Royal Papworth Charity Privacy Statement

1. Who we are

We are Royal Papworth Hospital Charity (aka Royal Papworth Charity), a registered charity in England and Wales (no. 1049224).

Our registered address is:

Royal Papworth Hospital NHS Foundation Trust
Papworth Road
Cambridge Biomedical Campus
Cambridge
CB2 0AY

You can also contact us by email at papworth.charity@nhs.net or phone on 01223 639950.

Whenever you see the words ‘We’, ‘Us’ or ‘Our’, it refers to Royal Papworth Hospital Charity.

2. Data protection overview

Royal Papworth Hospital Charity is committed to protecting your privacy and being open and transparent about how we collect, use and protect your personal information.

This notice explains what information we collect, why we use it, who we may share it with, how long we keep it and the rights you have.

We process personal information in accordance with applicable UK data protection and privacy legislation, including the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 (PECR), as amended, and the Data (Use and Access) Act 2025.

We also follow relevant Charity Commission guidance and the Code of Fundraising Practice.

If you would like this notice in another format or need support understanding how we use your information, please contact us using the details below.

Royal Papworth Hospital Charity and Royal Papworth Hospital NHS Foundation Trust

Royal Papworth Hospital Charity works closely with Royal Papworth Hospital NHS Foundation Trust, but the Charity and Trust are separate organisations for many data protection purposes.

This notice explains how Royal Papworth Hospital Charity uses information for charitable purposes including fundraising, donations, supporter engagement, events and grant-making.

Information held by Royal Papworth Hospital NHS Foundation Trust about patients and their healthcare is governed by the Trust's own privacy arrangements.

Supporting the Charity does not give us access to your medical records. Where information is shared between the Trust and Charity, it will only be shared where there is an appropriate lawful basis and in accordance with applicable data protection and confidentiality requirements.

Royal Papworth Hospital NHS Foundation Trust is committed to adhering to all Data Protection Legislation, including the UK General Data Protection Regulations, that came into force in May 2018. If you would like more information with regard to how they process your information, please visit their website here.

3. What personal information do we collect?

Personal information is information that can be used to identify you.

When we use personal information, we will ensure that it is: processed lawfully, fairly and transparently; collected for clear and specified purposes; limited to what is necessary for those purposes; kept accurate and up to date where appropriate; retained for no longer than necessary; and appropriately protected.

We aim to collect only the information we genuinely need.

The information we collect depends on how you interact with us. It may include:

your name and title, contact details and date of birth where necessary;
your donation and fundraising history, including Gift Aid information;
payment and transaction information;
information about events you attend or participate in;
volunteering information;
details of products or services you have requested;
lottery participation;
information about gifts in Wills;
communication and marketing preferences;
correspondence and records of interactions with us;
information provided when applying for, managing or reporting on charitable funding;
photographs, videos and stories where appropriate;
information obtained from legitimate publicly available sources for appropriate fundraising research or due diligence;
information about your interactions with our website and digital communications; and
technical information such as IP addresses, device information and online identifiers where applicable.

Special category information

Sometimes you may choose to tell us information that data protection law considers particularly sensitive.

For example, you may tell us about your health or your experience as a patient or family member when explaining why you support the Charity or when sharing your story.

Where we process special category personal information, we will identify both an appropriate lawful basis under UK GDPR and an additional condition permitting the processing of special category information.

Where appropriate, we will ask for your explicit consent, particularly where health information is being used in a supporter or patient story.

We will not seek to obtain unnecessary health information about our supporters.

How we collect information

We may collect information:

directly from you, for example when you donate, fundraise, contact us, attend an event, volunteer, make a purchase, enter our lottery, share your story or apply for charitable funding;
from organisations you use to support us, such as fundraising, payment, event and lottery providers;
from appropriate publicly available sources for limited purposes such as fundraising research and donor due diligence; and
through our website and digital services, including through cookies and similar technologies where permitted.

From organisations you use to support us

For example, fundraising, payments, event or lottery providers, e.g. Sterling Lotteries Management Ltd, our lottery provider, may provide information to us where this is appropriate and consistent with your choices.

All third-party organisations that we work with are required to comply with data protection laws and our high standards, and are only allowed to process your information strictly as instructed. We will always make sure appropriate contracts and controls are in place and we regularly monitor all our partners to ensure compliance.

Where we obtain your information from another source, rather than directly from you, we will provide appropriate privacy information as required by data protection law unless an exemption applies.

4. Why we use your information and how

We will only process your personal information where we have a lawful basis for doing so.

When we are provided with explicit consent, also known as your contact preferences, we will use this consent as the legal basis to contact you. The Charity will provide opportunities throughout the year for supporters to update their preferences.

Supporters can also update their preferences at any time by contacting papworth.charity@nhs.net or calling 01223 639950.

Depending on the circumstances, this may include:

Lawful bases for how we use your information
What we do	Lawful basis we may rely upon
Process and administer donations	Legitimate interests and/or contract as appropriate
Administer Gift Aid	Legal obligation
Provide products or services you request	Contract
Respond to enquiries	Legitimate interests and/or steps taken at your request
Manage fundraising activities and events	Legitimate interests and/or contract
Manage our relationships with supporters	Legitimate interests
Send fundraising communications by post	Legitimate interests
Send fundraising/marketing communications electronically	Consent or, where applicable, the charitable purposes soft opt-in together with an appropriate UK GDPR lawful basis
Manage volunteers	Legitimate interests and/or contract as appropriate
Manage gifts in Wills and legacies	Legitimate interests and legal obligations where applicable
Assess applications for charitable funding	Legitimate interests
Administer and monitor awarded grants	Legitimate interests
Meet governance, financial and audit requirements relating to grants	Legitimate interests and/or legal obligation
Undertake proportionate supporter and high-value fundraising research	Legitimate interests
Undertake proportionate donor due diligence	Legitimate interests and/or legal obligation where applicable
Maintain financial and accounting records	Legal obligation
Prevent and detect fraud and protect the Charity	Legitimate interests and legal obligations where applicable
Improve our fundraising, communications and services	Legitimate interests
Use non-essential website analytics	Consent where required
Use online advertising/tracking technologies	Consent where required
Handle complaints	Legitimate interests and/or legal obligation

Where we rely on legitimate interests, we consider our interests alongside your rights, freedoms and reasonable expectations. Where appropriate, we document this through a Legitimate Interests Assessment.

5. Charitable grants

Royal Papworth Hospital Charity provides charitable funding to support projects that further our charitable purposes.

If you apply for or receive charitable funding from us, we may process information about you to:

assess your application;
communicate with you about the application;
make and record funding decisions;
administer awarded funding;
monitor project expenditure and delivery;
evaluate outcomes and impact;
meet governance, financial and audit requirements; and
demonstrate the impact of charitable funding.

Where appropriate, a shorter privacy statement may also be provided when you submit a grant application, linking to this full notice.

6. Stories, photography and filming

Sharing the experiences of patients, families, supporters and staff can help us demonstrate the impact of charitable support and inspire others to support our work.

Where we use an identifiable person's story, photograph, video or particularly sensitive information for a case study or similar communication, we will explain how we intend to use the material and obtain appropriate permission.

Where this includes health or other special category information, we will ensure that we have an appropriate additional legal condition for processing it.

Different arrangements may apply to general photography or filming at Charity events. Where photography or filming is taking place, we will take reasonable steps to make people aware of this and provide information about how to raise any concerns.

7. Keeping in touch with you

We may contact you to tell you about:

the impact of charitable donations;
fundraising appeals;
events;
volunteering;
our lottery;
products;
fundraising opportunities; and
other ways to support Royal Papworth Hospital Charity.

The rules that apply depend upon the method we use to contact you.

Email and text

Where required, we will obtain your consent before sending electronic fundraising or marketing communications.

You can withdraw your consent at any time.

Charitable purposes soft opt-in

UK law allows charities, in certain circumstances, to send electronic marketing communications without prior consent under the charitable purposes soft opt-in.

Where Royal Papworth Hospital Charity chooses to rely upon this, we will only do so where all applicable legal requirements have been met.

This includes where we have obtained your contact details directly from you in connection with you expressing an interest in, offering or providing support for our charitable purposes, the communication is solely for the purpose of furthering our charitable purposes, and we provided a clear opportunity to opt out when your details were collected and in every subsequent communication.

We will not retrospectively assume that all historical supporter records qualify for the charitable purposes soft opt-in.

Post

We may use legitimate interests to send appropriate fundraising communications by post where we believe you may reasonably expect to hear from us.

You can ask us to stop sending fundraising communications by post at any time.

Telephone

Where we undertake fundraising by telephone, we will comply with applicable data protection, PECR and Fundraising Regulator requirements, including respecting your communication preferences and relevant preference services.

Changing your preferences

You can change your communication preferences or ask us to stop marketing to you at any time:

Email: papworth.charity@nhs.net
Telephone: 01223 639950

You can also use the unsubscribe option in our marketing emails.

Where you opt out, we may retain limited information on a suppression list so that we can continue to respect your wishes.

We love to talk about all the ways that the generous donations from our supporters make a difference to staff, patients and their family members at Royal Papworth Hospital.

The Charity sends out newsletters and appeals to share the projects that we have been working on, provide new and exciting ways to fundraise and share the opportunities available to get involved with. We also have information on our products and services such as our Duck Club, lottery and volunteering.

We only want to send the information that is important to you and ask that you let us know how you would like to hear from us and what you would like to hear about through our data consent form.

You can let us know your preferences at any time using the website: Marketing Consent Declaration (royalpapworthcharity.com) or by letting us know at papworth.charity@nhs.net or calling us on 01223 639950.

8. Fundraising research, profiling and prospective supporters

To help us fundraise appropriately and effectively, we may undertake proportionate research about individuals and organisations to identify and develop relationships with potential major donors, corporate partners, trusts and foundations, and others who may be interested in supporting our charitable work.

This research helps us understand whether an individual or organisation may have an interest in our work, their potential capacity to support us and how it may be appropriate for us to engage with them.

We undertake this processing on the basis of our legitimate interests in raising funds effectively to further our charitable purposes.

Research may involve information you have provided to us together with credible and appropriate information from publicly available sources. These may include:

Companies House;
the Charity Commission;
company and professional websites;
reputable media sources;
publicly accessible registers; and
professional networking sites such as LinkedIn.

We may also use appropriate specialist third-party providers to support this research.

We may use information we hold to group supporters according to factors such as previous engagement, fundraising interests or giving history. This helps us make our fundraising and communications more relevant and effective.

We may also use credible publicly available information to identify individuals or organisations who we reasonably believe may have an interest in supporting Royal Papworth Hospital Charity, including where we do not already have a relationship with them.

Where we obtain personal information indirectly, we will provide appropriate privacy information as required by data protection law unless an exemption applies.

Identifying somebody through research does not mean that we will automatically add them to our email or text marketing lists. Electronic marketing will only be undertaken where the applicable legal requirements are satisfied.

We take care to ensure that information collected is relevant, proportionate and not excessive.

We do not use profiling to make solely automated decisions that have legal or similarly significant effects on individuals.

You can object to us using your information for fundraising profiling or research by contacting us at papworth.charity@nhs.net or calling 01223 639950.

9. Donor due diligence

We have a responsibility to protect the Charity, its beneficiaries, supporters, staff and reputation.

We may therefore undertake proportionate due diligence on donors, prospective donors, corporate partners and donations, particularly where a donation or relationship is significant, unusual or presents a higher level of risk.

This may help us understand:

the identity of a donor;
the provenance of funds where appropriate;
potential fraud or financial-crime risks;
conflicts of interest;
reputational risks; and
whether accepting a donation is consistent with our Donation Acceptance Policy and legal and regulatory responsibilities.

The nature and extent of our due diligence will be proportionate to the value, nature and potential risk associated with the donation or relationship.

This does not mean that we undertake detailed research on every donor or question every donation.

We only collect and use information that is necessary and proportionate to the circumstances.

10. Supporting people who may be vulnerable

We recognise that people who interact with a hospital charity may sometimes be experiencing circumstances that make them particularly vulnerable, including illness, bereavement or financial difficulty.

We are committed to treating supporters fairly, sensitively and with respect and will take reasonable steps to adapt our communications or fundraising activity where we become aware that somebody may need additional support.

We will only record information about vulnerability where it is necessary, proportionate and lawful to do so. Access to such information will be appropriately restricted.

12. International transfers

Some organisations that provide services to us may process or store information outside the UK.

Where personal information is transferred outside the UK, we will ensure that an appropriate transfer mechanism and safeguards are in place as required by UK data protection legislation.

These may include UK adequacy regulations or appropriate contractual safeguards.

You can contact us if you would like further information about the safeguards applying to your information.

13. Donations, Gift Aid and payments

When you make a donation, we use your information to process and acknowledge your gift, maintain appropriate financial records and manage our relationship with you.

If you complete a Gift Aid declaration, we will use the information necessary to administer and claim Gift Aid and meet our legal obligations.

We use third-party payment providers to process some donations and payments, including providers such as Stripe, PayPal, SumUp, JustGiving, GoCardless, MuchLoved and Donr.

Where you provide payment information directly to one of these providers, they will process that information in accordance with their own privacy arrangements.

If you use Text-to-Donate to donate to us, your donation is processed by JustGiving. The Charity does not receive your personal details including your phone number, and the donation will be treated as anonymous. Your data will be held in compliance with JustGiving’s privacy policy found here.

Payment security

We receive the information necessary to record and administer your donation or transaction, but do not store full payment-card details on our donor management system. Relevant supporter and transaction information may be recorded on our donor management system to administer your donations, orders and other interactions with us.

Where card information is provided directly to authorised Charity staff, for example over the telephone, it will be handled and securely disposed of in accordance with our payment-security procedures. Only staff who are authorised to process payments will handle this data.

14. Our website, cookies and online advertising

Like most charities, we use cookies to help us track how people are using our website; this means we can improve our service and ‘remember you’ and your preferences.

Cookies are small amounts of information, which are stored on your device. For more detailed information about cookies visit the Direct Gov website.

You may disable the use of cookies by activating the setting on your internet browser that allows you to refuse the setting of all or some cookies. For information on how to do this on the browser of your mobile phone you will need to refer to your device manual.

Please note, if you change your settings to block all cookies (including essential cookies) you may not be able to access all or parts of: Royal Papworth Hospital Charity (royalpapworthcharity.com) (“Website”).

Our website uses "analytical" cookies. They help us to provide you with a good experience when you browse our website. We also use cookies to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example by ensuring that users are finding what they are looking for easily.

We will not use cookies to collect personally identifiable information about you.

You can find more information about the individual cookies we use on our website and the purposes for which we use them in the table below:

Cookies used on our website
Cookie name	Purpose	Duration (persistence)
_utma _utmb _utmc _utmz	These are Google Analytics cookies used to allow us to count page visits and traffic sources so that we can measure and improve the performance of our website. For more information about these cookies visit https://support.google.com/analytics	Session and 24 hour

Please note that the owners of third-party websites which our website links to may also use cookies, over which we have no control. To opt out of third parties collecting any data regarding your interaction on our website, please refer to their websites for further information.

Social media and online advertising

To increase awareness of our work and to promote fundraising events, we advertise on our website and the social media platforms owned by Meta Platforms Inc, specifically Facebook, LinkedIn and Instagram. When visiting our website, Facebook or Instagram page, if you agree to the use of cookies, a pixel is used to store anonymous cookie information on the end user’s device. This provides a measurement service which informs relevant retargeting for future adverts. If you engage with us through an advert or our website your personal details are not captured or stored by us.

Although it is not possible to opt out of viewing Facebook and Instagram ads, you are able to control what you see – more information about this can be found here. The anonymous data received by us is used to improve your browsing experience and show you personalised content.

15. Data retention

For supporters who have donated or made a purchase, we are legally required to retain their data for six full financial years from the date of the last payment or Gift Aid amount received.

If we have not received any correspondence from a supporter for two full years, we will anonymise or delete their records after this time.

For supporters who have subscribed to our weekly lottery, we will retain their data for two full years following notification that they have unsubscribed.

Supporters who have left us a Gift in their Will may continue to have an active record for some time after their death. The record for the supporter will be stored until the legacy comes to an end and the gift is settled. At this point the record will be archived and kept until six full tax years from the date of when the legacy has been fulfilled.

16. Your rights

We aim to ensure that all the information we hold about you is accurate and up to date. If any of the information we hold about you is inaccurate and we are advised of this by you or we become otherwise aware, we will ensure it is updated and changed as soon as possible.

Under data protection law, you have a number of rights in relation to your personal information. Depending on the circumstances, these may include the right to:

access the personal information we hold about you;
ask us to correct inaccurate or incomplete information;
ask us to delete your information in certain circumstances;
ask us to restrict how we use your information;
object to certain uses of your information, including direct marketing;
withdraw consent where we rely on consent;
receive certain information in a portable format where applicable; and
raise a complaint about how your information has been used.

Under UK data protection legislation, you have the ‘Right to be forgotten’. You can contact the Charity Office to request that we delete any information that we hold about you. If, however, the Charity has a legal obligation to retain the data, we will not be able to comply until the legal retention period of the data has expired. In this case all details will be archived securely and there will be no further contact.

We will respond to requests in accordance with the timescales and requirements set by data protection law.

17. Complaints

If you have concerns about how we use your personal information, please contact us in the first instance at papworth.charity@nhs.net or call 01223 639950.

You also have the right to complain to the Information Commissioner’s Office (ICO). Further information is available on the Information Commissioner’s Office website.

18. Changes to this notice

We may update this privacy notice from time to time to reflect changes in our activities, services or legal requirements. The latest version will be published on our website with the date it was last updated.