Temple Church London

Data Protection and Privacy Policy

Version 1.0  |  September 2025

Temple Church London uses personal data about living individuals for the purpose of general church administration, pastoral care, and communication. We recognise the importance of the correct and lawful treatment of personal data and are committed to handling all information about you with care, integrity, and respect.

All personal data, whether held on paper, on computer, or in any other medium, will be subject to the appropriate legal safeguards as specified in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. All team and volunteers who obtain, handle, process, transport, or store personal data on behalf of Temple Church London must adhere to these requirements.

The Principles
UK GDPR requires that personal data shall:

1.  Be processed lawfully, fairly, and in a transparent manner in relation to the data subject.

2.  Be collected for specified, explicit, and legitimate purposes and not processed in any manner incompatible with those purposes.

3.  Be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

4.  Be accurate and, where necessary, kept up to date.

5.  Not be kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data is processed.

6.  Be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

7.  Not be transferred to a country or territory outside the UK unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects.

1.  How We Collect Data and Information About You
We collect personal information each time you are in contact with us. For example, when you:

• Visit our website.
• Register your details or your family’s details via our church management system or an embedded form on our website or social media.
• Make a donation, by completion of offering envelopes, text, via our website, or by electronic means.
• Register for a conference, course, or other church event.
• Provide your contact details, in writing or verbally, to church staff or volunteers.
• Attend church services, small groups (Tables), children’s or youth ministry sessions, or participate in other church activities.
• Complete a children’s or youth ministry registration form or parental consent form.
• Communicate with the church by email, letter, or telephone.
• Meet face to face with staff or volunteers for pastoral care or ministry purposes.
• Access our social media platforms such as YouTube, Instagram, Facebook, or WhatsApp.

2.  Maintaining Confidentiality
Temple Church London will treat all your personal information as private and confidential. We will not disclose any data about you to anyone other than relevant church staff, ministry leaders, and volunteers, and only to the extent necessary to facilitate the administration and day-to-day ministry of the church. All staff and volunteers who have access to personal data will be required to read, sign, and adhere to this Data Protection and Privacy Policy.

There are four exceptional circumstances where disclosure is permitted by law:
1.  Where we are legally compelled to do so.

2.  Where there is a duty to the public to disclose.

3.  Where disclosure is required to protect your interests or the interests of others (for example, in safeguarding situations).

4.  Where disclosure is made at your request or with your explicit consent.

3.  Use of Personal Information
Temple Church London will use your personal data for the following purposes:

1. The day-to-day administration of the church, including pastoral care and oversight (calls, visits, and prayer), preparation of ministry rotas, and maintaining financial records of giving for audit and tax purposes.

2. Contacting you to keep you informed of church services, activities, resources, events, and announcements.

3. Administering children’s and youth ministry registration, safeguarding compliance, and parental consent.

4.  Coordinating and managing volunteers and their roles within the church.

5.  Processing Gift Aid declarations and donations in compliance with HMRC requirements.

6. Statistical analysis to gain a better understanding of our congregation’s demographics, in order to serve our community more effectively. Any collated data passed to a third party (such as group attendance figures) will be anonymised and contain no personal data. 

Sensitive personal information, such as health information or records relating to attendance at church activities, may be collected and stored where necessary for pastoral, safeguarding, or administrative purposes. This information will be kept strictly confidential and will never be sold, given away, or shared with any third party without your consent, except where required by law.

4.  Our Church Management System
Personal data is held on a secure, password-protected church management system. The following controls are in place:

1. Access to the system is strictly controlled through individually assigned passwords, selected by each user.

2.  Users only have access to the areas of the system relevant to their specific role. Access levels are set and managed by the Data Protection Lead and nominated administrators.

3.  Those with authorised access to the system include: Church Trustees, paid staff, the Data Protection Lead, ministry and department heads, and small group (Tables) leaders, as appropriate to their role.

4.  All access and activity on the system is logged and can be reviewed by the Data Protection Lead.

5.  Where data is held on third-party platforms (such as email or communication tools), Temple Church London will ensure appropriate data processing agreements are in place and that UK GDPR standards are met.

5.  How We Protect Your Data
Temple Church London takes the security of your personal data seriously. We have put in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These include:

• Ensuring that personal data held in paper or electronic format is stored securely and is not accessible to unauthorised individuals.
• Requiring all team and volunteers handling personal data to be familiar with this policy and to handle data in accordance with it.
• Ensuring computer screens are locked when unattended and that printouts containing personal data are stored securely and shredded when no longer needed.
• Avoiding the transmission of sensitive personal information by email unless encrypted.
• Verifying the identity of any person requesting personal data before it is released, particularly over the telephone.
• Maintaining secure back-up copies of key data to protect against loss or destruction. 

6.  Sharing Your Personal Data
We do not sell your personal information to any organisation or individual. Your personal data will only be shared in the following circumstances:

• With Temple Church London staff, ministry leaders, and volunteers, to the extent necessary for the operation of the church and its ministries.
• With trusted third-party service providers who assist us in fulfilling the purposes described in this policy, such as communication platforms (e.g. email tools). By providing us with your details, you give permission for your data to be transferred to such providers for this purpose only.
• Where required by law, or where disclosure is necessary to protect the interests of an individual (for example, in safeguarding situations).
• With your explicit consent, in any other circumstances.

We will never share your personal data with organisations outside Temple Church London for marketing or commercial purposes.

7.  Legal Basis for Processing
The legal basis for Temple Church London processing your personal data falls under Article 6 of the UK GDPR. Processing is lawful where at least one of the following applies:

• You have given consent to the processing of your personal data for one or more specific purposes.
• Processing is necessary for the performance of a contract, or to take steps at your request before entering into a contract.
• Processing is necessary for compliance with a legal obligation (e.g. Gift Aid, DBS checks, employment law).
• Processing is necessary for the purposes of legitimate interests pursued by Temple Church London, except where such interests are overridden by your rights and freedoms.

Where we process special category data (such as health information shared for pastoral purposes, or safeguarding records), we rely on the additional conditions in Article 9 of the UK GDPR, including explicit consent or substantial public interest.

8.  How Long We Keep Your Personal Data
We keep your personal data only for as long as is reasonably necessary for the purposes for which it was collected. Our retention guidelines are as follows:

• Congregation member records are kept for as long as you are an active member or attendee of Temple Church London. You may request removal of your records at any time.
• Staff employment records, including contact details and appraisals, are retained for a minimum of 5 years following the end of employment. Financial  records relating to employees are kept for 3 years in accordance with HMRC requirements.
• Financial and Gift Aid records are retained for a minimum of 6 years from the end of the financial year to which they relate, in line with charity law and HMRC guidance.
• All records relating to individuals who have worked with children or young people, including DBS certificates and safeguarding records, are kept indefinitely in line with safeguarding best practice.
• Pastoral care notes and prayer requests are held only for as long as they are necessary and relevant, and are treated with strict confidentiality throughout.

9.  Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:

• The right to request a copy of the personal data Temple Church London holds about you (Subject Access Request).
• The right to request that inaccurate or out-of-date personal data is corrected.
• The right to request that your personal data is erased where it is no longer necessary for us to retain it.
• The right to withdraw your consent to processing at any time, where processing is based on consent.
• The right to request that processing is restricted where there is a dispute about its accuracy or lawfulness.
• The right to object to processing carried out on the basis of legitimate interests.
• The right to lodge a complaint with the Information Commissioner’s Office (ICO).

Temple Church London aims to respond to all Subject Access Requests within 30 days of receipt. If there is good reason for a delay, the reason will be communicated to you in writing.

10.  Transfer of Data Outside the UK
Where personal data is processed using third-party platforms that operate outside the UK, Temple Church London will ensure that appropriate safeguards are in place in accordance with UK GDPR. This may include reliance on adequacy decisions, standard contractual clauses, or other approved transfer mechanisms. Details of specific platforms and their data transfer arrangements are available from the Data Protection Lead on request.

11.  Further Processing
If Temple Church London wishes to use your personal data for a new purpose not covered by this policy, we will provide you with a clear notice explaining the new use prior to commencing that processing. Where necessary, we will seek your prior consent before any new processing begins. 

12.  Contact and How to Exercise Your Rights
To exercise any of your rights, or to raise a query or complaint, please contact our Data Protection Lead in the first instance:

Temple Church London
Email: hello@templechurch.london

You can also contact the Information Commissioner’s Office (ICO) directly:
Telephone: 0303 123 1113
Website: https://ico.org.uk/global/contact-us/
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Policy Understanding and Acceptance
By accepting, I confirm that I have read and understood Temple Church London’s Data Protection and Privacy Policy and acknowledge how my personal data may be collected, used, and protected.