Privacy Policy

We are committed to protecting all personal information and being transparent about what we do with it. We use your personal information in accordance with all applicable laws concerning the protection of personal data and we will not do anything with your information you wouldn’t reasonably expect.

Listed in this section is a set of privacy statements which provide more detail as to how we process your personal data.

Each privacy statement outlines why, how, what, where and for how long Dorothy House processes (collects and uses) your personal data, including details of any sharing of data with third parties.

General Data Protection Regulation (GDPR), introduced in May 2018, provides six lawful bases under which personal information can be processed and we have highlighted in each privacy statement which lawful bases apply. In particular, we have highlighted where data is collected and used on the basis of “legitimate interest”. This means that Dorothy House deems it necessary and appropriate to collect this information for reasons that do not require your consent. However, you can object to data processing on this basis.

Dorothy House is registered as a Data Controller with the Information Commissioner’s Office (ICO) and our ICO registration number is Z7289749. Our Data Protection Lead is Tony De Jaeger, who is our Deputy Chief Executive and Finance Director. Our Caldicott Guardian is Rebecca Bhathia, Medical Consultant.

If you have a general query about data protection or would like to make a Subject Access Request as outlined in the ‘Your Rights’ section, please contact info.governance@dorothyhouse-hospice.org.uk
or call 01225 722 988.

If you are not happy with the way we have handled your data, and are unable to resolve the issue with us personally, you can complain to the ICO

The privacy statements may be updated from time to time and we will alert you to any significant changes on the pages of this website.

The latest version will always be available here. (Updated November 2021)

Why do we collect personal information about staff and how do we use it?

As an employer there are lawful bases for the personal information that we collect about our staff, agency staff, our contracted consultants and those with an honorary contract such as those with medical placements. We have used the collective term “staff” for the purpose of this privacy statement.

Using personal information helps us provide the best support to our workforce, to ensure their health and safety and to make for a better employee experience.

The main lawful basis (legal reason) for collecting and using this personal information is because we hold a contract with that individual. Processing information under this legal basis enables us to:

  • Recruit the right staff to Dorothy House
  • Pay staff
  • Develop and train staff
  • Administer pensions
  • Ensure health and safety of staff
  • Manage the organisation (for example staff rotas and availability, maintenance requests, IT helpdesk requests, use of intranet/Dot2Dot and library)
  • Analyse Dot2Dot use through OAK reporting (Intranet provider) facility
  • Use photographs for security purposes.

 

We also process the personal data of staff to meet our legal obligations as an employer, including to:

  • Meet immigration law obligations
  • Meet medical registration obligations
  • Keep staff safe using, for example, risk assessments or health and safety reports
  • Where appropriate, processing DBS checks to keep safe everyone who comes into contact with Dorothy House
  • Modify working conditions according to staff health conditions
  • Paying tax and National Insurance contributions to HMRC.

 

We also collect and use some personal information regarding staff on the lawful basis of “legitimate interest” so that we can:

  • Alert nominated emergency contacts for staff members if there are concerns for the health and safety of that staff member
  • Monitor demographic, equality and diversity data to evidence fair recruitment and staffing
  • Use staff photographs on Outlook and internal software for the purpose of staff identification and for presentations and publicity.
  • Use CCTV cameras in the controlled drug room on the Inpatient Unit for safety and security purposes, as detailed in the CCTV privacy notice.

Processing information on the basis of legitimate interest means that Dorothy House deems it necessary and appropriate to collect this information for reasons that do not require your consent. However, you can object to data processing on this basis. (See Your Rights section below)

 

What personal information do we collect about our staff?

Based on the data processing reasons outlined above, we may collect some or all of the following information (this list is not exhaustive):

Basic details including name, postal/email address, telephone number, date of birth and emergency contact details

Demographic, equality and diversity data

Terms of employment information including letters of offer, employment contract, place of work, references, ID information

Skills and experience information including CVs, records of qualifications, training and professional membership/registration.

Financial information so that we can pay you including bank details, National Insurance documentation and social security numbers, where applicable

Identification information including photos, car driver information, copies of birth certificate/driving licence, CCTV footage where an employee has restricted access to the controlled drugs room on Inpatient Unit

Employment process information including absence from work and any disciplinary issues

Performance records such as appraisals and one-to-one’s

Personal health information such as occupational health advice or health and safety reports

Information on use of DH electronic devices including Dorothy House intranet, email data and back-up from Dorothy House servers, building access, printing history.

 

Where do we store personal staff information and for how long?

Staff information as outlined above is primarily stored on a secure Human Resources database managed by Dorothy House. For some functions it may be necessary to hold basic contact details on other internally-managed databases whereby the data can be stored off-site with the relevant software provider, for example training records, maintenance requests, printing history, library use, IT helpdesk.

All databases are username and password protected and staff receive training so that they are aware of their professional responsibility to maintain confidentiality.

Some working documentation, such as personal development reviews, performance monitoring and one-to-one’s will be kept securely within the Dorothy House network. Currently the HR department also securely holds hard copy files within the department.

Staff record retention policy is for seven years after employment ceases unless exceptional circumstances apply.

 

Sharing personal information about staff

Dorothy House may need to share some of the information we hold on staff with:

  • Statutory organisations such as HMRC, Child Support Agency, local authorities (for attachment of earnings), student loans
  • Third-party communications services such as mailing houses, email marketers, survey providers, event booking systems
  • External education system providers (eg Moodle, Training Tracker)
  • Other external organisations such as credit card companies, pension companies (including NHS Pensions)

(UPDATED NOVEMBER 2021)

Why do we collect personal information about job applicants and referees and how do we use it?

As an employer, there are lawful bases for the personal information that we collect on our job applicants and referees.

Job applicants’ and referees’ data can also help us to support our workforce better and make for a better recruitment experience. A significant lawful basis (legal reason) for collecting and using certain personal information about job applicants is that of “legal obligation”. In other words, we have to collect this information to comply with the law. Processing information under this lawful basis enables us to:

  • Meet immigration law obligations
  • Verify the job applicant’s right to work

We also collect and use information about job applicants under the lawful basis of “contract” with a view to entering a contract with that individual as an employee. Processing information under this legal basis enables us to:

  • Recruit the right staff to Dorothy House, understanding, for example, their skills, job history and background

We process some personal information on job applicants on the lawful basis of “legitimate interest” so that we can:

  • Monitor demographic, equality and diversity data to evidence fair recruitment

Processing information on the basis of “legitimate interest” means that Dorothy House deems it necessary and appropriate to collect this information for reasons that do not require your consent. However, you can object to data processing on this basis (see Your Rights section below).

 

What personal information do we collect about job applicants and referees?

Based on the data processing reasons outlined above, we may collect all or some of the information below to help us ensure the best recruitment process (this list is not exhaustive):

Basic details: Name, postal/email address, telephone number, date of birth.

Demographic, equality and diversity data (this information is collected anonymously and separately from a job application form)

Job application information including references and contact details of referees.
NB: DBS checks take place once applications have been successful

Skills and experience information including CVs, records of qualifications, education, training and professional membership/registration

Identification information including photos, car driver information, copies of birth certificate/driving licence.

 

Where do we store personal job applicants and referees information and for how long?

Job applicant’s and referee’s personal information is stored on a secure database managed by Dorothy House. All databases are username and password protected and staff receive training so that they are aware of their professional responsibility to maintain confidentiality.

If job applicants are unsuccessful in their application, their application details are kept on file by Dorothy House for six months and then deleted unless prior agreement has been obtained. Copies of official documentation are shredded immediately after an unsuccessful interview.

Successful job applicants’ personal information is retained – please see above

 

Sharing personal information about job applicants

Information on job applicants and referees will be shared internally with Dorothy House teams and line managers in order to make the best recruitment decisions.