions and offences. We only collect such information about Children’s Hospital capital campaign supporters, ambassadors, or campaign board members in limited cases, and where there is a clear reason for doing so, such as accessibility or dietary requirements for events, or due diligence in respect of major donations.

In respect if certain special category data, we may collect information that is manifestly made public by you (for example where you have published your political opinions/affiliations).

How do we collect your personal information as a Children’s Hospital capital campaign supporter, ambassador, or campaign board member?

Information you provide

We collect personal information that you may provide to us; Addenbrooke’s Charitable Trust, a UK registered charity, including when you:

  • Donate or complete a Gift Aid declaration
  • Complete an ambassador or campaign board member enrolment form.
  • Respond to an invitation or attend an ACT event.
  • Are in correspondence or verbal conversation about a donation, support of ACT related project with a member of ACT’s staff.

Information we get from your use of our website(s) and services

We collect information about the services you use and how you use them in several ways, including:

  • When you visit our website, including using cookies. See our cookies policy for more information.
  • When you view and interact with our emails, advertisements, and content.
  • Information about contact you have with us as a supporter of ACT.

Information we collect from publicly available sources

In relation to some Children’s Hospital capital campaign supporters, ambassadors, and campaign board members, we may collect publicly available information about you to assist us with our activities (See below ‘Analysis and research of our supporters and potential supporters’)

How do we use your information as a Children’s Hospital capital campaign supporter, ambassador, or campaign board member?

We will only process your information if we have a legal basis for doing so under current UK data protection legislation including:

  1. Processing your information because it is necessary for the performance of a contract with you or to take steps at your request prior to entering a contract, for example:
    1. To process payments
    2. In relation to donations, to credit you in whatever way we have agreed to do.
  2. Where we are required by law to process your information, for example.
    1. To make a Gift Aid declaration
  3. Where we have your consent to process your information, for example.
    1. Where you have agreed to receive email invitations in relation to ACT events

Where you have given consent to the processing of your data you may withdraw it at any time. See our General Privacy Information for further details.

  1. Where processing your information is necessary for our legitimate interests, for example.
    1. To process donations
    2. When we carry out analysis and research of Children’s Hospital capital campaign supporters, ambassadors, and campaign board members to gain a better understanding of our existing and potential supporters. This enable us to raise funds for our charitable purposes more effectively and efficiently and allows us to approach supporters in a targeted and informed way about projects or activities they may be interested in supporting. See below ‘Analysis and research of our supporters and potential supporters’.
    3. When we carry out due diligence in advance of asking supporters for major donations. Before seeking or accepting large donations we are required to conduct checks, including reviewing publicly available data relating to criminal convictions and offences, to ensure that by accepting the donation we are not risking the reputation of either ACT or the hospital.
  2. Where (from time to time) we (or a third party) carry out filming, including interviews or filming/photographing of events. Where areas of the hospital or events are going to be used for filming or photography, we will always flag this in advance with clear signage or otherwise make you aware of the filming in advance, so that you can avoid being filmed or photographed.

Where we are relying on this basis of processing you have the right to object to this. See our General Privacy Information for further details.

  1. We may process special category data (for example, health data) based on additional grounds, including where it is necessary to protect an individual’s vital interests (for example, where you have an accident or illness while at an ACT event, and we must process your personal data to ensure you receive appropriate medical attention).

Analysis and research of our supporters and potential supporters

By building a picture of those who support, or could potentially support ACT, we are able to improve the level of service that we provide, and better understand your interests and preferences so that we are talking to you about what interests you – this in turn means we can fundraise more efficiently and make sure your donation has the greatest possible impact on making Addenbrooke’s even better.

When we build a picture of our supporters we may use:

  • Your donation history with ACT
  • Geographic, demographic, and other information you have provided to ACT.
  • Publicly available information, including Companies House, 192.com, and information that has been published in newspapers/articles.

We also carry out due diligence in advance of asking supporters for major donations. Before seeking or accepting large donations we are required to conduct checks, including reviewing publicly available data relating to criminal convictions and offences, to ensure that by accepting the donation we are not risking the reputation of either ACT or the hospital.

Click here to read our Fundraising Promise.

What other organisations do we share your information with?

Sharing your information with the Children’s Hospital Capital Campaign Partners

We will not sell your personal information to any third parties or external organisations.

The Children’s Hospital Campaign is a partnership between Cambridge University Hospitals Foundation Trust (CUH), Addenbrooke’s Charitable Trust (ACT), Cambridge University Development Office, Cambridge & Peterborough NHS Foundation Trust, and Head-to-Toe Charity. On occasion it will be necessary for ACT to share limited information with the other partner organisations – in particular Cambridge University Development Office – to ensure that no two organisations are asking the same individual to support a project, and to ensure that each supporter and potential supporter receives the most appropriate communications from the most appropriate partner organisation regarding this campaign. The information that we might share with the partner organisations above may include:

  • Names and postal addresses
  • Email address

A strict Data Sharing Agreement exists between ACT and Cambridge University Development Office, a copy of which can be obtained on request. This agreement makes clear that neither organisation may store or process the personal information of a supporter or potential supporter that are provided by the other partner explicitly for the purposes of ensuring duplicate asks are made.

ACT will not share Special Category Data with Cambridge University Development Office, including health related information. For the purposes of establishing which organisation is best placed to manage a relationship with a supporter or potential supporter we may indicate if an individual is a grateful patient of Cambridge University Hospitals, but this information will not be stored or processed by Cambridge University and is shared only for the purposes of ensuring the individual receives communications only from the most appropriate partner.

Sharing your information with our service providers/external data processors

We may share some of your personal information with our service providers/external data processors, to carry work out on our behalf. Examples of such service providers/data processors include:

  • Our e-news distribution service provider (currently MailChimp)
  • The Direct Debit bureau that lodges and collects our regular Direct Debit payments
  • Third party mailing houses where we are sending out postal communications to many individuals and it is necessary and efficient to employ a third-party printer with capacity and expertise.

Any such companies are acting as our data processors and the contracts we enter with them require them to comply with UK data protection laws; to process your information only for the purposes we specify, and to make sure they have the appropriate controls in place to protect the security of your information.

How long do we keep your information?

We will keep your information for as long as is necessary for the purposes set out in this privacy notice, to fulfil our contractual obligations to you, and to comply with legal requirements, tax, and accounting rules for ACT record-keeping purposes. The retention period will vary according to the nature of the purpose under which the information is held. For example:

  • We retain Gift Aid declarations in accordance with HMRC guidance, which in the case of a one-off donation is generally six years from the end of the accounting period in which the donation is received; the period is longer in the case of a declaration which applies to a series of donations or in an HMRC query is received during the normal retention period.
  • Records of donations (credit card and bank details are redacted) are kept for a period of seven years in line with the charity Statement of Recommended Practice (SORP).

4.1    Cambridge Cancer Research Hospital (CCRH)

If you’re a supporter of the Cambridge Cancer Research Hospital (CCRH) then your data will be processed as per section 4. However, the campaign partners will be: Addenbrooke’s Charitable Trust (ACT), Cambridge University Hospitals NHS Foundation Trust (CUH) and the University of Cambridge.

[go to top of page]

5.    What this means if you are an ACT Volunteer

ACT volunteers help to raise awareness of our charity, in our communities and hospitals, they support us to do more in our offices and they play an important part in making the Addenbrooke’s and Rosie hospitals even better.

What personal information do we collect about our volunteers?

We collect personal information that is necessary to help us identify the most appropriate roles for prospective volunteers, as well as to carry out the necessary checks as part of the safeguarding procedures that Addenbrooke’s Charitable Trust and Cambridge University Hospitals have in place.

The personal information we collect from you may include your:

  • Name, title, gender, and date of birth
  • National Insurance Number
  • Your postal address, email address and telephone number
  • Information about the types of volunteering roles and opportunities you may be interested in
  • The details of a person to contact in the event of an emergency.
  • Bank details if it is necessary to reimburse reasonable expenses.
  • Details of correspondence sent to you, or received from you.
  • Images captured at events or during your volunteering duties.

As part of our volunteer application process, we also ask for two forms of ID as well as two references. Copies of these are kept securely with your application and are only kept for as long as you are a volunteer with ACT.

Special categories of personal data

Under the data protection law, certain categories of personal information are recognised as sensitive, including health information and information regarding race, religious beliefs, and political opinions (‘special category data’) and personal data relating to criminal convictions and offences. We only collect such information about volunteers in limited cases and where there is a clear reason for doing so, for example:

  • We might collect health information relating to access requirements or to make reasonable adjustments for a volunteering role, and we might collect dietary requirements for events.

It is the policy of Addenbrooke’s Charitable Trust and Cambridge University Hospitals that volunteers are subjected to a Criminal Records Bureau Check (CRB). For this check to be carried out a limited amount of additional personal data may be collected and processed by Cambridge University Hospitals as the provider of such checks for ACT.

How do we collect your personal information as a volunteer?

We collect personal information that you may provide to us, a charity registered in the UK, when you:

  • Complete a volunteering Expression of Interest Form on the ACT website
  • Complete a ‘follow-up form’ after an interview
  • When you submit an enquiry form through the ACT website, or send ACT an email.
  • When you visit the ACT office and enquire about volunteering
  • When you enquire about volunteering at an event that ACT is attending or organising
  • When you visit our website, including using cookies. See our cookies policy for more information.

How do we use your personal information as a volunteer, and what is our legal basis for processing it?

We will only process your information if we have a legal basis for doing so under current UK data protection legislation, including:

Processing your information because it is necessary for the performance of a contract with you or to take steps at your request prior to entering a contract, for example:

  • To process payments, including the paying of reasonable expenses in relation to your volunteering
  • To process your application to become an ACT volunteer.

Where we are required by law to process your information, for example:

  • Where the volunteering role you are applying for necessitates a Criminal Records Bureau Check

Where we have your consent to process your information, for example:

  • Where you have agreed to receive emails about volunteering opportunities, ACT fundraising, events, or other ACT related news.

Where processing your information is necessary for our legitimate interests, for example:

  • When we carry out analysis and research of volunteers or potential volunteers to gain a better understanding of our existing or potential volunteers. This enables us to recruit new volunteers more effectively and efficiently, and allows us to approach volunteers in a targeted and informed way about our activities and related volunteering opportunities.
  • Where (from time to time) we (or a third party) carry out filming, including interviews or filming/photographing of events. Where events or areas of the hospital are going to be used for filming or photography, we will always flag this in advance with clear signage or otherwise make you aware of the filming in advance, so that you can avoid being filmed or photographed.

When we are relying on this basis of processing you have the right to object to this. See our general privacy information for further details.

We may process special category data (for example, health data) based on additional grounds, including where it is necessary to protect an individual’s vital interests (for example, where you have a life-threatening accident of illness while at an event, and we must process your personal data to ensure you receive appropriate medical attention).

Our communications with you as a volunteer

We are committed to communicating with volunteers using an approach that is right for you. This means we carefully manage the communications we send you to ensure that we are contacting you in the most relevant way.

We communicate with volunteers by telephone, email, post and online through social media, and these communications will include information about you as a specific volunteer (the hours you are available, your volunteering application, etc…) and information about volunteering opportunities (specific events or specific roles). These are service messages – information you need to receive to be an ACT volunteer.

You will be asked if you’d like to receive information about ACT generally – i.e. that we think our volunteers will be interested in receiving.

If you have agreed to receive such emails, or emails about any other element of ACT’s work or events, then you can change your preferences at any time by:

  • Emailing hello@act4addenbrookes.org.uk
  • Calling us on 01223 217757
  • Writing to us at ACT, Box 126, Addenbrooke’s Hospital, Hills Road, Cambridge, CB2 0QQ

If you are an email subscriber see what this means for our e-news subscribers

If you have provided us with your postal address, we may send you direct mail about our work or invitations to our events, including fundraising appeals. unless you have told us that you do not want to receive such information via this channel. You may change your direct mail preferences anytime by contacting hello@act4addenbrookes.org.uk

What other organisations do we share your information with?

We will not sell your personal information to any third parties or external organisations.

Sharing your information with our service providers/external data processors

We may share some of your personal information with our service providers/external data processors, to carry work out on our behalf. Examples of such service providers/data processors include:

  • Our email distribution service provider, which is currently MailChimp – you can find out more about MailChimp’s information security and privacy here.
  • Cambridge University Hospitals, who currently carry out our Criminal Records Bureau checks on our behalf, authorise our onsite volunteers, as well as issuing ID badges that allow volunteers to operate on site at Addenbrooke’s

Details of how Cambridge University Hospitals store, process, retain and collect personal information can be found in their privacy statement by visiting: www.cuh.nhs.uk/patient-privacy/

How long do we keep your information?

We will keep your information for as long as is necessary for the purposes set out in this privacy notice, to fulfil our contractual obligations to you, and to comply with legal requirements, tax, and accounting rules for ACT’s record keeping purposes. The retention period will vary according to the nature of the purpose under which the information us held. For example:

  • We retain contact details for as long as we deem to have a legitimate reason to stay in touch with you.
  • We retain records of financial transactions (for example an expense claim) for a period of seven years, unless the transaction is part of an investigation or query.
  • We retain records of Criminal Records Bureau checks for as long as you are an active volunteer with ACT.

[go to top of page]

6.    What this means for children and young people

We do not actively collect the personal information of children. However, we know that some are kind enough to fundraise for us. If we capture a child’s data through our giving platforms, we will ensure parental consent is in place for anyone under the age of 13. We do not actively market to under 18s and will update our records when made aware that an under 18 is on our database. If we want to store a photograph of an under 18, we will seek their consent if they are 13 or over, and that of their parent or guardian if they are younger than 13.

[go to top of page]

7.  What this means if you are a member of CUH staff applying for a grant from ACT

This section contains information specific to staff in CUH FT or related partners who are applying for grants from Addenbrooke’s Charitable Trust.

7.1 What personal information do we collect about grant applicants?

We collect personal information that is necessary to administer applications for funding, this includes information that allows us to communicate the outcome of a grant application, monitor the progress of projects and spending, and evaluate the outcome of grants made.

The personal information that we collect from you may include:

  • Name, title, gender
  • Email address, phone number
  • Details of correspondence sent to you, or received from you
  • Images captured on film or photography taken at the hospital or at an event
  • Any other information provided by you to ACT

In addition to the above, when you visit our website, we use cookies to improve the experience and personalise the service you receive. See our cookies policy for more information.

7.2 How do we collect your personal information as a grant applicant or as someone involved in the delivery of a project ACT is funding?

Information you provide

We collect personal information that you may provide to us, including when you:

  • Complete the grant application form (online or paper form)
  • Are in correspondence or verbal conversation about a grant or project with a member of ACT’s staff

Information we get from your use of our website(s) and services

We collect information about the services you use and how you use them in several ways, including:

  • When you visit our website, including using cookies.
  • When you view and interact with our emails, advertisements, and content
  • Information about contact you have with us as a grant applicant or in relation to your role in delivering a project

7.3 How do we use your information as a grant applicant or as someone involved in the delivery of a project ACT is funding?

We will only process your information if we have a legal basis for doing so under current UK data protection legislation, including:

  • Processing your information because it is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract, for example:
    • To evaluate a grant application and communicate the outcomes of that application
    • To administer successful grants, including monitoring and evaluation
  • Where we are required by law to process your personal information, for example:
    • When compiling annual reports and accounts for the Charity Commission
    • When complying with audit requests
  • Where we have consent to process your information, for example:
    • Where you have agreed to receive emails or other communications from ACT
  • When processing your personal information is necessary for our legitimate interests, for example:
    • When we carry out analysis and research to understand which areas of the hospital, and which staff, are applying for grants. This allows us to better target our marketing to areas of the hospital where ACT funding is underrepresented, or where ACT has funding relevant to the area where you work

Where you have given consent to the processing of your data you may withdraw it at any time, and where ACT is relying on legitimate interest you have the right to object. See our General Privacy Information for further details.

7.4 What other organisations do we share your information with?

We may share some of your personal information with our service providers/external data processors, to carry work out on our behalf. Examples of such service providers/data processors include:

  • Our e-news distribution service provider (currently MailChimp)
  • Our Grant Management System provider (currently SmartSimple)

Any such companies are acting as our data processors and the contracts we enter with them require them to comply with UK data protection laws; to process your information only for the purposes we specify, and to make sure they have the appropriate controls in place to protect the security of your information.

7.5 How long do we keep your information

We will keep your information for as long as is necessary for the purposes set out in this privacy notice, to fulfil our contractual obligations to you, and to comply with legal requirements, and accounting rules for CAT record-keeping purposes. The retention period will vary according to the nature of the purpose under which the information is held.

Updated on 07 October 2022