Privacy notice

Last updated: 24 July 2026

St Mary’s Church, Whitkirk is a community of people. We need to use personal information to run the church, communicate with people, provide pastoral care, organise worship and events, and carry out our charitable work.

This privacy notice explains what information we use, why we use it, and the choices and rights you have.

We try to keep this notice as clear and straightforward as possible. If something here is unclear, please ask us.

Who we are

The organisation responsible for your personal information is The Parochial Church Council of the Ecclesiastical Parish of St Mary, Whitkirk — usually referred to as the PCC.

The PCC is a registered charity, charity number 1130280.

In this notice, “we”, “us” and “our” means the PCC.

You can contact our Data Protection Officer about privacy and data protection at:

Data Protection Officer
Email: [email protected]

Postal address:
The Parish Office
390 Selby Road
Leeds LS15 0AA
United Kingdom

The information we use

Depending on how you interact with St Mary’s, we may use different kinds of information about you. This may include, but is not limited to:

  • Identity and contact information, such as your name, address, email address and telephone number;
  • Information about your relationship with the church, such as your involvement in church activities, groups, services, volunteering or other responsibilities;
  • Information relating to church services and activities, including information needed to organise and administer worship, events, baptisms, weddings, funerals and other activities;
  • Financial and administrative information, such as information relating to donations, Gift Aid, payments and the electoral roll;
  • Information you provide to us, including information contained in enquiries, correspondence, applications and other communications;
  • Sensitive information, including information relating to pastoral care, safeguarding, health or other circumstances where this is relevant to the work of the church;
  • Images and recordings, including photographs, video and audio recordings made at services and events;
  • Information about your use of our websites and online services; and
  • Security information, such as CCTV footage.

We do not collect all of this information about everyone. What we use depends on your relationship with us, the activities you take part in, and what you choose to do.

There may also be other kinds of information that we use where this is necessary for one of the purposes described in this notice and permitted by law.

Why we use personal information

We use personal information to carry out the work of St Mary’s and the PCC. This includes:

  • running and administering the church and its activities;
  • organising and administering worship and other church services, including services such as baptisms, weddings, funerals, memorial services and confirmations;
  • providing pastoral care, including pastoral support, prayer, visits and other forms of care;
  • communicating with people connected with St Mary’s and the wider community about the life and activities of the church;
  • managing donations, payments, Gift Aid and other financial matters;
  • meeting our legal, regulatory, charitable and ecclesiastical responsibilities;
  • protecting people, buildings and property, including through appropriate security measures;
  • providing and improving our websites and online services; and
  • livestreaming and recording services and events, so that people who cannot attend in person can still take part.

We may also use personal information for other purposes where this is necessary, lawful and compatible with the purposes described in this notice.

Pastoral care

St Mary’s is a Christian community, and pastoral care is an important part of our work.

People may choose to share personal information with us so that we can provide pastoral support, prayer, visits or other care.

Pastoral information can be particularly sensitive. We will only use it where there is a proper reason to do so and will limit access to people who need the information for the relevant pastoral purpose.

Where information reveals information about a living person’s health or another special category of personal data, additional legal protections apply. We will only use such information where both a lawful basis and an appropriate additional condition under data protection law apply.

We will not assume that someone else has the right to consent to the use of another person’s information simply because they are a relative, friend or otherwise concerned for them. Where someone is legally authorised to act on another person’s behalf, different rules may apply.

Live streaming, photography, video and recordings

We livestream and record some services and events so that people who cannot attend in person can still take part. This is particularly important for people who are housebound, ill, travelling, caring for others or otherwise unable to attend.

The livestreams and recordings may be made available publicly, including through online services such as YouTube.

If you attend a service or event, you may appear in footage. We try to operate cameras in a way that focuses primarily on the people leading or participating in the service rather than on members of the congregation.

If you are not taking part in the service or performing a particular role, we generally only expect you to appear in wider group shots. You may nevertheless be identifiable.

We recognise that not everyone wants to appear on camera. If you do not want to appear on camera, please tell a member of the streaming or welcome team. You do not have to explain why. They can explain the camera-free areas and help ensure that you are not filmed. In particular, there are areas of the church where our cameras cannot reach, including the pews along the south wall immediately to the right of the main door and the family corner immediately to the left of the main door.

If you approach the altar for Communion, please let a member of the team know if you need us to avoid filming you.

Further information about streaming and recording is available on our streaming and your privacy page.

CCTV

We use CCTV at parts of our premises for the safety and security of people, buildings and property, and to help prevent and investigate crime.

CCTV footage is only accessed by people who need to use it for these purposes. It may be disclosed to the police or other public authorities where this is necessary and lawful.

We normally retain CCTV footage for 30 days. Footage may be kept for longer where it is needed for a specific incident, investigation or legal purpose.

If you have questions about our use of CCTV, or want to exercise your data protection rights in relation to CCTV footage, please contact our Data Protection Officer.

Our websites and online services

When you use our websites or other online services, we may collect and process information such as:

  • information you submit through forms;
  • information contained in messages or enquiries;
  • technical information about your device and browser;
  • information about how you use the website; and
  • information needed to keep the website secure and functioning properly.

We use this information to provide and improve our online services, respond to enquiries, understand how our website is being used and protect it from abuse.

Our websites may use cookies or similar technologies. Where consent is required, we will ask for it.

Some online services are provided by other organisations. Where this happens, those organisations may process personal information on our behalf or as independent controllers in their own right.

Our lawful bases for using personal information

Data protection law requires us to have a lawful basis for using personal information, and the lawful basis we use depends on the particular purpose and circumstances. We may rely on:

Consent

Sometimes we ask you to consent to a particular use of your information.

You can withdraw consent at any time. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

Legitimate interests

We may use personal information where this is necessary for our legitimate interests, or those of another organisation, provided that those interests are not overridden by your rights and interests.

Our legitimate interests may include administering and operating St Mary’s, communicating with people connected with the church, organising worship and activities, maintaining safety and security, maintaining and improving our websites and services, and carrying out the charitable purposes of the PCC.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether the impact on people’s rights is proportionate.

Legal obligation

We may use personal information where this is necessary to comply with a legal obligation.

This may include obligations relating to:

  • legally required record-keeping around life events such as marriages or deaths;
  • financial records and Gift Aid;
  • charity administration;
  • employment;
  • safeguarding;
  • health and safety; and
  • other legal requirements.

Contract

In some circumstances, we may need to use personal information to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

Vital interests

In exceptional circumstances, we may use personal information where this is necessary to protect someone’s vital interests.

Special category data

Some information requires additional protection. This includes information such as health information and information revealing religious beliefs.

Where we use special category data, we identify both:

  1. a lawful basis under Article 6 of the UK GDPR; and
  2. an additional condition under Article 9, or another applicable legal provision.

We do not treat sensitive information casually, and we limit its use to what is necessary for the particular purpose.

Where we get information from

We usually get personal information directly from you.

We may also receive information from:

  • people acting on your behalf, where they are entitled to provide it;
  • clergy, church officers, volunteers and other people involved in the life of the church;
  • organisations involved in arranging particular church services or activities;
  • public bodies and authorities where this is lawful and necessary; and
  • publicly available sources.

Where we receive information about you from somewhere else, we will normally tell you about this and explain how we use the information, unless data protection law allows us not to do so.

Who we share information with

We do not sell personal information.

We may share information where this is necessary and lawful with:

  • people within St Mary’s who need the information to carry out their responsibilities;
  • service providers who provide systems or services to us;
  • banks, payment service providers, accounting systems and other financial service providers;
  • government departments, regulators and public authorities;
  • law enforcement agencies;
  • professional advisers;
  • safeguarding bodies; and
  • other organisations where this is necessary for a particular activity or required by law.

We only share the information that is necessary and relevant for the particular purpose.

Some organisations we use may process information outside the United Kingdom. Where this happens, we will ensure that the transfer is made in accordance with applicable data protection law.

How long we keep information

We keep personal information only for as long as we need it for the purpose for which it was collected, unless we are required to keep it for longer.

The length of time varies depending on the type of information. We consider:

  • the purpose for which we collected it;
  • whether there is an ongoing relationship with the person;
  • legal and regulatory requirements;
  • the need to establish or defend legal claims;
  • the historical or archival value of the information; and
  • the need to protect the church and other people.

Some records, such as financial, legal, safeguarding or formal church records, may need to be kept for significant periods.

If you would like to know how long we normally keep a particular type of information, please ask us.

Keeping information secure

We take reasonable and appropriate steps to protect personal information from:

  • loss;
  • misuse;
  • unauthorised access;
  • alteration; and
  • unauthorised disclosure.

Access to personal information is limited to people who need it for an appropriate purpose.

No method of transmitting or storing information is completely secure, but we take security seriously and regularly review our arrangements.

Your rights

Depending on the circumstances, you may have rights under data protection law including the right to:

  • ask for a copy of personal information we hold about you;
  • ask us to correct inaccurate or incomplete information;
  • ask us to delete information where there is no good reason for us to continue using it;
  • ask us to restrict how we use your information;
  • object to particular uses of your information;
  • ask for certain information to be transferred to you or another organisation; and
  • withdraw consent where we are relying on consent.

These rights are not all absolute, and which rights apply depends on the circumstances and the lawful basis on which we are using your information.

Your right to object

You have the right to object to processing based on our legitimate interests.

You also have an absolute right to object to the use of your personal information for direct marketing.

If you want to object to a particular use of your information, please contact us and explain what you object to.

Making a request

If you want to exercise your rights, or simply want to ask us a question about how we use your information, please contact our Data Protection Officer:

Data Protection Officer
Email: [email protected]

Postal address:
The Parish Office
390 Selby Road
Leeds LS15 0AA
United Kingdom

We may need to confirm your identity before providing information or acting on a request.

We normally respond to data protection requests without charge and within the timescale required by law.

Complaints

We hope that if you have a concern about how we use your personal information, you will contact us first so that we can try to put things right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.

You can find information about making a complaint on the ICO’s website.

Changes to this notice

We may update this privacy notice from time to time.

The date at the top of the page shows when it was last updated.

We will try to make sure that the information here remains accurate and reflects how St Mary’s actually uses personal information.

This notice was last reviewed on 24 July 2026.