1. Who we are and how to contact us

Living Word Church Network (LWCN) is a charity registered in England and Wales (registration number 1184540). Its registered office is Living Word Church, High street, Titchfield, Fareham, PO14 4AF

LWCN is committed to protecting the privacy and security of personal information. Relevant legislation includes the General Data Protection Regulation (Regulation (EU) 2016/679) and all other legislation governing data protection within the UK). We are registered with the Information Commissioner’s Office (ICO), the UK data-protection regulator. LWCN will be the ‘data controller’ for the purposes of data-protection laws in relation to any personal information we hold about living data subjects.

LWCN’s Data Protection Officer is:

• Mercedesz Hibberd , LWCN administrator
• Email: admin@lwcn.uk

This privacy notice explains how we collect and use information about you.

2. Purpose of this Privacy Notice

The purpose of this privacy notice is to inform our charitable mission partners (such as congregational members and visitors, guest speakers, conference and event attendees, partner/associate organisations, other 3^rd party entities), website visitors and other relevant stakeholders how we process any personal data i.e. about ‘natural’, living people. When processing personal data, LWCN adheres to the overarching principles that data should be processed in a manner which is responsible, secure, proportionate, lawful, fair and transparent.

3. Data Protection Principles

This privacy notice reflects the following data protection principles as provided for by the GDPR, namely that processed personal data should be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

4. LWCN Charitable Mission

All personal data processed by LWCN will be in direct or indirect support of its charitable mission objectives. These are to advance the Christian faith, to administer and support all churches forming part of LWCN, as well as to provide support to those in need.

LWCN’s primary activities in support of its charitable mission are teaching, preaching, discipleship, training, equipping, educational, worship, pastoral care, prayer ministry, evangelism and other outreach activities, community projects, church planting, and publishing.

5. Types of personal data collected

There are two types of personal data which we may collect: general and special category data.

General personal data

Typically, we collect the following types of personal data in the course of our charitable mission activities:

• Personal details, including name and contact information.
• Professional and personal details of employees, interns, self-employed consultants, guest speakers, persons from associated organisations, including copies of any contract or agreement, and other relevant documents such as signed doctrinal statements.
• Personal details of volunteers, including copies of any agreement, and other relevant documents such as signed doctrinal statements, prayer ministry forms.
• Terms of reference and personal appraisals, for employees and relevant volunteers.
• Personal details of members of the local community where LWCN churches are planted, to whom LWCN reaches out and/or supports.
• Financial details, including bank details, pensions, payroll, credit card payment, charitable giving details.
• IT and security details, such as device details, user activity details and user preferences, browser history details.
• Location details, including your geographical location which may be relevant to our charitable mission.
• Details of all contracts and agreements with 3^rd parties, including any goods and services provided/received.

Special categories of personal data

Normally we do not collect special categories of personal data (formerly known as ‘sensitive data’). Examples of special category data include information about an individual’s: race; ethnic origin; politics; religion; trade union membership; genetics; biometrics; health; sexual orientation, or unspent criminal convictions.

• When we do need to process this kind of personal data, it will be done with the explicit consent of the individual or based on the very strict criteria outlined by Article 9 GDPR.
• Examples of such personal data that we may obtain include:
• Personal identification documents that may reveal race or ethnic origin, and possibly biometric data of private individuals or applicants.
• Adverse information about potential or existing employees, interns or volunteers that may reveal criminal convictions or offences information. We may need to hold details of any unspent criminal convictions (governed by the rules of their respective jurisdiction where imposed) for so long as they remain unspent.
• Trade-union membership.
• Other data provided to us in the course of our charitable mission.
• Normally we do not intentionally process information regarding minors other than to meet our legal obligations, such as in relation to safeguarding.

6. How personal data is collected

Personal data may be collected directly or indirectly.

Directly

There are a number of ways in which we may directly obtain personal data from individuals in the course of our charitable mission dealings. This includes through establishing a charitable mission relationship which may involve entering into a contractual or volunteer agreement relationship for the performance of various activities in support of the charitable mission, completing our online forms, subscribing to our newsletters and any other website-based subscription services we may set up from time to time, registering for and attending any meetings or events that we organise, applying for vacancies or other opportunities.

Indirectly

There are a number of ways in which we may obtain other personal data indirectly about individuals. Such data may come from a variety of sources such as in the course of recruitment, charitable mission activities, be publicly available or provided to us by others.

• Associated entities and third party organisations — Our charitable missional activities may involve the performance of services with associated entities and other third party organisations which involve sharing personal data they control as part of that engagement. Our activities may also include processing personal data under the control of such entities and organisations on our hosted software applications, which may be governed by different privacy terms and policies; in this latter case, your attention will be drawn to any separate, dedicated privacy policy.

• Public open sources— Personal data may be obtained from public registers (such as the Charities Commission), news articles, open data sources, Internet searches and social media platforms (e.g. Facebook).

• Recruitment services. We may obtain personal data about candidates from an employment agency, and other parties including former employers, credit reference agencies, immigration status and criminal convictions/DBS background checks.

• Internal management/administrative systems – We may attach personal data to internal relationship management records to better understand and serve individuals or associated entities in the course of our charitable mission, satisfy a legal obligation, or pursue our legitimate interests.

7. Legal bases for processing personal data

The GDPR is not intended to prevent the processing of personal data, but to ensure that it is done lawfully, fairly and transparently, without adversely affecting the rights of the data subject. Its provisions are more extensive than those of the Data Protection Act 1998, with the GDPR placing more emphasis on accountability for and transparency about the lawful basis relied upon for data processing.

For personal data to be processed lawfully, they must be processed on the basis of one or more of the legal grounds set out in the GDPR. These specified legal bases are as follows:

• Consent: you have given clear consent for us to process your personal data for a specific purpose.
• Contract: the processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
• Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations).
• Vital interests: the processing is necessary to protect someone’s life.
• Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
• Legitimate interests: the processing is necessary (i.e. conducted in a targeted and proportionate way) for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect your personal data which overrides those legitimate interests (i.e. a balancing test has been undertaken between our legitimate interests and your interests, rights and freedoms to assess whether your interests override our legitimate interests). When this legal basis is relied upon, we are under an obligation to keep it under review.

8. Why we need to process personal data

There are a number of reasons why we may need to process personal data in the course of our charitable mission dealings as previously outlined. Typically, though not exhaustively, this will be for one or more of the following reasons:

• Providing, maintaining and enhancing LWCN’s charitable mission activities.
• Account management.
• In support of our charitable mission activities, including teaching, preaching, discipleship, training, equipping, educational, worship, pastoral care, prayer ministry, evangelism and other outreach activities, community projects, church planting, and publishing (in hard copy and digitally);
• Vendor administration, order management, and accounts payable.
• Evaluating potential employees, volunteers and suppliers.
• Direct marketing of our charitable mission activities to existing and prospective congregational members and members of local communities where LWCN churches are planted.
• Making contact or sending our invitations in relation to events (physical or virtual) that we organise, either on our own accord or on behalf of other associated entities we collaborate with.
• Communication, such as processing enquiries submitted through our online contact portal.
• Recruitment and selection of employees and volunteers who are also governed by our ‘job applicant’ privacy notice when a recruitment process is involved, or personalising online landing pages reflecting your previous interactions with us.
• External outreach activities aimed at promoting the LWCN charitable mission, such as organising networking or outreach events.
• Supporting network and system security, including of our information systems, applications and websites, or authenticating registered users to certain areas of our sites.
• Detecting and preventing fraud.
• Complying with legal and regulatory obligation, such as in relation to money laundering, terrorist, fraud and other forms of crime, child safety, tax and immigration requirements.
• Conducting web analytics.

9. How we hold your data

In order to adequately protect your personal data from loss, misuse, alteration or destruction we have put various organisational and technical policies and procedures in place. Your data is held and accessed in accordance with the overarching data protection guiding principles outlined earlier in this privacy notice (para. 4 above). Furthermore, we respect the principle of confidentiality whereby your information should only be accessed by those persons authorised to do so.

Key organisational and technical measures in place include:

• Encryption of some personal data.
• Segregation of personal data from other networks.
• Access control and user authentication.
• Employee and volunteer training on information security.
• Written information security policies and procedures.

So far as it is reasonable for us to do so, we aim not to transmit personal data via insecure means such as the Internet. Please be advised that whilst we do our best to protect the security of your personal data, we cannot ensure or guarantee its security if you transmit it to us by insecure means such as our website.

10. How long we retain personal data for

As a basic principle, we only retain personal data for as long as it is necessary. We retain personal data in support of our charitable mission objectives and activities, especially to stay in contact with you and to comply with applicable laws, regulations and professional obligations that we are subject to.

Unless a different time period is specified, e.g. under specific legislative, regulatory or contractual obligations, we will normally hold personal data for the following lengths of time:

• Personal details including name and contact information: While actively engaged with LWCN and up to six years after such engagement ceases. For volunteers, while they are volunteering with us and up to one year after volunteering ceases.
• Contractual and agreement details, including any goods and services provided: Six years following the termination of the contract or agreement date (or each individual contract or agreement date if more than one). For volunteers, while they are volunteering with us and up to one year after volunteering ceases.
• Financial details: While actively engaged personally or commercially with LWCN and up to six years after such activities cease.
• Credit card, charitable giving, payment for LWCN organised events or other activities, information and payment details: While actively engaged and up to six years after such activities cease.
• Location details: While actively engaged with LWCN and up to six years after such activities cease.
• Device details: While actively engaged with LWCN and up to six years after such activities cease.
• User activity details and user preferences: While actively engaged with LWCN and up to six years after such activities cease.
• Browser history details: While actively engaged with LWCN and up to six years after such activities cease.
• Electronic identification data including IP address and information collected through cookies: While actively engaged with LWCN and up to six years after such activities cease.
• Recruitment details: If applicant unsuccessful, then up to 6 months following the end of the related recruitment round; up to 6 years on reduced information including name, email address, brief description of areas of expertise, and why an applicant was unsuccessful (in accordance with our ‘job applicant’ privacy notice; successful applicants are covered by our separate ’employee’ privacy notice).

When the applicable time period has expired, if there are no other legitimate grounds for retaining personal data, it will be disposed of in an appropriate and secure way.

11. Sharing personal data with third parties

LWCN may disclose personal data to the following categories of recipients, some of which may be located in third countries or may be international organizations as defined in Article 4(26) of the GDPR:

• Associated entities or charitable organisations.
• Auditors and professional advisors, such as lawyers and consultants.
• Federal, state, and local law enforcement or immigration officials.
• Other governmental or regulatory agencies (such as HMRC) or other third parties as required by applicable law or regulation.
• Third-party service providers, such as providers of:
• IT system management;
• Information security;
• Communications systems;
• Marketing service providers;
• Recruitment service providers;
• Human resources management;
• Payroll administration; or
• Retirement plan administration.

In circumstances whether it is necessary or appropriate to share personal data with third parties, we will ensure that they comply with the same data protection principles that we are obligated to meet, including under the GDPR.

12. Transferring personal data outside of the European Economic Area

We store personal data on servers located in the European Economic Area (EEA) and outside of the European Economic Area (EEA). Furthermore, on occasion, such as in the performance of our charitable mission, it may be necessary for us to transfer a limited amount of personal data subject to Article 49(1) which are necessary for LWCN’s compelling legitimate interests. This will only be to reputable third-party organisations, with each such organisation being required to safeguard personal data in accordance with our contractual obligations and data protection legislation.

13. Rights of data subjects in relation to personal data we process

Whenever we process your personal data, you have a number of rights under data protection law in relation to that data which you may exercise at any time, subject to any overriding interests that e.g. we or the public may have in retaining such information. The rights are briefly explained here:

• Right of access – You may make a ‘subject access request’ at any time to find out more about the personal data which we hold on you, what we are doing with that personal data, and why.
• Right to rectification– You can ask us to correct our records if you believe they contain incorrect or incomplete information about you. Personal data is deemed to be inaccurate if it is incorrect or misleading as to any matter of fact.
• Right to erasure (so-called ‘right to be forgotten’) – You can ask us to erase (delete) your personal data after you withdraw your consent to processing or when we no longer need it for the purpose it was originally collected. Other grounds include that the personal data has been processed unlawfully, or that the personal data needs to be erased in order for us to comply with a particular legal obligation.
• Right to restriction of processing – You can ask us to restrict or suppress the processing of your personal data in certain circumstances, as an alternative to erasing it. This includes where you contest the accuracy of your personal data, or the data has been unlawfully processed but you prefer to restrict its use by us rather than our erasing it.
• Right to data portability – In certain circumstances, such as where it is technically feasible, this right allows you to obtain and reuse your personal data for your own purposes across different services. For instance, it allows you to move, copy or transfer personal data easily from one IT environment (such as LWCN’s IT systems) to another in a safe and secure way, without affecting its usability.
• Right to Object– You have the right to object to our processing of your personal data in certain circumstances, such as if we use it for direct marketing purposes. We may need to keep some minimal information to comply with your request to cease marketing to you.
• Right to Withdraw Consent – If the legal ground for us processing particular personal data of yours is consent, you may withdraw this at any time. Such withdrawal of consent, however, with not impact upon the lawfulness of any processing carried out before you exercise this right.

You may exercise these rights in writing or orally (see contact details below). Where there is any uncertainty regarding your identity, we may ask you to verify e.g. three pieces of personal information before we release any data to you.

Normally we have one calendar month in which to respond (and where appropriate also resolve) your request, acting without undue delay. In certain limited circumstances, such as where a request is complex or multiple requests are received from the same person, it may be possible to extend the time period by a further two months.

No fee is required to make a request unless your request is clearly unfounded or excessive. Depending on the circumstances, we may be unable to comply with your request based on other lawful grounds.

14. Website analytics and cookies

Our website uses cookies. These are small text files downloaded onto whatever device (computer, tablet, smartphone and so forth) you use to look at our website. Where cookies are used, a statement will be sent to your browser explaining the use of cookies.

The cookies that we use retain user preferences and provide anonymised tracking data to third party applications like Google Analytics (see further Google’s privacy site including to understand how these cookies work and are used). They help us to better understand how visitors navigate around and interact with our website (e.g., they record how many times particular pages are visited). Such information can assist us in better focusing our website content and experience to suit the preferences of our site’s users.

Significantly, none of the cookies we use collect any personal data, nor can they be used to identify you. You can set your browser preferences at any time to decline or delete cookies at any time. Additionally, you may opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout. We do not use cookies to track your behaviour once you have left our website, and the data from cookies will not be passed on to or used by other third party entities.

On occasion, postings on our website may include links to other vetted and reputable sites which are governed by their own privacy policies, cookies, website analytics and so forth over which we have no control or responsibility for. You therefore choose to select such links at your own risk.

15. Contact details

If you wish to contact us in relation to how your personal data is processed, this may be done in writing (e.g. by email or a letter) or orally. The relevant contact details are:

LWCN Data Protection Officer: Mrs Katie Savage

Email: livingwordchurches@yahoo.co.uk

Registered address: 79 Catisfield Lane, Fareham PO15 5NT, England, UK

If you have any concerns regarding how we may be processing your personal data, you may also contact the UK Information Commissioner’s Office at https://ico.org.uk/concerns/handling/.

This privacy notice is periodically reviewed as necessary.

Date of last review: January 2019