The Church of Scotland is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice O'Sullivan, who can be contacted by emailing: Privacy@churchofscotland.org.uk

The purpose of processing the personal data we have is to enable the Commission of Assembly appointed by the 2023 General Assembly of the Church of Scotland to meet both in person and by video-conference in order to attend to urgent matters affecting the interests of the Church.

Your personal data will not be used for any other purpose without your permission, except in the context of fulfilling a legal obligation to which The Church of Scotland is subject.

The data subjects are our members, office-bearers, trustees and staff of the Church of Scotland.

• From the information you supplied as a Commissioner to the General Assembly of 2023 we have your: surname, first name, middle initial, email address, postal address, congregation and designation as a minister, deacon or elder. If you gave any information as to accessibility or other needs then we may have that information also. In addition, we may hold your date of birth and qualifications/decorations. We will use this information for the purpose of enabling you to join and participate in the meeting.
• During the meeting itself we will record your questions, chat comments and oral and written contributions.
  If the meeting uses a poll or voting form your voting preference will be recorded but will be known only to the meeting organiser and will not be shared with anyone else.
• If you join the meeting by telephone, your telephone number will be recorded (only where used). If you speak as part of the meeting, your webcam image and your voice will be recorded.
• This meeting will be recorded so that a record can be kept for accountability and archiving purposes. The video part of the meeting will also be streamed live on the internet for others to view.

The lawful basis for processing the personal data is UK GDPR Article 6(1)(e) "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller." The Church of Scotland Act 1921 provides for the official authority vested in the General Assembly of the Church of Scotland as data controller.

For the processing of special category data (sensitive personal data) the lawful basis is UK GDPR Article 9(2)(d) "processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects"

Your personal data is shared with our contracted data processors Sanctus Media and Oscus Media, both of whom will process your data according to instructions agreed by The Church of Scotland.

Your personal data will not be used for any other purpose or shared with any other third party unless doing so is necessary in order to comply with a legal obligation or in order to protect your vital interests or those of another data subject.

Your personal data will be not transferred outside the European Economic Area (EEA).

The meeting itself will be recorded as a record of the process under the control of the Principal Clerk. This recording will only reference you as an individual if you take part in the debate or chat. The recording will not be published but it will be retained for accountability and archiving purposes.

Under data protection law, individuals have a number of rights. These are detailed on the Church of Scotland website privacy centre.

Not all rights apply and it depends on the lawful basis as to what rights apply. For this purpose the lawful basis is public task. This means that all the rights apply except for the right to erasure and the right to data portability. If you wish to exercise any of your rights, please email the DPO at Privacy@churchofscotland.org.uk