1. Introduction

This Privacy Policy explains how [COMPANY NAME] ("we", "us", "our") collects, uses, stores, and protects personal data when you use the Parish Compass platform ("Service").

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy applies to all users of the Service, including organisations and their authorised users.

2. Data Controller Information

The data controller for personal data processed through the Parish Compass platform is:

For data protection enquiries, please contact us at [DPO EMAIL] or write to the address above, marking your correspondence "Data Protection".

3. Categories of Personal Data We Collect

We collect and process the following categories of personal data:

3.1 User Account Data

• Full name
• Email address
• Profile image (optional)
• Password (stored securely using industry-standard hashing)
• Role and permissions within your organisation
• Account status and verification information

3.2 Authentication and Security Data

• Session tokens and identifiers
• Two-factor authentication (2FA) configuration
• Backup recovery codes (encrypted)
• Email verification tokens
• Password reset tokens

3.3 Technical and Device Data

• IP address
• Browser type and version (user agent)
• Device information
• Access timestamps

3.4 Organisation Data

• Organisation name and logo
• Organisation settings and preferences
• Membership information

3.5 Booking and Event Data

• Contact names, email addresses, and phone numbers
• Event titles, descriptions, and notes
• Event dates, times, and locations
• Event types (services, christenings, weddings, funerals, etc.)

3.6 Intercession Records

• Names of individuals (sick or recently departed)
• Contact person names and details
• Health-related information (categories only, e.g., "sick")

3.7 Invoice and Financial Data

• Customer contact names and email addresses
• Invoice details and line items
• Integration credentials for Xero (encrypted)

3.8 Social Media Data

• Social media account names and identifiers
• Access tokens for Facebook and Instagram (encrypted)
• Post content, images, and scheduling information
• Campaign details

3.9 Audit Logs

• User actions and activity records
• IP addresses and user agents for each action
• Timestamps of all activities
• Resource identifiers affected by actions

4. Legal Bases for Processing

Under UK GDPR Article 6, we process personal data on the following legal bases:

• Contract Performance (Article 6(1)(b)): To provide the Service to your organisation under our Terms of Service, including user authentication, feature access, and data processing.
• Legitimate Interests (Article 6(1)(f)): To maintain security (including audit logging, fraud prevention, and protection of our systems), improve the Service, and communicate with you about your account.
• Legal Obligation (Article 6(1)(c)): To comply with legal requirements, including data retention obligations, responding to lawful requests, and maintaining records.
• Consent (Article 6(1)(a)): Where required for specific processing activities, such as marketing communications (you may withdraw consent at any time).

5. How We Use Personal Data

We use personal data for the following purposes:

• Service Provision: To operate the Parish Compass platform, authenticate users, and provide the features you use.
• Security: To protect our systems, prevent unauthorised access, detect fraud, and maintain audit trails.
• Communication: To send important notices about your account, respond to enquiries, and provide support.
• Service Improvement: To analyse usage patterns (using aggregated, anonymised data) and improve the Service.
• Legal Compliance: To comply with legal obligations and respond to lawful requests from authorities.

6. Data Sharing

We do not sell your personal data to third parties. However, we may share data in the following circumstances:

6.1 Third-Party Service Integrations

When you connect third-party services, data is shared with:

• Google: Calendar event data for calendar synchronisation.
• Xero: Invoice and customer data for accounting integration.
• Meta (Facebook/Instagram): Post content and images for social media publishing.

These integrations are optional and controlled by you. Each provider processes data according to their own privacy policies.

6.2 Service Providers

We use trusted service providers who process data on our behalf:

• Cloud hosting providers (data storage and processing)
• Email service providers (transactional emails)
• Payment processors (subscription billing)

All service providers are bound by data processing agreements and are required to protect your data.

6.3 Anonymised and Aggregated Data

We may share anonymised, aggregated data that cannot identify individuals with:

• Analytics partners for service improvement
• Research institutions for academic research
• Commercial partners for industry insights

This data is fully anonymised and cannot be used to identify any individual.

6.4 Legal Requirements

We may disclose personal data if required by law, court order, or to protect our legal rights, safety, or property.

7. International Data Transfers

Your data is primarily stored and processed within the United Kingdom and European Economic Area (EEA). Where data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, including:

• Transfers to countries with UK adequacy decisions (deemed to provide adequate protection).
• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office.
• Additional technical and organisational measures where necessary.

You may request information about the safeguards in place for specific transfers by contacting us.

8. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected:

• Active Account Data: Retained for the duration of your subscription and account.
• Post-Termination: Organisation Data is retained for one (1) year after account termination to comply with legal obligations and allow for data export requests.
• Audit Logs: Retained for a minimum of 7 years for compliance and security purposes.
• Verification Tokens: Email verification (24 hours), password reset (1 hour), invitations (48 hours), 2FA codes (10 minutes).
• Backups: System backups are retained for up to 30 days and then securely deleted.

After the retention period, data is securely deleted or anonymised.

9. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access (Article 15): Request a copy of your personal data and information about how it is processed.
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Article 17): Request deletion of your personal data in certain circumstances.
• Right to Restrict Processing (Article 18): Request limitation of how we process your data in certain circumstances.
• Right to Data Portability (Article 20): Request your data in a structured, commonly used, machine- readable format.
• Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decision-Making (Article 22): We do not use automated decision-making that produces legal or similarly significant effects.

To exercise your rights, contact us at [EMAIL ADDRESS]. We will respond within one month (this may be extended by two months for complex requests). We may need to verify your identity before processing your request.

If you have provided consent for any processing, you have the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

10. Security Measures

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest.
• Secure password hashing using industry-standard algorithms.
• Two-factor authentication (2FA) available for all accounts.
• Role-based access controls and permission management.
• Regular security assessments and updates.
• Comprehensive audit logging of all user activities.
• Email verification for all new accounts.
• Secure session management with automatic expiration.

11. Cookies

The Service uses essential cookies that are necessary for the operation of the platform:

• Session Cookies: Required to maintain your authenticated session and remember your preferences.
• Security Cookies: Used to implement security features and prevent unauthorised access.

These cookies are strictly necessary for the Service to function and cannot be disabled. We do not use cookies for advertising or cross-site tracking purposes.

12. Children's Privacy

Parish Compass is a business-to-business service designed for use by organisations, not individuals. The Service is not directed at children under the age of 18, and we do not knowingly collect personal data directly from children.

Where organisations store data about children (e.g., in intercession records or event bookings), the organisation acts as the Data Controller for that data and is responsible for obtaining appropriate consent or legal basis.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will:

• Update the "Last updated" date at the top of this policy.
• Notify Account Administrators of material changes by email.
• For significant changes, provide notice through the Service before they take effect.

We encourage you to review this policy periodically.

14. Complaints

If you have concerns about how we handle your personal data, we encourage you to contact us first so we can address your concerns:

You also have the right to lodge a complaint with the UK's supervisory authority:

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: