Data Privacy Notice

1. Your personal data – what is it?

Personal data relates to a living individual who can be identified from that data.  Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).

2. Who are we?

The University Church data controller group comprises the Parochial Church Council of the University Church of St Mary the Virgin, St Mary's (PCC) Limited and the De Brome Trust. These bodies are the controllers and responsible for your personal data. When we mention 'the University Church', 'we', 'us', or 'our' in this privacy notice, we are referring to the relevant body in this group responsible for processing your data. The Parochial Church Council of the University Church of St Mary the Virgin is the controller and responsible for this website (contact details below). 

We have appointed a Data Protection Officer who is responsible for overusing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the Data Protection officer using the details set out below:

Mrs Sarah Ockwell,
The Administrator (Data Protection Officer),
University Church of St Mary the Virgin,
High Street,
Oxford OX1 4BJ

Email: admin@universitychurch.ox.ac.uk

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links of enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

3. The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have groups together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identified, marital status, title, date of birth and gender.
• Contact Data includes organisation's name, billing address, delivery address, email address and telephone numbers.
• Financial Data includes bank account and payment card details.
• Transaction Data induces details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operation system and platform, and other technology on the devices you use to access this website.
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our website, produces and services.
• Marketing and Communications Data induces your preferences in receiving marketing from us and our third parties and your communication preferences.
• Employment Data includes data you have given us when you have sent in your CV or applied for a position.
• Safeguarding Data includes data you have given us when you have completed a Confidential Declaration Form or submitted a DBS application.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

We do not knowingly collect, via this website, any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data).

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

4. How is your personal data collected?

We use different methods to collect data from and about you including:

• Direct interactions You may give us your Identity, Contact, Financial, Employment and Safeguarding Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you: apply for our products and services; subscribe to our newsletters or publications; volunteer your services or apply for a job; donate; request marketing to be sent to you; enter a competition, promotion or survey; or give us some feedback.
• Automated technologies or interactions This site uses cookies – small text files that are placed on your machine to help the site provide a better user experience. In general, cookies are used to retain user preferences, store information for things like shopping carts, and provide anonymised technical data to third party applications like Google Analytics. As a rule, cookies will make your browsing experience better. However, you may prefer to disable cookies on this site and on others. The most effective way to do this is to disable cookies in your browser.
• Third parties or publicly available sources We may receive personal data about you from various third parties and public sources as set out below:
  • Technical Data from analytics providers such as Google and Facebook based outside the United Kingdom;
  • Contact, Financial and Transaction Data from providers of technical, payment and delivery services such as WorldPay based outside the United Kingdom;
  • Identity and Contact Data from publicly available sources such as Companies House and the Electoral Register (records created for regulatory purposes) and directories on clergy, professionals and trades people (records created for commercial or reference purposes), all of such sources being based inside the United Kingdom.

5. How do we process your personal data?

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To enable us to provide a voluntary service for the benefit of the public in a particular geographical area as specified in our constitution;
• To enable us to perform the contract we are about to enter into or have entered into with you;
• To process and deliver your order (including payments, fees, charges, and bookings) and to collect and recover money owed to us; 
• To administer membership records;
• To fundraise and promote the interests of the University Church;
• To register you as a new volunteer, supporter, customer or contractor;
• To enable you to apply for a job;
• To maintain our own accounts and records (including the processing of gift aid applications);
• To inform you of news, events, activities and services running at the University Church;
• To comply with a legal or regulatory obligation;
• To inform you that, on your visit to the University Church, you may have come into contact with someone who has COVID-19, and to tell you what to do next; or, by sharing your data with Public Health England, to enable you to be contacted by the NHS Test and Trace Service for the same purpose. 
• To administer and protect our business and this website;
• To use data analytics to improve our website, products/services, marketing, customer relationships and experiences;
• To share your contact details with the Diocesan office so they can keep you informed about news in the diocese and events, activities and services that will be occurring in the diocese and in which you may be interested.

4. How we use your personal data

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

5. Disclosures of your personal data

Your personal data will be treated as strictly confidential and will only be shared with staff at the University Church in order to carry out a service to church members or for purposes connected with the church or St Mary's PCC Limited. We may share your data with third parties as follows: 

• We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.
• If we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets.
• If we have a legal obligation to do so or for the purposes of fraud protection and credit risk reduction.
• We may share your personal data with third party service providers who act on our behalf such as IT services providers. We require all third parties to respect the security of your personal data and to read it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. International transfers

Some of our external third parties are based outside the United Kingdom, so their processing of your personal data will involve a transfer of data outside the United Kingdom. We aim not to, but whenever we do transfer your personal data out of the United Kingdom, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• The country shall have been deemed to provide an adequate level of protection for personal data by the government of the United Kingdom.
• Where we use certain service providers, we may use specific contracts approved by the government of the United Kingdom which give personal data the same protection it has in Europe.
• Where we use providers based in the USA, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the UK and the USA.

7. How long do we keep your personal data?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

We keep parochial records in accordance with the guidance set out in the guide “Keep or Bin: Care of Your Parish Records” which is available from the Church of England website. Specifically, we retain electoral roll data while it is still current; gift aid declarations and associated paperwork for up to 6 years after the calendar year to which they relate; and parish registers (baptisms, marriages, funerals) permanently.

7. Your rights and your personal data 

Unless subject to an exemption under the GDPR or DPA 2018, you have the following rights with respect to your personal data: -

• The right to be informed about any data we hold about you;
• The right to request a copy of your personal data which we hold about you;
• The right to withdraw your consent at any time, while the University Church still has your data;
• The right to request that we correct any personal data if it is found to be inaccurate or out of date;
• The right to request your personal data is erased where it is no longer necessary for us to retain such data;
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
• The right to obtain and reuse your personal data to move, copy or transfer it from one IT system to another.

8. Complaints and queries

If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the Administrator (Data Protection Officer) at The University Church of St Mary the Virgin, High Street, Oxford OX1 4BJ or admin@universitychurch.ox.ac.uk.

If you do not feel that your complaint has been dealt with appropriately, please contact the Vicar: vicar@universitychurch.ox.ac.uk

You also have the right to lodge a complaint with the Information Commissioners Office. You can contact the Information Commissioners Office on 0303 123 1113 or online: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/ or https://ico.org.uk/global/contact-us/