POLICY STATEMENT: 

Anthem House Church 

DATA PROTECTION POLICY 

 

Anthem House Church is committed to protecting personal data and respecting the rights of our data subjects (people whose personal data we collect and use). Anthem House Church values the personal information entrusted to us and we respect that trust, by complying with all relevant laws, and adopting good practice. 

We process personal data to help us: 

1. Maintain a list of our church members 

2. Provide pastoral support for members and others connected with our church 

3. Provide services to the community including Foodbank, Childcare, etc. 

4. Safeguard children, young people and adults at risk 

5. Recruit, support and manage staff and volunteers 

6. Maintain our church accounts and records 

7. Promote our services 

8. Maintain the security of property and premises 

9. Respond effectively to enquirers and handle any complaints 

10.And for any fundraising events that might require this information. 

This policy has been approved by the Anthem House Church Trustees who are responsible for ensuring that we comply with all our legal obligations. It sets out the legal rules that apply whenever we obtain, store or use personal data. 

Why this policy is important: 

1. We’recommittedtoprotectingpersonaldatafrombeingmisused,gettingintothewronghands as a result of poor security or being shared carelessly, or being inaccurate, as we’re aware that people can be upset or harmed if any of these things was to happen.

2. This policy sets out the measures we’re committed to taking as an organization and, what each of us will do to ensure we comply with the relevant legislation.

3. For instance, we’ll make sure that all personal data is: a. Processed lawfully, fairly and done transparently 

 

• Processed for specific, explicit and legitimate purposes and not in a manner that’s incompatible with those purposes

• Adequate, relevant and limited to what is necessary for the purposes for which it’s being processed

• Accurate and, where necessary, up-to-date

• Not kept longer than necessary for the purposes for which it’s being processed

• Processed in a secure manner, by using appropriate technical and organizational means

• Processed in keeping with the rights of data subjects regarding their personal data.

How this policy applies to you and what you need to know:
1. ]As an employee, volunteer or trustee processing personal information on behalf of the church, you’re require to comply with this policy. If you think that you’ve accidentally breached the policy it’s important that you contact our Data Protection [Officer/Trustee] immediately so that we can take swift action to try and limit the impact of the breach. 

Anyone who breaches the Data Protection Policy may be subject to disciplinary action, and where that individual has breached the policy intentionally, recklessly or for personal benefit they may also be liable to prosecution or to regulatory action. 

2. As a leader and/or manager you’re required to make sure that any procedures that involve personal data, that you’re responsible for in your area, follow the rules set out in this Data Protection Policy. 

3. As a data subject of Anthem House Church: We will handle your personal information in line with this policy. 

4. As an appointed data processor/contractor: Companies who are appointed by us as a data processor are require to comply with this policy under the contract with us. Any breach of this policy will be taken seriously and could lead to us taking contract enforcement action against the company, or terminating the contract. Data processors have direct obligations under the GDPR, primarily to only process data on instructions from the controller (us) and to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk involved. 

 

1. OurDataProtection[Officer/Trustee]isresponsibleforadvising[InsertChurchName]andits staff and members about their legal obligations under data protection law, monitoring compliance with data protection law, dealing with data security breaches and with the development of this policy. Any questions about this policy or any concerns that the policy has not been followed should be referred to them at [Email Address].

2. Before you collect any personal data as part of your work (paid or otherwise) forAnthem House Church, it’s important that you take the time to read this policy carefully and understand exactly what is required of you, as well as the organization’s responsibilities when we process data.

3. Our procedures will be in line with the requirements of this policy, but if you’re unsure about whether anything you plan to do, or are currently doing, might breach this policy you must first speak to the Data Protection [Officer/Trustee].

Training and Guidance: 

1. We will provide general training at least annually for all staff to raise awareness of their obligations and our responsibilities, as well as to outline the law.

2. We may also issue procedures, guidance or instructions from time to time. [Managers/leaders must set aside time for their team to look together at the implications for their work.]

OUR DATA PROTECTION RESPONSIBILITIES 

What personal information do we process? 

1. In the course of our work, we may collect and process information (personal data) about many different people (data subjects). This includes data we receive straight from the person it’s about, for example, where they complete forms or contact us. We may also receive information about data subjects from other sources including, for example, previous employers.

2. Weprocesspersonaldatainbothelectronicandpaperformandallthisdataisprotectedunder data protection law. The personal data we process can include information such as names and contact details, education or employment details, and visual images of people.

3. In some cases, we hold types of information that are called “special categories” of data in the GDPR. This personal data can only be processed under strict conditions.

4. We will hold information relating to criminal proceedings or offenses or allegations of offenses unless there is a clear lawful basis to process this data such as where it fulfils one of the substantial public interest conditions in relation to the safeguarding of children and individuals at risk or one of the additional conditions relating to criminal convictions set out in either Part 2 or Part 3 of Schedule 1 of the Data Protection Act 2018. This processing will only ever be carried out on the advice of the Ministries Team of the Anthem House Church contact person.

5. Otherdatamayalsobeconsidered‘sensitive’suchasbankdetails,butwillnotbesubjecttothe same legal protection as the types of data listed above.

Making sure processing is fair and lawful: 

1. Processing of personal data will only be fair and lawful when the purpose of the processing meets a legal basis, as listed below, and when the processing is transparent. This means we will provide people with an explanation of how and why we process their personal data at the point we collect data from them, as well as when we collect data about them from other sources. 

How can we legally use personal data? 

1. Processing of personal data is only lawful if at least one of these legal conditions, as listed in Article 6 of the GDPR, is met: 

• The processing is necessary for a contract with the data subject

• The processing is necessary for us to comply with a legal obligation

• The processing is necessary to protect someone’s life (this is called “vital interests”)

• The processing is necessary for us to preform a task in the public interest, and the task
  has a clear basis in law

• The processing is necessary for legitimate interests pursued by Anthem House Church
  or another organization, unless these are overridden by the interests, rights and freedoms of the data subject.

f. If none of the other legal conditions apply, the processing will only be lawful if the data subject has given their clear consent. 

How can we legally use ‘special categories’ of data? 

1. Processing of ‘special categories’ of personal data is only lawful when, in addition to the conditions above, one of the extra conditions, as listed in Article 9 of the GDPR, is met. These conditions include where: 

   • The processing is necessary for carrying out our obligations under employment and social security and social protection law

   • Theprocessingisnecessaryforsafeguardingthevitalinterests(inemergency,lifeor death situations) of an individual and the data subject is incapable of giving consent

   • The processing is carried out in the course of our legitimate activities and only relates
     to our members or persons we are in regular contact with in connection with our purposes

   • The processing is necessary for pursuing legal claims

   • If none of the other legal conditions apply, the processing will only be lawful if the data
     subject has given their explicit consent

1. Before deciding which condition should be relied upon, we may refer to the original text of the
   GDPR as well as any relevant guidance, and seek legal advice as required.

What must we tell individuals before we use their data? 

1. Ifpersonaldataiscollecteddirectlyfromtheindividual,wewillinformthem[inwriting]about;our identity/contact details [and those of the Data Protection [Officer/Trustee], the reasons for processing, and the legal bases, [including explaining any automated decision making or profiling], explaining out legitimate interests, and explaining where relevant, who we will share the data with. This information is commonly referred to as a ‘Privacy Notice’. This information will be given at the time when the personal data is collected.

2. Ifdataiscollectedfromanothersource,ratherthandirectlyfromthedatasubject,wewillprovide the data subject with the information described in the section above as well as the categories of the data concerned; and the source of the data. 

This information will be provided to the individual in writing and no later than within one month after we receive the data, unless a legal exemption under the GDPR applies. If we use the data to communicate with the data subject, we will at the latest give them this information at the time of the first communication. 

If we plan to pass the data onto someone else outside of Anthem House Church, we will give the data subject this information before we pass on the data. 

When we need consent to process data: 

1. Where none of the other legal conditions apply to the processing, and we’re required to get consent from the data subject, we will clearly set out what we’re asking consent for, including whey we’re collecting the data and how we plan to use it. Consent will be specific to each process we’re requesting consent for and we will only ask for consent when the data subject has a real choice whether or not to provide us with their data.

2. Consent can however be withdrawn at any time and if withdrawn, the processing will stop. Data subjects will be informed of their right to withdraw consent and it will be as easy to withdraw consent as it is to give consent.