Any further updates to this privacy notice will be posted here.

• "Data Protection Law" means all data protection laws and regulations applicable to the UK including (i) the UK Data Protection Act 2018; (ii) UK General Data Protection Regulation ("UK GDPR"); (iii) the Privacy & Electronic Communications Regulations 2003 ("the PECR") relating to electronic communications; (iv) In the event that the EU GDPR (as defined in the Data Protection Act 2018) applies to activities, we will comply with the EU GDPR; and applicable national implementations of (iii) and (iv).

• "The Service" means our proprietary ChurchSuite software (including where the software is made available through a CharitySuite brand), which is accessed online through a web browser, or by using our mobile applications (Apps).

• "you", or "your Organisation" means you as an individual or the organisation you belong to as you interact with ChurchSuite. More specifically we define you as a data subject, as defined within the context of Data Protection Law, under the ‘Whose data do we collect?’ section.

• "us", "we" and "our" refer to ChurchSuite Ltd. In the relationship between us as you use The Service, our marketing website, and our customer support services, ChurchSuite Ltd should be considered the Data Controller (the Service Provider) as defined within the context of General Data Protection Regulation Data Protection Law. This means we decide how your personal data is processed and for what purposes (explained below).

We collect data from a few types of individuals for different purposes:

• Our customers, who are churches, charities, businesses or individuals who are subscribed to The Service, including those temporarily trialling The Service.

• End users, those who use The Service as provided by our customers or visit our marketing website.

• Consenting users, those who have given us consent to use their data for a specific purpose (consent includes subscribing to our mailing list, engaging with us at an event, giving us a review or attending a training event, amongst others).

ChurchSuite obtains the following data for customers from third party sources (including organisation websites, social media accounts, email signatures and the Charity Commission) when you sign up for a trial of The Service:

• Your job title within the organisation

• Organisation social media accounts

• Organisation type

• Organisation ‘known by’ names and abbreviations

• Charity information

We do not collect data from third parties about end users or other individuals.

We only collect and use personal data as the law allows us to. We do so under four different lawful bases of processing which are:

• You have provided us with consent to process your data for a specific purpose.

• Necessary for the performance of a contract.

• Necessary for our compliance with legal obligations.

• Necessary due to our, or a third party’s, legitimate interest which does not contradict your rights or freedoms.

Where legitimate interest is identified as a lawful basis, we will undertake a legitimate interest assessment which is a three part test covering:

The purpose test – to identify the legitimate interest

Necessity test – to consider if the processing is necessary for the purpose identified

Balancing test – considering the individual’s interests, rights or freedoms and whether these override the legitimate interests identified.

We only use cookies that are necessary and functional to the operation of The Service and the marketing website. You can view more information in our cookie policy.

We take security very seriously and will do everything within our power to keep your information safe in accordance with our obligations under Data Protection laws. We have in place technical and organisational measures to ensure your data is secured - preventing it from being accessed in an unauthorised way, altered or disclosed.

We have policies and procedures to handle any potential security breaches and will notify data subjects, third parties and any applicable regulators where we are legally required to do so.

We will never sell, rent, distribute or otherwise make your personal information commercially available to any third party, but information may be shared as outlined under the section ‘What data does ChurchSuite share with third parties?’ and we will process it as outlined in this privacy notice.

Details on the technical measures we take to manage your data securely can be found on our security page.

When registering for a trial of The Service through our marketing website we will use automated decision making to determine whether or not to automatically approve the trial. This process takes into consideration your location, organisation website and email to determine whether or not the trial requires manual approval. This processing is done as a means to manage security risks to the service.

Your data is not used in any other automated decision making or profiling outside of this.

Unless subject to an exemption under the UK Data Protection Law, you have the following rights with respect to your personal data: -

• Access to your information: You have the right to request a copy of the personal information that we hold about you.

• Correcting your information: We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.

• Deletion of your information: You have the right to ask us to delete personal information about you where:

  • you consider that we no longer require the information for the purposes for which it was obtained or that we no longer need to retain it in accordance with our statutory obligations under UK Data Protection Law;

  • you have previously consented to us processing your data but you have now withdrawn that consent;

  • you object to the processing of your data that we are doing so under legitimate interest and there is no overriding legitimate interest to continue;

  • your data is being used for direct marketing purposes and you object to your data being used for that purpose;

  • our use of your personal information is contrary to law or our other legal obligations.

• Restricting how we may use your information: In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, when we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information but you do not want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

• Portability of your data: you have the right to transfer the personal data you have provided us to another provider or service by retrieving your data in a machine readable format.

• Withdrawing consent using your information: Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given. Please contact us in any of the ways set out in the ‘Who do you contact if you have any privacy concerns?’ section if you wish to exercise any of these rights.

• Automated decision making and profiling: we do not perform any profiling of individuals, and the only automated decision making is made when you register for a trial which is required as part of registering for The Service. Details for the automated decision making can be found under the section ‘Does ChurchSuite use any automated decision making with your data?’

• Lodging a complaint: If you feel we have used your information incorrectly or without a lawful basis, or you dispute our lawful basis, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) - details found under the section ‘Who do you contact if you have any privacy concerns?’.

If you are based within the European Union, as per Article 27 of the EU GDPR, we have appointed European Data Protection Office (EDPO) as our EU representative and you can contact them using their online request form or alternatively by writing to EDPO at Regus Block 1, Blanchardstown Corporate Park, Ballycoolen Road, Blanchardstown, Dublin D15 AKK1, Ireland.