Privacy Policy
About this notice
This Privacy Policy explains how personal information is handled in connection with the St Mary’s Willesden website, parish enquiries and related activities. More specific privacy information may be provided when you arrange a service, join an activity or raise a safeguarding concern.
Who is responsible for your information?
Data controller: [Confirm the full legal name of the responsible parish body, including whether the PCC and/or clergy act as separate controllers for particular records.]
St Mary Willesden
Neasden Lane, London, NW10 2TS
Privacy enquiries: info@stmarywillesden.org
Information we may receive
Depending on how you contact or engage with us, information may include your name, email address, telephone number, postal address and the content of your enquiry. Requests about services or parish activities may include relevant family details, dates and arrangements.
Website systems may process technical information such as IP addresses, browser details and security logs. The exact information collected depends on the website configuration and its service providers.
Some information may reveal religious beliefs, health matters or other sensitive circumstances. Safeguarding information can also include allegations or information about criminal offences. Please provide only what is relevant to your enquiry.
How information reaches us
Information may come directly from you through the contact form, email, telephone, letters or conversations. Where relevant, it may also come from a parent or guardian, a funeral director, diocesan personnel or another person involved in an arrangement or safeguarding matter.
Where information is obtained from someone else, we will provide the relevant privacy information as required, unless a lawful exception applies.
Why information is used
Relevant information may be used to answer enquiries; discuss and administer services and activities; maintain required parish records; respond to safeguarding concerns; protect website systems; and meet applicable legal obligations.
If you request optional updates, the purpose and choices should be explained when you subscribe. Providing contact details for an enquiry does not by itself amount to permission for unrelated marketing.
Lawful grounds for processing
[Before publication, confirm the lawful basis for each activity and remove any basis that does not apply.]
Routine enquiries: legitimate interests in responding to requests and administering parish communications, where appropriate and balanced against your rights.
Contractual arrangements: steps requested before a contract or performance of a contract, where the particular arrangement is contractual.
Legal duties: compliance with a specific legal obligation where one applies to the record or activity.
Optional communications: consent where required. You can withdraw consent by contacting us or using any unsubscribe facility, without affecting processing that took place before withdrawal.
Emergencies: vital interests where necessary and the legal requirements are met.
Sensitive information and safeguarding
Processing special category information requires an appropriate additional legal condition. Depending on the activity, this may include explicit consent, the condition for legitimate activities of a religious not-for-profit body within its limits, or an applicable substantial public interest condition.
[Confirm the precise special category and criminal offence data conditions for parish records, pastoral care and safeguarding, including any required policy documentation.]
Information about safeguarding may need to be shared with diocesan safeguarding personnel, statutory authorities or other appropriate recipients. Absolute confidentiality cannot be promised where disclosure is necessary and lawful to protect someone or meet an obligation.
Visit our Safeguarding page for reporting contacts. General enquiries are not an emergency service.
Who may receive information
Access should be limited to those who need the information for the relevant purpose. Depending on the activity, recipients may include authorised clergy, parish personnel, diocesan teams, statutory authorities and providers of hosting, email, website maintenance or form processing.
[Confirm the actual providers, their roles and any other recipients, including service providers involved in weddings, funerals or activities.]
Only relevant information should be shared, with appropriate safeguards and a lawful basis.
Website forms, cookies and Google services
Our contact page uses a WPForms form. Its submitted information may be stored in WordPress and/or sent by email, depending on the settings. [Confirm storage, email recipients, anti-spam services and any external processing.]
Pages may include Google Maps or Google Calendar. Loading these services connects your browser to Google and may disclose technical information, including your IP address. See Google’s Privacy Policy.
See our Cookie Policy for information about cookies and embedded services. [Confirm any analytics tools and the working consent controls before publication.]
Transfers outside the UK
Some hosting, email or embedded service providers may process information outside the UK. [Confirm which providers make international transfers, the destinations where relevant, and the applicable adequacy arrangements or safeguards. Explain how a copy of relevant safeguards can be requested.]
How long information is kept
Information should be kept only for as long as needed for its purpose and any applicable legal, record-keeping or safeguarding requirements. Retention depends on the type of record, the arrangement involved and whether a concern, dispute or legal obligation requires continued retention.
[Confirm the parish retention schedule, including enquiry correspondence, form entries, website logs and any permanent registers. Add the actual periods or sufficiently specific retention criteria for each category.]
Keeping information secure
Appropriate technical and organisational measures should protect personal information against unauthorised access, loss or misuse. [Confirm the measures and access arrangements actually in place.]
Please avoid sending unnecessary sensitive information through a general website form. Contact the parish to discuss a suitable way to provide confidential details.
Your rights
Depending on the processing and the applicable law, you may have rights to access your personal information, correct inaccuracies, request erasure, restrict processing and receive certain information in a portable format. These rights are subject to conditions and exceptions.
Your right to object: you can object to processing based on legitimate interests on grounds relating to your situation. You can object to use of your information for direct marketing at any time.
Where processing relies on consent, you can withdraw it at any time. To exercise your rights, email info@stmarywillesden.org. We may need proportionate information to confirm your identity and will respond within the applicable legal time limit.
Children and young people
Where an enquiry or activity concerns a child, information should be limited to what is needed, handled with particular care and explained in an age-appropriate way. [Confirm arrangements for parental involvement, photographs and activity-specific privacy notices.]
Automated decisions
[Confirm whether any decisions with legal or similarly significant effects are made solely by automated processing. If none are used, state this. If any are used, explain the information involved, the logic, likely effects and applicable safeguards.]
Questions and complaints
Please contact info@stmarywillesden.org if you have a privacy question or concern.
You also have the right to complain to the UK Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint/ for information about raising a complaint.
Updates to this policy
We may update this policy when parish activities, website features or data-handling arrangements change. The current version will be available on this page.
Last updated: 03.10.2026