DATA PRIVACY POLICY

1. Your personal data – what is it?

Personal data relates to a living individual who can be identified from that data.  Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).

 

2. Who are we? 

The AW Aberystwyth MA (the LMA, church, we, us) is the data controller (contact details below).  This means it decides how your personal data is processed and for what purposes.

 

3. How do we process your personal data?

The AW Aberystwyth MA complies with its obligations under the “GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

 

In the interests of transparency and to be as clear as possible, you can read about the specific information we collect about you, how we keep your information confidential and secure, and how you can access your information.

 

This policy explains what we will use information for…

1.         If we collect information about you or your children

2.         If you make a financial donation to the church

3.         If you are a customer who makes a booking of the church’s resources

4.         If you are an authorised user of the church’s database

5.         If you sign up for one of our events

6.         If you sign up for one of our small groups

7.         If you check your visiting child in to one of our children’s groups

 

 

In summary we use your personal data for the following purposes: -

• To enable us to provide a voluntary service for the benefit of the public in a particular geographical area as specified in our constitution; 

• To administer membership records; 

• To fundraise and promote the interests of the charity; 

• To manage our employees and volunteers; 

• To maintain our own accounts and records (including the processing of Gift Aid applications);

• To inform you of news, events, activities and services running in the AW Aberystwyth MA.

• To share your contact details with the Diocesan office so they can keep you informed about news in the diocese and events, activities and services that will be occurring in the diocese and in which you may be interested.

 

4. What is the legal basis for processing your personal data?

 

Legitimate interest

• Processing is carried out by a not-for-profit body with a political, philosophical, religious or trade union aim provided: -

  • Where we maintain and process information about our members, former members and those who are in regular contact with us.

  • Where you sign up for an event or group run by the church and we communicate with you about that event or group.

  • Where you have contacted us independently for information about the LMA. In this context we will only use your contact details to respond to your enquiry unless you explicitly consent for us to use your information for another purpose.

  • Where we need to communicate with you about: -

    • Church news, events, course, services and ministries

    • A public-interest matter, for example to let you know if an event is cancelled due to bad weather

    • A ministry or group that you are involved in as part of a serving team

  • For good governance and accounting, for planning, analysis and developing new ministries.

  • There is no disclosure to a third party without consent. 

 

Legal obligation

• Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement;

  • When you exercise your rights under data protection law and related disclosures.

  • Where we are required to maintain and report financial/accounting information for up to six years from the end of the tax year in which a financial transaction was processed. This would typically be in respect of donations you may make to the LMA, or ticket payments for certain events or courses run by the church.

  • Where we are required to maintain attendance records at groups or events for safeguarding purposes.

 

Consent applies

• Where you have voluntarily subscribed to the church’s subscriber mailing list so that we can keep you informed about news, events, activities and services and process your gift aid donations and keep you informed about diocesan events. You can unsubscribe from this list at any time using the unsubscribe link in the footer of those periodic emails.

 

 

5. Sharing your personal data

Your personal data will be treated as strictly confidential and will only be shared with other members of the church in order to carry out a service to other church members or for purposes connected with the church. We will only share your data with third parties outside of the parish with your consent or unless required to do so by law

 

How secure is your information?

The LMA uses a secure church management system that is only accessible by authorised church leaders, staff and ministry leaders. We have taken all practical and reasonable technical measures to ensure our administrative and processing activities are secure.

 

6. How long do we keep your personal data[1]?

We keep data in accordance with the guidance set out in the guide “Keep or Bin: Care of Your Parish Records” which is available from the Church in Wales website [see footnote for link] by the GDPR.

 

We endeavour to maintain only data that is relevant, accurate and up to date. We have internal processes to periodically review the data we hold and delete data that is no longer relevant to our purpose for processing. 

 

Specifically, we retain electoral roll data while it is still current; gift aid declarations and associated paperwork for up to 6 years after the calendar year to which they relate; parish registers (baptisms, marriages, funerals)and safeguarding records permanently.

 

7. Your rights and your personal information  

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: -

• Access to your information: The right to request a copy of your personal data which the AW Aberystwyth MA holds about you; 

• Correcting your information: We want to make sure that your personal information is accurate, complete and up to date and you have the right to ask us to correct any personal information about you that you believe does not meet these standards.

• Deletion of your information: You have the right to ask us to delete personal information about you where:

  • you consider that we no longer require the information for the purposes for which it was obtained or that we no longer need to retain it in accordance with our statutory obligations;

  • you have validly objected to our use of your personal information - see ‘Objecting to how we may use your information’ below;

  • our use of your personal information is contrary to law or our other legal obligations 

• The right to request that we provide the you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable) [Only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means].

·      Objecting to how we may use your information: Where we use your personal information to perform tasks carried out in the public or legitimate interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.

·      Restricting how we may use your information: In some cases, you may ask us to restrict how we use your personal information.  This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information.  The right might also apply where there is no longer a basis for using your personal information but you do not want us to delete the data.  Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

·      Withdrawing consent using your information: Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given. Please contact us St Michael’s Church Office if you wish to exercise any of these rights.

·      Lodging a complaint: If you feel we have used your information incorrectly or without lawful basis, or you dispute our lawful basis, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

8. Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

 

9. Contact Details

 

To exercise all relevant rights, queries of complaints please in the first instance contact The Church Office, St Michael’s Church, Laura Place, Aberystwyth, SY23 2AU, 01970 617184.

 

 

You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.

 

 

The much of content and information contained in this document has been produced by the Archbishop’s Council of the Church of England and with their agreement has been used by the Church in Wales. Some of the content is based on the ChurchSuite Demo - Kingshope Church - Privacy Notice. 

 

[1] Details about retention periods can currently be found in the Record Management Guides located on the Church in Wales website at: - www.churchinwales.org.uk