Church of Scotland Faith Action is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice O'Sullivan, who can be contacted by emailing: Privacy@churchofscotland.org.uk

Church of Scotland Learning is a collaborative community platform to encourage and help members in their learning. This is done through the platform, allowing access to materials and, where appropriate, small community groupings.

We also use this information for the following purposes:

• send relevant notifications when any new downloadable resources are added to the site.
• respond to any communications or comments which you send us
• monitor or analyse the Church of Scotland Community usage.

When you become a member of our community, you will set up a member profile. We will only ask for your name and email address; no other personal data is necessary. At this point you can make your membership invisible to other members to protect your privacy.

Individuals may opt to join Church of Scotland Learning by filling their name and email address in on an online form. These details generate an invitation email to join Church of Scotland Learning. Individuals can then set up their profile details on the platform. Guidance will be available to individuals as to setting up their profile. It is recommended that the minimum data is entered, e.g. name and email address. There is guidance available to you to make your profile invisible from others on the platform

The lawful basis for processing is UK GDPR Article 6(1)(b) "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract."

Despite the platform being specific for Church of Scotland Learning, special category religious beliefs are not collected and processed, therefore it is not necessary to have the UK GDPR Article 9 lawful basis for processing.

The Church of Scotland Learning platform is hosted by Circle Co Inc. This is a US based company and is a processor of Church personal data. As a processor it will only process your data on the Church's explicit instructions. There is appropriate contractual documentation in place.

Your membership details will not be shared with any other part of the Church of Scotland. The site administrators of the platform will be the only staff within the Church who can view membership details.

Circle Co Inc and the sub-processors it uses are all based in the United States of America. Therefore, there are data transfers which occur outside the UK to a third country. There are appropriate safeguards in place including the contractual requirements for international data transfers, there is also appropriate security measures in place to protect the data when it is transferred to Circle and its sub-processors.

The platform holds the profile data for ninety days once an individual is no longer a member of the Church. However, individuals can request directly to Church of Scotland Learning and their profile data will be deleted that day. With both the data is destroyed following secure Church procedures.

The Church does not process data in this way

Individuals have a number of rights under data protection laws. These are detailed here. Not all rights are absolute and some only apply in relation to the lawful basis for processing the data. For this purpose, the only right that does not apply is the Right to Object. All other rights apply. If you want to exercise any of your rights please contact the DPO at Privacy@churchofscotland.org.uk