DATA PRIVACY NOTICE
York City Church
York City Church understands that your privacy is important to you and that you care about how your information is used and shared. We respect and value the privacy of everyone who provides and trusts us with personal data in any format and will only collect and use information in ways that are consistent with your rights and our obligations under the law.
Please read this Privacy Notice carefully and ensure that you understand it. If you are uncertain with anything contained within, please ask, and if necessary you have a number of rights to have your personal data removed from our records as highlighted below.
1. Your personal data – what is it?
Personal data relates to anything that could be used to identify an individual from that data, including some photographs. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (EU 2016/679), more commonly referred to as the “GDPR”.
2. Who are we?
York City Church is the data controller (contact details below), which means that it decides how your personal data is processed and for what purposes, and the York City Church Trustees collectively take on the Data Protection Officer Role.
3. How do we process your personal data?
York City Church complies with its obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
We use your personal data for the following purposes: -
- To enable us to provide a voluntary service for the benefit of the public in a particular geographical area as specified in our constitution;
- To provide pastoral support;
- To administer membership records and provide a members’ directory (primarily through the ‘ChurchBox’ system);
- To manage our employees and volunteers;
- To fundraise and promote the interests of the charity;
- To manage bookings and events run by us and others at The Citadel;
- To manage other events and activities organised and run by York City Church;
- To promote the activities of the church to others;
- To maintain our own accounts and records (including the processing of gift aid applications);
- To inform you of news, events, activities and services running at York City Church (primarily managed through the ‘Church Box’ system) using email/phone/text/WhatsApp/Facebook/mail as selected by yourself.
4. What is the legal basis for processing your personal data?
- For some data such as personal data stored in ChurchBox, including contact preferences and photographs classed as personal data, we require explicit consent from the data subject to allow us to continue to store or process your data. Most of this is completed through ChurchBox or using the contact us forms where you provided us with your details.
- Certain data we have a legal obligation to process and keep in accordance with the appropriate legislation, for example to process Gift Aid claims and manage the charity finances, or under employment, social security or social protection law or a collective agreement;
- Other data we have to keep for contractual reasons, such as venue hire, supplier contract or other agreements between you and us.
- As a faith based charitable body we may also process special category data (ie sensitive personal data) in accordance with Article 9 in relation to church members, trustees, volunteers or employees by explicit consent.
- We may also process your special category data as required by law, in particular in accordance with the Safeguarding Vulnerable Groups Act 2006.
5. Sharing your personal data
Your personal data will be treated as strictly confidential and will only be shared with other members of the church in order to carry out a service to other church members or for purposes connected with the church. We will only share your data with third parties outside of the church with your consent (for example if you wanted us to put you in touch with another church) OR if required under our legal obligations (eg Gift Aid requires us to pass your donation details to HMRC).
We do NOT share or sell any data to third party organisations.
6. How long do we keep your personal data?
We keep data in accordance with these guidelines and the church confidentially policy. We will keep your personal data only for as long as we consider it necessary to carry out the activity for which we have collected it.
Specifically, we retain membership data whilst you are still actively engaged with or connected to activities related to York City Church; event specific data for up to 2 years after the calendar year to which they relate to allow us to provide you with information about subsequent events you may be interested in; and gift aid declarations, other associated donation paperwork and all other financial related data used in our accounts for up to 6 years after the end of the calendar year to which they relate.
We will delete data, and in particular membership or contact information from Church Box, twice a year when no longer required so that if you leave the church or complete an enquiry form but decide not to remain connected with part of the church, the longest we will hold your data is 6 months. The exception to this is when you have agreed for us to hold your data for marketing purposes relating to an event, when we will delete it at the next biannual data cleanse 2 years after the event (or your last engagement with the church following the event) unless you request otherwise. Where York City Church takes photographs to record events or to publicise future events and the photographs are such that they are classed as personal data (photographs of crowds or where individuals are not the primary focus are not classified as personal data), we will contact those individuals (or their parent or guardian in the case of minors) to explicitly request permission to store and/or use these photographs. If permission is not, or cannot be obtained, we will delete them within 2 months of the photograph being taken. Please note, we cannot manage photographs taken by private individuals at events run by York City Church.
7. Your rights and your personal data
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: -
- The right to request a copy of your personal data which York City Church holds about you;
- The right to request that York City Church corrects any personal data if it is found to be inaccurate or out of date;
- The right to request your personal data is erased where it is no longer necessary for York City Church to retain such data;
- The right to withdraw your consent to the automatic processing of certain data at any time
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to the processing of personal data when collected for certain purposes.
- The right to lodge a complaint with the Information Commissioners Office.
8. Church Box
The main location that all of our membership personal data is stored is within the online ‘ChurchBox’ system (system details available at www.churchbox.co.uk). This includes the church members’ directory, event management, rota management and email management along with some other member management features.
If you are a member of York City Church you have full control of which data is stored within the system and can provide consent for your communication preferences in the settings section within the system. Please login to the system at http://connect.yorkcitychurch.org.uk to manage the data we hold about you.
8. Further processing
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
9. Contact Details
To exercise all relevant rights, queries or complaints please in the first instance contact us at the church office:
- By phone: 01904 541444
- By Post at: The Citadel, Gillygate, York. YO31 7EA
You can also contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF if you feel that we have not handled your request or complaint to your satisfaction.