Navigation: Previous Section; Table of Contents; Next Section
The following terms are used throughout this policy and have their legal meaning as set out within the GDPR. The GDPR definitions are further explained below:
Data controller means any person, company, authority or other body who (or which) determines the means for processing personal data and the purposes for which it is processed. It does not matter if the decisions are made alone or jointly with others.
The data controller is responsible for the personal data which is processed and the way in which it is processed. We (Spurgeon Baptist Church) are the data controller of data which we process.
Data processors include any individuals or organisations, which process personal data on our behalf and on our instructions e.g. an external organisation which provides secure waste disposal for us. This definition will include the data processors’ own staff (note that staff of data processors may also be data subjects).
Data subjects include all living individuals who we hold or otherwise process personal data about. A data subject does not need to be a UK national or resident. All data subjects have legal rights in relation to their personal information. Data subjects that we are likely to hold personal data about include:
a) the people we care for and support;
b) our employees (and former employees);
c) consultants/individuals who are our contractors or employees working for them;
d) volunteers;
e) tenants;
f) trustees;
g) complainants;
h) supporters;
i) enquirers;
j) friends and family;
k) advisers and representatives of other organisations.
ICO means the Information Commissioners Office which is the UK’s regulatory body responsible for ensuring that we comply with our legal data protection duties. The ICO produces guidance on how to implement data protection law and can take regulatory action where a breach occurs.
Personal data means any information relating to a natural person (living person) who is either identified or is identifiable. A natural person must be an individual and cannot be a company or a public body. Representatives of companies or public bodies would, however, be natural persons.
Personal data is limited to information about living individuals and does not cover deceased people.
Personal data can be factual (for example, a name, address or date of birth) or it can be an opinion about that person, their actions and behaviour.
Privacy notice means the information given to data subjects which explains how we process their data and for what purposes.
Processing is very widely defined and includes any activity that involves the data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing can also include transferring personal data to third parties, listening to a recorded message (e.g. on voicemail) or viewing personal data on a screen or in a paper document which forms part of a structured filing system. Viewing of clear, moving or stills images of living individuals is also a processing activity.
Special categories of data (as identified in the GDPR) includes information about a person’s:
a) Racial or ethnic origin;
b) Political opinions;
c) Religious or similar (e.g. philosophical) beliefs;
d) Trade union membership;
e) Health (including physical and mental health, and the provision of health care services);
f) Genetic data;
g) Biometric data;
h) Sexual life and sexual orientation.
Navigation: Previous Section; Table of Contents; Next Section