Parish Privacy Statement
Who are we?
The Parish Milltown, is part of the Catholic Archdiocese of Dublin. The parish is a registered charity (charity no. CHY7424) and our address is Parish of Milltown, Milltown, Dublin. The Parish Priest/Administrator/Moderator is the data controller for the parish, in other words he is the person responsible for making sure your data is safe and secure.
Your personal data – what is it?
Personal data relates to a living individual who can be identified from that data. Identification can be through the information alone or in conjunction with other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation or the GDPR and the Data Protection Act (2018).
Who does this Privacy Notice apply to?
This Privacy notice is for all those whose personal information is dealt with in any way by the parish including parishioners, clergy, staff, volunteers, contractors, suppliers and visitors and there may be others.
What is the lawful basis for processing your personal data?
The GDPR requires specification in the Privacy Notice of the lawful basis for processing personal data. Below are the lawful bases which are relevant to our processing activities;
Where consent has been obtained. This can be withdrawn at any time.
Compliance with a legal obligation
Performance of a contract, or to take steps to enter into a contract
To protect a person’s vital interests
Legitimate interests – this includes any activities that involve advancing and maintaining the Roman Catholic religion.
Where processing is carried out by a not-for-profit body with a religious aim provided: –
the processing relates only to members of the congregation or former members (or those who have regular contact with it in connection with those purposes); and there is no disclosure to a third party without consent.
What personal data do we process?
The parish will process some or all of the following types of data, where necessary to perform our duties;
Contact details – telephone numbers, addresses, email addresses;
Information about the Sacraments of Baptism, Confirmation, Marriage and Holy Orders;
Information relating to donations as required for audit purposes and the Charities Act (2009 & 2016);
Safeguarding information on staff, clergy and volunteers as required by the National Safeguarding Office;
Information relating to gender, age, date of birth, marital status;
Information gathered for the furtherance of faith development supports and services;
Information relating to education/work histories, academic professional qualifications;
Some of the personal data we process will fall under the category of sensitive personal data as it will identify your religious belief. There may be other categories of sensitive personal data processed including information on health (e.g. pilgrimage requirements), details of injuries (e.g. legal claim), trade union membership (for a staff member).
How does the Parish process personal information?
We use your personal data for purposes included among the following;
to enable us to meet all legal and statutory obligations;
to deliver the Church’s mission to our parish community and to carry out other voluntary/charitable activities for the benefit of our parish community;
to minister to our parishioners and provide you with pastoral and spiritual care (such as visiting the sick or the bereaved);
to organise and facilitate ecclesiastical liturgies for our parishioners including baptism, confirmations, weddings and funerals;
to promote and assist the mission and growth of the Church in the Diocese of Dublin;
to carry out comprehensive Safeguarding procedures in accordance with best; safeguarding practice with the aim of ensuring that all children and vulnerable adults are provided with safe environments;
for those involved in the management of the parish we use the personal information you provided to enable both the parish and you to carry out your role effectively (e.g. members of the pastoral council, finance committee etc.);
for lay people who assist in all aspects of parish life including the creation of rosters, being involved in parish sacramental teams etc., we use your information to assist you in your various roles. Without such information it would not be possible for you to function effectively in your role in our parish;
To fundraise and promote the interests of the parish and process donations e.g. information supplied by donors to use in supporting our work
To maintain our own accounts and records e.g. putting agreements in place, invoicing and making payments. Personal data held in this regard forms part of our contractual arrangements with you;
To send you the parish newsletter; [if you send your newsletter via email you will need consent from the parishioner to do this]
To deal with your request;
To manage our staff, volunteers and contractors;
Our processing may also include the taking of photographs, live streaming via the webcam, or capturing images in our CCTV;
On occasion the parish has to share your personal data with the Diocesan offices. To enable this to happen compliantly a Data Processing Agreement has been put in place which is signed by the Parish Priest/Administrator/Moderator and counter-signed by the Archbishop. Examples of this sharing include contact with Chancellery in relation to sacramental issues; HR in relation to employment issues; Finance in relation to tax on donations and other areas affected by the Charities Regulation; Child Safeguarding for Vetting and Safe-guarding issues; Office for Liturgy regarding workshops/seminars that maybe of interest to Ministers of the Word/Eucharist/Choirs; Education Secretariat regarding Boards of Management and training events; Lourdes Pilgrimage in relation to parishioners travelling with them for the September pilgrimage; Evangelisation regarding those taking place in events such as Faithfest, World Youth Day and other seminars and workshops; and Archives in relation to GDPR request. The information will never be used for any purpose other than what it was gathered for.
Sharing your personal data
Your personal data will be treated as strictly confidential and will only be shared where appropriate;
Information may be shared with statutory or church bodies for tax relief purposes or for law enforcement agencies for the prevention and detection of crime;
Information may be shared with third parties who assist us with our work;
We reserve the right to release personal data without your consent where permitted by law or to meet a legal obligation.
How long do we keep your personal data?
We keep your personal data for as long as it is need and in line with our Retention/Disposition schedule. Some records are permanently kept and these will be placed in the Parish/Diocesan Archives.
How is our information kept safe and secure?
The Parish complies with its obligations under the “GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
Your rights and your personal data
Unless subject to an exemption under the GDPR you have the following rights with respect to your personal data: –
Right of Access – you can request a copy of your personal data from the Parish;
Right of Correction – you have the right to request that the Parish corrects any personal data if it is found to be inaccurate, incomplete or out of date;
Right of Erasure – You have the right, in certain circumstances, to ask for the data we hold on you to be destroyed. This is known as the Right to be Forgotten;
Right to Restriction of Processing – where certain conditions apply, you have the right to restrict the processing of your personal data;
Right to Data Portability – you can request that the Parish transfer your data directly to another data controller where we hold the data in an electronic format;
Right to Object –you have the right to object to certain types of processing;
Right to Lodge a Complaint with the Office of the Data Protection Commission.
When exercising any of the above rights and in order to facilitate your request, we may need to verify your identification for security purposes.
Transfer of Data Abroad
We do not transfer personal data abroad although some of of our data servers are located in the UK.
This Parish reserves the right to review and amend this statement at any time without notice.
The data subject may, at any time, prevent the setting of cookies through our website by means of a corresponding setting of the Internet browser used, and may thus permanently deny the setting of cookies. Furthermore, already set cookies may be deleted at any time via an Internet browser or other software programs. This is possible in all popular Internet browsers. If the data subject deactivates the setting of cookies in the Internet browser used, not all functions of our website may be entirely usable.
Subscription to our newsletters
On the website of the Miltown Parish, users are given the opportunity to subscribe to our enterprise’s newsletter. The input mask used for this purpose determines what personal data are transmitted, as well as when the newsletter is ordered from the controller.
The Miltown Parish informs its customers and business partners regularly by means of a newsletter about enterprise offers. The enterprise’s newsletter may only be received by the data subject if (1) the data subject has a valid e-mail address and (2) the data subject registers for the newsletter shipping. A confirmation e-mail will be sent to the e-mail address registered by a data subject for the first time for newsletter shipping, for legal reasons, in the double opt-in procedure. This confirmation e-mail is used to prove whether the owner of the e-mail address as the data subject is authorized to receive the newsletter.
During the registration for the newsletter, we also store the IP address of the computer system assigned by the Internet service provider (ISP) and used by the data subject at the time of the registration, as well as the date and time of the registration. The collection of this data is necessary in order to understand the (possible) misuse of the e-mail address of a data subject at a later date, and it therefore serves the aim of the legal protection of the controller.
The personal data collected as part of a registration for the newsletter will only be used to send our newsletter. In addition, subscribers to the newsletter may be informed by e-mail, as long as this is necessary for the operation of the newsletter service or a registration in question, as this could be the case in the event of modifications to the newsletter offer, or in the event of a change in technical circumstances. There will be no transfer of personal data collected by the newsletter service to third parties. The subscription to our newsletter may be terminated by the data subject at any time. The consent to the storage of personal data, which the data subject has given for shipping the newsletter, may be revoked at any time. For the purpose of revocation of consent, a corresponding link is found in each newsletter. It is also possible to unsubscribe from the newsletter at any time directly on the website of the controller, or to communicate this to the controller in a different way.
Data Protection provisions about the application and use of AddThis
On this website, the data controller has integrated components of the enterprise AddThis. AddThis is a so-called bookmarking provider. The service allows for simplified bookmarking of Internet pages via buttons. By clicking on the AddThis component with the mouse, or by clicking on it, a list of bookmarking and sharing services is displayed. AddThis is used on over 15 million websites, and the buttons are displayed, according to the information of the operating enterprise, over 20 billion times a year.
The operating company of AddThis is AddThis, Inc. 1595 Spring Hill Road, Suite 300, Vienna, VA 22182, United States.
By calling up one of the individual pages of the website, which is operated by the controller, and on which an AddThis component has been integrated, the Internet browser of the data subject is automatically prompted by the respective AddThis component to download data from the website www.addthis.com. Within the framework of this technical procedure, AddThis is informed of the visit and the specific individual page of this website that was used by the data subject with the help of information technology. In addition, AddThis is informed about the IP address of the computer system assigned by the Internet service provider (ISP) and used by the data subject, the browser type and language, the web page accessed before our website, the date and the time of the visit to our website. AddThis uses this data to create anonymous user profiles. The data and information transmitted to AddThis in this way will enable the enterprise AddThis, as well as affiliates or their partner-enterprises, to contact visitors of the web pages of the controller with personalized and interest-based advertising.
AddThis displays personalized and interest-based advertising on the basis of a cookie set by the enterprise. This cookie analyzes the individual surfing behavior of the computer system used by the data subject. The cookie saves the computer-based outgoing visits to Internet pages.
The data subject may, at any time, prevent the setting of cookies through our website by means of a corresponding setting of the Internet browser used, and thus permanently deny the setting of cookies. Such a setting of the Internet browser used would also prevent AddThis from setting a cookie on the information technology system of the data subject. Cookies may also be deleted by AddThis at any time via an Internet browser or other software programs.
The data subject also has the possibility of objecting permanently to the processing of personal data by AddThis. For this purpose, the data subject must click on the opt-out button under the link http://www.addthis.com/privacy/opt-out, which sets an opt-out cookie. The opt-out cookie used for this purpose is placed on the information technology system used by the data subject. If the data subject deletes the cookies from his system, then the data subject must call up the link again and set a new opt-out cookie.
With the setting of the opt-out cookie, however, the possibility exists that the websites of the controller are not fully usable anymore by the data subject.
The applicable data protection provisions of AddThis may be accessed under http://www.addthis.com/privacy/privacy-policy.
Data protection provisions about the application and use of Facebook
On this website, the controller has integrated components of the enterprise Facebook. Facebook is a social network.
A social network is a place for social meetings on the Internet, an online community, which usually allows users to communicate with each other and interact in a virtual space. A social network may serve as a platform for the exchange of opinions and experiences, or enable the Internet community to provide personal or business-related information. Facebook allows social network users to include the creation of private profiles, upload photos, and network through friend requests.
The operating company of Facebook is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, United States. If a person lives outside of the United States or Canada, the controller is the Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
With each call-up to one of the individual pages of this Internet website, which is operated by the controller and into which a Facebook component (Facebook plug-ins) was integrated, the web browser on the information technology system of the data subject is automatically prompted to download display of the corresponding Facebook component from Facebook through the Facebook component. An overview of all the Facebook Plug-ins may be accessed under https://developers.facebook.com/docs/plugins/. During the course of this technical procedure, Facebook is made aware of what specific sub-site of our website was visited by the data subject.
If the data subject is logged in at the same time on Facebook, Facebook detects with every call-up to our website by the data subject—and for the entire duration of their stay on our Internet site—which specific sub-site of our Internet page was visited by the data subject. This information is collected through the Facebook component and associated with the respective Facebook account of the data subject. If the data subject clicks on one of the Facebook buttons integrated into our website, e.g. the “Like” button, or if the data subject submits a comment, then Facebook matches this information with the personal Facebook user account of the data subject and stores the personal data.
Facebook always receives, through the Facebook component, information about a visit to our website by the data subject, whenever the data subject is logged in at the same time on Facebook during the time of the call-up to our website. This occurs regardless of whether the data subject clicks on the Facebook component or not. If such a transmission of information to Facebook is not desirable for the data subject, then he or she may prevent this by logging off from their Facebook account before a call-up to our website is made.
The data protection guideline published by Facebook, which is available at https://facebook.com/about/privacy/, provides information about the collection, processing and use of personal data by Facebook. In addition, it is explained there what setting options Facebook offers to protect the privacy of the data subject. In addition, different configuration options are made available to allow the elimination of data transmission to Facebook. These applications may be used by the data subject to eliminate a data transmission to Facebook.
Data protection provisions about the application and use of Google Analytics (with anonymization function)
On this website, the controller has integrated the component of Google Analytics (with the anonymizer function). Google Analytics is a web analytics service. Web analytics is the collection, gathering, and analysis of data about the behavior of visitors to websites. A web analysis service collects, inter alia, data about the website from which a person has come (the so-called referrer), which sub-pages were visited, or how often and for what duration a sub-page was viewed. Web analytics are mainly used for the optimization of a website and in order to carry out a cost-benefit analysis of Internet advertising.
The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States.
For the web analytics through Google Analytics the controller uses the application “_gat. _anonymizeIp”. By means of this application the IP address of the Internet connection of the data subject is abridged by Google and anonymised when accessing our websites from a Member State of the European Union or another Contracting State to the Agreement on the European Economic Area.
The purpose of the Google Analytics component is to analyze the traffic on our website. Google uses the collected data and information, inter alia, to evaluate the use of our website and to provide online reports, which show the activities on our websites, and to provide other services concerning the use of our Internet site for us.
Google Analytics places a cookie on the information technology system of the data subject. The definition of cookies is explained above. With the setting of the cookie, Google is enabled to analyze the use of our website. With each call-up to one of the individual pages of this Internet site, which is operated by the controller and into which a Google Analytics component was integrated, the Internet browser on the information technology system of the data subject will automatically submit data through the Google Analytics component for the purpose of online advertising and the settlement of commissions to Google. During the course of this technical procedure, the enterprise Google gains knowledge of personal information, such as the IP address of the data subject, which serves Google, inter alia, to understand the origin of visitors and clicks, and subsequently create commission settlements.
The cookie is used to store personal information, such as the access time, the location from which the access was made, and the frequency of visits of our website by the data subject. With each visit to our Internet site, such personal data, including the IP address of the Internet access used by the data subject, will be transmitted to Google in the United States of America. These personal data are stored by Google in the United States of America. Google may pass these personal data collected through the technical procedure to third parties.
The data subject may, as stated above, prevent the setting of cookies through our website at any time by means of a corresponding adjustment of the web browser used and thus permanently deny the setting of cookies. Such an adjustment to the Internet browser used would also prevent Google Analytics from setting a cookie on the information technology system of the data subject. In addition, cookies already in use by Google Analytics may be deleted at any time via a web browser or other software programs.
Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.com/intl/en/policies/privacy/ and under http://www.google.com/analytics/terms/us.html. Google Analytics is further explained under the following Link https://www.google.com/analytics/.
Data protection provisions about the application and use of Jetpack for WordPress
On this website, the controller has integrated Jetpack. Jetpack is a WordPress plug-in, which provides additional features to the operator of a website based on WordPress. Jetpack allows the Internet site operator, inter alia, an overview of the visitors of the site. By displaying related posts and publications, or the ability to share content on the page, it is also possible to increase visitor numbers. In addition, security features are integrated into Jetpack, so a Jetpack-using site is better protected against brute-force attacks. Jetpack also optimizes and accelerates the loading of images on the website.
The operating company of Jetpack Plug-Ins for WordPress is the Automattic Inc., 132 Hawthorne Street, San Francisco, CA 94107, UNITED STATES. The operating enterprise uses the tracking technology created by Quantcast Inc., 201 Third Street, San Francisco, CA 94103, UNITED STATES.
Jetpack sets a cookie on the information technology system used by the data subject. The definition of cookies is explained above. With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which a Jetpack component was integrated, the Internet browser on the information technology system of the data subject is automatically prompted to submit data through the Jetpack component for analysis purposes to Automattic. During the course of this technical procedure Automattic receives data that is used to create an overview of website visits. The data obtained in this way serves the analysis of the behaviour of the data subject, which has access to the Internet page of the controller and is analyzed with the aim to optimize the website. The data collected through the Jetpack component is not used to identify the data subject without a prior obtaining of a separate express consent of the data subject. The data comes also to the notice of Quantcast. Quantcast uses the data for the same purposes as Automattic.
The data subject can, as stated above, prevent the setting of cookies through our website at any time by means of a corresponding adjustment of the web browser used and thus permanently deny the setting of cookies. Such an adjustment to the Internet browser used would also prevent Automattic/Quantcast from setting a cookie on the information technology system of the data subject. In addition, cookies already in use by Automattic/Quantcast may be deleted at any time via a web browser or other software programs.
In addition, the data subject has the possibility of objecting to a collection of data relating to a use of this Internet site that are generated by the Jetpack cookie as well as the processing of these data by Automattic/Quantcast and the chance to preclude any such. For this purpose, the data subject must press the ‘opt-out’ button under the link https://www.quantcast.com/opt-out/ which sets an opt-out cookie. The opt-out cookie set with this purpose is placed on the information technology system used by the data subject. If the cookies are deleted on the system of the data subject, then the data subject must call up the link again and set a new opt-out cookie.
With the setting of the opt-out cookie, however, the possibility exists that the websites of the controller are not fully usable anymore by the data subject.
The applicable data protection provisions of Automattic may be accessed under https://automattic.com/privacy/. The applicable data protection provisions of Quantcast can be accessed under https://www.quantcast.com/privacy/.
Data protection provisions about the application and use of Twitter
On this website, the controller has integrated components of Twitter. Twitter is a multilingual, publicly-accessible microblogging service on which users may publish and spread so-called ‘tweets,’ e.g. short messages, which are limited to 280 characters. These short messages are available for everyone, including those who are not logged on to Twitter. The tweets are also displayed to so-called followers of the respective user. Followers are other Twitter users who follow a user’s tweets. Furthermore, Twitter allows you to address a wide audience via hashtags, links or retweets.
The operating company of Twitter is Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, UNITED STATES.
With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which a Twitter component (Twitter button) was integrated, the Internet browser on the information technology system of the data subject is automatically prompted to download a display of the corresponding Twitter component of Twitter. Further information about the Twitter buttons is available under https://about.twitter.com/de/resources/buttons. During the course of this technical procedure, Twitter gains knowledge of what specific sub-page of our website was visited by the data subject. The purpose of the integration of the Twitter component is a retransmission of the contents of this website to allow our users to introduce this web page to the digital world and increase our visitor numbers.
If the data subject is logged in at the same time on Twitter, Twitter detects with every call-up to our website by the data subject and for the entire duration of their stay on our Internet site which specific sub-page of our Internet page was visited by the data subject. This information is collected through the Twitter component and associated with the respective Twitter account of the data subject. If the data subject clicks on one of the Twitter buttons integrated on our website, then Twitter assigns this information to the personal Twitter user account of the data subject and stores the personal data.
Twitter receives information via the Twitter component that the data subject has visited our website, provided that the data subject is logged in on Twitter at the time of the call-up to our website. This occurs regardless of whether the person clicks on the Twitter component or not. If such a transmission of information to Twitter is not desirable for the data subject, then he or she may prevent this by logging off from their Twitter account before a call-up to our website is made.
The applicable data protection provisions of Twitter may be accessed under https://twitter.com/privacy?lang=en.
Data protection provisions about the application and use of YouTube
On this website, the controller has integrated components of YouTube. YouTube is an Internet video portal that enables video publishers to set video clips and other users free of charge, which also provides free viewing, review and commenting on them. YouTube allows you to publish all kinds of videos, so you can access both full movies and TV broadcasts, as well as music videos, trailers, and videos made by users via the Internet portal.
The operating company of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, UNITED STATES. The YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, UNITED STATES.
With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which a YouTube component (YouTube video) was integrated, the Internet browser on the information technology system of the data subject is automatically prompted to download a display of the corresponding YouTube component. Further information about YouTube may be obtained under https://www.youtube.com/yt/about/en/. During the course of this technical procedure, YouTube and Google gain knowledge of what specific sub-page of our website was visited by the data subject.
If the data subject is logged in on YouTube, YouTube recognizes with each call-up to a sub-page that contains a YouTube video, which specific sub-page of our Internet site was visited by the data subject. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject.
YouTube and Google will receive information through the YouTube component that the data subject has visited our website, if the data subject at the time of the call to our website is logged in on YouTube; this occurs regardless of whether the person clicks on a YouTube video or not. If such a transmission of this information to YouTube and Google is not desirable for the data subject, the delivery may be prevented if the data subject logs off from their own YouTube account before a call-up to our website is made.
YouTube’s data protection provisions, available at https://www.google.com/intl/en/policies/privacy/, provide information about the collection, processing and use of personal data by YouTube and Google.
Please contact the Parish if you have any questions about this Privacy Statement or the information we hold about you or to exercise all relevant rights, queries or complaints.
Parish of Milltown, at 01 2196740 or
by email at milltownparishcentre @gmail.com
You can contact the Data Protection Commissioners Office on 00353 57 8684800 or Lo-Call 1890 252 231 or by email at firstname.lastname@example.org.
The postal addresses are:
Data Protection Commissioner
R32 AP23 Co. Laois
21 Fitzwilliam Square