Privacy Policy
- Published
- Questions about this policy
- [email protected]
This notice explains how the Parish of South Lafford and the Benefice of Billingborough, together the Wellsprings Group, use your personal data.
Your personal data and who we are
Personal data is any information that identifies you, such as your name, address, email address, phone number or a photograph. Processing means anything we do with it: collecting, storing, using, sharing or deleting it. We follow the UK GDPR and the Data Protection Act 2018.
The data controllers are:
The Parochial Church Council (PCC) of the Parish of South Lafford, [address]
The PCC of each parish in the Benefice of Billingborough, [list parishes and addresses]
Each PCC is a separate controller for the personal data of its own parish. Where the Wellsprings Group shares a website, mailing list or events, the PCCs act together as joint controllers, and this notice covers that shared use. The incumbent or priest-in-charge, Revd. Rebecca Rock, may hold some pastoral records separately and acts as their own controller for those.
The Wellsprings Group is part of the Church of England, Diocese of Lincoln. The Diocese has its own privacy notice for data it holds.
What we process, why, and our lawful basis
We process personal data only where the law allows. Most of what we hold falls under these purposes:
Purpose | Typical data | Lawful basis |
|---|---|---|
Keeping the electoral roll and running PCC meetings | Name, address, dates of eligibility | Legal obligation (Church Representation Rules) |
Pastoral care and church life: services, groups, rotas, newsletters | Name, contact details, role or group | Legitimate interests of the church; consent for anything beyond that |
Baptism, marriage and funeral records and registers | Names, addresses, dates, family details | Legal obligation; public task of the Church of England |
Gift Aid claims and giving records | Name, address, gift amounts | Legal obligation (HMRC); contract or consent for regular giving |
Safeguarding, DBS checks and safer recruitment | Identity, contact and check details | Legal obligation; public interest; substantial public interest for special category data |
Hall and venue bookings | Name, contact details, booking details | Contract |
Volunteers and staff | Contact details, references, payroll data | Contract; legal obligation |
Website enquiries and mailing lists | Name, email, message content | Consent or legitimate interests |
Photographs and recordings of services and events | Images, voices | Consent, or legitimate interests for general congregation views (with notices displayed) |
Some of this is special category data, because information that someone attends a church can reveal religious belief. We process it as a not-for-profit religious body for members and those in regular contact with us, and we do not share it outside the church without consent.
Where we rely on consent, you can withdraw it at any time by contacting us. Withdrawing consent does not affect processing done before that.
Sharing, retention and transfers outside the UK
We never sell your data. We share it only where needed, with:
The Diocese, the Archdeacon and the Church of England national bodies, for statutory returns, safeguarding and church administration
HMRC, for Gift Aid
Our clergy, churchwardens, PCC members and volunteers, on a need-to-know basis
Service providers who process data for us under contract, such as our website host, email and database providers, and payroll provider
The police, courts or regulators, where the law requires it
We keep data no longer than needed. We follow the Church of England's Keep or Bin guidance, which sets these typical periods:
Record | How long we keep it |
|---|---|
Baptism, marriage and burial registers | Permanently, as legal records |
Electoral roll | Until you leave the roll; superseded rolls per the guidance |
Gift Aid records | 6 years after the end of the tax year |
Safeguarding records | As set out in the national safeguarding guidance, often long term |
Mailing lists and rotas | Until you ask us to stop, or you are no longer in contact |
Email enquiries | 18 months |
We aim to keep your data within the UK. Some providers, such as Google Workspace, may process data outside the UK. Where they do, we rely on UK-approved safeguards such as the UK Data Bridge or standard contractual clauses.
Your rights, and how to contact us or complain
You have the right to:
Be informed about how we use your data, which this notice does
Access the personal data we hold about you
Correct data that is wrong or incomplete
Erase your data, though this does not apply to legal records such as registers
Restrict how we use your data in some cases
Object to processing based on legitimate interests, and to direct marketing
Data portability, where we process it by automated means on the basis of consent or contract
Withdraw consent at any time
To use any of these rights, contact us at [email address] or [postal address]. We will reply within one month, and we will not charge a fee unless a request is clearly unfounded or excessive. We may need to check your identity first.
We may update this notice from time to time. Where a change matters to you, we will tell you directly.
If you are unhappy with how we have used your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Website: analytics, cookies and forms
Our website measures visits using Cloudflare Web Analytics, a privacy-focused service that does not use cookies, does not track you across sites and does not build profiles of individual visitors. If we add anything that sets non-essential cookies, such as embedded video or maps, we will ask for your consent first and update this notice.
When you send us a message through a website form, we use your name, email address and message only to reply to you. We keep it for the period in the table above. Our website is hosted by Cloudflare and Google, which processes data on our behalf.
Other websites we link to, including the Church of England and the Diocese, have their own privacy notices.