Data Privacy Notice for the Parochial Church Council (“PCC”)

of St. Thomas Norbury (“Norbury Church”)

Registered Charity 1130910

This Privacy Notice is provided by the PCC of Norbury Church to explain what to expect

when we collect and process your personal information in accordance with UK data

protection legislation.

This version of our Privacy Notice applies from January 2026

What is personal data?

Personal data relates to a living individual who can be identified from that data. Data for

example can be a name, photograph, email address, bank details, posts on social

networking websites, medical information, or a computer IP address. Identification can

be by the data alone or in conjunction with any other information in the data controller’s

possession or likely to come into such possession. The processing of personal data is

governed by the General Data Protection Regulation (GDPR).

How do we process your personal data?

The PCC of Norbury Church complies with its obligations as a data controller under the

GDPR by:

● keeping personal data up to date;

● storing and destroying it securely;

● not collecting or retaining excessive amounts of data;

● protecting personal data from loss, misuse, unauthorised access and disclosure;

and

● ensuring that appropriate technical measures are in place to protect personal

data.

What personal information do we collect?

Personal data relates to a living individual who can be identified from that data.

Identification can be by the information alone or in conjunction with any other

information in the data controller’s possession or likely to come into such possession.

The processing of personal data is governed by the General Data Protection Regulation

(“GDPR”).

We collect information about you when:

● you participate in the worship and other activities of Norbury Church and its

associated organisations;

● you act in a voluntary capacity in the worship and other activities of Norbury

Church and its associated organisations;

● you make an enquiry about, or ask us to conduct, weddings, baptisms, funerals

and such other services as we may provide from time to time;

● you sign up to receive communications from or relating to specific activities of

Norbury Church and its associated organisations;

● you make an enquiry about, or make a booking to utilise our property and

facilities for your own purposes;

● you donate funds to us, or contact us about doing so;

● you apply for employment or a voluntary role with us;

● we operate CCTV to cover the buildings, grounds and property of Norbury

Church in line with our CCTV policy.

We collect only information which is necessary, relevant and adequate for the purpose

you are providing it for. Depending on why you have given us information, we may

collect some or all of the following:

● personal name(s);

● the names of individuals with parental responsibility for children whose data we

hold;

● contact details including postal address; telephone numbers and email address;

● date of birth;

● records of your participation with us including as a member or as a volunteer;

● photographs, video or audio recordings;

● the date and time you used our services;

● details of any transactions between you and us;

● educational, professional, employment and other information provided during the

course of applying for employment or to volunteer with us;

● the methods by which you wish us to contact you; and

● any information within correspondence you send to us.

In addition to information you provide to us directly, we may also collect personal data

via third parties acting on your behalf, for example:

● enquiries about funeral arrangements through your chosen funeral director

● information provided via the Diocese of Chester or the wider Church of England

(for example, about clergy who may be available to serve in the parish)

How do we use your personal information?

We use your personal data for the following purposes:

● to enable us to promote the whole mission of the church, pastoral, evangelistic,

social and ecumenical, for the benefit of the public in Norbury Parish;

● to administer membership records;

● to fundraise and promote the interests of Norbury Church;

● to manage our employees and volunteers;

● to maintain our own accounts and records (including the processing of gift aid

applications);

● to inform you of news, events, activities and services running at Norbury Church;

and

Our use of CCTV is covered by a separate CCTV policy, which sets out that CCTV

surveillance is used for the purposes of protecting people and our buildings, grounds

and assets from crime, anti-social behaviour and other risks such as fire.

What is our lawful basis for processing your personal information?

We need a lawful basis to collect and use your personal data under data protection law.

The law allows for six ways to process personal data. We process information on the

basis of:

● Consent. For example, so that we can keep you informed about news, events,

activities and services and keep you informed about diocesan events.

● Contractual performance. For example, we may use and process your personal

information where this is necessary to perform a contract with you such as a

booking to utilise our property and facilities for your own purposes.

● Legal obligation. For example, in relation to Gift Aid or under employment,

social security or social protection law.

● Legitimate interest. Personal data may be legally collected and used if it is

necessary for a legitimate interest of the organisation using the data, as long as

its use is fair and does not adversely impact the rights of the individual

concerned. When we use your personal information, we will always consider if it

is fair and balanced to do so, and if it is within your reasonable expectations. We

will balance your rights and our legitimate interests to ensure that we use your

personal information in ways that are not unduly intrusive or unfair. Norbury

Church’s legitimate interests include:

o Charity governance. This includes delivery of our charitable purposes,

statutory and financial reporting and other regulatory compliance purposes.

o Administration and operational management. This includes answering

enquires, giving information and services, research, events management,

administration of volunteers and employment and recruitment requirements.

o Fundraising and campaigning. This includes administering campaigns and

donations and sending direct marketing by post, sending thank you letters,

analysis, targeting and segmentation to develop communication strategies

and maintaining communication suppressions.

● Public interest. For example, the maintenance of records of marriages,

baptisms and burials.

● Vital interests. For example, sharing medical information relating to a church

member who has lost consciousness with a paramedic.

As an organisation with a number of children’s activities, Norbury Church is aware of its

particular responsibilities to children when collecting and processing their personal data.

In particular:

● when relying on consent, we make sure that young people understand what they

are consenting to, and we do not exploit any imbalance of power in the

relationship between us. For children under the age of 14 we will only accept

consent to process personal information from whoever holds parental

responsibility for the child;

● when relying on ‘necessary for the performance of a contract’, we consider the

child’s competence to understand what they are agreeing to, and to enter into a

contract; and

● when relying upon ‘legitimate interest’, we take responsibility for identifying the

risks and consequences of the processing and put age-appropriate safeguards in

place.

In addition, as a not-for-profit organisation with a religious aim, Norbury Church

processes special category data in respect of an individual’s religion on the lawful basis

that processing is carried out in the course of our legitimate activities with appropriate

safeguards on condition that the processing relates solely to the members or to former

members of Norbury Church or to persons who have regular contact with it in

connection with its purposes and that the personal data is not disclosed outside Norbury

Church without the consent of the data subjects.

How do we share this information?

Your personal data will be treated as strictly confidential and will only be shared with

other members of the church in order to carry out a service to other church members or

for purposes connected with the church. We will only share your data with third parties

outside of the parish with your consent.

How long do we keep your information for?

We seek to follow the best practice set out by the Church of England.

Specifically, our policy is to retain electoral roll data while it is still current; gift aid

declarations and associated paperwork for up to 6 years after the calendar year to

which they relate; and parish registers (baptisms, marriages, funerals) permanently.

How can you manage the information we hold about you?

You have a number of rights in relation to your personal information under data

protection law. In relation to most rights, we will ask you for information to confirm your

identity and, where applicable, to help us search for your personal information. Except

in rare cases, we will respond to you within 30 days after we have received any request

(including any identification documents requested).

You have the right to:

● ask for a copy of the information that we hold about you;

● correct and update your information;

● withdraw your consent (where we rely on it);

● object to our use of your information (where we rely on our legitimate interests to

use your personal information) provided we do not have any continuing lawful

reason to continue to use and process the information;

● erase your information (or restrict the use of it), provided we do not have any

continuing lawful reason to continue to use and process that information; and

● transfer your information in a structured data file (in a commonly used and

machine readable format), where we rely on your consent to use and process

your personal information or need to process it in connection with your contract.

To exercise all relevant rights, or for queries or complaints, please in the first instance

contact the PCC secretary:

Post: Norbury Parish Church, London Road, Hazel Grove, Stockport, SK7 4RF

Email: pcc@norburychurch.com

You can contact the Information Commissioner’s Office on 0303 123 1113 or via Contact

us - public | ICO

Data protection and personal information complaints tool | ICO