DATA PROTECTION NOTICE

1. Your Personal Data – What Is It?

Personal data relates to a living individual who can be identified from that data. Identification can be made from the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation 2016/679 (the “GDPR”).

2. Who Are the Data Controllers?

The Vestry of St Michael and All Saints, Edinburgh, and the Clergy are each data controllers (contact details below). This means they each decide how your personal data is processed and for what purposes.

3. How Is Your Personal Data Processed?

The Vestry and Clergy of St Michael and All Saints comply with their obligations under the GDPR by:

• Keeping personal data up to date;

• Storing and destroying it securely;

• Not collecting or retaining excessive amounts of data;

• Protecting personal data from loss, misuse, unauthorised access and disclosure; and

• Ensuring that appropriate technical and organisational measures are in place to protect personal data.

The Clergy will use your personal data in order to provide pastoral care and to administer records such as the Communicants’ Roll and the Adherents’ Roll.

The Vestry uses your personal data for the following purposes:

• To administer membership records;

• To fundraise and promote the interests of the charity;

• To manage employees and volunteers;

• To maintain accounts and records (including the processing of Gift Aid applications);

• To inform you of news, events, activities and services at St Michael and All Saints and in the broader Scottish Episcopal Church;

• To share your contact details with the diocesan office so they can inform you about events and services you may be interested in;

• To share your contact details with the diocesan office or the General Synod Office if you are appointed to a role within the congregation or diocese for the purposes of church administration;

• To enable the provision of a voluntary service for the benefit of the public.

4. What Is the Legal Basis for Processing Your Personal Data?

• Explicit consent of the data subject so that you may be kept informed about news, events, activities and services across the Scottish Episcopal Church via email, telephone or text, and so that any sensitive personal data (e.g. inclusion on the Communicants’ Roll) may be shared with the Clergy, Vestry, Diocesan authorities and the General Synod Office.

• If you are an employee of the Vestry, the processing is necessary for carrying out obligations under employment, social security or social protection law, or under a collective agreement.

• Processing is carried out by a not-for-profit body with a religious aim, provided that:

  • The processing relates only to members, former members, or those who have regular contact with the body in connection with its purposes;
    

  • There is no disclosure to a third party without consent.
    

• Processing is necessary for legitimate interests, meaning there is a genuine and legitimate reason to process your personal data which does not override your rights and interests. This includes church administration, processing Gift Aid donations, and fundraising.

5. Sharing Your Personal Data

Your personal data will be treated as strictly confidential and will only be shared as necessary:

• With members of the Vestry and Clergy;

• With the diocesan office and, if applicable, the General Synod Office (for those appointed to a role within the congregation or diocese);

• With other members of the congregation, where necessary, for those involved in duties, rotas, or committees (you will be informed beforehand).

Data may also be shared with third parties if required to comply with a legal obligation or court order, or to protect the rights, property or safety of individuals or the church community.

6. How Long Is Your Personal Data Retained?

Data is retained in accordance with guidance from the Scottish Episcopal Church:

• Communicant and Adherent Roll data is kept while current; historic records are archived for six years.

• Gift Aid declarations and associated records are kept for up to seven years after the relevant tax year.

• Church registers (baptisms, marriages, funerals) are retained permanently.

7. Your Rights and Your Personal Data

Unless subject to an exemption under the GDPR, you have the following rights:

• To request a copy of your personal data held by the Rector or Vestry;

• To request that any inaccurate or outdated data is corrected;

• To request the erasure of your data where it is no longer necessary;

• To withdraw your consent at any time;

• To request data portability (i.e. to receive and/or transmit your data to another controller where applicable);

• To request a restriction on processing where there is a dispute regarding accuracy or lawfulness;

• To object to processing based on legitimate interests, direct marketing, or research purposes;

• To lodge a complaint with the Information Commissioner’s Office.

8. Further Processing

If personal data is to be used for a new purpose not covered by this notice, a new notice will be issued explaining the new use and outlining the relevant conditions. Consent will be sought where necessary before proceeding.

9. Contact Details

To exercise your rights, raise queries, or lodge a complaint, please contact:

• Vestry Secretary: secretary@stmichaelandallsaints.org

• Rector: rector@stmichaelandallsaints.org

You may also contact the Information Commissioner’s Office:

• Telephone: 0303 123 1113

• Website: https://ico.org.uk/global/contact-us/email/

• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF