Privacy Statement for The Parochial Church Council (“PCC”) of St Thomas Norbury (“Norbury Parish Church”)

Registered Charity 1130910

Norbury Parish Church is committed to protecting and respecting any personal information you share with us.

The PCC of Norbury Parish Church is the data controller (contact details below).  This means it decides how your personal data is processed and for what purposes.

This statement describes what types of information we collect from you, how it is used by us, how we share it with others, how you can manage the information we hold and how you can contact us.

The contents of this statement may change from time to time so you may wish to check this page occasionally to ensure you are still happy to share your information with us. Where possible, we will also contact you directly to notify you of these changes.

This version of our Privacy Statement is live from 01 June 2018.

What personal information do we collect?

Personal data relates to a living individual who can be identified from that data.  Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (“GDPR”).

We collect information about you when:

·       you participate in the worship and other activities of Norbury Parish Church and its associated organisations;

·       when you act in a voluntary capacity in the worship and other activities of Norbury Parish Church and its associated organisations;

·       when you make an enquiry about, or ask us to conduct, weddings, baptisms, funerals and such other services as we may provide from time to time;

·       you sign up to receive communications such as the Parish Magazine or relating to specific activities of Norbury Parish Church and its associated organisations;

·       when you make an enquiry about, or make a booking to utilise our property and facilities for your own purposes;

·       when you make donate funds to us;

·       when you apply for employment with us. 

We only collect information which is necessary, relevant and adequate for the purpose you are providing it for.

The information we collect includes some or all of the following:

·       name;

·       names of individuals with parental repsonibility in respect of children;

·       contact details including postal address; telephone numbers and email address;

·       date of birth;

·       records of your participation with us including as a member or as a volunteer;

·       photographs, video or audio recordings;

·       the date and time you used our services;

·       details of any transactions between you and us;

·       educational, professional, employment and other information provide during the course of applying for employment or to volunteer with us;

·       the methods by which you wish us to contact you; and

·       any information within correspondence you send to us.

How do we use your personal information?

Norbury Parish Church complies with its obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

We use your personal data for the following purposes:

·       to enable us to promote the mission of the church, pastoral, evangelistic, social and ecumenical for the benefit of the public in Norbury Parish as specified in our constitution; 

·       to administer membership records; 

·       to fundraise and promote the interests of Norbury Parish Church; 

·       to manage our employees and volunteers; 

·       to maintain our own accounts and records (including the processing of gift aid applications);

·       to inform you of news, events, activities and services running at Norbury Parish Church; and

·       to share your contact details with the Diocesan office so they can keep you informed about news in the diocese and events, activities and services that will be occurring in the diocese and in which you may be interested.

What is the lawful basis for processing your personal information?

We need a lawful basis to collect and use your personal data under data protection law. The law allows for six ways to process personal data. We can use process information on the basis of:

·       Consent; for example, so that we can keep you informed about news, events, activities and services and keep you informed about diocesan events.

·       Contractual Performance; for example, we may use and process your personal information where this is necessary to perform a contract with you such as booking to utilise our property and facilities for your own purposes;

·       Legal Obligation; for example, in relation to Gift Aid or under employment, social security or social protection law;

·       Legitimate Interests; personal data may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, as long as its use is fair and does not adversely impact the rights of the individual concerned.  When we use your personal information, we will always consider if it is fair and balanced to do so, and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that are not unduly intrusive or unfair. Norbury Parish Church’s legitimate interests include:

o    Charity governance. This includes delivery of our charitable purposes, statutory and financial reporting and other regulatory compliance purposes;

o    Administration and operational management. This includes answering enquires, giving information and services, research, events management, administration of volunteers and employment and recruitment requirements.

o    Fundraising and campaigning. This includes administering campaigns and donations and sending direct marketing by post, sending thank you letters, analysis, targeting and segmentation to develop communication strategies and maintaining communication suppressions.

·       Public Task; for example, the maintenance of records of marriages, baptisms and burials.

·       Vital Interests; for example, sharing medical information with a paramedic relating to a church member who has lost consciousness.

As an organisation with a number of children’s organisations, Norbury Parish Church is aware of its particular responsibilities to children when collecting and processing their personal data.  In particular:

·       when relying on consent, we make sure that the child understands what they are consenting to, and we do not exploit any imbalance of power in the relationship between us.  For children under the age of 14 we will only accept consent to process personal information from the whoever holds parental responsibility for the child;

·       when relying on ‘necessary for the performance of a contract’, we consider the child’s competence to understand what they are agreeing to, and to enter into a contract; and

·       when relying upon ‘legitimate interests’, we take responsibility for identifying the risks and consequences of the processing and put age appropriate safeguards in place.

In addition, as a not-for-profit organisation with a religious aim, Norbury Parish Church processes special category data in respect of an individual’s religion on the lawful basis that processing is carried out in the course of our legitimate activities with appropriate safeguards on condition that the processing relates solely to the members or to former members of Norbury Parish Church or to persons who have regular contact with it in connection with its purposes and that the personal data is not disclosed outside Norbury Parish Church without the consent of the data subjects.

How do we share this information?

Your personal data will be treated as strictly confidential and will only be shared with other members of the church in order to carry out a service to other church members or for purposes connected with the church. We will only share your data with third parties outside of the parish with your consent.

How long do we keep your information for?
We keep data in accordance with the guidance set out in the guide “Keep or Bin: Care of Your Parish Records” which may be found at https://www.churchofengland.org/sites/default/files/2017-11/care_of_parish_records_keep_or_bin_-_2009_edition.pdf

Specifically, we retain electoral roll data while it is still current; gift aid declarations and associated paperwork for up to 6 years after the calendar year to which they relate; and parish registers (baptisms, marriages, funerals) permanently.

How can you manage the information we hold about you?

You have a number of rights in relation to your personal information under data protection law. In relation to most rights, we will ask you for information to confirm your identity and, where applicable, to help us search for your personal information. Except in rare cases, we will respond to you within 30 days after we have received any request (including any identification documents requested).

You have the right to:

·       ask for a copy of the information that we hold about you;

·       correct and update your information;

·       withdraw your consent (where we rely on it).

·       object to our use of your information (where we rely on our legitimate interests to use your personal information) provided we do not have any continuing lawful reason to continue to use and process the information;

·       erase your information (or restrict the use of it), provided we do not have any continuing lawful reason to continue to use and process that information; and

·       transfer your information in a structured data file (in a commonly used and machine readable format), where we rely on your consent to use and process your personal information or need to process it in connection with your contract.

You can exercise the above rights and/or manage your information by contacting us using the details below:

Post: Norbury Parish Church, London Road, Hazel Grove, Stockport, SK7 4RF.

Email:  info@norburychurch.org.uk

Telephone:  0161 483 6325

The same contact details should also be used if you have any specific data protection concerns or a complaint.

If you are unhappy, you have the right to lodge a complaint with a data protection regulator in Europe, in particular in a country you work or live or where your legal rights have been infringed. The contact details for the Information Commissioner’s Office, the data protection regulator in the UK, are below:

Post:  Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Telephone:  0303 123 1113

Email:  casework@ico.org.uk.