The processing of personal data is governed by the Data Protection Act 2017 the General Data Protection Regulation 2016/679 the “GDPR” and other legislation relating to personal data and rights such as the Human Rights Act 1998.
 
What this privacy notice covers
The Christian Healing Mission (CHM) is strongly committed to protecting personal data and being transparent about why and how we collect and use it.  We may use the personal data provided to us for any of the purposes described in this Privacy Notice or as otherwise stated at the point of collection. 
 
Who we are
CHM is the data controller for your data. We are a registered charity (number 1080534) and a company limited by guarantee in England and Wales (number 3877993). Our registered office is: International House, 142 Cromwell Road, London SW7 4EF.
 
What data do we process? 
We will process some or all the following where necessary to perform our tasks and to provide services to you and others:

• Your name and contact details (such as telephone number, address and email)

• Brief healing details if you ask us to pray for you

• Appropriate financial details if you make donations or pay for products or events.

 
How do we process your personal data?
CHM will comply with its legal obligations to keep personal data up to date; to store and destroy it securely; to avoid collecting or retaining excessive amounts of data; to protect it from loss, misuse, unauthorised access and disclosure; and to ensure that appropriate technical measures are in place to protect personal data.
 
We use your personal data for some or all of the following purposes:

• To keep you up to date with what CHM is doing and send you information and resources you have requested (this may include information about training, events, services, appeals and other activities)

• To enable us to meet all legal and statutory obligations, including safeguarding

• To maintain our own accounts and records

• To process a payment or donation that you have made (including Gift Aid)

• To keep records of your relationship with us eg events attended

 
What is the legal basis for processing your personal data?
Your data is processed because it is necessary for our legitimate interests. We will always consider your interests, rights and freedoms.
 
Some of our processing is necessary for compliance with a legal obligation, for example, we are required by HMRC to keep Gift Aid records.
 
We may also process data if it is necessary for the performance of a contract with you, or to take steps to enter into a contract. An example of this would be processing your data in connection with the purchase of resources.
 
Sharing your personal data
Your personal data will be treated as strictly confidential. We will never sell it to any other organisation. It will only be shared with third parties where it is necessary for the performance of our tasks, where you first give us your prior consent or where we have a legal obligation to do so. We may need to share your data with our agents and contractors, for example, we may ask a commercial provider to send out newsletters on our behalf, or to maintain our database software.
 
How long do we keep your personal data?
We will endeavour to keep data only for as long as we need it. This means that we will delete it when it is no longer needed. We will keep some records permanently if we are legally required to do so and may keep some other records for an extended period to follow best practice. For example, it is currently best practice to keep employment records for 50 years and financial records for a minimum of 7 years, to support HMRC audits.
 
Your rights and your personal data
You have the right to access, correct, have erased, and object to processing your personal data. You can make any changes easily by contacting CHM by telephone, email or post.
 
When exercising any of your rights, we may need to verify your identity for your security. Once we have received your request, we will respond as soon as possible. For the right to access there are no fees or charges for the first request but additional requests for the same data may be subject to an administrative fee.
 
We will confirm whether the data has been deleted or processing has stopped, or the reason why this cannot be done (for example because we need it for our legitimate interests or regulatory purpose(s)).
.
Transfer of Data Abroad
Any electronic personal data transferred to countries or territories outside the EU will only be placed on systems complying with measures giving equivalent protection of personal rights either through international agreements or contracts approved by the European Union.
 
Further processing
If we wish to use your personal data for a new purpose, not covered by this Notice, then we will contact you to seek your prior consent to the new processing.
 
Contact Details
If you have any questions about this Privacy Notice or the information we hold about you, or if you wish to update personal data submitted to us or to exercise all relevant rights, queries or complaints please contact us.

Should you feel it necessary, you have the right to lodge a complaint with the Information Commissioner’s Office on 0303 123 1113, or via email https://ico.org.uk/global/contact-us/email/, or at the Information Commissioner's Office (Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF).