Privacy and Data Protection

Last updated: 12 October 2026. Next scheduled review: October 2027.

This notice explains how All Nations Community Church, Leeds (ANCC) handles personal information in its church activities and on this website. It also sets out the data-handling procedures required of people acting for ANCC. It should be read alongside our Safeguarding Policy and Procedures and Cookies Policy.

Quick links: Contact us · Information and purposes · Sensitive information · Your rights · Complaints · Security and incidents

1. Who is responsible and how to contact us

All Nations Community Church, Leeds is responsible for deciding how personal information is used for its own church activities. In data-protection law, this is the role of the data controller. ANCC leadership is responsible for ensuring that this policy is implemented and that requests reach an appropriate person.

• Email: info@allnationscc.org, marked “Data protection request”.
• Post: Data Protection, All Nations Community Church, First Floor, Albion House, 24 Roundhay Road, Leeds LS7 1BT.
• Telephone: 07903 888378 (Edgar), to request a private conversation or help making a request.

The general church inbox is not a dedicated safeguarding or confidential counselling service. Please initially provide only the contact details and brief information needed to arrange a suitable private channel. Do not send identity documents, detailed health information or allegations through a general website form unless an authorised person has arranged an appropriate method. These channels are not emergency services. Call 999 if someone is in immediate danger.

2. Information we use and why

The information relevant to you depends on your contact with ANCC. We must collect only what is necessary for a stated purpose, explain new uses before they begin where required, and correct inaccurate information. The following describes the purposes and types of information covered by this policy; it does not mean that every category is collected about every person.

• Enquiries and planning a visit: your name, email or other contact details, message, and any gathering or date you choose to provide, so that we can respond and help you attend.
• Church activities and pastoral support: contact and participation details, communication preferences, and information you choose to share when requesting support. Pastoral notes must be limited to what is necessary and must not become a record of speculation or unnecessary personal detail.
• Children and activities requiring additional support: relevant parent or carer details, emergency contacts, collection permissions, attendance and necessary accessibility or health information, where an activity needs these to operate safely.
• Safeguarding: concerns, factual incident records, referrals, relevant communications and decisions needed to protect people and handle allegations responsibly.
• People serving with ANCC: applications, role information, references, training records and checks appropriate to the role. Information about criminal offences and DBS checks requires additional legal safeguards.
• Donations and financial administration: information provided with a donation or financial transaction, and records needed to account for it and meet applicable legal requirements. A separate notice must explain any new payment service or tax-relief arrangement before information is collected for it.
• Communications and photographs: your choices about optional updates, stories, photographs or recordings, and the material you agree may be used.
• Website operation: technical information such as IP addresses, device and browser information, security logs and, depending on your choices, cookie identifiers and website usage information. These can be personal data even when they do not contain your name.

Most information comes directly from you. Where necessary, it may come from a parent or authorised representative, a referee, an activity organiser, a person raising a concern, or a relevant authority or service provider. Where information comes from elsewhere, we must provide the legally required privacy information, subject to any applicable safeguarding or other lawful exception.

3. Our lawful grounds for using information

The UK GDPR, Data Protection Act 2018 and relevant amendments, including the Data (Use and Access) Act 2025, govern our handling of personal information. The person responsible for an activity must identify and record a lawful basis before using information. Depending on the purpose, relevant grounds include:

• Legitimate interests: responding to enquiries, administering ordinary church activities and protecting our systems, where necessary and proportionate and where those interests are not overridden by your rights. The assessment must consider reasonable expectations, less intrusive alternatives and the particular interests of children.
• Consent: uses for which we ask you to make a genuine, specific and informed choice, such as optional communications or agreed publicity. Consent must be recorded and capable of being withdrawn.
• Legal obligation: keeping records or making disclosures where a specific legal requirement applies. We must identify the relevant obligation; a useful church activity is not automatically a legal obligation.
• Contract: where information is genuinely necessary to enter into or fulfil an agreement with you.
• Vital interests: where necessary to protect someone’s life in circumstances meeting the legal test, such as an emergency.

Different purposes may require different grounds. We must not change the stated basis simply to avoid a withdrawal of consent or an objection. Sensitive information also needs a separate legal condition, as explained below.

4. Religious beliefs, health, safeguarding and other sensitive information

Information revealing religious beliefs, health, ethnicity, sexual orientation and certain other matters is special category data. Church participation or pastoral information can reveal religious beliefs, even without an explicit statement of faith. Extra care is therefore required.

Where its conditions are met, Article 9(2)(d) of the UK GDPR permits necessary processing in the legitimate activities of a religious not-for-profit body, with appropriate safeguards, relating to members, former members or people in regular contact in connection with its purposes. This is not a blanket permission to use information about every website visitor. It does not permit disclosure outside the body without consent under that condition; any other disclosure needs a separately identified lawful route.

Other conditions may include explicit consent for an optional use, or a relevant substantial-public-interest condition under UK law for safeguarding where its requirements are met. An appropriate policy document must be maintained where the law requires it. Criminal-offence information is subject to Article 10 and the relevant UK legal conditions, rather than being treated as ordinary contact information.

Privacy must not prevent necessary and lawful action to protect a child or adult. Information may need to be shared with social care, police or another appropriate authority without consent where a valid legal basis and any additional condition apply. The reason, recipient, information disclosed and decision must be recorded. Only relevant information should be shared, through a suitable secure route.

5. Your choices: updates, prayer, photographs and children

Our policy is to ask for your choice before adding you to optional church updates or using identifiable material for publicity. Attending worship, submitting an enquiry or asking for support is not agreement to receive marketing. You can withdraw your choice by contacting us or using an unsubscribe facility where one is provided. Necessary replies and activity-specific messages are separate from optional publicity.

Private prayer requests, pastoral matters and contact details must not be placed in public prayer lists, group messages, social media or testimonies without appropriate permission or another specifically justified lawful basis. Before joining a messaging group, you should be told whether other participants can see your number or profile.

For identifiable photographs or recordings, the intended use and audience must be explained. Children’s understanding and wishes must be considered alongside appropriate parental or carer involvement. People must have a reasonable way to avoid publicity. A later withdrawal can stop future ANCC use where consent is the basis, although independently shared or already distributed material may not always be recoverable.

Information about children must be explained in language they can understand and limited to what is needed. A parent’s access to a child’s records is not automatic in every situation: the child’s rights, understanding, best interests and any safeguarding implications must be considered.

6. Who may receive information

Access must be limited to authorised people who need the information for their role. Relevant information may be shared with:

• Church leaders, safeguarding personnel and authorised activity organisers on a need-to-know basis.
• Providers supporting website hosting, IT, communications or administration, under appropriate contractual and confidentiality arrangements where they act as processors.
• Social care, police, emergency services or other competent authorities when necessary and lawful.
• Professional advisers, insurers or legal representatives where needed for a relevant matter and supported by a lawful basis.

Our policy prohibits selling personal information or making church contact lists available for unrelated third-party marketing. Sharing with another organisation must have a defined purpose, appropriate legal grounds and suitable safeguards. A request from an authority must be checked; information must not be disclosed merely because someone asks for it.

7. Websites, cookies and international transfers

Our website uses cookie-choice controls and is configured to support Google Analytics. Analytics can involve online identifiers and information about website use. Our policy is to require a valid choice before optional analytics or advertising storage is enabled. Essential functions, security and remembering your cookie choice are treated separately. See the Cookies Policy for further information and ways to manage your choices.

Opening external links or using third-party content can involve a separate provider receiving technical information and applying its own privacy terms. Please consider those terms before sharing information. Our website policies do not govern another organisation’s website.

Providers may process information outside the UK. Before making a restricted international transfer, ANCC must check that an applicable adequacy arrangement or another lawful transfer mechanism is in place, such as appropriate contractual safeguards, with the required assessment and supplementary measures where necessary. We do not promise that all website information stays in the UK. You may contact us for information about safeguards relevant to your data.

8. How long information is kept

Information must not be kept indefinitely “just in case”. Retention depends on its purpose, sensitivity, legal requirements, any live concern or claim, and whether the purpose can be met without identifying anyone. ANCC leadership must maintain a record-specific retention schedule, assign responsibility for reviews and document any justified exception.

• Routine enquiries: retain for the response and a justified follow-up period, then delete or anonymise when no ongoing purpose remains.
• Participation and contact records: review when involvement ends or details change; remove information no longer needed while keeping only justified continuing records.
• Financial records: retain for the statutory period applying to the particular record and any relevant unresolved matter.
• Safeguarding and serious incidents: apply a specifically documented retention decision informed by relevant safeguarding, legal and insurance requirements. Do not use routine enquiry deletion rules or destroy records relevant to an investigation, claim or preservation requirement.
• Recruitment and DBS information: retain only the information needed to demonstrate a suitable recruitment decision and fulfil relevant requirements; restrict access and follow current DBS handling guidance for certificate information.
• Consent and objections: keep sufficient evidence of the choice and, where needed, a minimal suppression record so that an opt-out continues to be respected.
• Technical records: review security and analytics retention against their specific purpose and provider settings, rather than retaining raw identifiers without need.

You can ask which retention period or criteria apply to your particular information. Deletion must include a suitable approach to copies and backups, subject to lawful preservation needs.

9. Your data-protection rights

Depending on the circumstances, you can ask to access your personal information, correct it, erase it, restrict its use or receive certain information in a portable format. You can object to processing based on legitimate interests and object at any time to direct marketing. Where consent is the basis, you can withdraw it without affecting the lawfulness of earlier use.

Rights are not absolute. For example, a safeguarding obligation, another person’s privacy or a legal preservation requirement may affect what can be disclosed or erased. We must explain a refusal or limitation, the reason where legally permitted, and how to challenge it.

You do not have to use a special form or legal wording. Contact us by email, telephone or post. Requests must be passed promptly to the responsible person, recorded, and answered without undue delay, normally within one calendar month. Where the law permits an extension or pause, we must explain this and meet the applicable notification requirements. We may make proportionate checks of identity or authority and seek necessary clarification. Requests are normally free; any lawful exception must be explained before a charge is made.

10. How to complain

If you are unhappy about our use of your information, contact us using the details above and mark your message “Data protection complaint”. Tell us what happened and the outcome you would like, without sending unnecessary sensitive detail. We can help you make a complaint verbally or in an accessible format.

The responsible person must acknowledge a data-protection complaint within 30 days, make appropriate enquiries, keep you informed and explain the outcome and any corrective action without undue delay. A conflict of interest must be addressed by referring the complaint to an appropriate person who was not responsible for the issue, where possible.

You may complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. See the ICO complaints service or call 0303 123 1113. You do not have to give up your regulatory or legal rights by using our complaints process.

11. Required security and breach procedures

People handling information for ANCC must use approved systems, limit access to their role, protect devices and accounts, use strong unique passwords and multi-factor authentication where available, and keep software supported and updated. Sensitive records must not be stored in public folders, circulated in open groups or left on shared devices. Paper records require secure storage and disposal. Access must be reviewed when a role changes or ends.

Before introducing a new form, service, recording arrangement or significant use of information, the responsible person must assess necessity, access, retention, supplier terms and risks. A data protection impact assessment is required where the processing is likely to result in high risk. Staff and volunteers must receive guidance appropriate to the information they handle.

1. Report immediately: anyone discovering loss, unauthorised access, misdirected correspondence or another suspected breach must alert the responsible church leader promptly, preserve evidence and avoid further disclosure.
2. Contain and assess: restrict the exposure where safe, establish what happened, what information and people are affected, and the likely consequences. Involve appropriate technical or professional support.
3. Notify where required: report a breach to the ICO without undue delay and, where feasible, within 72 hours of awareness where it is likely to risk people’s rights and freedoms. Explain any delay. Where a breach is likely to result in high risk, tell affected people without undue delay unless a legal exception applies.
4. Record and improve: document every personal-data breach, including the assessment, notification decision, remedial action and lessons, even where notification is not required.

If you believe ANCC information has been exposed, use the contact details above, say it is urgent and request a private response. Do not forward sensitive material widely to demonstrate the problem.

12. Accountability and changes

Leadership must maintain responsibility for data protection, processing and retention records appropriate to the church’s activities, supplier checks, consent records, requests, complaints and incidents. Important pastoral or safeguarding decisions must receive human consideration; any proposed use of automated decision-making that affects people significantly requires a separate legal assessment and appropriate explanation before use.

This notice and its implementation must be reviewed at least annually and sooner after a significant change, incident or change in law. Material new uses require appropriate notice and, where needed, a new choice. Simply continuing to browse this website does not constitute consent to every use of personal information. Please contact us for an accessible or printed copy.