Privacy Notice
CARLINGWARK PARISH CHURCH SCOTTISH CHARITY NUMBER SCO11037
The Kirk Session of CARLINGWARK PARISH CHURCH Scottish Charity number SCO11037 (the
‘Congregation’) is providing you with this Privacy Notice in order to comply with data
protection law and to ensure transparency in the collection and use of your personal data.
Who is collecting the information
The Presbytery of the South West, Scottish Charity Number SC020676 is the Data
Controller for the Congregation. Aileen Stoddart is the Data Protection Coordinator for the
Congregation Tel 01556502677
Why is this personal data collected and for what reason (Purpose)
This information is used to:
administer membership records, including the Communion/Supplementary Rolls;
enable pastoral care
enable participation in Congregational activities
provide you with information in relation to news, events, and activities within the
Congregation or the wider Church of Scotland
provide the services of a parish church to the local community
fulfill legal obligations
further charitable aims, for example through fundraising activities
maintain accounts and records (including the processing of Gift Aid applications);
comply with safeguarding obligations including, the protection of vulnerable groups
scheme
maintain a directory of contact details
What personal data is collected
Personal data will include only what is necessary to fulfill the purposes listed. For most
members it will only include name, address and contact details supplied.
Name
Address
Telephone number
Mobile number
Date of Birth
Email address
Bank details (for Gift Aid and fundraising purposes)
Children’s data (for example, but not limited to, if required for instance for Junior
Church, holiday clubs or baptism)
Role in congregation (e.g. office-bearer information)
Health-related information
Photographs and videos (where applicable)
Safeguarding information, including Covenant of Responsibilities
Religious beliefs are collected by implication by being a church member
4130-2464-1115, v. 3
The information source
The information is collected directly from you. Some data is collected via the Presbytery or
the National Offices.
The lawful basis for the processing
The Congregation processes special category (sensitive) data under UK GDPR Article 9(2)(d):
“processing is carried out in the course of its legitimate activities with appropriate
safeguards by a foundation, association or any other not-for-profit body with a political,
philosophical, religious or trade union aim and on condition that the processing relates solely
to the members or to former members of the body or to persons who have regular contact
with it in connection with its purposes and that the personal data are not disclosed outside
that body without the consent of the data subjects”.
For the other processing activities, the lawful basis are:
UK GDPR Article 6(1)(c) “processing is necessary for compliance with a legal
obligation to which the controller is subject”.
Article 6(1)(f) “processing is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party, except where such interests are
overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data, in particular where the data subject is a
child”.
Article 6(1)(a) “the data subject has given consent to the processing of his or her
personal data for one or more specific purposes”. This is specific to safeguarding
purposes and Sunday School and other related activities dealing with children.
Consent will be sought from parents/guardians for processing a child’s personal
data.
Who data is shared with
Your personal information will only be shared where this is necessary for the purposes set
out above. Information will not be shared with any third party out with the Church of
Scotland without your consent unless the Congregation is obliged or permitted to do so by
law.
How long the personal data is held for
The Congregation will keep your personal information for as long as you are a member or
adherent, or have regular contact with the Congregation, or for as long as the Congregation
is obliged to keep it by law or may need to do so in order to respond to any questions or
complaints, or to show that the Congregation treated you fairly. When the information is
no longer needed it will be securely destroyed following church procedure.
Individuals’ rights in relation to this processing
Under data protection laws, individuals have a number of rights in relation to the processing
of their personal data. These rights are as follows:
4130-2464-1115, v. 3
The right to be informed – this privacy notice meets that right.
The right of access – this means you have the right to have access or receives copies
of personal data held by the organisation
The right to rectification – this means you have the right to correct incomplete or
inaccurate data held about you
The right to erasure – this means you have the right to have your data deleted from
an organisation’s records.
The right to restrict processing – this means you have the right to restrict processing.
This right is normally used with other rights, e.g. rectification
The right to data portability – this means you have the right to request your data in a
machine-readable format and transfer this to another organisation
The right to object – this means you have the right to object to how your data is
processed
Rights in relation to automated individual decision making, including profiling – the
Church does not carry out this type of processing.
Not all rights apply and it depends on the lawful basis as to what rights do apply.
For the processing purposes of this privacy notice, when the lawful basis is legal obligation
the right of erasure, right to data portability and the right to object do not apply. All other
rights do apply. For the processing purposes of this privacy notice when the lawful basis is
legitimate interests, all rights apply except for data portability. If you wish to exercise any of
your rights please contact the Data Protection Coordinator for Carlingwark Parish Church,
Aileen Stoddart tel 01556502677 who will process your request accordingly.
If any processing is carried out on the basis of consent it is important to note that you can
withdraw your consent at any time. To do this please contact Aileen Stoddart
Complaints to the Church of Scotland
If you are concerned about how your personal data is being used by the Church of Scotland,
please contact - in the first instance - the Data Protection Coordinator for Carlingwark Parish
Church Aileen Stoddart and the Data Protection Officer for the Church of Scotland at
Privacy@churchofscotland.org.uk, if required.
Complaints to the Information Commissioner’s Office (ICO)
If you are not satisfied with the outcome of your complaint to the Church of Scotland, a
referral can be made to the UK regulator of data protection, the Information
Commissioner’s Office (ICO).
The ICO has guidance on their website: https://ico.org.uk/your-data-matters/raising-
concerns/
The ICO can be contacted by email casework@ico.org.uk or by telephone on 0303 123 1113.
Alternatively, their postal address is:
Customer Contact
Information Commissioner's Office
Wycliffe House
4130-2464-1115, v. 3
Water Lane
Wilmslow
SK9 5AF
Further information
If you would like further information in relation to this Privacy Notice please contact the
Church of Scotland Data Protection Officer at Privacy@churchofscotland.org.uk.
This Privacy Notice may be updated from time to time to reflect changes in legal
requirements or other operational reasons. The latest version will always be available from
Carlingwark Parish Church SCO 11037 Aileen Stoddart is the Data Protection Coordinator for
the Congregation tel 01556502677
4130-2464-1115, v. 3