Privacy Notice

How Citygate Church Uses Your Personal Information

Last Updated: June 2026

Citygate Church ("Citygate", "we", "us", "our") is committed to protecting your privacy and handling your personal information in a transparent and secure manner.

This Privacy Notice explains how we collect, use, store, protect and share personal information and outlines your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Citygate Church is the Data Controller for the personal information described in this notice.

Contact Details

If you have any questions about this Privacy Notice or how we process your personal information, please contact:

Data Protection Officer
Citygate Church
138a Holdenhurst Road
Bournemouth
BH8 8AS

Telephone: 01202 299628

Email: dpo@citygate.church

What Information Does This Notice Cover?

This Privacy Notice applies to:

  • Visitors to our website

  • ChurchSuite users

  • Individuals who complete Connect Cards

  • Individuals who complete online forms

  • Individuals who email us

  • Individuals who contact us via social media or messaging platforms

  • Subscribers to our email communications

  • People attending Citygate Church services, events and activities

  • People registering for events organised by Citygate Church

  • Parents and guardians registering children for Citygate Kids and Youth activities

  • Individuals who give financially to Citygate Church

  • Job applicants and current or former employees

  • Individuals making complaints, enquiries or exercising data protection rights

  • Individuals captured by CCTV systems at our premises

Our Lawful Basis for Processing Personal Data

Depending on the circumstances, we process personal data using one or more of the following lawful bases under UK GDPR:

  • Consent

  • Contract

  • Legal Obligation

  • Vital Interests

  • Legitimate Interests

The lawful basis relied upon will depend on the purpose for which the information is processed.

Visitors to Our Website

Our website is hosted and managed by Squarespace.

When you visit our website, Squarespace may automatically collect technical information including:

  • IP address

  • Browser type and version

  • Device information

  • Website usage information

  • Referring websites

  • Cookie and session data

We use this information to:

  • Maintain website security

  • Improve website functionality

  • Understand how visitors use our website

  • Monitor website performance

For more information about our use of cookies, please see our Cookie Notice.

ChurchSuite

We use ChurchSuite as our primary church management system and contact database.

ChurchSuite enables us to:

  • Manage contact information

  • Organise teams and rotas

  • Manage event registrations

  • Record pastoral and administrative information

  • Manage children's and youth ministry records

  • Allow church members to update their own details

Individuals connected with Citygate Church may receive access to ChurchSuite so they can view and manage their personal information.

Connect Cards

If you complete a paper Connect Card, the information you provide will be stored securely and transferred into ChurchSuite.

Paper forms are securely destroyed once the information has been entered into our systems.

We use this information to contact you and help connect you with relevant church activities and opportunities.

Online Forms

We use various third-party services to process online forms, including:

  • Squarespace

  • ChurchSuite

  • Google Forms

  • JotForm

Information submitted through these forms may be:

  • Sent via email

  • Stored in secure databases

  • Added to ChurchSuite where appropriate

We only collect information that is relevant to the purpose of the form being completed.

Email Communications

If you contact us by email, we will process the information you provide in order to respond to your enquiry and manage any ongoing communication.

We use Transport Layer Security (TLS) where available to protect email communications.

Emails and attachments may be monitored for security purposes, including detecting malicious software and unauthorised activity.

Social Media and Messaging Platforms

We use various social media and communication platforms, including:

  • Facebook

  • Instagram

  • WhatsApp

  • Slack

  • YouTube

  • X (formerly Twitter)

If you contact us through these services, the information you provide will also be subject to the privacy policies of those platform providers.

We may retain copies of communications where necessary for pastoral, safeguarding, administrative or customer service purposes.

Email Bulletins and Marketing Communications

We send regular email updates and church news to individuals who have subscribed to receive them.

Our lawful basis for sending these communications is generally consent.

We use Squarespace Email Campaigns (or equivalent services provided by Squarespace) to manage and deliver email communications.

We may collect information about:

  • Email delivery

  • Opens

  • Link clicks

This information helps us improve our communications.

You may unsubscribe at any time using the link provided in each email.

Events and Event Registration

When you register for an event organised by Citygate Church, we may collect information including:

  • Name

  • Contact details

  • Attendance information

  • Emergency contact details, where appropriate

  • Accessibility or dietary requirements where relevant

Event registrations are usually managed through ChurchSuite.

Payments for events may be processed through trusted third-party providers, including Stripe or PayPal.

Citygate Church does not store payment card details.

Children and Youth Activities

This section applies to Citygate Kids, youth activities, Little Acorns and other children's programmes.

We collect information necessary to ensure the safety and well-being of children in our care, including:

  • Child's name

  • Date of birth

  • Parent or guardian details

  • Emergency contact information

  • Medical information

  • Additional needs information

Information is stored securely in ChurchSuite and accessed only by authorised staff and approved volunteers.

Visitors

Visitor records are retained separately and generally retained for up to eight weeks after the last attendance unless further engagement occurs.

Regular Attendees

Parents may choose to have their children's details included within the ChurchSuite children's address book to facilitate ongoing communication and administration.

Financial Giving

If you give financially to Citygate Church, we may retain information required for:

  • Accounting purposes

  • Charity reporting obligations

  • Gift Aid administration

  • Financial auditing requirements

Your information may be processed by:

  • HSBC

  • Xero

  • ChurchSuite

  • Dona

  • Stripe

  • PayPal

Citygate Church does not store payment card information.

Financial records are retained in accordance with legal and regulatory requirements.

Recruitment and Employment

If you apply for a role with Citygate Church, we will use the information you provide to:

  • Assess your application

  • Communicate with you regarding recruitment

  • Meet legal and employment obligations

Successful applicants' information will become part of their employment record.

Unsuccessful applicant records will normally be retained for up to twelve months unless a longer period is required by law.

Complaints and Enquiries

When you submit a complaint or enquiry, we will use the information you provide to:

  • Investigate the matter

  • Respond appropriately

  • Improve our services

Complaint records are normally retained for two years following closure.

Access to complaint information is restricted to those who require it for legitimate purposes.

CCTV

Some Citygate Church locations use Closed Circuit Television (CCTV).

CCTV is used for:

  • Crime prevention and detection

  • Protecting people and property

  • Supporting safeguarding and security arrangements

Appropriate signage is displayed where CCTV operates.

Footage is only viewed where necessary and is retained for a limited period unless required for investigation or legal proceedings.

Photography and Videography

Photography and video recording may take place during services, events and church activities.

Images and recordings may be used in:

  • Church publications

  • Presentations

  • Newsletters

  • Websites

  • Social media

  • Promotional materials

  • Historical records documenting church life

Images and recordings will be retained only for as long as they remain relevant to our communications and historical record purposes. They will not be shared with third parties except where necessary to fulfil those purposes, such as with website providers, social media platforms, printers, or other suppliers acting on our behalf under appropriate contractual arrangements.

Adults

For identifiable images of adults, our lawful basis is Legitimate Interests under Article 6(1)(f) UK GDPR.

Our legitimate interest is documenting, communicating and promoting the life and ministry of Citygate Church.

Individuals have the right to object to this processing.

If you do not wish to be photographed or recorded, please inform a photographer, videographer, member of the media team, or event organiser as soon as possible, and send an email to media@citygate.church. We will make reasonable efforts to avoid capturing or using images of you.

If an image or recording featuring you has already been published and you would like it removed, please contact media@citygate.church with sufficient information to help us identify the relevant content. We will consider all requests promptly and, where appropriate, remove the content without undue delay.

Children and Young People

Citygate Church takes particular care when photographing or filming children under the age of 18.

For identifiable images of children used in promotional materials, websites, social media, or other public communications, our lawful basis is Consent (Article 6(1)(a) UK GDPR), provided by a parent or legal guardian.

This means:

  • Parental or guardian consent will be obtained before identifiable photographs or video recordings of children are used publicly by Citygate Church.

  • Children will not be identified by their full name alongside their image.

  • Images will be selected and used in a manner that respects the dignity, privacy, and safety of every child.

  • Consent may be withdrawn at any time by updating communication and media preferences within ChurchSuite or by contacting kids@citygate.church.

Withdrawal of consent will not affect the lawfulness of any processing carried out before consent was withdrawn, but Citygate Church will cease any future use of the child's image where consent has been withdrawn.

If an image or recording featuring you has already been published and you would like it removed, please contact media@citygate.church with sufficient information to help us identify the relevant content. We will consider all requests promptly and, where appropriate, remove the content without undue delay.

International Transfers

Some of our service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we ensure appropriate safeguards are in place, including approved contractual arrangements and other lawful transfer mechanisms recognised under UK data protection legislation.

Who We Share Information With

We may share information with trusted third-party providers that help us operate our church and deliver services.

These may include:

  • ChurchSuite

  • Squarespace

  • Google

  • JotForm

  • Textlocal

  • Meta (Facebook and Instagram)

  • YouTube

  • Slack

  • Stripe

  • PayPal

  • HSBC

  • Xero

  • Dona

We require service providers acting on our behalf to process information securely and in accordance with applicable data protection laws.

We may also share information where required by law or where necessary to protect individuals, prevent crime or fulfil legal obligations.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to meet legal, regulatory, safeguarding and operational requirements.

Retention periods vary depending on the type of information involved.

Examples include:

  • Children's visitor records: approximately 8 weeks

  • Complaint records: approximately 2 years

  • Recruitment records for unsuccessful applicants: up to 12 months

  • Financial and Gift Aid records: normally 6 years

  • CCTV footage: limited retention period unless required for investigation

Some records may be retained for longer where legally required or where safeguarding considerations apply.

Your Rights

Under UK GDPR, you have the right to:

  • Access personal information we hold about you

  • Request correction of inaccurate information

  • Request deletion of personal information in certain circumstances

  • Request restriction of processing

  • Object to processing based on legitimate interests

  • Receive personal information in a portable format where applicable

  • Withdraw consent where processing relies on consent

  • Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, please contact our Data Protection Officer.

Complaints

If you have concerns about how we use your personal information, please contact us first so that we can attempt to resolve the matter.

You also have the right to complain to the Information Commissioner's Office:

Website: https://ico.org.uk/concerns/

Telephone: 0303 123 1113

Data Accuracy

We seek to ensure that personal information remains accurate and up to date.

You may request corrections to your information at any time by contacting us or updating your details through ChurchSuite, where available.

Links to Other Websites

This Privacy Notice does not apply to external websites linked from our website.

We encourage you to read the privacy notices of any third-party websites you visit.

Changes to this Privacy Notice

We review this Privacy Notice regularly and may update it from time to time.

Any updates will be published on our website with a revised "Last Updated" date.