Privacy & Data Protection Policy

Streams of Joy International Erith London ("the Church", "we", "us", "our") is the data controller responsible for your personal data. This policy explains how we collect, use, store and protect your information, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or how we handle your data, please contact us at info@sojlondon.org.

We collect and process the following categories of personal data:

• Identity & contact details — name, email address, phone number, postal address and postcode, date of birth.
• Membership information — date you joined, the teams/ministries you belong to, your role, and attendance records.
• Pastoral & engagement data — prayer requests, follow-up and pastoral care notes, and messages exchanged with the Church.
• Giving & donations — records of tithes, offerings and donations (processed securely via our payment provider; we do not store full card details).
• Media — profile photos and, where relevant, images from Church events.
• Technical data — login timestamps and information necessary to keep your account secure.

Because we are a church, the fact that you are a member may reveal information about your religious beliefs. This is "special category data" under UK GDPR. We process it on the basis of your consent and/or Article 9(2)(d), which permits a not-for-profit body with a religious aim to process the data of its members and people in regular contact with it, provided the data is not shared outside the Church without your consent.

• Consent — to send you communications by SMS and email, and to include you in Church activities.
• Legitimate interests — to administer membership, track attendance, provide pastoral care, and run the life of the Church effectively.
• Legal obligation — to keep financial and Gift Aid records where required by law.
• Contract / vital interests — where necessary to provide a service you have requested or to protect someone's safety.

We use your contact details to send you Church announcements, pastoral messages, event information and administrative notices. You can opt out of non-essential communications at any time by contacting us or using the unsubscribe option where provided. SMS messages include a "do not reply" notice.

We do not sell your personal data. We share it only with trusted service providers ("data processors") who help us operate, under contracts that protect your data:

• Twilio — to deliver SMS text messages.
• Resend — to deliver email messages.
• Stripe — to process online giving and donations securely.

We may also disclose data where required by law or to protect the rights and safety of individuals.

Some of our providers may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place (such as UK adequacy regulations or International Data Transfer Agreements) so your data remains protected to UK standards.

We keep your personal data only for as long as necessary for the purposes described above, or as required by law (for example, Gift Aid and financial records are retained for at least 6 years). Membership data is kept while you remain in contact with the Church and for a reasonable period afterwards, after which it is securely deleted or anonymised.

Access to personal data is restricted to authorised leaders and staff on a role-based basis. Accounts are password protected, sensitive actions are recorded in an audit log, and data is transmitted over encrypted connections.

Under UK GDPR you have the right to:

• Be informed about how your data is used;
• Access a copy of the data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your data ("right to be forgotten");
• Restrict or object to processing;
• Data portability;
• Withdraw consent at any time.

To exercise any of these rights, contact us at info@sojlondon.org. We will respond within one month.

This application uses only essential cookies and local storage needed to keep you signed in and to operate securely. We do not use advertising or third-party tracking cookies.

If you are unhappy with how we have handled your data, please contact us first so we can put things right. You also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113.

We may update this policy from time to time. Any changes will be posted on this page with a revised "last updated" date.