Data Protection and Privacy Policy
1. Purpose & scope
This policy sets how Lighthouse Fellowship handles personal data in line with the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). It reflects 2025 developments (including the Data (Use and Access) Act 2025 (DUAA) commencement timetable and Information Commissioner’s Office (ICO) guidance refreshes) and covers data we process for worship, pastoral care, safeguarding, youth work, communications, events, finance/gift aid, volunteers, livestreaming and our website (including cookies and analytics).
- UK GDPR (consolidated legislation text): https://www.legislation.gov.uk/eur/2016/679
- ICO hub (UK GDPR): https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
2. Our commitment — data protection principles (Article 5 UK GDPR)
We process personal data in line with Article 5: lawfulness, fairness, transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity & confidentiality; accountability.
- Article 5 text: https://www.legislation.gov.uk/eur/2016/679/article/5
- ICO guide to principles: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/guide-to-the-uk-gdpr/key-principles/
3. Roles & responsibilities
- Trustees — legal accountability; provide resources; approve this policy; monitor risks.
- Data Protection Officer (DPO) (or Data Protection Trustee) — advises on compliance; handles rights requests and breaches; maintains Records of Processing Activities (RoPA); oversees Data Protection Impact Assessments (DPIAs).
- Operational Board / Ministry Leads — implement policy; keep data accurate; ensure volunteers follow rules.
- All workers/volunteers — complete training; follow policy; report incidents promptly.
4. What we process & why (examples)
- Members/attenders — contact details, pastoral notes, rota availability (legitimate interests/consent).
- Children & youth — consents, medical info, attendance (legitimate interests/public interest) with safeguards under P1/P10/P19.
- Safeguarding — case records, risk management (public interest/substantial public interest).
- Giving/finance — donations, Gift Aid declarations (legal obligation).
- Website & comms — subscriptions, enquiries, analytics/cookies (see P34).
- Volunteers — applications, references, Disclosure and Barring Service (DBS) outcomes, training logs.
5. Lawful bases (Article 6 UK GDPR) & special category data (Article 9)
We rely on one or more bases under Article 6 (consent, contract, legal obligation, vital interests, legitimate interests). For special category data under Article 9 (e.g., health, religious beliefs), we use explicit consent, substantial public interest (including safeguarding), or legitimate activities of a not-for-profit body with appropriate safeguards. Our Appropriate Policy Document (APD) sits in P3.1.
- ICO lawful bases: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/guide-to-the-uk-gdpr/lawful-basis-for-processing/
- ICO special category: https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/special-category-data/
6. Children’s, safeguarding & criminal-offence data
We apply heightened protection for minors and adults at risk (see P1 Safeguarding, P10 Children & Youth, P19 Safeguarding Online). Criminal offence data is processed only where permitted by DPA 2018 Schedule 1 conditions with an Appropriate Policy Document (APD) (in P3.1).
7. Transparency — Privacy Notices
We provide clear Privacy Notices at collection (forms/website) describing purposes, bases, retention, sharing, international transfers and rights. Notices are reviewed at least annually and after any material change. (We follow a clear structure similar to best-practice church notices.)
8. Direct marketing & updates — Privacy and Electronic Communications Regulations (PECR)
Electronic communications comply with PECR. For newsletters/updates we use consent or the soft opt-in (where lawful) and always include unsubscribe.
- ICO PECR overview: https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/
- ICO direct marketing: https://ico.org.uk/for-organisations/guide-to-pecr/electronic-and-telephone-marketing/
9. Cookies, analytics & consent (“prior consent” for non-essential cookies)
On our website we will:
- Obtain prior consent for non-essential cookies (e.g., analytics/advertising).
- Provide a granular banner (accept / reject / custom) and a detailed cookie list.
- Honour choices and keep a consent log.
- Keep P34 Cookies & PECR aligned to the ICO’s 2025 cookies guidance.
- ICO cookies guidance: https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/
10. International transfers
Where data leaves the UK we use an approved mechanism, e.g., United Kingdom–United States Data Bridge (UK–US Data Bridge) for certified recipients, or International Data Transfer Agreement (IDTA)/Standard Contractual Clauses (SCCs) with UK Addendum and a Transfer Risk Assessment (TRA) where needed.
- UK–US Data Bridge: https://www.gov.uk/government/publications/uk-us-data-bridge
11. Security (see P18 IT & Digital Security)
We apply multi-factor authentication (MFA) on admin accounts, least-privilege access, up-to-date devices, encryption at rest/in transit on core platforms, regular backups and restore tests, and revoke leaver access within 24 hours. No saving of church data to unmanaged personal cloud. (Technical controls in P18.)
12. Retention & disposal (see P3.1)
We keep data only as long as necessary, then securely delete or anonymise. The Retention Schedule in P3.1 sets periods and deletion methods (e.g., finance 6 years; safeguarding long-term; incident logs; consent records; media). Paper records are shredded (cross-cut or accredited service); digital data is deleted from live systems and scheduled backups per procedure.
13. Sharing & processors
We share data only where lawful and proportionate (e.g., HM Revenue & Customs (HMRC) for Gift Aid; DBS checks; statutory safeguarding partners). Any processors (e.g., email/SaaS providers) are onboarded with due diligence and written contracts covering UK GDPR and security. We maintain Records of Processing Activities (RoPA) and a vendor register.
14. Your data protection rights
Individuals can access, rectify, erase (where applicable), restrict or object to processing, and exercise data portability and consent withdrawal. We respond within one month (extendable by two months for complexity).
- Requests: techsupport@lighthousefellowship.co.uk
- ICO rights guidance: https://ico.org.uk/your-data-matters/
15. DPIAs & change management
We complete Data Protection Impact Assessments (DPIAs) for higher-risk processing (e.g., new platforms, tracking, large-scale special category data) and consult the Information Commissioner’s Office (ICO) where residual risk remains high.
- ICO DPIA guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/guide-to-the-uk-gdpr/accountability-and-governance/data-protection-impact-assessments/
16. Personal data breaches
We log all personal data breaches. If a breach risks people’s rights and freedoms, we notify the ICO within 72 hours, and, where high risk, the affected individuals without undue delay. We record the incident, our assessment, notifications and remedial action.
- ICO breach guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/guide-to-the-uk-gdpr/personal-data-breaches/
17. Governance & 2025 updates (DUAA readiness)
The Data (Use and Access) Act 2025 (DUAA) introduces staged changes to elements of data law and PECR through 2025–26. Lighthouse Fellowship will update P3/P34 as commencement regulations and ICO guidance go live. A standing agenda item will track DUAA-related actions, with changes recorded in the Version Control Table.