Keep in touch with news from the parish
Your personal data - what is it?
Personal data is any information about a living individual from which they can be identified: a name, a photograph or video, an email address, a postal address. Identification may be from that information alone, or from it together with anything else we hold. The processing of personal data is governed by the Data Protection Act 2018, the UK General Data Protection Regulation, and other legislation relating to personal data and rights, including the Human Rights Act 1998.
Who we are
This notice is given to you by the Parochial Church Council (PCC) of St Mary the Virgin, Monken Hadley, which is the data controller for your data.
The Church of England is made up of several organisations and office holders who work together to deliver the Church's mission in each community. The PCC works with the incumbent of the parish, our Rector, The Rev'd Francesco Aresco; the Bishops of the Diocese of London; and the Diocesan Office, which is responsible for the financial and administrative arrangements of the Diocese of London.
Because the Church is made up of these people and organisations working together, we may need to share personal data with them so that they can carry out their responsibilities to the Church and to our community. They are joint data controllers, which means that we are each responsible to you for how we process your data. This notice is given by the PCC on our own behalf and on behalf of those other controllers. Below, we means each controller, as appropriate.
What data we process
Where it is necessary for our work, we may process some or all of the following: names, titles and aliases, and photographs; contact details such as telephone numbers, addresses and email addresses; where relevant to our mission, or where you give them to us, demographic information such as gender, age, date of birth, marital status, nationality, education and work history, qualifications, interests, family composition and dependants; and, where you make a donation or pay for something such as the hire of a hall, financial identifiers such as bank account numbers, card numbers and transaction references.
How we process it
We will keep personal data up to date, store and destroy it securely, not collect or keep more than we need, keep it secure, protect it from loss, misuse and unauthorised access or disclosure, and make sure appropriate technical measures are in place.
We use personal data for some or all of these purposes: to meet our legal and statutory obligations, including maintaining and publishing the electoral roll under the Church Representation Rules; to carry out safeguarding procedures in line with best practice, so that children and adults at risk are in safe environments; to minister to you and offer pastoral and spiritual care, such as visiting you when you are seriously ill or bereaved, and to arrange and conduct services such as baptisms, confirmations, weddings and funerals; to deliver the Church's mission in our community and carry out charitable activities for the public benefit; to administer parish, deanery, archdeaconry and diocesan membership records; to fundraise and promote the interests of the church and the charity; to keep our own accounts and records; to process donations, including Gift Aid; to seek your views; to tell you about changes to our services, events and role holders; to send you communications you have asked for, which may include appeals and fundraising; and to process a grant, or an application for a role.
Our lawful basis
Most of our processing is necessary for our legitimate interests, or those of another organisation in the Church of England; our safeguarding work is an example. We always take account of your interests, rights and freedoms. Some processing is necessary to comply with a legal obligation: we are required by the Church Representation Rules to maintain and publish the electoral roll, and by Canon Law to publish banns of marriage. We may process data where it is necessary to perform a contract with you, or to take steps towards one, as with the hire of church facilities. As a religious organisation we are also permitted to process information about your religious beliefs in order to administer membership and contact details. Where we use your information other than on one of these bases, we will ask for your consent first.
Sharing your data
Your personal data is treated as strictly confidential. We share it only where it is necessary for our work, or where you have given your consent first. We may need to share it with the appropriate bodies of the Church of England, including the other data controllers named above; our agents and contractors, for example a provider who sends our newsletter or maintains our database; other clergy or lay people licensed by the Bishops of the Diocese of London to support the Church's mission here, including our Area Dean and Archdeacon, curates, deacons, licensed and commissioned lay ministers, and those holding the Bishop's Permission; other people or organisations within the Diocese of London, including where relevant the London Diocesan Board of Education; and occasionally other churches with whom we hold joint events or activities.
How long we keep it
Some records we keep permanently, because the law requires it. Others we keep for an extended period: current best practice is to keep financial records for at least seven years to support HMRC audits. Otherwise we keep data only for as long as we need it, and delete it when we no longer do.
Your rights
You have the right to ask what information we hold about you, why we hold it, who has access to it and where we obtained it; we will respond within one month, and there is no charge for a first request, though repeated requests for the same data may attract an administrative fee. You have the right to have information corrected or completed where it is out of date, incomplete or wrong. You have the right to ask us to erase information if you believe we should no longer be using it, and we will confirm whether it has been deleted or explain why it cannot be. You have the right to object to our processing your data, and we will tell you whether we can comply or whether we have legitimate grounds to continue; even then we may keep data to comply with your other rights, or to bring or defend legal claims. You have the right to ask us to transfer some of your data to another controller, where that is feasible, within one month. You have the right to withdraw your consent at any time where processing was based on consent, by telephone, email or post. And you have the right to complain to the Information Commissioner's Office.
When you exercise any of the rights listed above, we may need to verify your identity, for your own security, before we can act.
Transfers outside the United Kingdom
Any personal data transferred to a country outside the United Kingdom will only be placed on systems giving equivalent protection, through adequacy regulations or appropriate safeguards. Our website can be reached from overseas, so on occasion some personal data, in a newsletter for example, may be accessed from abroad.
Further processing
If we wish to use your personal data for a new purpose not covered by this notice, we will give you a new notice explaining it before we begin, setting out the purposes and the conditions of processing. Where necessary, we will ask for your consent first.
Contact
If you have a question about this notice, or about the information we hold about you, or if you wish to exercise any of your rights, please write to the Data Controller, PCC Secretary, St Mary the Virgin, Hadley Green Road, Monken Hadley, Barnet EN5 5PZ, or email the PCC Secretary at tricia.wales@outlook.com
You can contact the Information Commissioner's Office on 0303 123 1113, through ico.org.uk, or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
This notice was last reviewed in October 2026.