GDPR Privacy Notice

What is the legal basis for processing your personal data?
Most of our data is processed because it is necessary for our legitimate interests, or the legitimate interests of a third party (such as another organisation in the Church of England). An example of this would be our safeguarding work to protect children and adults at risk. We will always take into account your interests, rights and freedoms.

Some of our processing is necessary for compliance with a legal obligation. For example, we are required by the Church Representation Rules to administer and publish the electoral roll, and under Canon Law to announce forthcoming weddings by means of the publication of banns.

We may also process data if it is necessary for the performance of a contract with you, or to take steps to enter into a contract. An example of this would be processing your data in connection with the hire of church facilities.

Religious organisations are also permitted to process information about your religious beliefs to administer membership or contact details.

Where your information is used other than in accordance with one of these legal bases, we will first obtain your consent to that use.

 

Sharing your personal data
Your personal data will be treated as strictly confidential. It will only be shared with third parties where it is necessary for the performance of our tasks or where you first give us your prior consent. It is likely that we will need to share your data with some or all of the following (but only where necessary):
· The appropriate bodies of the Church of England including the other data controllers;
· Our agents, servants and contractors. For example, we may ask a commercial provider to send out newsletters on our behalf, or to maintain our database software;
· Other clergy or lay persons nominated or licensed by the bishops of the Diocese of Southwark to support the mission of the Church in our parish. For example, our clergy are supported by our area dean and archdeacon, who may provide confidential mentoring and pastoral support. Assistant or temporary ministers, including curates, deacons, licensed lay ministers, commissioned lay ministers or persons with Bishop’s Permissions may participate in our mission in support of our regular clergy;
· Other persons or organisations operating within the Diocese of Southwark including, where relevant, the Southwark Diocesan Board of Education, Southwark Cathedral and Subsidiary Bodies;
· There may be other legal entities we share data with within the Church of England who are also data controllers;
· On occasion, other churches with which we are carrying out joint events or activities.

How long do we keep your personal data?
We will keep some records permanently if we are legally required to do so. We may keep some other records for an extended period of time. For example, it is current best practice to keep financial records for a minimum period of 7 years to support HMRC audits. In general, we will endeavour to keep data only for as long as we need it. This means that we may delete it when it is no longer needed.

Your rights and your personal data
You have the following rights with respect to your personal data:

When exercising any of the rights listed below, in order to process your request, we may need to verify your identity for your security. In such cases we will need you to respond with proof of your identity before you can exercise these rights.

· At any point you can contact us to request the information we hold on you as well as why we have that information, who has access to the information and where we obtained the information from. Once we have received your request we will respond within one month.
· There are no fees or charges for the first request but additional requests for the same data may be subject to an administrative fee.

· If the data we hold on you is out of date, incomplete or incorrect, you can inform us and your data will be updated.

· If you feel that we should no longer be using your data or that we are illegally using your data, you can request that we erase the data we hold.
· When we receive your request we will confirm whether the data has been deleted or the reason why it cannot be deleted (for example because we need it for our legitimate interests or regulatory purpose(s)).

--> Page 3