DATA PRIVACY NOTICE

1. INTRODUCTION

LIFESPRING values everyone who engages with us by whatever means, and we do all we can to protect your privacy and to make sure the personal data you provide us is kept safe. This policy explains how we collect data, how we use and store information and what it means for you.

2. WHO WE ARE

LIFESPRING is the data controller (contact details at the foot of the page). This means LIFESPRING decides how your personal data is processed and for what purposes.

3. WHAT INFORMATION WE COLLECT

This policy explains how LIFESPRING and the website comply with the General Data Protection Regulation (GDPR) 2018. LIFESPRING complies with its obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

a. DIRECTLY FROM US

We collect personal information each time you deal with us, for example when you provide your contact details, in writing or orally, to church staff or volunteers, make a donation, request materials or information, sign up for an event or small group, use our check in system for children’s activities (under age 18) on a Sunday, or otherwise provide your personal details.

b. FROM WEBSITE INTERACTION FROM US

We collect non-personal data such as IP addresses, details of pages visited, and files downloaded. Website usage information is collected using cookies.

c. INDIRECTLY FROM THIRD PARTIES

We collect information from third parties, such as event organisers, where you have agreed and have given your consent. You may wish to check the privacy policy for any third party that you have given consent to find out more information on how they will process your data.

d. WHERE YOU GIVE PERMISSION TO OTHER ORGANISATIONS

We may collect information that you make available on, for example, Twitter, Facebook, LinkedIn or similar organisations. You may wish to check their privacy policy to find out more information on how they will process your data.

e. SENSITIVE DATA

Where you provide the information, we may collect sensitive personal data, including, but not limited to, your religious beliefs, or your physical or mental health.

4. WHAT WE DO WITH IT

a. PROCESSING OF REQUESTS/DONATIONS

By providing your personal details you agree to allow LIFESPRING to contact you by mail, email, telephone or SMS text message in connection with its charitable purposes. Either on the basis of the consents you have given us or for our legitimate interests in accordance with current data protection regulations.

We may use the personal data we collect to:

• Enable us to provide a voluntary service for the benefit of the public;
• Provide pastoral care to our attendees;
• Administer attendance/membership records;
• Provide interactive websites where email is used to communicate with users;
• Fundraise and promote the interests of the charity;
• Manage our employees and volunteers;
• Maintain our own accounts and records (including the processing of gift aid applications);
• Inform you of news, events, activities and services running at LIFESPRING;
  

b. BASIS OF PROCESSING YOUR DATA

In order that we can provide services you have requested, and keep you informed about news, events, activities and services and process your donations we will process your personal data on the basis of the consent you provided us with. You are free to change your consent and communication preferences at any time.

Other processing based on legitimate interest is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement. Legitimate interest is also the basis of our processing relating to enquirers, members or former members (or those who have regular contact with us in connection with these purposes) as we are a not-for-profit body with religious aims.

c. APPLYING FOR A JOB OR VOLUNTEERING WITH US

Where you provide personal data and sensitive personal data when applying for a job or volunteer role with us, such as the information on your CV we will process, store and disclose the personal data we collect to:

· Support the recruitment process;

· Answer any questions you may have;

· Use third parties to provide services such as references, qualifications, criminal referencing, checking services, verification of information you have provided, health screening and psychometric evaluation or skills tests;

· Provide anonymised data to monitor compliance with our equal opportunities policy.

5. HOW AND WHERE WE STORE YOUR INFORMATION

a. HOW LONG?

We will keep your personal information only for as long as we consider it necessary to carry out each activity. We take account of legal obligations and accounting and tax considerations as well as considering what would be reasonable for the activity concerned.

b. SECURITY

We ensure that we have appropriate technical controls in place to protect any personal data you provide. For example, we ensure that any online forms are encrypted and our network is protected and routinely monitored.

Your personal data held on the Church Directory can be viewed by other members of LIFESPRING. What data is accessible to other members is within your control and you can amend your data preferences, at any time.

We ensure that access to all other personal data is restricted only to those staff members or volunteers whose job roles require such access and that suitable training is provided for these staff members and volunteers.

We may make limited use from time to time of external companies to collect or process personal data on our behalf. When we do so, we carry out checks on these companies, put in place contracts to make sure our requirements are clear, and carry out periodic reviews. When we do use external companies, we remain responsible for the storing and processing of your personal data.

However, we need to remind you that despite all our efforts, the internet cannot be guaranteed to be 100% secure, and that you submit data at your own risk.

c. CREDIT/DEBIT CARD SECURITY

If you use your debit or credit card to donate to us, purchase something or pay for an event, whether online, over the phone or by Gift Envelope, we will process your information securely in accordance with the Payment Card Industry Data Standard.

We may hold your bank account details if you have asked us to set up a standing order for you, which are stored securely and retained in line with legal requirements.

d. WHERE WE STORE YOUR PERSONAL INFORMATION

We use cloud-based systems to process data and therefore data may be processed outside of the European Economic Area (EEA). We adopt the Information Commissioners approved measures and therefore ensure that personal data is held in compliance with European data protection regulations. We take all reasonable steps to ensure that your data is stored and processed securely in accordance with this policy. By submitting your personal data you agree to this transfer, storing and processing of your information.

6. WHEN WE SHARE YOUR PERSONAL INFORMATION

Your personal data will be treated as strictly confidential and will only be shared with staff and members of LIFESPRING in order to carry out a service or for purposes connected with LIFESPRING. We will only share your data with third parties with your consent.

a. LEGAL DUTY

We may need to pass on information if required by law or by a regulatory body. For example, a Gift Aid audit by the HMRC, or if asked for details by a law enforcement agency.

b. OUR SERVICE PROVIDERS

We do not sell or pass any of your personal information to any other organisations and/or individuals without your express consent, with the following exception - by providing us with your details you are giving LIFESPRING your express permission to transfer your data to our service providers including mailing houses, such as MailChimp, to enable fulfilment of the purpose for collection. Where such details are shared we have confidentiality agreements in place that restrict the use of your information to the purpose for which it is provided and ensure it is stored securely and kept no longer than necessary.

We may employ agents to carry out tasks on our behalf, such as processing donations. These agents are bound by contract to protect your data and we remain responsible for their actions.

We may provide third parties with general information about users of our site, but this information is both aggregate and anonymous. However, we may use IP address information to identify a user if we feel that there are or may be safety and/or security issues or to comply with legal requirements.

7. COOKIES

a. WHAT ARE COOKIES?

A cookie is a small amount of data that is sent to your browser and stored on your computer’s hard drive. Our website makes use of cookies to collect information about our visitors through Google Analytics.

b. HOW WE USE THEM ON OUR WEBSITE

To enjoy our website to the full, we recommend that you leave cookies turned on. If you turn off cookies then you may not be able to enter parts of the site or parts may not be displayed as intended.

The cookie data that we collect we may use to customise the content on our website and to help to understand visitors’ current and future needs

c. MANAGING COOKIES

Most browsers allow you to turn off the cookie function. To do this you can look at the help function on your browser.

d. THIRD PARTY COOKIES

We work with a number of third party suppliers who set cookies on our website to enable them to provide us with services. These are mainly used for reporting and advertising purposes, so we can improve the way we communicate.

We use websites such as YouTube and Vimeo to embed videos and you may be sent cookies from these websites. We do not control the setting of these cookies, so we suggest you check the third-party website for more information about their cookies and how to manage them.

We also use third party suppliers such as Google Analytics and Facebook These providers may use cookies. They may also use tracking pixels, which are commonly found in advertising to track the effectiveness of adverts.

As some of these services may be based outside of the UK and the European Union, they may not fall under the jurisdiction of UK courts. If you are concerned about this, you can change your cookie settings via your own browser.

8. CHILDREN

Families making use of the children’s groups during our services are required to provide personal data for their children. This data is provided with the consent of a parent or guardian who holds parental responsibility for the child(ren) and is securely held and stored as above. We require parental consent for any child under the age of 18.

9. YOUR CHOICES AND TELLING US WHEN THINGS CHANGE

a. COMMUNICATION PREFERENCES

You can change your preferences on what you receive from us, or how we contact you, by mail, phone, text, or email, at any time. You can update your consent and communication preferences yourself via My ChurchSuite or contacting us using the contact details below.

b. UPDATING YOUR DETAILS

We do appreciate it if you keep your details up to date. You can do so in the same way as updating your preferences (above).

We may use Post Office address search, postcode lists or other available sources to confirm data that you provide us with, where, for example, we are unsure of what you have completed on a form.

We will not use these sources to create data that you have chosen not to provide, for example, if you have left a telephone number blank; nor will we automatically update changes of address, we will normally only update your address when you tell us it’s changed.

c. TELLING US TO STOP PROCESSING

You have the right to ask us to erase your personal data, to ask us to restrict our processing or to object to our processing of your personal data. You can do so at any time via My ChurchSuite or by emailing or writing to us.

10. ACCESS TO YOUR INFORMATION

You have the right to request details of the information we hold about you. To make this request, please write to us using the contact details below. For more information about your rights under the Data Protection Act you can visit the website of the Information Commissioner’s Office.

11. HOW LONG DO WE KEEP YOUR INFORMATION?
We will keep your personal information only for as long as we consider it necessary to carry out each activity unless required to keep for UK law and will be deleted within 24 months of your last activity with us, unless you request to be forgotten or remove the information yourself. We take account of legal obligations and accounting and tax considerations as well as considering what would be reasonable for the activity concerned. Pastoral and sensitive personal information will only be kept whilst you are accessing our Pastoral Care from LIFESPRING and will be deleted within 6 months of either your pastoral situation being resolved or you no longer wish to access pastoral care from our organisation.

12. CHANGES TO THIS POLICY

This policy was last updated in July 2019. We may amend this policy from time to time to take account of changes to our processes or changes to data protection or other legislation. If we make any significant changes to this policy, we will show this clearly on our website or in our communications. By continuing to use our website you will be deemed to have accepted these changes.

13. FURTHER PROCESSING

If we wish to use your personal data for a new purpose, not covered by this Data Privacy Policy then we will provide you with a new policy explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

14. GOVERNING LAW

This Data Privacy Policy is subject to English law. All claims or disputes (including non-contractual disputes or claims) arising out of or in connection with the use of the websites shall be subject to the non-exclusive jurisdiction of the courts of England and Wales.

[Feb 2020]