Draft pending review by the PCC. Details shown in [BRACKETS] are still to be confirmed. This is not legal advice.
For community admins. Your community is the data controller for the people you record in Pastoral Hellos. You need to tell them how you use their information. Adapt the wording below, fill in each [highlighted] part, and publish it on your own website. Then link it from the Data protection page so your pastoral givers can find it too.
The wording assumes your community is a not-for-profit organisation, such as a charity, voluntary group, community association or faith group. If you already have a privacy notice, you may only need to add the “Pastoral care records” section to it. Umbrella bodies often publish their own guidance too: for example, Church of England parishes can use the Parish Resources GDPR templates, and charities can use the ICO's guidance for small organisations. This is not legal advice.
Pastoral care: how we use your information
[COMMUNITY NAME, e.g. Anytown Community Trust] (“we”) is the data controller for the information described here. Contact [NAME / ROLE] at [EMAIL] or [ADDRESS].
Pastoral care records
To care well for members of our community, our pastoral team keeps a simple record of the people they support. This includes your name, any contact details you have given us, short notes, and a log of when someone from the team was in touch. The log can include a brief note of how you seemed and whether a follow-up is needed.
Some notes may touch on your health or wellbeing. [IF YOUR COMMUNITY HAS A RELIGIOUS, PHILOSOPHICAL OR POLITICAL AIM: Because of what our community is, being on our records may also suggest your beliefs.] This is “special category” data, and we take particular care with it. We record only what helps us care for you.
Why we use it and our lawful basis
We use this information only to coordinate pastoral care: to make sure nobody is overlooked and to follow up when support is needed. Our lawful basis is legitimate interests: caring for the people in our community, in ways you would reasonably expect.
For special category data we rely on Article 9(2)(d) UK GDPR: processing by a not-for-profit body with a [RELIGIOUS / PHILOSOPHICAL / POLITICAL / TRADE UNION] aim, about its members or people in regular contact with it. This information is not shared outside our community without your consent.
[ARTICLE 9(2)(d) ONLY COVERS NOT-FOR-PROFIT BODIES WITH ONE OF THE AIMS ABOVE, AND ONLY FOR MEMBERS, FORMER MEMBERS OR REGULAR CONTACTS. IF THAT DOES NOT FIT YOUR COMMUNITY (FOR EXAMPLE, A GENERAL COMMUNITY OR WELLBEING CHARITY), REPLACE THE PARAGRAPH ABOVE WITH: “For information about your health, we ask for your explicit consent (Article 9(2)(a) UK GDPR), and you can withdraw it at any time.” AND RECORD THAT CONSENT]
Who can see it
Only members of our pastoral team that we have authorised can see these records. Some team members can only see the people they look after. We do not sell your information or use it for marketing.
We keep these records in Pastoral Hellos, an online service run for us by The Parochial Church Council of St Martin's Church, East Horsley as our data processor. They store the records securely and only use them to provide the service to us. They use hosting, database and email providers, some of which are based in the USA, under approved safeguards.
How long we keep it
We keep your record while you are receiving pastoral support. When that ends, we archive it, and we delete it after [RETENTION PERIOD, e.g. 2 years], or sooner if you ask.
Your rights
You can ask to see the information we hold about you, and to have it corrected or deleted. You can also object to us keeping it, or ask us to restrict how we use it. Where we rely on your consent, you can withdraw it at any time. Contact [EMAIL]. We will reply within one month.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Platform privacy noticeTerms of ServiceData Processing TermsModel community notice