Privacy Policy

Introduction
This Privacy Policy explains how St Luke’s Parochial Trust collects, uses, stores and protects your personal data in line with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act 2025 (DUAA). It reflects strengthened DUAA transparency obligations.

Information We Collect
We collect personal data you provide, data generated by your use of our services, and limited information from third parties where lawful.
We collect:
• Information provided to us (e.g., name, contact details)
• Information from the use our services (e.g., bookings, class usage)
• Identifiable images of service users, staff and visitors (still photographs, video and CCTV) whilst accessing our premises and using our services.

How We Use Your Data
We use your data to provide services, administer memberships, manage donations, analyse website usage, improve services, comply with legal duties, and communicate with you. DUAA transparency and reuse provisions are applied where relevant.

Legal Bases for Processing
We process personal data under consent, contractual necessity, legal obligation, legitimate interests, and where applicable recognised legitimate interests under DUAA.

Email Marketing and Soft Opt-in
DUAA extends the soft opt-in for charities. We may send electronic marketing to supporters who expressed interest or provided support, provided clear opt-out options are offered.

Cookies and Tracking
Certain cookies may be set without consent under DUAA where they are strictly necessary, functional or statistical. Our cookie notice explains categories used and your controls.

Your Rights
You have rights of access, rectification, erasure, restriction, objection (including to marketing), portability, and withdrawal of consent. SAR responses follow DUAA’s reasonable and proportionate search standard. To exercise any of these rights, please contact us using the details below.

Automated Decision-Making
If used, we provide safeguards including explanations, the right to human review, and routes to challenge decisions, in line with DUAA. Currently, St Luke’s does not use automated decision-making.

Data Protection Complaints Process
DUAA requires organisations to offer a complaints process before contacting the Information Commission’s Office. You may complain to us via email or post. We will respond promptly and explain next steps including escalation rights.

Data Sharing
We share data only with trusted processors, service providers, legal authorities or where required by law. Third parties must protect your information.

Data Retention
We retain data only as long as necessary for its purpose, legal requirements or organisational needs.

International Transfers
Where data is transferred outside the UK/EEA, it is protected by adequacy decisions or appropriate safeguards. Currently, St Luke’s do not transfer data outside of the UK.

Contact Us
St Luke’s Parochial Trust, 90 Central Street, London EC1V 8AJ. Email: [email protected]  Phone: 020 7549 8181.