This Privacy Notice applies to the Benefice of Witney, comprising the churches of St Mary the Virgin, Witney; Holy Trinity, Witney; St John the Evangelist, Hailey; Windrush Church; St John the Baptist, Curbridge; and St Kenelm, Minster Lovell.
Your Personal Data: What Is It?
Personal data is information relating to a living individual who can be identified from that information, either alone or together with other information. The handling of personal data is governed principally by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and amendments made by the Data (Use and Access) Act 2025.
Who We Are
This Privacy Notice is provided by the joint Data Controllers for the Benefice: The Parochial Church Council (PCC) of Witney, The Parochial Church Council (PCC) of Minster Lovell, and The Rector of the Benefice of Witney.
Clergy, ministers, church officers, employees and authorised volunteers may have access to personal data where this is necessary for them to carry out their role. In this notice, “we” refers to the joint Data Controllers.
How We Process Your Personal Data
We comply with data protection law by processing personal data lawfully, fairly and transparently; collecting only what is necessary; keeping it accurate and secure; and retaining it only for as long as needed.
We process data for:
- Legal obligations: fulfilling statutory duties, such as maintaining the Church Electoral Roll per Church Representation Rules.
- Pastoral care: providing spiritual support, visiting parishioners, and organizing life events (baptisms, weddings, funerals).
- Community service: advancing our mission and carrying out voluntary activities for public benefit.
- Record management: administering employee, officer, and volunteer records.
- Fundraising and promotion: supporting the interests and operational work of our churches and communities.
- Account maintenance: processing donations (including Gift Aid) and keeping accurate financial records.
- Communications: gathering views, notifying you of events, and sending requested information.
- Applications: processing grants, room hire requests, or job applications.
- Safeguarding: implementing best practice to ensure safe environments for all in line with national Church policies.
- Oxford Diocesan Board of Finance: sharing contact details when necessary for administrative and financial tasks, such as property maintenance or governance.
Legal Basis for Processing Your Data
We process personal data only where we have a lawful basis under UK GDPR. Depending on the purpose, this may be:
- Legitimate interests: where processing is necessary for the effective administration and ministry of the Benefice, provided this does not override your rights and freedoms.
- Legal obligation: where processing is required by law or Church of England rules.
- Contract: where processing is necessary to enter into or fulfil an agreement with you, for example the hire of church premises.
- Consent: where you have given consent, for example to receive general newsletters or other non essential communications.
Some information we hold may reveal religious beliefs or other special category data. Where appropriate, we process this under Article 9(2)(d) UK GDPR as a not for profit body with a religious aim. Other Article 9 conditions may apply where necessary, for example for safeguarding or legal obligations.
Sharing Your Data
Your data is confidential and shared only when necessary or with your explicit consent. Possible recipients include:
- Church personnel: clergy and lay individuals licensed by or acting on behalf of the Diocese of Oxford (such as area deans or archdeacons).
- Oxford Diocesan Board of Finance: administrative, property, and financial support teams.
- Diocesan organizations: entities such as the Oxford Diocesan Board of Education, where relevant.
- Agents and contractors: maintenance personnel, printers, architects, or IT providers acting on our behalf.
- Community organizations: for joint events organized alongside partner churches.
- Other Church bodies: where necessary for statutory safeguarding duties under national Church policies.
Special category data is handled with particular care and disclosed only where consent or another lawful basis permits it, including for safeguarding or legal obligations.
Data Retention
We keep personal data only for as long as necessary and in accordance with current Church of England records management guidance. In particular:
- Electoral Roll: retained while current.
- Gift Aid records: retained in accordance with HMRC requirements.
- Parochial registers: baptism, marriage and burial records are retained permanently where required.
Other administrative records are reviewed regularly and securely deleted or destroyed when no longer needed.
Your Rights Concerning Your Data
Depending on the circumstances, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate or outdated information;
- ask for your data to be erased or its use restricted;
- withdraw consent where processing is based on consent;
- object to processing based on legitimate interests or direct marketing;
- request data portability where applicable;
- complain to us about how your personal data has been used;
- complain to the Information Commissioner’s Office (ICO).
Some rights do not apply where we are required by law to retain or process the information.
Further Processing
If we wish to use your personal data for a new purpose, we will explain the new use before processing begins and obtain consent where required.
Contact Information
To exercise your rights, ask a question or make a complaint about how we use your personal data, please contact the Benefice Office:
Benefice Office: St Mary’s Church, Church Green, Witney, OX28 4AW
Email: office@witneyparish.org.uk
Telephone: 01993 779492
We will acknowledge a data protection complaint within 30 days and respond without undue delay.
You may also complain to the Information Commissioner’s Office (ICO) on 0303 123 1113 or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.