PRIVACY NOTICE for Parishioners & Public Engaging with the Parish
Your personal data – what is it?
Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the Data Protection Act 2018 (DPA) and the UK GDPR.
Who are we?
The Parochial Church Council (PCC) are together the Data Controller for the Parish. The Priest in Charge also has separate responsibility as a Data Controller for some aspects of work within the Parish. The Data Controller decides how your personal data is processed and for what purposes.
What personal data do we collect?
This includes, but is not limited to:
- Identity data – name, usernames, marital status, title, date of birth and gender
- Contact data – address, email address and telephone numbers
- Financial data – bank details sufficient to allow us to pay you
- Details about your involvement with the PCC and the parish
- Marketing and communications data – how you would like us to correspond with you, services you attend, groups you attend.
- CCTV footage
- Video and photographs
We will not normally collect Special Categories of personal data about you. This includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and criminal convictions and offences. However, in certain circumstances, such as when providing support through our pastoral care programme, or when you work for us as an employee or volunteer.
If you fail to provide personal data required by law, or under the terms of any arrangement we have with you, we may not be able to provide services to you.
How do we process your personal data?
The PCC complies with its obligations under the DPA and UK GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
What do we use your personal data for?
We use your personal data for the following purposes:
For the Rector:
- To provide pastoral care to my parishioners;
For the PCC:
- To enable us to provide a voluntary service for the benefit of the public in and around the Parish of Holy Trinity with St Columba, Fareham;
- To administer membership records;
- To fundraise and promote the interests of the charity;
- To manage our employees and volunteers;
- To maintain our own accounts and records.
- To maintain records for the purposes of safeguarding and welfare
- To operate the Holy Trinity with St Columba, Fareham (HTSCF) web site and deliver the services that individuals have requested.
- To stream services to social media platforms, providing an opportunity to worship to those unable to attend Church in person.
- To maintain the security of our property and premises and prevent and investigate crime through the use of CCTV.
And where you are on the Electoral Roll or have asked that we do so:
- To inform individuals of news, events, activities or services running at Holy Trinity and St Columba.
- To share your contact details within the Parish, to coordinate Parish activity and so that you can be kept informed.
- To share your contact details with the Diocesan Office so they can keep you informed about news, events, activities and services that will be occurring in the Diocese and which are relevant to the role you are undertaking.
- To process gift aid applications.
- To contact individuals via surveys to conduct research about their opinions of current services or of potential new services that may be offered.
What is the legal basis for processing your data?
If you are registered on the Electoral Roll for the Parish, we process your personal data because we have a legal requirement to do so.
We process your personal data in support of the following activities because, as a membership organisation, we have a legitimate interest in doing so:
- In providing a voluntary service for the benefit of the public within the Parish;
- To fundraise and promote the interests of the charity;
- To administer membership records;
- To manage our employees and volunteers;
- To maintain our own accounts and records.
We process your personal data in support of the following activities because you are a member of the church (ie. you are on the Electoral Roll) or we have received your consent to do so: - To inform you of news, events, activities or service;
- To stream services to social media;
- To share your contact details within the Parish;
- To share your contact details with the diocesan office;
- To process gift aid applications;
- To contact individuals via surveys to conduct research.
We process your personal data to meet our responsibilities for the Safeguarding of Children and Vulnerable Adults, because it is necessary for carrying out our obligations under employment, social security or social protection law.
We may also process the special categories of personal data, including criminal convictions and DBS checks, in limited circumstances with your explicit consent, where we need to carry out our legal obligations or exercise rights in connection with employment, where it is needed in the public interest or where it is necessary to protect you or another person from harm.
As we are a not for profit organisation, we may also process special category personal data about our members or those who have regular contact with us in the course of our legitimate activities with appropriate safeguards in place and we shall not disclose it outside the parish without the consent of the data subjects. For example, when we are streaming our services. Less commonly we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.
Sharing your personal data
Your personal data will be treated as strictly confidential and will be shared only with authorised staff within the Parish for specific Parish purposes. We will only share your data with third parties outside of the parish with your consent or if required to do so by law or regulatory requirements. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specific purposes and in accordance with our instructions. We do not transfer your data outside the UK.
How long do we keep your personal data?
We keep your personal data for no longer than reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. In most cases, this is for a period of seven years, in case of any legal claims or complaints.
For CCTV footage, it is no more than 30 days unless required in support of an investigation. For streamed services, it is 30 days unless it is decided that a video clip should be retained within our permanent archive as a historical record. Full details can be found in our Data Retention Policy, a copy of which is available on request.
Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator where we are
legally required to do so.
Your rights and your personal data
Unless subject to an exemption under the DPA, you have the following rights with respect to your personal data:
- The right to request a copy of your personal data which the Parish holds about you;
- The right to request that the Parish corrects any personal data if it is found to be inaccurate or out of date;
- The right to request your personal data is erased where it is no longer necessary for the Parish to retain such data;
- The right to withdraw your consent to the processing at any time;
- The right to request that the Parish provides the data subject with his/her personal data and where possible, to transmit that data directly to another data controller (known as the right to data portability);
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to the processing of personal data;
- The right to lodge a complaint with the Information Commissioners Office.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us to confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case we will notify you and keep you updated.
Further processing
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
Contact Details
To exercise all relevant rights, queries of complaints please in the first instance contact the PCC Secretary at pccsecretary@htscf.org.uk or through the Parish Office by telephone on 01329 232688 or by writing to The Parish Office, West Street, Fareham, Hampshire, PO16 0EL, for the attention of the PCC Secretary.
If you have a complaint, you can contact the Information Commissioners Office on 0303 123 1113 or via the ICO Contact Us page or by post to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.