Data Processing Terms

1. What we process

• Subject matter and purpose: hosting and operating Pastoral Hellos so the community can record and coordinate pastoral care.
• Duration: while the community uses the service, plus the deletion period in section 9.
• People concerned: people receiving pastoral care, and the community's pastoral givers and admins.
• Types of data: names, contact details, notes, tags, records of contact (“hellos”), wellbeing scores and follow-ups. Notes may include special category data, such as health information or details that reveal religious belief.
• Nature of processing: storing, organising, displaying, reporting on, exporting and deleting that data as the community directs through the app.

2. Instructions

We process the community's personal data only on its documented instructions. These are these terms, and the community's use of the app's features and settings. The exception is where the law requires otherwise, and then we will tell the community unless the law forbids it. We will tell the community if we think an instruction breaks data protection law.

We do not use community data for our own purposes. We do not sell it, use it for marketing, or combine it across communities. We do use per-community activity totals (counts, not content) to run and support the service.

3. Confidentiality and our access

Only people who need access to run the service can reach community data, and they are bound by confidentiality. Our administrators can see each community's name, its admins' contact details and activity totals. They can only open a community's care records if they are added to it as a member, which the community's admins can see. They do so only when the community asks for support or the law requires it. People maintaining the database may come across data, but only while keeping the service running.

4. Security

We take appropriate technical and organisational measures, including:

• encryption in transit (HTTPS) and at rest by our hosting providers;
• invite-only access, passwordless sign-in (Google, one-time email links or passkeys), and separation between communities;
• role-based access within a community: admins, pastoral givers, and per-person visibility limits;
• an audit trail of sensitive actions such as edits, deletions and exports, visible to the community's admins;
• regular software updates, automated checks on code changes, and backups.

5. Sub-processors

The community gives general authorisation for us to use these sub-processors. Each is bound by data protection terms at least as protective as these:

We will give the community's admins at least 30 days' notice before adding or replacing a sub-processor. If the community reasonably objects, we will discuss it. If we can't resolve the objection, the community may leave and have its data returned. We remain responsible for our sub-processors.

If a community admin connects their own tools, such as an AI assistant or BI tool, through the app's analytics connection, that tool is the community's choice and acts for the community, not for us.

6. International transfers

Some sub-processors handle data outside the UK. We only allow this under UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the ICO's International Data Transfer Addendum, with appropriate safeguards.

7. Helping the community

The app lets admins view, correct, export (in full or for one person) and delete records themselves, so the community can answer people's rights requests. If we receive a request directly about a community's records, we will pass it to that community and not answer it ourselves. We will give reasonable help with security, breach notifications, data protection impact assessments and any consultation with the ICO.

8. Personal data breaches

If we become aware of a breach affecting a community's data, we will tell its admins and data protection contact without undue delay, aiming for within 48 hours. We will include what we know about what happened, the data and people affected, the likely consequences and what we are doing about it. We will keep them updated. The community decides whether to notify the ICO and the people affected.

9. When the community leaves

Admins can export all of the community's data at any time from the Data protection page. When the arrangement ends, we will keep the data for 30 days so the community can export it, unless it asks us to delete sooner. We will then delete it permanently. Backups roll off within a further [30] days. We keep nothing unless the law requires it.

10. Audits and information

We will provide the information reasonably needed to show we meet these terms. We will also allow and contribute to reasonable audits, normally by answering written questions, at a mutually agreed time.

11. Contact

Contact us about these terms or a data protection matter at parishoffice@easthorsleychurch.org.uk. We contact a community through its admins and the data protection contact it sets on the Data protection page.