Privacy notice.

This notice explains, in plain terms, what personal information Hope Vineyard Church (“we”, “us”) collects, why, who helps us look after it, how long we keep it and what your rights are. We follow UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Hope Vineyard Church Great Yarmouth is a church in Great Yarmouth, Norfolk, and a satellite of Gateway Vineyard, in partnership with Vineyard Churches UK & Ireland. The “data controller” for the information described here (the organisation that decides what is collected and how it is used) is Hope Vineyard Church Great Yarmouth. While our own registration as a charity is pending, Hope Vineyard Church operates under the charity registration of Gateway Vineyard (registered charity no. 1135206) and is covered by Gateway Vineyard’s insurance. Hope Vineyard Church Great Yarmouth remains the data controller for your information.

Our postal address is Hope Vineyard Church Great Yarmouth, The Christchurch Building, King Street, Great Yarmouth NR30 2NZ.

As a not-for-profit organisation, we are exempt from paying the data protection fee to the Information Commissioner’s Office (ICO), so we do not have an ICO registration number. This makes no difference to how we look after your information or to your rights.

Our data protection lead is Andrew Wiltshire, and decisions about how we use personal data are signed off by the Chair of our trustees, Adam Baker. You can reach us at hello@hope.gy.

What we collect, and why

• If you sign up to hear from us: your name and email address (and your mobile number, if you choose to give it), and which kinds of update you chose (for example events and what’s on, church news or prayer), so we can send you those, in the ways you have chosen (by email, and by text message only if you have agreed to texts).
• If you sign up for an event: your name and contact details, the names of anyone you book for, your address if the event asks for it, and your answers to the event’s questions (for example dietary needs, allergies or access needs, an emergency contact, and whether you are happy to appear in photos), so we can run the event safely and get in touch about it. Only that event’s coordinators and our administrators can see the sensitive answers (children’s details have stricter rules: see below), and, for food, we tell the caterer only what they need to know.
• Allergy, dietary and access information: this can be health information, so we only ask for it when it matters. If you give it, we keep it on your record so you don’t have to tell us again each time you book, and so we can look after you at future events. It can be seen by our team members who look after our contact records (when they open your record), by our event coordinators and by our administrators, and by nobody else; every time someone looks at it, that is recorded, and it is stored encrypted. When you book again we ask you to check it is still right, and you can ask us to update or remove it at any time.
• Emergency contacts: if you give us an emergency contact when you book, we keep it on your record in the same way as allergy information (seen by the same people, every look recorded, stored encrypted), so we have it for future events; when you book again we ask you to check it is still right. If you give us someone else’s details as an emergency contact, please let them know.
• Children’s details: some events ask for each child’s name and age, any allergies or medical needs, and who will collect them, so our team can look after children safely. We only take these from a parent or carer (or someone with their permission), never from the child: if you are under 16, please ask your parent or carer to book for you. They are kept on the parent or carer’s record, in a separate, protected part of our records: they can be seen only by the coordinators of an event the child is booked for and by team members we have specifically authorised to see children’s details. Other team members who look after our contact records can see only how many children are linked to a parent or carer’s record, not who they are or anything about them. Every look is recorded, and they are stored encrypted. To see, update or remove them, contact our children’s data and safeguarding contact, our Safeguarding Lead Hannah Wiltshire, at safeguarding@hope.gy.
• If you contact us: your name, contact details and the content of your message, so we can reply.
• If you are part of church life: the contact details you give us and simple notes of how you’re involved (for example which team you serve on), so we can keep in touch and care for you well. Because we are a church, being on our records may indicate your religious belief; we only use this within the church and never share it for anyone else’s purposes.
• Consent records: what you agreed to (each purpose and each channel, such as email or text, separately), when, how (for example online or on a paper card) and any later changes, so we can prove we have your permission and respect your choices.
• Technical records: when you use this website or Hope OS, our servers keep logs of technical details such as your IP address, your browser and the pages requested, so we can keep the systems secure and working.

Our lawful basis

• Newsletters, updates and texts: your consent, recorded separately for each purpose and each channel (email or text). You can withdraw it at any time.
• Event sign-ups and replying to messages: our legitimate interests in running church activities and responding to you. Dietary, allergy and access information is kept and used with your explicit consent, given when you tell us, and you can withdraw it at any time by asking us to remove it.
• Children’s details: the parent or carer’s explicit consent for allergies and medical needs, and our legitimate interests (and safeguarding duties) in keeping children safe and knowing who collects them.
• Emergency contacts: our legitimate interests in keeping people safe at our events and, in an emergency, to protect someone’s vital interests.
• Photos and videos: your consent (for a child, their parent or carer’s), which you give or refuse on the sign-up form. If you say no, we won’t use photos or videos that include you. We keep your answer on your record (and each child’s on their record) and ask you to confirm it when you book again, and you can withdraw it at any time by telling us; we record the date you withdrew it.
• Church records: our legitimate interests and, for information that reveals religious belief, the condition for not-for-profit religious bodies looking after their members and regular contacts.
• Keeping our systems secure: server logs and backups rely on our legitimate interests in keeping your information safe and our services working.
• Legal obligations: for example safeguarding duties, or keeping records the law requires.

Newsletters, emails and texts

We only send updates to people who have asked us to: we don’t email anyone who hasn’t. On our sign-up forms (and when you book for an event or say hello) there is a box, never ticked for you, that says “Yes, please keep me updated”. If you tick it, you then choose what you’d like to hear about, for example events and what’s on, church news or prayer; nothing is chosen for you. If you have given a mobile number you can also choose to hear by text as well. If you tell one of our team instead, they record your choices in the same way.

We record each choice separately (each kind of update, and email and text separately), with the exact words you agreed to and when, so saying yes to one does not mean yes to the others. As soon as you sign up we send you one email to say thanks and to list what you chose, with a button to unsubscribe straight away if you change your mind or didn’t sign up. If you were already getting everything you chose, we don’t send it again. Every email has an unsubscribe link that works straight away, and a link to change what you hear about.

If you have agreed to texts, we may send occasional text messages about the things you chose to the mobile number you gave us. We send texts through our own system. You can ask us to stop at any time by replying to say so or emailing hello@hope.gy.

Our newsletters are managed with listmonk, run on our own Hope OS servers, and delivered by Amazon Simple Email Service (Amazon SES, London region). If an email bounces or is marked as spam, we record that and stop sending to that address. We see overall open and click figures for each newsletter; we don’t track what individual readers do.

Connected Google accounts (our team)

If you serve on our team and choose to connect a Google account to Hope HQ, we ask Google only for what that feature needs.

Calendars. We ask for read-only access to your calendars and copy the title, time, place and description of events in the calendars you switch on, so you can see them in Hope HQ. They are visible only to you unless you choose to share a calendar with the church’s team. We never change your calendars unless you tick “Let Hope HQ add events to my calendars”: then, and only then, we also ask Google for permission to add events, and we add them only to the calendars you choose (for example an event you send us a screenshot of).

Contacts. If you connect your contacts, we read them (read-only) so you can find people in Hope HQ’s address book. We never change or delete anything in your Google account.

We cannot see your email or files through these connections. You can disconnect at any time in Hope HQ: we withdraw our access at Google and delete what we copied. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

We don’t sell your data or share it for anyone else’s marketing. We use trusted providers to run the church on our behalf (our “data processors”). They act only on our instructions and must keep your data secure:

• Hope OS — our church management system, which holds contacts, event sign-ups, consent records and newsletters. It is provided by Andrew Wiltshire trading as Ackrem Consulting, acting as our data processor.
• Oracle Cloud — hosts the Hope OS servers.
• Ackrem’s own equipment — backups of Hope OS are kept on equipment owned by our data processor. Some tools run on our processor’s own equipment. Your information is not sent to any outside AI company.
• Tailscale — the private network that connects the Hope OS servers and backup equipment securely. It sees technical connection details, not your data.
• Google Workspace — our church email, calendars and documents.
• Amazon Web Services — Amazon SES delivers our emails.
• Cloudflare — runs this website’s domain name system.
• Google Fonts — supplies the fonts on this website, so your browser connects to Google, which sees your IP address.
• ChurchSuite — our previous church management system. Some sign-up forms on this website are still hosted by ChurchSuite while we finish moving to Hope OS, after which we will close our ChurchSuite account.

We aim to keep your data in the UK. Google (which supplies our website fonts) and Cloudflare may process some data, such as your IP address, outside the UK. Where they do, they protect it with the safeguards UK data protection law requires for transfers abroad, such as the UK–US “data bridge” or contract terms approved for that purpose. We may disclose information if required by law (for example, to comply with a legal obligation or to protect someone’s safety).

How long we keep it

• Email and text sign-ups: while you’re hearing from us, and deleted 24 months after our last contact with you. If you unsubscribe, we keep only a minimal record that you opted out, so we don’t email you again by mistake.
• Event bookings: kept for 12 months after the event, then deleted (we keep only a count of how many came). This includes each booking’s answers.
• Photo and video permission: kept on your record (and each child’s) for as long as we are using photos or videos, so we can respect your choice. If you withdraw it we keep the date you did so, and we stop using photos or videos that include you. We delete it when we are no longer using those photos, or if you ask us to erase your information. If we keep a child’s photo permission beyond 24 months, we keep only their name with it.
• Allergy, dietary and access information, emergency contacts and children’s details: kept on your record for as long as you’re in contact with us, so we can look after you at future events, and deleted 24 months after our last contact with you, or sooner if you ask us to remove it.
• Contact details: while you’re involved with the church, and deleted 24 months after our last contact with you.
• Consent records: for as long as we rely on the consent, and for two years after you withdraw it, so we can show we acted properly.
• Messages to us: messages you send us (emails, texts and our “Say hello” and sign-up forms) are deleted from Hope OS 12 months after we receive them, unless we are still dealing with them, in which case they are deleted once we have finished.
• Server logs: 90 days.
• Backups: up to about 12 months. Something deleted from Hope OS stays in older backups until they expire, and is not used in the meantime.

Cookies

Cookies are small files stored on your device. This website does not use analytics or advertising cookies, and we don’t run Google Analytics or any other tracking. We only use essential cookies — for example to keep you signed in to Hope OS, or to remember that you’ve hidden a notice. These are needed for the site to work and don’t need consent.

Your rights

Under UK data protection law you have the right to: be told how we use your data (this notice); access the personal data we hold about you; have it corrected; have it erased; restrict or object to how we use it; data portability; and withdraw consent at any time, without affecting anything we did before. You can always ask us to stop sending you updates. To exercise any of these rights, email hello@hope.gy. We’ll respond within one month, and there’s normally no charge. If a request is complex, or you have made several, we may extend that by up to two further months; if so we’ll tell you within the first month and explain why. We may need to check your identity before we act on a request, so we don’t give your information to someone else.

Some rights have limits. For example, we can’t erase records the law requires us to keep, such as Gift Aid declarations and our financial accounts, until the time for keeping them has passed. We do not make decisions about you by purely automated means.

Changes to this notice

We may update this notice as the church develops. We’ll change the “last updated” date above when we do.

Contact

Questions about your data? Email our data protection lead, Andrew Wiltshire, at hello@hope.gy, or write to us at Hope Vineyard Church Great Yarmouth, The Christchurch Building, King Street, Great Yarmouth NR30 2NZ.