This page describes how we handle your personal data. Because we do so, we're a Data Controller and you are a Data Subject. 

Who are we?
We are ‘The Church in Upper Rissington Valuing Everyone’. 

What is personal data?
It’s data that can be associated with a living person. This notice explains how we handle personal data in accordance with the General Data Protection Regulation (GDPR). 

For what purposes does Curve hold personal data?
• To enable us to fulfil our charitable aims for the benefit of the public
• To administer membership records
• To fundraise and promote the interests of Curve
• To manage our employees and volunteers

• To enable us to perform appropriate safeguarding activities
• To maintain our own accounts and records (including the processing of gift aid applications)
• To inform you of news, events, activities and services running at Curve and in other local churches

What is the legal basis for processing personal data?
• Explicit consent of the data subject so that we can keep you informed about news, events, activities and services
• Processing is necessary for carrying out legal obligations in relation to Gift Aid or under employment, social security or social protection law
• Processing is carried out by a not-for-profit body with a religious aim provided: the processing relates only to members or former members (or those who have regular contact with it in connection with those purposes) and there is no disclosure to a third party without consent

Sharing your personal data
Your personal data will be treated as strictly confidential and will only be shared with other members of the church in order to carry out a service to other church members or for purposes connected with the church. We will only share your data with third parties with your consent.

How long do we keep personal data?
We keep membership data current, and delete it when no longer needed. 
We keep employment, volunteer and safeguarding information for six years. 
We keep financial and gift aid information for six years. 

Your rights 
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:
• The right to request a copy of your personal data that Curve holds about you;
• The right to request that Curve corrects any personal data if it is found to be inaccurate or out of date;  
• The right to request your personal data is erased where it is no longer necessary to retain such data;
• The right to withdraw your consent to the processing at any time
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing
• The right to object to the processing of personal data
• The right to lodge a complaint with the Information Commissioners Office

Contact Details
To exercise all relevant rights, queries or complaints please first contact Curve at

The contact details for the Information Commissioner’s Office can be found at