When you provide us with personal data (see glossary) we keep a record of it in order to

-comply with our statutory obligations

Under the General Data Protection Regulation (GDPR), the diocese, through its trustees is a data controller (see glossary) in respect of your personal data.

Everyone has rights about how their personal data is managed, and the diocese is committed to ensuring that this is properly and securely managed in accordance with the relevant data protection laws, and recognises this plays an important part in establishing and maintaining trust and confidence between the diocese and those with whom it interacts. This notice explains how we use and protect personal data, and what your rights are in relation to this. (It only applies to information about living persons.)

We may hold the following types of personal data and also special categories of personal data - (see glossary)

-name and contact details

Your personal data may be processed in a number of ways, for example

-to communicate with you about news, activities and events

Any information gathered through cookies and similar technologies via the diocesan (or any parish) website is used only to analyse information about website visits to enable us to improve website functionality.

We must always have a lawful basis for processing your information. This varies according to circumstances but typical examples include

-the processing is within our legitimate interests eg advancing and maintaining the Roman Catholic religion, providing information about the diocese and its parishes, raising charitable funds

In addition processing special categories of personal data requires a further lawful basis, which may include

-as a Roman Catholic diocese working with and supporting our current and former parishioners (provided the information is not shared outside the diocese other than with your consent)

If we process any personal data comprising criminal convictions or offences, we must also have a further lawful basis for processing, which may include

-as part of the diocese’s legitimate activities as a charitable body with religious aims (eg carrying out pastoral activities)

We may share your information with departments within the Catholic Church (referred to as an ‘ecclesiastical body enjoying canonical jurisdiction or powers of governance’).

We may share your information with government bodies for tax purposes (including gift aid) or law enforcement agencies for the prevention and detection of crime.

Sometimes the diocese works with third parties, whom we ask to process personal data on our behalf (eg IT consultants, distributors of publications). We require these third parties to comply with our instructions and with the GDPR.

We have established robust administrative, technical and physical measures to guard against and minimise the risk of loss, misuse, unauthorised processing, or disclosure of the personal data that we hold.

In the course of processing or disclosing your personal data, it may be transferred to other countries, some of which may not have laws providing the same level of data protection. In such cases we will take steps to ensure that your personal data is appropriately protected (including using the most secure method for the transmission of information, and where appropriate password-protection).

Your information will be kept in accordance with our retention policy, copies of which are available from the diocesan office. We aim to keep personal data only as long as is necessary, and then to delete it.

You have rights in respect of personal data provided to us, and these include the right to

-request a copy of some or all of the personal data that we hold about you, and this is free of charge

For any of the above, please send your request to the diocesan office (address under ‘contact details’ below).

In some circumstances the above rights may be limited eg when we have a legal requirement to process your personal data.

Rights about your personal data can only be exercised by you or with your express permission. You may need to provide us with proof of identity. Children from 12 years upwards are entitled to make their own requests if the diocese considers they have an appropriate understanding of the request they are making.

We may make changes to this notice from time to time as our organisational practices and/or applicable laws change. We will not make any use of your personal information that is inconsistent with the original purpose(s) for which it was collected or obtained (or as is permitted by data protection laws) without notifying you in advance if possible.

If you have any questions, require any further information, or wish to exercise any of the above rights; or if you would like to provide feedback or make a complaint please contact;

Data Protection Officer

We hope that our response will be satisfactory to you - however if you have unresolved concerns you also have the right to complain to the Information Commissioner at www.ico.org.uk.

Data controller means a person, organisation or body that determines the purposes for which, and the manner in which, any personal data is processed. They are responsible for complying with data protection laws including the GDPR and establishing practices and policies in line with them.  

A data processor is responsible for processing personal data on behalf of a controller.

Personal data means any information relating to a living individual who can be directly or indirectly identified from that information or in conjunction with other information. It can be factual (eg name, date of birth) or an opinion (eg a performance appraisal).

A data subject is a living individual who can be identified through their personal data.

Processing is any activity that involves obtaining, recording or using personal data.

Special categories of personal data (previously known as sensitive personal data) include information about a person’s racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health or condition, or sexuality. It includes genetic and biometric data.

Privacy Notice v1.3 - September 2021