PUBLIC Privacy Policy
Who are we?
St Giles' Cathedral, Edinburgh (Church of Scotland), Scottish Charity number SC003565 and St Giles’ Cathedral SCIO, Scottish Charity Number SC049530 (together referred to as ‘St Giles’ Cathedral’) is providing you with this Privacy Notice in order to comply with data protection law and to ensure transparency in the collection and use of your personal data.
Who is collecting this information?
The Data Controller is the Church of Scotland Presbytery of Edinburgh and West Lothian, Scottish Charity No. SC017076 (ICO registration Z5659270), acting on behalf of St Giles’ Cathedral, Edinburgh (Church of Scotland), Scottish Charity No. SC003565. The local Data Protection contact for queries in relation to this processing is Fraser Macdonald, Communications Officer, Fraser.Macdonald@stgilescathedral.org.uk.
What personal data is collected?
Identity data:
Name and title
Contact information (telephone numbers, postal address, email address)
Gender preference
Date of Birth
Email address
Organisational details (such as your school, university or workplace and role within the organisation)
Transaction data:
Payment information (such as debit or credit card details)
Transaction data (including payments to you, ticket and donation payments from you and from you and details of products and services you have purchased from us)
Technical data:
Login credentials
Device information (such as IP address, operating system and browser type)
Digital footprint information, for example interactions with marketing materials, bulletins, surveys, website engagement
CRM and preference data:
Marketing preferences for our weekly bulletin and other promotional materials
Accessibility and health-related information, for example dietary restrictions
Reasons for contacting us, such as requests, complaints, opinions, preferences
Additional information sent to us, for example in email communication
Visual data:
Photographs and videos (where applicable)
CCTV Footage from security cameras
How your personal data is collected and for what reason (Purpose)
We collect and use your personal information to:
administer purchases of tickets for events and visiting
record donation frequency and amounts as well as Gift Aid declarations
log marketing preferences for bulletins and other promotional materials
facilitate correspondence or collect feedback provide you with information in relation to news, events, concerts, and activities within St Giles’ Cathedral or the wider Church of Scotland
further charitable aims, for example through fundraising activities
maintain accounts and records
fulfil legal obligations
comply with safeguarding obligations
further the prevention and detection of crime
communicate important notices, updates and changes
Personal information may be held in one or more Customer Relationship Management (CRM) databases to ensure we have clear and accurate records about your interactions with us, to help understand your requirements, and how we might provide other services to you.
The information source
The information is collected directly from you through direct interactions with you. We also collect information when you interact with our website, such as technical data about your equipment, browsing actions and user journeys. We collect this personal data by using cookies and similar technologies.
Cookie Policy
Cookies are small text files that can be used by websites to make a user's experience more efficient. The law states that we can store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies, we need your permission. We use cookies to personalise content and to analyse our traffic. You can change or withdraw your consent at any time. This site uses different types of cookies. Some cookies are placed by third party services that appear on our pages.
The lawful basis for the processing
St Giles’ Cathedral processes special category (sensitive) data under UK GDPR Article 9(2)(d): “processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects”.
For the other processing activities, the lawful basis are:
UK GDPR Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject”.
Article 6(1)(f) “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.
Article 6(1)(a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”. This is specific to safeguarding purposes and Sunday School and other related activities dealing with children. Consent will be sought from parents/guardians for processing a child’s personal data.
Who data is shared with
Your personal information will only be shared where this is necessary for the purposes set out above. Information will not be shared with any third party out with St Giles’ Cathedral without your consent unless St Giles’ Cathedral is obliged or permitted to do so by law.
Third-party services
St Giles’ Cathedral uses third-party services who process your data to build and maintain functionality and to service your requests on this website. While appropriate contracts are in place, St Giles’ Cathedral is not responsible for these third parties, and we encourage you to review their privacy policies directly:
How long the personal data is held for
St Giles’ Cathedral will only keep your personal data for as long as is reasonable and necessary. Some
retention periods will be determined by legal or professional guidelines and others by internal policies. At
the end of a retention period, we will review and delete data as required. Further information about our
retention and disposal schedule is available in our Data Retention Policy on request.
Individuals’ rights in relation to this processing
Under data protection laws, individuals have a number of rights in relation to the processing of their
personal data. These rights are as follows:
The right to be informed – this privacy notice meets that right.
The right of access – this means you have the right to have access or receive copies of personal data held by the organisation
The right to rectification – this means you have the right to correct incomplete or inaccurate data held about you
The right to erasure – this means you have the right to have your data deleted from an organisation’s records.
The right to restrict processing – this means you have the right to restrict processing. This right is normally used with other rights, e.g. rectification
The right to data portability – this means you have the right to request your data in a machine readable format (e.g. a .csv file) and transfer this to another organisation.
The right to object – this means you have the right to object to how your data is processed.
Rights in relation to automated individual decision making, including profiling – the Church does not
carry out this type of processing.
Not all rights apply and it depends on the lawful basis as to what rights do apply. For the processing purposes of this privacy notice, when the lawful basis is legal obligation the right of erasure, right to data portability and the right to object do not apply. All other rights do apply. For the processing purposes of this privacy notice when the lawful basis is legitimate interests, all rights apply except for data portability. If you wish to exercise any of your rights the main contact for queries in relation to this processing is Fraser Macdonald - Fraser.Macdonald@stgilescathedral.org.uk, who will deal with your request accordingly.
If any processing is carried out on the basis of consent it is important to note that you can withdraw your consent at any time. To do this please contact Fraser Macdonald - Fraser.Macdonald@stgilescathedral.org.uk.
Making a complaint
If you are concerned about how your personal data is being handled, please contact - in the first instance - the local Data Protection contact for St Giles’ Cathedral, Fraser Macdonald – Fraser.Macdonald@stgilescathedral.org.uk, and the Data Protection Officer for the Church of Scotland at Privacy@churchofscotland.org.uk, if required.
You also have the right to make a data protection complaint. You can do this by contacting the Church of Scotland Data Protection Officer at privacy@churchofscotland.org.uk, or via the Church of Scotland’s ‘Your rights and choices’ page at https://www.churchofscotland.org.uk/about-us/privacy/your-rights-and-choices.
Your complaint will be acknowledged within 30 days and, without undue delay, will be investigated on behalf of the Data Controller, and you will be kept informed of progress and notified of the outcome.
If you are not satisfied with the outcome of your complaint to the Church of Scotland, a referral can be made to the UK regulator of data protection, the Information Commissioner’s Office (ICO).
The ICO has guidance on their website: https://ico.org.uk/your-data-matters/raising-concerns/
The ICO can be contacted by email casework@ico.org.uk or by telephone on 0303 123 1113.
Alternatively, their postal address is:
Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
Updates
This Privacy Notice may be updated from time to time to reflect changes in legal requirements or other
operational reasons. The latest version will always be available this webpage. We publish the date of the
most recent amendments below.
Last updated 1-10-26