Privacy Policy

Kingston Hospital Charity – Privacy Policy

  1. Introduction

Kingston Hospital Charity (“Us”, “We”) is a charity registered in England and Wales with charity number 1056510 and registered address:

Kingston Hospital
Galsworthy Road
Kingston Upon Thames
KT2 7QB

Kingston Hospital Charity is the charity of Kingston & Richmond NHS Foundation Trust (“KRFT”) and exists to support and raise money for Kingston Hospital Trust.

Kingston Hospital Charity operates the website www.khc.org.uk (“the Website”).

We are committed to protecting your privacy and will only use the information that we collect about you lawfully. This policy explains how and why we collect, use, store and protect your personal information.

Please read this policy carefully. We may update this policy from time to time, so please review it periodically.

Full registered name: Kingston & Richmond NHS Foundation Trust General Charitable Fund.

  1. What information do we collect about you?

We collect personal data for a number of reasons, including communicating with you, responding to requests for information, processing donations and managing our relationship with you.

The personal data we collect may include:

  • Your full name;
  • Postal address;
  • Telephone number(s);
  • Email address;
  • Records of your correspondence with us;
  • Donation and Gift Aid details;
  • Information entered on our website;
  • Information shared with us through fundraising activities, events or other interactions.

We also collect information about use of our website through cookies and similar technologies (see Section 7).

We will not intentionally collect special category personal data (such as health information) unless it is necessary and we have an appropriate lawful basis to do so.

  1. How will we use the information about you?

We may use your personal information to:

  • Administer your donation, including processing Gift Aid claims;
  • Acknowledge donations and send thank you communications;
  • Deliver services, literature and other information you have requested;
  • Send information that we think may be of interest to you, including updates about Kingston Hospital Charity, fundraising appeals, volunteering opportunities and events by post. We may also contact you by email, SMS or other electronic means where we have your consent or where we are permitted to do so under applicable privacy and electronic communications legislation;
  • Contact you regarding celebratory giving, leadership gifts, gifts in memory, legacy giving or other fundraising opportunities you have expressed an interest in;
  • Manage our relationship with you and maintain accurate supporter records;
  • Manage your communication preferences;
  • Conduct surveys and research regarding our services and future developments;
  • Carry out research to understand more about our supporters’ backgrounds, interests and ability to support our charitable work;
  • Comply with legal and regulatory requirements.
  • We may analyse personal information, including your name, address and giving history, to help us better understand supporter interests and engagement. This helps us ensure communications are relevant and appropriate.

We may also undertake supporter research using publicly available information, such as:

  • Publicly available directorship information;
  • Electoral roll information where lawfully available;
  • Press reports;
  • Public social media content;
  • Geographic and demographic information.

This analysis helps us better understand our supporters and identify individuals who may wish to contribute in different ways to support the Charity.

In some cases, we may use specialist third-party providers to assist with this work, including wealth screening services. This may involve sharing limited personal information such as your name and address to compare against publicly available information.

If you would prefer us not to use your information in this way, please contact us using the details provided in Section 12.

  1. Our legal basis for processing personal data

Kingston Hospital Charity requires a lawful basis under UK GDPR to collect and process personal data.

The lawful bases most relevant to our activities are:

Consent

Where you have provided clear consent for us to process your personal data for a specific purpose, for example receiving marketing communications by email.

Legal Obligation

Where processing is necessary for compliance with a legal obligation, such as administering Gift Aid claims and maintaining financial records.

Legitimate Interests

Personal data may be processed where it is necessary for the legitimate interests pursued by Kingston Hospital Charity, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests include:

  • Charity governance and regulatory compliance;
  • Administration and operational management;
  • Responding to enquiries and providing requested information;
  • Managing volunteers and recruitment processes;
  • Fundraising and campaigning activities;
  • Administering donations and supporter relationships;
  • Sending fundraising communications by post;
  • Maintaining communication suppression records;
  • Conducting supporter research and analysis.

If you would like further information about our legitimate interests assessment, please contact us.

  1. Will we share this information with others?

We do not sell or rent your personal information to third parties for marketing purposes.

We may share your personal information with trusted service providers acting on our behalf to support our fundraising and operational activities.

These providers may include:

  • Beacon CRM for supporter, donor and fundraising management;
  • Blackbaud CRM for supporter, donor and fundraising management during a transition period ending in February 2028;
  • Dotdigital for email communications;
  • Stripe for online payment processing;
  • GoCardless for Direct Debit processing;
  • Cloud hosting and infrastructure providers supporting the delivery of these services.

Kingston Hospital Charity is currently transitioning from Blackbaud CRM to Beacon CRM. During this transition period, which is expected to continue until February 2028, supporter, donor and fundraising information may be held and processed within both systems. We have appropriate data processing agreements and security measures in place with both providers to ensure personal information remains protected throughout this period.

These organisations process personal information only under our instructions and are required to maintain appropriate technical and organisational security measures.

We may also allow our staff, consultants and external providers acting on our behalf to access and use your information where necessary for the purposes for which it was provided.

We will not otherwise disclose your personal information unless required to do so by law, regulation, court order or another lawful authority.

  1. How do we protect the security of personal data?

We are committed to ensuring that appropriate physical, technical and organisational measures are in place to protect your personal data against unauthorised access, loss, misuse, alteration or disclosure.

Any information submitted through our website is protected using encryption technologies including Secure Socket Layer (SSL) and Transport Layer Security (TLS).

While no internet transmission can be guaranteed to be completely secure, we take appropriate measures to safeguard personal data once received.

Kingston Hospital Charity uses Beacon CRM and, until February 2028, Blackbaud CRM to manage supporter, donor and fundraising information. Both systems act as data processors on our behalf and are subject to contractual obligations to protect personal data. Security measures include encryption, access controls, authentication processes, monitoring and backup arrangements designed to safeguard personal information.

Where personal information is shared with trusted providers including Dotdigital, Stripe and GoCardless, those providers are required to maintain appropriate technical and organisational security measures.

We encourage you to review the privacy policies of external websites accessed through links on our website. Kingston Hospital Charity is not responsible for the content or privacy practices of external websites.

Where personal data is transferred outside the United Kingdom or European Economic Area (EEA), we will ensure appropriate safeguards are in place, including adequacy regulations, International Data Transfer Agreements (IDTAs), Standard Contractual Clauses or other lawful transfer mechanisms.

  1. Cookies and Tracking Technologies

Kingston Hospital Charity uses cookies and similar tracking technologies to improve website functionality, understand visitor behaviour and enhance user experience.

Cookies are small text files stored on your device when you visit a website.

We may use:

Strictly Necessary Cookies

Required for the operation, security and functionality of our website.

Performance and Analytics Cookies

Used to help us understand how visitors use our website and improve website performance.

Functionality Cookies

Used to remember choices and preferences you make.

Marketing Cookies

Used to measure the effectiveness of fundraising and communication activities.

We may use website analytics services, including Google Analytics or equivalent privacy-compliant analytics tools.

When you first visit our website you will be provided with a cookie banner allowing you to manage your cookie preferences.

You can change your preferences at any time through our cookie settings.

Further information can be found in our Cookie Policy.

  1. How long do we keep your data for?

We retain personal data only for as long as necessary for the purposes for which it was collected and in accordance with our retention policies and legal obligations.

The retention period may depend on:

  • Financial regulations;
  • Tax legislation;
  • Gift Aid requirements;
  • Limitation periods;
  • Regulatory obligations;
  • Contractual obligations.

Typically, information relating to donors and supporters will be retained for seven years following the last interaction or donation.

Once retention periods have expired, personal data will be securely deleted, anonymised or archived as appropriate.

Where data exists within backup systems it will be removed in accordance with the applicable backup retention schedule.

Where you opt out of communications, we may retain limited information on a suppression list to ensure you do not receive unwanted communications in the future.

  1. Your rights

You have several rights under UK GDPR.

Right of Access

You have the right to request access to personal information we hold about you.

We will respond without undue delay and normally within one month of receiving a valid request.

Right to be Informed

You have the right to know how your personal data is being used.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Right to Object

You may object to processing carried out under our legitimate interests.

Right to Restrict Processing

You may request that processing is restricted in certain circumstances.

Right to Erasure

You may request deletion of your personal information where applicable.

Right to Rectification

You have the right to have inaccurate personal information corrected.

Right to Data Portability

Where processing is based on consent or contract, you may request that your data be transferred to another service provider.

To exercise any of these rights, please contact us using the details in Section 12.

  1. What if you have questions or need to make corrections to your information?

We aim to keep personal information accurate and up to date.

We may use publicly available sources to update our records, for example checking against deceased records.

You may request that inaccurate information is corrected at any time.

You may also:

  • Opt out of fundraising and marketing communications;
  • Object to profiling and supporter research activities;
  • Request restriction of processing.

If you are unhappy with how we have handled your personal information, please contact us using the details below.

You also have the right to complain to the Information Commissioner’s Office:

https://ico.org.uk/

  1. How will we let you know of changes to our privacy policy?

We may update this Privacy Policy from time to time. Any future updates will be published on our website and users will be informed by email.

This Privacy Policy was last updated in October 2026.

  1. How to contact us

If you have any questions about this Privacy Policy or the personal information we hold about you, please contact us:

Telephone: 020 8973 5040

Email: krft.charity@nhs.net

Post: Freepost KHCHARITY