Privacy Policy Link to Privacy Policy Document PRIVACY POLICY  Approval  This policy has been approved by the Senior Pastor and Leadership of Generocity Church LTD. References to the policy will be included in information we provide to visitors, church members and those we provide a service to in our community.  Privacy Officer  Generocity Church LTD has a designated Privacy Officer who is responsible for storing, correcting and giving people access to data collected about them. The Privacy Officer is also responsible for making decisions that could affect the privacy of individual church members and adherents.  Individuals who wish to discuss any known or suspected privacy breaches or to discuss any privacy-related issues should be directed to the Executive Pastor who functions as the Privacy Officer.  If you have any further questions about our privacy policies please call us at 1300 240 831 or send an email to: info@generocitychurch.com  Introduction  Generocity Church LTD is committed to maintaining an environment and processes that protect the privacy of individuals associated with our church. We have chosen to use the National Privacy Principles (NPPs), as contained in the Privacy Act (1988), as a guiding principle for our church. We also comply with rights given to individuals through the General Data Protection Regulation (GDPR).  For more information about the Privacy Act (1988) please refer to the national Privacy Commissioner’s website at: http://www.privacy.gov.au     Privacy Statements  1. Generocity Church LTDwill use the NPPs and the GDPR as a guiding principle for our church in dealing with data  2. Generocity Church LTDwill only use data for the primary purpose for which it is collected (legitimate interest)  a. In most cases, the purpose will relate to the spiritual, pastoral, social, educational and administrative functions of the Church  b. These functions include maintaining data for the purpose of analysing the role of the Church in society and recording the family histories of its members  c. data may, where properly authorised, be disclosed to scholars studying the Church and to relatives of Church members  3. Generocity Church LTD will only use data about an individual for a secondary purpose (i.e. something beyond the scope of the primary purpose) if that individual has consented, or the use is otherwise provided for by the NPPs and GDPR  4. Generocity Church LTD will take reasonable steps to keep data and data secure and will, consistent with the NPPs and GDPR, comply with any request from a person to correct or remove his or her data  5. data collected by Generocity Church LTD may be sensitive data for the purpose of the NPPs or special categories of data for the purpose of the GDPR (e.g. data about a person’s religious beliefs) a. As a non-profit organisation, Generocity Church LTD is permitted to collect sensitive data without a person’s express consent  b. We will endeavour to seek consent from a person if sensitive data is sought for something other than the primary functions of the Church described in clause 2 (above)  6. The operating procedures (whether or not they are formalised in a manual) of Generocity Church LTD will comply with this policy  7. Generocity Church LTD will appoint a Privacy Officer who will be responsible for storing, correcting and giving people access to data collected about them  Policy Background  While the essence of being a church is being involved in each other's lives, caring for one another and creating a strong sense of community, we are also mindful of respecting and protecting the privacy of all who attend this church. We recognise that an individual’s privacy may be of utmost importance to them and that they have a right to control their data. We also recognise the individual’s need for appropriate protection and management of data that is shared with us.  This policy has been developed to assist the understanding of how we collect, use and safeguard the data that is provided to us. It is the intention of this church to regularly review this policy statement in accordance with new developments in State and Federal legislation, best business practices, technology and individual needs.  This church acknowledges that when individuals provide data about themselves, it is an act of trust. Unless the individual gives us explicit consent to act otherwise, this policy will govern how we handle an individual’s data and safeguard their privacy.    Collection and Use of Data  Generocity Church LTD collects data when such data is provided to the church through the completion of documents such as  ● Church Census Forms  ● Pastoral Care Slips  ● Visitors Information Sheets  ● Decision Cards  ● Event Registration Forms (Including BrushFire and PCO events)  ● Email Correspondence  ● Online Giving (PushPay, Tithe.ly, Planning Center, Stripe, Square)  ● Website based registrations  Data may be collected when individuals register for a particular course or event. Personal Data may also be collected when an individual accesses any of the services provided by the church to the general and church community.  Such data can be added to our church database, or to some other church list.  We will not collect any data unless such data is necessary for one or more of the church’s functions or activities.  Each person remains in control of their data.  We do not give, sell, rent or loan any identifiable data regarding members and adherents to any person or organisation without the consent of the person involved.  We will only use this data for the primary purpose for which it is collected.  In most cases, the purpose will relate to the spiritual, pastoral, social, educational and administrative functions of the church. Those functions include maintaining data for the purpose of providing pastoral care within our congregation, and for the promotion of activities and functions associated with the church.  Public Prayer  Due to the often sensitive nature of prayer requests, and taking into consideration the dire need often represented by a prayer request, we have endeavoured to implement a process which will protect the privacy of individuals and yet still allow those in our church to be prayed for should they desire it. For those who strongly identify with a congregation, there can be a sense of great comfort knowing that their church is aware of their situation and praying for them. Therefore, when the Church is asked to publicly pray for any prayer request, the following guidelines will apply.  When praying for any person or prayer request publicly, every effort will be made to ensure that the person who is the subject of the request is aware of, and has agreed to, the prayer. Full names can be used in prayer requests if written consent is first gained from the person who is the subject of the prayer request. This request will take the form of a signed Prayer Request Form or other written request (e.g. email) if an official form is unavailable.    If the person who is the subject of the prayer request is a member of our church and is incapacitated, so that they are unable to provide a written request to us, we will accept a written request from the immediate family. This written request may take the form of a fax, email or SMS message from the family member.  If we are unable to receive a written request, then only first names will be used, as long as there is no reasonable chance that the person who is the subject of the prayer request could be identified. These guidelines will apply to all prayers within the church that could be considered public, including any prayer requests submitted to the Emergency Prayer Chain.  Counselling and Pastoral Care  It is understood that a large part of pastoral care is the use and transmission of data relating to those in the congregation. data must be treated as confidential and with great care.  Church Database  Our Church Database is provided by Planning Center (PCO). You can view their privacy policy here: https://www.planningcenter.com/congregant-privacy  Counselling  Counselling, on behalf of the church, will be conducted only by pastoral staff or authorised volunteers. Records made during the counselling process will be kept secured.  Where records are on paper, these will be kept in a locked office and/or filing cabinets.  Electronic files will be password protected, accessible only to the person authorised to create that file. Access to these files, by persons other than those who created the file, should only occur in cases where pastoral care is being provided by another authorised staff member and the data contained in the file is necessary for effective pastoral care.  Care will be taken to ensure the integrity of the data contained in files. Personal opinions should not be reflected as facts.  When statutory requirements dictate that files are required to be kept for seven years after the file is closed, the church will ensure the file is held securely for that entire time.  When files are no longer needed, all data is to be shredded or electronically deleted.  Breaching Confidentiality  You need to be aware that confidentiality can be legally breached by issues relating to subpoenas or mandatory reporting. Over and above subpoenas and mandatory reporting, a decision to breach confidentiality may also be taken in the following situations:  1. Suspected abuse and neglect  2. Actual or possible overdose situations  3. Where an individual issues substantive threats of intended violence or harm either to themselves or to others    Apart from the above, confidentiality will be regarded as a sacred trust by any minister or counsellor. It would be advisable that such breaches of confidentiality are made only after the pastor/counsellor have consulted with their supervisor or professional associate.  In response to any subpoena, only the material specifically requested will be provided, in whatever form it may be held. Legal advice is recommended.  Released material must only be delivered to official individuals (e.g. to the Clerk of the Court) and an official receipt obtained.  Breach of any confidentiality could be grounds for a church to dismiss the offender and such matters are to be clearly stated in appropriate job descriptions or contract.  Accessing Counselling Records  Should a person wish to access pastoral data about them, they may apply in writing to the Privacy Officer. Access to the file, in the first instance, should be done in the presence of a pastor, who can provide explanation for terminologies used.  Generocity Church Website  Our website located at https://www.generocitychurch.com.au uses cookies. By using our Website, you consent to the use of cookies.  What are cookies  Cookies are small pieces of text sent by your web browser by a website you visit. A cookie file is stored in your web browser and allows the Service or a third-party to recognize you and make your next visit easier and the Service more useful to you.  Cookies can be "persistent" or "session" cookies. Persistent cookies remain on your personal computer or mobile device when you go offline, while session cookies are deleted as soon as you close your web browser.  How Generocity Church uses cookies  When you use and access the Service, we may place a number of cookie files in your web browser. We use cookies for the following purposes:  1. To enable certain functions of the Service  2. We use both session and persistent cookies on the Service and we use different types of cookies to run the Service  3. Essential cookies. We may use essential cookies to authenticate users and prevent fraudulent use of user accounts.  What are your choices regarding cookies  If you'd like to delete cookies or instruct your web browser to delete or refuse cookies, please visit the help pages of your web browser.    Please note, however, that if you delete cookies or refuse to accept them, you might not be able to use all of the features we offer, you may not be able to store your preferences, and some of our pages might not display properly.  For the Chrome web browser, please visit this page from Google:  https://support.google.com/accounts/answer/32050  For the Internet Explorer web browser, please visit this page from Microsoft:  http://support.microsoft.com/kb/278835  For the Firefox web browser, please visit this page from Mozilla:  https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored  For the Safari web browser, please visit this page from Apple:  https://support.apple.com/kb/PH21411?locale=en_US  For any other web browser, please visit your web browser's official web pages.  Where can you find more information about cookies  You can learn more about cookies and the following third-party websites:  1. AllAboutCookies: http://www.allaboutcookies.org/  2. Network Advertising Initiative: http://www.networkadvertising.org/    The 10 National Privacy Principles  Introduction  Generocity Church LTD is not required by law to comply with the private sector provisions of the Privacy Act 1988, however, because of our commitment to privacy, we have voluntarily chosen to use the follow National Privacy Principles (NPPs), as contained in the Act, as the guiding principles for our Church and they are applied within the Church in the following practical ways:  1. Collection  a. We collect data from members of our congregation and visitors to our church for a variety of pastoral reasons. Usually we collect data in order to be able to provide pastoral care and follow-up, as well as being able to notify members and visitors of upcoming events  b. We collect data on Pastoral Care slips, Visitors Slips and other departmental paperwork c. In line with the NPP, we will include a statement such as follows when we collect data: i. “Generocity Church LTD believes in being a caring community, and constantly endeavours to improve our pastoral care. The data gathered on this form will be  provided to a member of our pastoral team or church leadership, who may make  contact with you. This is done to ensure we are able to suitably care for you. You are free not to complete any part of this form, but by doing so you may limit our  ability to make contact with you. If you wish to access any data held about you, or want to find out more about the church’s privacy policy, please contact the church’s Privacy Officer.”  2. Use and Disclosure  a. We provide data to church staff and lay leadership as related to the area of ministry in which the lay leader is involved. It is reasonable to expect that pastoral care cannot be thoroughly done without the use of lay leaders, and therefore, the data collected will be disclosed to them for the purposes of pastoral contact  b. When there is a reasonable need to provide contact details of church members to other church members who are involved in a team ministry together, pastors or staff may disclose those details  c. We do not sell, rent or disclose data to any other persons outside of our church congregation  3. Data Quality  a. The use of tools such as weekly pastoral care slips allows congregation members the opportunity to update data on a regular basis  b. Our database will be regularly updated with new details obtained via such methods 4. Data Security  a. Our church database is password protected  b. Printed address lists will be kept out of public sight (e.g. in folders or desks) and destroyed when no longer required  c. Phone messages are emailed to staff. Any details written down will be kept out of public sight until emailed and will then be destroyed  d. When sending emails to multiple recipients, addresses will be placed in the BCC (blind carbon copy) field  5. Openness  a. Generocity Church LTD has a Privacy Information brochure outlining our data handling practices. This is available in our guest lounge and reception. It is also available on request 6. Access and Correction  a. An individual has the right to make a written request to allow them to access the data that the Church holds about them  b. When a written request is received by the Privacy Officer, they record details of the request in a privacy register and determine if an exception applies. An exception may apply if: i. it is unlawful to provide the data; or  ii. the request poses a serious and imminent threat to the life or health of any individual; or  iii. the request has an unreasonable impact on the privacy of other individuals; or iv. the request is frivolous or vexatious  c. If the privacy officer determines that an exception applies, they are required to notify the person making the request and give their reasons for the exception  d. If an exception does not apply, the request is acknowledged by the Privacy Officer and a time is arranged to view the data within the next 14 days  7. Identifiers  a. The church will never use an identifier that has been issued by a Commonwealth government agency  8. Anonymity  a. While we recognise the importance of pastoral care in church life, those who attend this church and do not wish to provide any data are free to do so  b. It should be recognised that anonymity will restrict the ability of the church to contact and provide any care for the person  9. Trans-Border Data Flows  a. The Church regularly communicates with missionaries overseas  b. Some missionaries are in countries where the practice of Christianity is illegal. The church has the highest responsibility to protect these missionaries and must ensure that any data transferred to a recipient in a foreign country has adequate protection for the circumstance  c. No data will be sent without the individual’s consent, and only in the manner that the individual prescribes  10. Sensitive data  a. The church regularly has cause to deal with sensitive data, particularly with regard to praying for individuals who are in crisis or have a medical need  b. When receiving sensitive data, the church should make all reasonable effort to ascertain if the individual concerned has given permission for this data to be used (e.g. on a prayer chain)  c. Where the individual or next-of-kin has given permission, the data can be used d. Where permission cannot be obtained, the data can only be used if any identifying details are removed (e.g. if the friend of a congregation member is taken to hospital and permission to pray cannot be obtained from them, the prayer request will be framed similar to ”Please pray for the friend of one of our members who has been admitted to hospital with a serious illness”  General Data Protection Regulation (GDPR)  The GDPR is a new legal framework from the EU that takes effect on May 25, 2018. This law is designed to accomplish two main things:  1. Unify the current data protection privacy laws throughout the EU, and  2. Enhance the rights of citizens of the EU to protect their personal information  Data  The personal information (data) that Generocity Church collects on a Data Subject is outlined above.  Data Subject  The Data Subject is you, the individual.  Data Controller  The Data Controller is Generocity Church LTD (ABN 37447253549)  Data Processor  The Data Processors are:  1. Generocity Church LTD  2. Google (Google Apps for Non Profit)  3. Tithe.ly  4. Planning Center  5. Hevo Data  6. Coupler.io  7. Slack  8. ClickUp  9. Zoom