Privacy Notice
How Harvest Ayr (“the Church”) uses your information
Your privacy is important to us. We are committed to safeguarding the privacy of your information.
It is important that you read this privacy notice together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data.
Data Protection Compliance Manager
If you have questions regarding this privacy notice or would like to receive a copy of our Data Protection Policy, please contact our Data Protection Compliance Manager:
Lee Ballantine
Data Protection and the GDPR
Our legal obligations in relation to your personal data are governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
In particular, we will comply with our legal obligations to keep personal data up to date, to not collect or retain excessive amounts of personal data, and to securely store and protect personal data from loss, misuse, unauthorised access and disclosure.
The categories of information that we may collect, hold and share include:
Personal identifiers such as names, addresses, contact information, photos, and video during Sunday services
Characteristics such as gender, date of birth, marital status, family members, medical conditions, and dietary requirements
Financial information such as bank account details and donations to be able to process
Gift Aid declarations or expense reimbursements
Other information such as Disclosure Scotland certifications, church membership status, anniversaries, and service team and small group membership
How we collect your data
We receive your data through a number of channels, including:
Connection cards
Membership applications and interviews
Gift Aid declarations
Consent forms
Disclosure Scotland application forms
Donations to the church
Event sign-ups
Contact forms submitted through the website
Applications for internships and/or employment
Photos and video taken during Sunday services
Why are we collecting your data?
We collect personal data to provide appropriate pastoral care, to monitor and assess the quality of our services, to fulfil our purposes as a church and to comply with the law. In legal terms this is called ‘legitimate interests’. When it is required, we may also ask you for your consent to process your data. We do not share your information with others except as described in this notice.
The legal ground for processing the data
When we process your data, we do so in accordance with one or more of the lawful bases set out in Article 6 of the GDPR:
Consent: the individual has given clear consent for you to process their personal data for a specific purpose
Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract
Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations)
Vital interests: the processing is necessary to protect someone’s life
Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law
Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party
Who do we share your information with?
Your personal data is treated as strictly confidential. We will only share your information with third parties where it is necessary for the performance of our services or where prior consent is given. Your information may be transferred to third party service providers who store and process information on our behalf, including but not limited to: Planning Centre, Dropbox, Google, Microsoft, Volunteer Scotland, Disclosure Scotland. Before engaging third party organisations to process personal data, we will ensure that they have the necessary technical and organisational measures in place to keep your data safe.
Storing your data
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
We hold your data for varying lengths of time depending on the type of information in question but in doing so we always comply with Data Protection legislation. Details of retention periods are available in our retention policy which you can request by contacting us at [email protected].
We will contact you annually to check that the information we are holding is accurate and that you agree to us holding it.
Security of your data
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees or trustees who need to know. They will only process your personal data on our instructions.
We have put in place procedures to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so.
Requesting access to your personal data
Under Data Protection legislation, you have the right to request access to information about you that we hold. To make a request for your personal information contact [email protected].
You also have the right to:
object to processing of personal data that is likely to cause, or is causing, damage or distress;
prevent processing for the purpose of direct marketing;
object to decisions being taken by automated means;
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed;
and claim compensation for damages caused by a breach of the Data Protection regulations.
For further information on how your information is used, how we maintain the security of your information and your rights to access information we hold on you please contact [email protected].
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/
Information you provide via the website
Your privacy is important to us. By providing personal information such as your name and email address via the forms on this website, you agree to us contacting you with regard to the information you request.
Some forms on our website may also include a checkbox asking you for permission for us to add you to our mailing list. This is an opt-in mailing list and your personal information will be used solely by us.
Changes to our privacy policy
We review our data privacy policy annually. This notice was last updated on 20/05/2022.