Privacy Policy

Introduction

The privacy and security of the personal information you give to Christ Church Dunstable (CCD) is extremely important to us and we want to be clear and open about how and why we use this data. We want to keep you informed and for you to be confident when providing us with your personal data.

Christ Church Dunstable will never sell your personal data and will only share your data where we are legally obligated to do so, ensuring at all times that the privacy and security of your data is assured.

This policy will be updated from time to time and applies if you are a church member or attend any of the groups at Christ Church Dunstable, The Way Community Centre, or The Way Coffee House.
 

About Us

We are Christ Church Dunstable (CCD), a registered charity number 1159475.

CCD consists of:

  • The Church
  • The Way Community Centre
  • The Way Coffee House

We have full and part time Pastoral and Operational employees and volunteers working from the Church Office (Aletheia House), in our main church building, and in The Way. We have members of the church running ministry groups in each of the above locations.
 

What Information We Process

 

Website

We do not collect any personal data from our website.

We use Google Analytics for collecting statistical, anonymised data about the pages website users visit, the search terms they used to find the website and analysing the website’s performance and general user behaviour. Analytics cookies are used for this purpose without requiring your explicit consent, provided you are given clear information and a simple opt-out mechanism, in line with the Data (Use and Access) Act 2025.
 

Members

When a new member is accepted into membership we collect personal details via application forms, including full name, home address, contact details, children’s names and dates of birth, and members’ questionnaires indicating prior experience and how they can volunteer in the church.

Members’ data will be processed in the following ways:

  • Gift Aid processing (and anyone else giving via Gift Aid)
  • Informing you about events the church is running
  • Informing you about the running of the church
  • Creating the online members list directory

 

Church Visitors

Visitors to CCD can complete visitor information cards and place them in the secure Red Boxes in the church building. We only collect enough information to contact the individual: name, phone number and email address. Most data is now collected electronically directly onto our ChurchSuite database so we can collect approval to use data provided at the same time.
 

The Way Coffee House

Should a visitor to The Way Coffee House show an interest in other ministries that run in The Way, then relevant contact details and interests will be recorded so future contact can be made.
 

The Way Ministries

CCD runs a number of ministry groups such as Knit & Natter, Art, Book Club etc throughout the week. Participants of these groups will normally provide personal details (name, phone number, email address etc.) for the purposes of running the group efficiently, keeping in contact, and informing participants of the group’s plans and events. Occasionally, where relevant, information may be sent about other groups running in The Way or events being held in the church.
 

Children’s and Youth Events

CCD runs children’s and youth events including annual Holiday Bible Clubs and various weekly clubs. We will require personal data from both the parents and the children or young people to allow us to fulfil our safeguarding duties and successfully run the events. We collect names, home and email addresses, phone numbers, dates of birth and in some cases special dietary or allergy needs and any specific medical information as would be deemed sensible for looking after children and young people. Our safeguarding policy is available on our website.
 

Children and Young People

Youth groups and leaders will communicate with each other typically using a designated mobile phone that is solely for this purpose – usually on text or WhatsApp. Leaders will therefore collect and process their contact details.
 

Employees

We store data on employees as required to fulfil our employment contracts and will share data with HMRC for statutory purposes.
 

Volunteers

People serve in many capacities as volunteers leading small groups, or in the church office. We may process additional information on a volunteer as required for their task, such as DBS registration, valid driving licence and insurance for youth workers etc.
 

Contractors

We will process contact details and other relevant information to carry out business with contractors who perform work for the church.
 

Global Mission Partners

CCD supports a number of mission partners and we will hold information to keep in contact with these people. This may be about the individual or about a supporting organisation.
 

CCTV

CCD operates CCTV systems for the purposes of security, crime prevention, and the safety of those on our premises:

  • External CCTV cameras are in operation at the main church building.
  • Internal and external CCTV cameras are in operation at The Way Community Centre.

CCTV footage constitutes personal data under UK GDPR. Our lawful basis for this processing is Legitimate Interests. A Legitimate Interests Assessment (LIA) has been completed and is held on file for each system. We have assessed that the security and safety benefit to members, visitors, children, young people, volunteers, and staff outweighs the limited privacy impact of operating proportionate CCTV systems.

Key operational details:

  • Signage is displayed at all points of entry to CCTV-monitored areas, identifying CCD as the data controller and providing contact details.
  • Footage is retained for a maximum of 14 days and then automatically overwritten, unless it is required in connection with a specific incident, insurance claim, or investigation, in which case it will be retained until the matter is resolved.
  • Access to recorded footage is restricted to a small number of authorised individuals.
  • Footage is stored securely on password-protected systems.
  • No facial recognition, automated analysis, or AI-based processing is used.

If you believe you have been captured on CCTV and wish to make a Subject Access Request, please contact us at the address below. We will provide information about you where we are able to do so without prejudicing the rights of others whose images may also be recorded.
 

Other Information

We may keep a record of attendance for some events/clubs. This may be for subs or fees, or just as information to help us better serve the needs of those attending.
 

For all members, friends and visitors of the church we will use your contact information to provide any information you requested and to inform you of other forthcoming church events.
 

Lawful Reasons for Data Processing

We rely on the following lawful bases under the UK General Data Protection Regulation (UK GDPR) as updated by the Data (Use and Access) Act 2025:

  • Legitimate Interests – the primary basis for processing personal data relating to members, visitors, volunteers, contractors, mission partners, and CCTV operation.
  • Contract – employee data is processed on this basis to fulfil our employment obligations.
  • Legal Obligation – where we are required by law to process data (e.g. HMRC reporting for Gift Aid and payroll).

The Data (Use and Access) Act 2025 also introduced a new basis called Recognised Legitimate Interests (RLI), which covers certain activities such as safeguarding and crime prevention disclosures. We may rely on this basis where applicable, without the need for a separate balancing test.
 

Direct Marketing and Email Communications

As a registered charity, CCD may make use of the charitable ‘soft opt-in’ exemption introduced by the Data (Use and Access) Act 2025 (in force from 5 February 2026). This means we may send electronic marketing communications (such as emails or text messages) to individuals who have previously engaged with our charitable activities, without requiring a new explicit consent, provided:

  • The communication is solely for the purpose of furthering our charitable aims;
  • We are not promoting or selling products or services;
  • We collected your contact details in the course of your engagement with CCD;
  • Every message includes a clear and simple option to opt out.

You can opt out of receiving these communications at any time by contacting us at the address below or using the unsubscribe link in any email we send.
 

Sharing Your Data

We will never sell your data.

Your data may be passed on to relevant bodies for statutory or legal reasons, such as HMRC for employees and gift aid declarations for anyone giving to the church.

Data is shared with several data processors with which we have relevant contracts in place.
 

How We Store Your Data

 

Central Database (ChurchSuite)

All personal data is stored securely in ChurchSuite, our cloud-based church management system. This holds church members, friends and guests contact information, children’s and young people’s details, and relevant information from church events, particularly in Children’s & Youth.
 

Members’ Directory

We use the ChurchSuite mobile/web application which allows church members to view each other’s contact information. Note that only church members’ information is shared in this way; all other contact information is only available to relevant leaders and administrative staff.

Individuals have the ability to control, by means of preference settings, what contact information is visible to other members.

Security of the app is provided either by the mobile device or the application. Either the mobile device will require authentication, or the in-app PIN number security feature will be enabled. Members of the church using the app will agree to using one of these two methods to secure fellow members’ personal data. The ChurchSuite PIN or mobile device authentication must be complex.

If using ChurchSuite on a computer through a web browser, your computer must be password protected and your account not shared with non-members.
 

Data Retention

We will hold your data for differing lengths of time depending on your relationship with us, statutory and legal requirements, and the nature of the information. CCTV footage is retained for a maximum of 14 days and is then automatically overwritten, unless required in connection with a specific incident or investigation.
 

How We Secure Your Data

We take the security and safety of your data seriously and take relevant steps to ensure this is maintained. We protect your data with multiple levels of relevant security at both the network and device level.

    • All computers are kept secure using multiple levels of security including unique authentication, encryption, up-to-date antivirus and security patches.
    • Appropriate firewalling is provided at the network level.
    • Mobile devices are encrypted where they hold personal data.
    • All data in transit is encrypted.
    • Office staff (employed and volunteer) complete mandatory security and data protection training when they commence and annually thereafter.

 

 

Data Protection Complaints

We have a formal process for handling data protection complaints. If you have a concern about how we handle your personal data, please contact us in the first instance at the address below. We aim to acknowledge all complaints promptly and to resolve them within one month. For more complex matters, we may require up to two months.

If you remain dissatisfied after raising a complaint with us, you also have the right to contact the Information Commissioner’s Office (ICO).

Your Rights

Under the UK GDPR you have the right to access, correct, or request deletion of the personal data we hold about you. You can also object to how it is used or ask us to restrict processing. You also have the right to data portability where applicable.

If you would like to make a Subject Access Request (SAR) or exercise any other right, please write to us at Christ Church Dunstable, West Street, Dunstable, LU6 1SX or email privacy@christchurchdunstable.org.uk

When making a SAR, it helps if you provide:

  • The personal information you want to access
  • Where it is likely to be held
  • The date range of the information you wish to access

We will ask you to verify your identity before providing information. For simple requests we will respond within one month of confirming your identity; for more complex requests the timeframe may be extended to two months.

If you are not happy with the way we process your data, please come and talk to us using the contact information above. You also have the right to contact the Information Commissioner’s Office (ICO):

  • Helpline: 0303 123 1113
  • Website: www.ico.org.uk

 

Changes to Our Privacy Policy

We keep our privacy policy under regular review and will place any updates on our website at www.christchurchdunstable.org.uk/privacy.

This privacy policy was last updated October 2026 to reflect the Data (Use and Access) Act 2025 and to add CCTV processing information.