St.Marys Indian Orthodox Church

Privacy Policy

Your personal data – what is it?

“Personal data” is any information about a living individual which allows them to be identified from that data (for example a name, photographs, videos, email address, or address). Identification can be by the information alone or in conjunction with any other information. The processing of personal data is governed by the UK GDPR, Data Protection Act 2018 and any other legislation relating to personal data and rights such as the Human Rights Act 1998.

Who are we?

The Church (St. Marys Indian Orthodox Church, Bristol) is the data controller (contact details below) and registered with the Information Commissioners Office. This means the church decides how your personal data is processed and for what purposes.

What type of data do we process?

Names, titles, and aliases, photographs.
Contact details such as telephone numbers, addresses, and email addresses.
Where they are relevant to our mission, or where you provide them to us, we may process demographic information such as gender, age, date of birth, marital status, nationality etc.
Financial identifiers such as bank details and account numbers. Financial information such expenses claimed.
Other operational personal data created, obtained, or otherwise processed in the course of carrying out our activities, including but not limited to, CCTV footage, IP addresses and website visit histories.
The data we process is likely to constitute sensitive personal data because, as a church, the fact that we process your data at all may be suggestive of your religious beliefs.

How do we process your personal data?

St. Marys Indian Orthodox Church Bristol complies with its obligations under the “UK GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

We use your personal data for some or all of the following purposes:

To promote orthodox Christian faith;
To enable those who undertake pastoral care duties as appropriate (e.g. visiting the bereaved);
To carry out comprehensive safeguarding procedures (including due diligence and complaints handling) in accordance with best safeguarding practice from time to time to ensure that all children and adults-at-risk are provided with safe environments;
To deliver the Church’s mission to our community, and to carry out any other voluntary or charitable activities for the benefit of the public as provided for in the Church constitution and statutory framework;
To enable us to provide a voluntary service for the benefit of the public in a particular geographical area as specified in our constitution;
To administer membership records;
To administer Baptism register;
To administer Birth and Death Register;
To administer confession records;
To administer offertory records;
To fundraise and promote the interests of the charity;
To manage our role holders and volunteers;
To maintain our own accounts and records (including the processing of gift aid applications);
To inform you of news, events, activities and services running at St Marys Indian Orthodox Church;
To notify you of changes to our services, events and role holders;
To enable us to meet all legal and statutory obligations (which include maintaining and publishing our electoral roll in accordance with the Church Representation Rules);
To share your contact details with the Diocesan office so they can keep you informed about news in the diocese and events, activities and services that will be occurring in the diocese and in which you may be interested;
To process a grant or application for a role;
We will process data about role holders for legal, personnel, administrative and management purposes and to enable us to meet our legal obligations. “Role Holders” includes the Vicar, Trustee, Secretary, all managing committee members, custodian trustees, all volunteers, contractors, other beneficiaries and other role holders not mentioned.
We may process sensitive personal data relating to Role Holders including, as appropriate;
Our processing also includes the use of CCTV systems for the prevention and prosecution of crime.

In each of these cases, the data you provide will be securely stored. Depending on the information you have provided and the purpose for us processing your data, this is likely to include your name, address, telephone number, email address, event booking information, donation amount, payment method, donation date and Gift Aid declaration.

If you have paid or donated by card we will hold this data to process the donation. In order to meet our financial reporting requirements, we will securely store card details for transactions and donations made online for 18 months. After this time, we will destroy this information.

What is the legal basis for processing your personal data?

Most of our data is processed because it is necessary for our legitimate interests or the legitimate interests of a third party (such as another organisation within the Diocese of UK Europe Africa). An example of this would be our safeguarding work to protect children and adults at risk. We will always take into account your interests, rights and freedoms.
Some of our processing is necessary for compliance with a legal obligation. For example, we are required by the Church Representation Rules to administer and publish the electoral roll of eligible members who attend the General Bodies, and under Canon Law to announce forthcoming weddings by means of the publication of banns.
We will also process your data in order to assist you in fulfilling your role in the church including pastoral and administrative support or if the processing is necessary for compliance with a legal obligation.
Religious organisations are also permitted to process information about your religious beliefs to administer membership or contact details. Processing is necessary for carrying out legal obligations in relation to Gift Aid or under employment, social security or social protection law, or a collective agreement.
We may also process data if it is necessary for the performance of a contract with you, or to take steps to enter into a contract. An example of this would be processing your data in connection with the hire of church facilities.
Where your information is used other than in accordance with one of these legal bases, we will first obtain your consent to that use.

Sharing your personal data

Your personal data will be treated as strictly confidential. It will only be shared with third parties including other data controllers where it is necessary for the performance of the data controllers’ tasks or where you first give us your prior consent. It is likely that we will need to share your data with

The appropriate bodies of the Malankara Orthodox Church including other churches within the UK Europe Africa Diocese ;
Our agents, servants and contractors. For example, we may ask a commercial provider to maintain our website;
Other clergy or lay persons nominated or licensed by the UK Europe Africa Diocese to support the mission of the Church in our parish. For example, our clergy are supported by our Diocese, who may provide confidential mentoring and pastoral support. Assistant or temporary ministers or persons with Bishop’s Permissions may participate in our church in support of our regular clergy;
Other persons (for example – Sunday School Director) or organisations operating within the UK Europe Africa Diocese including, where relevant;
On occasion, with other churches where we carry out joint events or activities.

How long do we keep your personal data?

We will keep some records permanently if we are legally required to do so. We may keep some other records for an extended period of time. For example, it is the current best practice to keep financial records for a minimum period of 7 years to support HMRC audits. In general, we will endeavour to keep data only for as long as we need it. This means that we may delete it when it is no longer needed.

Your rights and your personal data

You have the following rights with respect to your personal data: -

When exercising any of the rights listed below, in order to process your request, we may need to verify your identity for your security. In such cases, we will need you to respond with proof of your identity before you can exercise these rights.

The right to access the information we hold on you

At any point, you can contact us to request the information we hold on you as well as why we have that information, who has access to the information and where we obtained the information from. Once we have received your request we will respond within one month.
There are no fees or charges for the first request but additional requests for the same data may be subject to an administrative fee.

The right to correct and update the information we hold on you

If the data we hold on you is out of date, incomplete or incorrect, you can inform us and your data will be updated.

The right to have your information erased

If you feel that we should no longer be using your data or that we are illegally using your data, you can request that we erase the data we hold.
When we receive your request we will confirm whether the data has been deleted or the reason why it cannot be deleted (for example because we need it for our legitimate interests or regulatory purpose(s)).

The right to object to the processing of your data

You have the right to request that we stop processing your data. Upon receiving the request we will contact you and let you know if we are able to comply or if we have legitimate grounds to continue to process your data. Even after you exercise your right to object, we may continue to hold your data to comply with your other rights or to bring or defend legal claims.

The right to data portability

You have the right to request that we transfer some of your data to another controller. We will comply with your request, where it is feasible to do so, within one month of receiving your request.

The right to withdraw your consent to the processing at any time for any processing of data to which consent was sought.

You can withdraw your consent easily by telephone, email, or by post (see Contact Details below).

The right to object to the processing of personal data where applicable.

You can find out more about your rights by visiting the Information Commissioner's Office website - www.ico.org.uk. In particular, you might find the following guidance helpful - https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

Should you have a complaint about the way we are processing your data, we encourage you to contact us in the first instance and we will investigate it. To make a complaint, to request a change to the way we process your data or to exercise any of your rights, please contact secretary@smiocbristol.org.

We will make every effort to address your concerns. However, if you are not satisfied with our response you can make a complaint to the Information Commissioner's Office - https://ico.org.uk/concerns/.

Transfer of Data Abroad

Any electronic personal data transferred to countries or territories outside the UK will only be placed on systems complying with measures giving equivalent protection of personal rights either through international agreements or contracts approved by the UK. Our website is also accessible from overseas so on occasion some personal data (for example in a newsletter/ photograph) may be accessed from overseas.

Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use before commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

Cookies

Cookies are small pieces of information, stored in simple text files, placed on your computer by a website. Some cookies can be read by the website on your subsequent visits. The information stored in a cookie may relate to your browsing habits on the webpage, or a unique identification number so that the website can ‘remember’ you on your return visit. Other cookies are deleted when you close your browser and only relate to the working of the website. Generally speaking, cookies do not contain personal information from which you can be identified, unless you have furnished such information to the website. Cookies are placed in several places on this website.

When you first visit this website, you will see a message informing you about cookies. If you click the ‘Close’ button, a cookie will be set which records your preference.

This website uses Google Custom Search to provide the site’s search functionality. Google may set cookies when you use the search function. You can find Google’s privacy policy here: www.google.com/policies/privacy/. Cookies from Google may also be set when Google Maps are displayed on this website.

Most browsers allow you to turn off cookies or to customise your settings for cookies. To find out how to do this, see the ‘Help’ menu on your browser. Please note that if you turn off cookies or change your settings, some features may not work correctly.

Links to other websites

Our website may contain links to enable you to visit other websites of interest easily. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Controlling your personal information

We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law. If you are concerned about how personal data is processed via this website, please do not hesitate to bring such concerns to our attention.

Glossary of technical terms used

Web Browser

The piece of software you use to read web pages. Examples are Safari, Google Chrome, Microsoft Internet Explorer, Mozilla Firefox and Opera.

IP Address

The identifying details for your computer (or your internet company’s computer), expressed in internet protocol code (for example 192.168.72.34). Every computer connected to the web has a unique IP address, although the address may not be the same every time a connection is made.

Changes to this notice

We keep this Privacy Notice under regular review and we will place any updates on this web page. https://www.smiocbristol.org. This Notice was last updated in March 2021.

Contact Details

Please contact us if you have any questions about this Privacy Notice or the information we hold about you or to exercise all relevant rights, queries or complaints at: The Vicar, St. Marys Indian Orthodox Church, Bank Road, Pilning, Bristol BS35 4JG. Email: vicar@smiocbristol.org or church office phone number: 01454430288. You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

SMIOC Bristol