The Parish Buying team is committed to protecting and respecting your privacy as a Member.

This Policy relates to personal data – that is, information which relates to a living individual who can be identified from that data.

This Policy explains when and why we collect personal information about people who visit our website, how we use it, the conditions under which we may disclose it to others and how we keep it secure.

We may change this Policy from time to time so please check this page occasionally to ensure that you’re happy with any changes. By using our website, you’re agreeing to be bound by this Policy.

Any questions regarding this Policy and our privacy practices should be sent by email to [email protected] or in writing to Parish Buying, Room 2, Pencoed Technology Park, Bridgend, CF35 5HZ

Who are we?

The Parish Buying service is provided by Church of England Central Services Trading Limited (no. 8940330). The registered address is Church House, Great Smith Street, London SW1P 3AZ.

Parish Buying is a service provided by the Church for the Church[1], dedicated to making available selected contracts for products and services, together with procurement guidance, for parishes, cathedrals and other church bodies.

Many of the services provided by the Parish Buying service to Members, and in particular all customer services and support, are delivered by a company called 2Buy2.com Limited, with which we have a contract. 2Buy2.com have access to your information and will use it to provide the services to you.

How do we collect information from you?
We obtain information about you when you register as a member on our website, when you contact us about products and services, when you respond to surveys, and when you purchase products and services from suppliers.

What type of information is collected from you?
The personal information we collect will include your name, address, email address, telephone number, IP address, and information regarding what pages are accessed and when.

Why do we need your information?
Parish Buying is a service to parishes, cathedrals, dioceses and other bodies in the Church of England and Church in Wales. To access its services as a Buying Group Member, and to be entitled to its special terms and conditions for contracts, we need to confirm your eligibility to join and to remain as a Member of the Parish Buying service.

The legal bases for our processing of your personal data is:

The consent you gave upon registration with Parish Buying.
For the performance of a contract (such as a contract for electricity or gas) to which you are a party or in order to take steps at your request prior to entering into a contract
For other legitimate purposes such as the management of the service, changes to contracts with suppliers or changes in suppliers, and to draw your attention to other relevant information.
How is your information used?
Parish Buying complies with its obligations under the regulation set out in the General Data Protection Regulation 2016/679 (“GDPR”) by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

We may use your information to:
process enquiries that you have submitted;
to carry out our obligations arising from any contracts entered into by you and us;
seek your views or comments on the services we provide - we may contact you by email, phone or mail. We may use the information to customise the website according to your interests, or to make your experience easier when visiting supplier websites.
notify you of changes to the contracts and services offered to Parish Buying members.;
send you our regular members’ newsletter which may include information about our suppliers’ goods and services, guidance and advice on Parish Resourcesand new suppliers;
make easier the creation of an account with a supplier by supplying identifying information;
We review our retention periods for personal information on a regular basis. We will hold your personal information on our systems for as long as is necessary for the relevant activity. You may at any time request deletion of your personal information via the website or by contacting our Customer Service Team.
Who has access to your information?
Your information is stored on a secure server accessible only to authorised personnel.

We will not sell or rent your information to third parties. We will not share your information with third parties for marketing purposes.

Third Party Service Providers working on our behalf: We may pass your information to our third party service providers, agents subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf (for example to send you mailings or surveys). However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. Please be reassured that we will not release your information to third parties for them to use for their own direct marketing purposes.

Parish Buying Suppliers: We work closely with various third party product and service providers to make available to Members a range of products and services (e.g. the Energy Basket, Office Products, Charity and Church Software, LED lighting, Safety suppliers). When you enquire about or purchase one or more of these products, the relevant third party product provider will use your details to provide you with information and carry out their obligations arising from any contracts you have entered into with them. In some cases, they will be acting as a data controller of your information and therefore we advise you to read their Privacy Policy.  These third party product providers will share your information with us which we will use in accordance with this Privacy Policy.

Parish Buying's digital giving suppliers share donation data with the Church's National Giving Team, who pass this information onto Dioceses. This information includes the number and value of transactions by account however it does not include any personal information (such as donor details) for individual transactions. This applies to accounts held with SumUp, Stripe, Give A Little, and GWD. For further information, please see the individual privacy policies for each supplier.

Your choices
You have a choice about whether or not you wish to receive information from us. If you do not want to receive the Members’ newsletter then you have the opportunity to unsubscribe.

We will not contact you for marketing purposes by email, phone or text message unless you have given your prior consent. We will not contact you for marketing purposes by post if you have indicated that you do not wish to be contacted. You can change your marketing preferences at any time by contacting us by email: [email protected] or telephone on 0800 368 0887.

Your rights and your personal data 
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: -

The right to request a copy of your personal data which the Parish Buying holds about you;
The right to request that the Parish Buying corrects any personal data if it is found to be inaccurate or out of date;
The right to request your personal data is erased where it is no longer necessary for the Parish Buying to retain such data;
The right to withdraw your consent to the processing at any time
The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
The right to lodge a complaint with the Information Commissioners Office.
Further processing
If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

How you can access and update your information
The accuracy of your information is important to us. You can amend the information we hold about you in My Account on the website, or if you wish to change your email address, or any of the other information we hold is inaccurate or out of date, please email us at: [email protected], or write to us at: Parish Buying, Room 2, Pencoed Technology Centre, Bridgend, CF35 5HZ. Alternatively, you can telephone 0800 368 0887.

You have the right to ask for a copy of the information Parish Buying hold about you.

Security precautions in place to protect the loss, misuse or alteration of your information
When you give us personal information, we take steps to ensure that it’s treated securely. When you are on a secure page, a lock icon will appear on the bottom of web browsers such as Microsoft Internet Explorer.

Non-sensitive details (your email address etc.) are transmitted normally over the Internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk. Once we receive your information, we make our best effort to ensure its security on our systems. Where we have given (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Profiling
We may analyse your personal information to create a profile of your interests and preferences so that we can contact you with information relevant to you. We may make use of additional information about you when it is available from external sources to help us do this effectively.

Use of 'cookies'
Like many other websites, the Parish Buying website uses cookies. 'Cookies' are small pieces of information sent by an organisation to your computer and stored on your hard drive to allow that website to recognise you when you visit. For Parish Buying members, a cookie allows a Member to access member-only information such as contract details and pricing. Cookies collect statistical data about your browsing actions and patterns and do not identify you as an individual.

It is possible to switch off cookies by setting your browser preferences. For more information about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.aboutcookies.org or www.allaboutcookies.org.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This will prevent you from taking full advantage of the website and, in particular, will prevent you from accessing Member-only information.

Social media pixels
These cookies are used to track visitor activity on our website and allow us to track when visitors are accessing the website via our social media posts such as FaceBook, read more here.

LinkedIn Insight Tag
The LinkedIn Insight Tag is a cookie that allows us to produce campaign reports and unlock valuable insights about your website visitors. Read more here.

Links to other websites
Our website contains links to other websites run by other organisations. This Privacy Policy applies only to our website and to the services provided by Parish Buying‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our website.

16 or Under
We are concerned to protect the privacy of children aged 16 or under. If you are aged 16 or under‚ please get your parent/guardian's permission beforehand whenever you provide us with personal information.

Transferring your information outside of Europe
As part of the services offered to you through this website, the information which you provide to us may be transferred to countries outside the European Union (“EU”). By way of example, this will happen when using our mailings and survey providers whose servers are located in the USA. Both these organisations comply with the EU’s regulations and operate under what is called the EU-US Privacy Shield (see https://www.privacyshield.gov/Program-Overview). If we transfer your information outside of the EU in this way, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this Policy.

If you use our services while you are outside the EU, your information may be transferred outside the EU in order to provide you with those services.

Website recording
Our web site will use Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site.

Hotjar privacy statement
We use Hotjar in order to better understand our users’ needs and to optimise our website service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like etc.) and this enables us to build and maintain our service with user feedback. We will use Hotjar to record user visits to the Parish Buying website and to create heatmaps that give us information on what attracts attention on the website and where that attention falls. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices. This includes a device’s IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymised user profile. Hotjar is contractually forbidden to sell or share any of the date collected on our behalf. We will be using the tools in Hotjar for six months and cease to use the tools on 31 January 2021 when we delete the account. After we delete the account, Hotjar will start an automated deletion process. This process begins with a soft deletion which can take up to seven days, from that point a hard deletion occurs. This process takes a total of 30 days to complete.

For further details, please see the ‘about Hotjar’s section of Hotjar’s support site.

Review of this Policy
We keep this Policy under regular review. This Policy was last updated in February 2018, and if updated in the future this will be the object of a notification in the Members’ newsletter following the change. Where the update is a notification of additional personal data processing, the notification will provide a link to seek your consent for the change.

 [1] Church of England and Church in Wales