Privacy notice

Introduction

Spirit of Life Church and the East Renfrewshire Foodbank project takes your privacy seriously. Spirit of Life Church is registered with the Information Commissioner as a controller Reference Number ZB325188 and is governed by the Data Protection Act 2018, the UK General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulations 2003 (PECR).

Who this policy applies to

Spirit of Life Church and East Renfrewshire Foodbank (a project of the Church) employees, volunteers, trustees and contractors are required to adhere to this policy which is designed to protect the personal data of data subjects - our beneficiaries, supporters, volunteers, employees and trustees.

Written data protection guidance is provided to help staff and volunteers comply with this policy and relevant data protection legislation in the document titled “understanding-your-responsibilities-for-data-protection”.

Key definitions

Data protection law applies to how we process people’s personal information. The key terms that we need to understand are:

Controller – Spirit of Life Church is the overall controller as it collects and decides how personal information will be used. The East Renfrewshire Foodbank, as a project of the Church, follows the guidance of the controller.

Principles – These are the rules that we must follow when processing personal information

Processing - This is what we do with personal information. It includes how we collect, record, store, share and use personal information

Personal information – This includes personal data and special category personal data

Personal data - This is information that can be used to identify a person. Held in computer systems, mobile devices, laptops, tablets, or in manual records such as in paper files and notebooks.

Personal data might include but is not limited to; name, address, date of birth, bank account details, interests.

It also includes opinions about a person. For example, notes on how you think someone has behaved, performed or appears

Special category personal data – this is information about a person’s health, religion, political opinion, trade union membership, race or ethnic origin, sexuality

A data subject - this is the person whose personal information is being processed. For example, a supporter, employee, volunteer, trustee

A privacy notice – this is a short notice when we collect personal information from people to inform them how their personal information will be used and to look at our privacy policy for more detail. It is displayed prominently at each of our sites.

A privacy policy – this is how we inform people about how their personal information will be used. Spirit of Life Church privacy policy is available on request electronically or as a physical copy by contacting our office, or by visiting a public gathering and requesting it. The privacy policy is available at East Renfrewshire Foodbank project sites for project users or on request as well as electronically for external partners, referral agencies and donors.

Data processor – this is an organisation that we use to process personal information on behalf of the organisation. For example, an IT service provider.

Information Commissioner’s Office (ICO) - this is the government body responsible for enforcing data protection law in the UK

Data protection principles

All staff and volunteers are responsible for complying with the principles of data protection legislation which states that personal information must be:

Collected and processed in a fair, lawful and transparent way
Used only for the reasons it was collected
Relevant and not excessive
Kept accurate and up to date, and corrected or deleted if there are mistakes
Kept for no longer than it is needed
Kept safe to protect it from being lost, stolen or used inappropriately
Processed in accordance with people’s rights

In addition, the GDPR provides rules relating to the transfer of personal data to countries outside of the UK.

Data subjects

Spirit of Life Church data subjects include: customers of East Renfrewshire Foodbank, church members, supporters, employees, volunteers, trustees and beneficiaries of its ministries or projects.

Data processing purposes

Spirit of Life Church and the East Renfrewshire Foodbank project needs to process personal information about our different data subjects to:

Process donations and gift aid claims
Process legacies and pledges
Enable supporters to fundraise for us
Enable supporters to participate in events
Manage relationships with our supporters
Provide supporters with information about us and the work that we do
Manage marketing and communication preferences of our supporters
Provide support to people who need to use the food bank
Develop case studies and stories about our beneficiaries to promote and report on the work that we do
Recruit and manage volunteers
Recruit and employ members of staff and contractors
Fulfil our legal and governance obligations

Legal basis for processing personal information

Spirit of Life Church and the East Renfrewshire Foodbank project’s legal basis for processing personal information is documented in detail in our ‘Record of Processing Activity’ which contains an inventory of all key personal data processing activities.

Personal information is processed for our legitimate interests, where appropriate with consent, and in order to meet our legal obligations.

Spirit of Life Church and the East Renfrewshire Foodbank project may process some personal information based upon our legitimate interests. This is where the processing is required to fulfil our organisational objectives, is not to the detriment of our data subjects, and will not cause them damage or distress. We undertake Legitimate Interest Assessments to balance the rights and interests of our data subjects with that of Spirit of Life Church and the East Renfrewshire Foodbank project in order to make a judgement as to whether the legitimate interest condition applies to our processing.

Responsibilities of staff and volunteers

Spirit of Life Church Data Protection Lead is also a Trustee of the church and is specifically responsible for church and membership matters and overall charity responsibility. The foodbank Data Protection Lead is a member of the foodbank’s Management Committee, dealing specifically with East Renfrewshire Foodbank data matters and is responsible to the Spirit of Life Church’s Data Protection Lead who has overall responsibility. The Spirit of Life Data Protection Lead is required to:

Provide compliance advice to volunteers / staff
Ensure that volunteers / staff receive appropriate data protection training and guidance
Ensure that Spirit of Life Church and East Renfrewshire Foodbank’s data protection policies and documents are appropriate and up to date
Be the focal point for the administration of any subject access requests
Deal with data subject rights in relation to erasure, objection, restriction and rectification that volunteers / staff feel unable to manage themselves
Log and assess all personal data breaches
Report applicable data breaches to the ICO within the statutory 72-hour time limit
Renew, and ensure that East Renfrewshire Foodbank’s controller registration with the ICO is accurate annually. How do I ensure this happens??
Keep a central register of all organisations that Spirit of Life Church or East Renfrewshire Foodbank project shares personal information with.
Maintain and update the organisation’s Records of Processing Activity, Privacy Notices, and any associated data protection assessments (e.g., DPIAs or LIAs).
Advise staff on the interpretation of this policy and guidelines and to monitor compliance with the policy.

All staff and volunteers are responsible for:

Working in compliance with the data protection principles as set out in this policy and Spirit of Life Church’s data protection guidance as set out in the document titled ‘understanding-your-responsibilities-for-data-protection’
Ensuring that any personal information that they provide to Spirit of Life Church or through the East Renfrewshire Foodbank project in connection with their employment, volunteering or other contraction agreement is accurate
Informing Spirit of Life Church or the East Renfrewshire Foodbank project Data Leads of any personal data breach which they become aware of immediately
Responding to any data subject requests to erase, access, correct or object to the personal information held and processed by Spirit of Life Church or by the East Renfrewshire Foodbank project.

Data subject rights

Spirit of Life Church and all related projects respects the rights of its data subjects including:

To be informed – we do this by including appropriate privacy notice information when collecting personal information
Subject access - the right to view their personal information which we hold
Object and / or withdraw consent - where the processing of personal data could cause them significant damage or distress.
Rectification - we must correct any inaccurate or incomplete personal Spirit of Life Church or East Renfrewshire Foodbank project information when asked
Erasure - deletion or the removal of their personal information where there is no compelling reason for its continued processing

See Spirit of Life Church data protection guidance set out in ‘understanding-your-responsibilities-for-data-protection’ for information on how to respond to data subject rights.

Data security

It is the responsibility of all staff, contractors and volunteers authorised to access personal data processed by Spirit of Life Church directly, or through the East Renfrewshire Foodbank project to ensure that data, whether held electronically or manually, is kept securely and not disclosed unlawfully, in accordance with this Policy and any associated policies. Unauthorised disclosure will usually be treated as a disciplinary matter and could be considered as constituting gross misconduct in some cases.

Policy awareness

Data protection awareness will be included as part of induction. Changes to policy on data protection policy or guidance will be circulated to all volunteers, staff and contractors. All volunteers, staff and contractors are expected to be familiar with and comply with the policy at all times.

Redress

Anyone who considers that this policy has not been followed in respect of personal data about themselves should raise the matter with the relevant Data Protection Lead.

Status of this policy

This policy does not form part of the formal contract of employment, but it is a condition of employment that employees will abide by the rules and polices made by Spirit of Life Church or any associated project from time to time.

Compliance is the responsibility of all staff and volunteers. Any breach of this policy may lead to disciplinary action being taken, or even a criminal prosecution.

Any questions or concerns about the interpretation or operation of this policy should be taken up with the relevant Data Protection Lead, Kenneth Trench.