Privacy Notice

Who we are

St Patrick's Catholic Parish, Duston (the "parish") is a Roman Catholic parish of the Diocese of Northampton. This privacy notice explains how we collect, use, and protect your personal information.

Controller details:
St Patrick's Catholic Parish
The Presbytery, 28 Peveril Road
Duston, Northampton NN5 6JW
United Kingdom

01604 751071
stpatrickduston@gmail.com

Parish Priest: Father Benny Joseph MSFS

What information we collect

If you register your child for sacramental preparation (First Holy Communion, Confirmation, etc.) or volunteer with the parish, we collect the following:

Data category	Why we collect it	Legal basis	How long we keep it
Account info Name, email, phone	Registration, contact, communications	Your consent; legitimate interests in running the parish	While account is active, then 3 years
Children's names & dates of birth School, year group	Sacramental preparation registration	Legitimate interests (pastoral care & liturgical records)	Indefinitely (Canon Law 535); prep records 7 years after sacrament
Religious information Sacrament type, baptism record, attendance at preparation	Sacramental preparation & liturgical records	Article 9(2)(d) GDPR: legitimate activities of a religious body	Indefinitely (Canon Law 535); attendance records 7 years after sacrament
Forms & consent Medical/dietary info, photo consent, emergency contacts, volunteer background	Safeguarding, photography, emergency response, vetting	Your consent; legitimate interests in safeguarding	7 years after sacrament or event; indefinite for safeguarding records
Supporting documents Baptism certificates or other documents you upload	Verifying eligibility for sacraments	Article 9(2)(d) GDPR: legitimate activities of a religious body	7 years after sacrament; removed within 30 days of account deletion
Session attendance Attendance records for each candidate	Tracking progress in preparation	Legitimate interests	7 years after sacrament
Communications Progress emails, newsletters, chat messages	Updates, announcements, community discussion	Your consent (optional emails); legitimate interests (essential comms)	Emails 1 year; chat messages 3 years
Technical data Session cookies, IP address, server logs	Website security & session management	Legitimate interests in security	Session cookies until logout; server logs 30 days

Canon Law and the sacramental register

Under Code of Canon Law 535, the parish must maintain a permanent register of sacraments (baptisms, First Holy Communions, confirmations, marriages, and deaths) with the names and parents of those who received them. These entries are kept indefinitely and cannot be deleted. However, your temporary records used for preparation (forms, attendance, emails, chat) can be deleted on request — see "Your rights" below.

How your account is created

When you submit a sacrament registration at /sacraments/register, the parish creates a parent account for you automatically using the email address on the form. We do this so you can track the registration, upload supporting documents (e.g. a baptism certificate), and keep your contact details up to date.

We do not ask for a password. Instead, we email you a one-time magic sign-in link from email@stpatricksduston.com. Clicking that link signs you in to /account. You can request a fresh link at any time from /login.

At the same time, Father Benny is notified by email so he can review the registration. You will be told by email when the registration is approved or if we need to speak with you about it.

Didn't mean to create an account? You can delete it at any time via /account/delete or by emailing the parish. Deletion removes your contact details, forms, attendance records, and any supporting documents you uploaded, subject to the Canon Law exception above once a sacrament has been conferred.

Who we share your data with

Diocese of Northampton

Sacramental register entries (names, dates, parents) are shared with the Diocese of Northampton as required by Canon Law and diocesan governance. The Diocese processes this data as a joint controller with the parish.

Technology partners (data processors)

We use the following third-party services. All have signed data processing agreements:

• Google (Firebase): Cloud database, authentication, file storage. Data centres in Europe. Google Cloud terms.
• Resend Inc.: Transactional email delivery (progress updates, event invites). Data centres in USA; transfers protected by Standard Contractual Clauses.
• Netlify Inc.: Website hosting & serverless functions. Data centres in USA/EU; transfers protected by Standard Contractual Clauses.

We do not sell or share your data for marketing purposes.

Your rights under UK GDPR

Right of access (Article 15)

You have the right to request a copy of your personal data. Log in to your account to download your data, or email stpatrickduston@gmail.com.

Right to rectification (Article 16)

If your information is inaccurate or incomplete, you can correct it yourself via your account or ask the parish to do so.

Right to erasure (Article 17)

You can delete your account and most of your personal data via /account/delete. Deletion is subject to a 7-day grace period. Please note: the sacramental register entry (name, date, parents) cannot be deleted under Canon Law, and records required for safeguarding or legal compliance may be retained.

Right to data portability (Article 20)

You can export your data in machine-readable format via /account or /api/user/export.

Right to object (Article 21)

You can opt out of non-essential communications (newsletters, progress emails) at any time via /account/email, or by emailing the parish. Essential communications (e.g. event updates) may continue.

Right to restrict processing (Article 18)

You can ask us to limit how we use your data while a request is being considered. Email stpatrickduston@gmail.com.

Withdraw consent

If we rely on your consent, you can withdraw it at any time without penalty. For email preferences, update /account/email. For other purposes, contact the parish.

Children's data

We process data of children typically aged 7–16 preparing for sacraments. A parent or guardian creates the account and consents on the child's behalf. The child does not log in directly. Parents have full access to manage their child's data and can request deletion or portability.

Cookies

We use one strictly-necessary session cookie to keep you logged in. This cookie is HttpOnly (not accessible to JavaScript) and first-party (from our domain only). We do not use analytics, advertising, or tracking cookies. No cookie consent banner is required under GDPR because session cookies are exempt from the consent requirement.

How long we keep your data

See the table above for retention periods by data type. In summary: sacramental register entries are kept indefinitely under Canon Law; preparation and form records are kept 7 years after the sacrament; temporary data (emails, chat, server logs) are kept 1–3 years.

Data breaches

If we discover a breach of personal data, we will notify affected individuals and the Information Commissioner's Office without undue delay (within 72 hours where required).

Changes to this notice

We may update this privacy notice as our data practices change. The "Last updated" date at the top of this page shows when it was last revised. Material changes will be communicated via email.

Complaints

If you have concerns about how the parish handles your personal data, please contact us first at stpatrickduston@gmail.com. You also have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office (ICO)
ico.org.uk
0303 123 1113