Version 1 26 March 2018
Malmesbury & Upper Avon Benefice is committed to delivering our obligations under the General Data Protection Regulation (GDPR)1 in the way we process, collect, record, store and dispose of personal data. This Data Privacy Notice explains what we do in relation to personal data, how to find out more and who to contact to exercise your GDPR rights.
Personal Data is information relating to an identifiable living individual. Whenever personal data is processed, collected, recorded, stored or disposed of it must be done within the terms of the GDPR.
The Malmesbury Abbey with Brokenborough and Corston & Rodbourne Parochial Church Councils (PCCs) act together as Data Controller (under the terms of GDPR), deciding how any personal data held by Malmesbury & Upper Avon Benefice is processed, collected, recorded, stored and disposed of.
Our GDPR obligations. We comply with our obligations under GDPR by keeping personal data up-to-date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
Use of personal data. We use personal data to:
Legal basis for processing personal data. Under GDPR, our bases for processing personal data are:
Sharing personal data. We treat all personal data as strictly confidential and it will only be shared with other members of the church in order to carry out a service to other church members or for purposes connected with the church. We will only share your data with third parties with your consent.
How long do we keep your personal data? We retain data in accordance with current Church of England guidance2 which dictates retention periods for, and final disposal of, parish records. Specifically, we retain Electoral Roll data while it is still current; Gift Aid declarations and associated paperwork for up to 6 years after the calendar year to which they relate; and Parish Registers (Baptisms, Marriages, Funerals) permanently.
Your rights and your personal data. Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:
Further Processing. If we wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
1General Data Protection Regulation effective 25 May 2018. For more information visit www.ico.org.uk and
2‘Keep or Bin…? The Care of Your Parish Records’ Church of England Record Centre Records Management Guide No. 1 Revised 2009 www.churchofengland.org/more/libraries-and-archives/records-management-guides
This document is also available as a downloadable PDF.