Privacy Policy (Privacy Notice)

Last updated: 13/03/2026

1 – Who We Are

Pastors Network (www.pastorsnetwork.co.uk) is a coordination platform for pastors, church administrators, and lay preachers across UK evangelical church networks.

The platform is operated by Concentric IT Ltd, 179 Walmersley Road, Bury, Lancs, BL9 5DF.

Company Number 05012213. ICO Registration Number: ZC106843.

If you have any questions about this privacy policy or how we handle your personal data, you can contact us at dp@pastorsnetwork.co.uk.

Data Protection Officer (DPO) Concentric IT Ltd has appointed a Data Protection Officer. The DPO can be contacted at:
Gordon Hall, dp@pastorsnetwork.co.uk, 179 Walmersley Road, Bury, Lancs, BL9 5DF.

Our Data Protection Agreement can be found at: https://pastorsnetwork.co.uk/dpa/

2 – What Personal Data We Collect

We collect and process the following categories of personal data:

2.1 – Account and Profile Data

Full name, email address, and phone number
Church name, address, postcode, and denomination
Your role (pastor/elder, administrator, or lay preacher)
Profile photograph (if uploaded)
Church logo (if uploaded)
Website URL
Sermon audio files (if uploaded to your profile)
Whether you preach and your experience level
Network memberships (e.g., LRBF, NWGP, Grace Baptist, FIEC, Independent)

2.2 – Service and Activity Data

Pulpit cover requests and slot acceptances
Pulpit swap arrangements
Calendar events you create or attend
Ask for Help requests and responses
Notes and tasks you create
Building and equipment log entries
BookShare listing activity (books proposed, commitments made)
Favourites and block lists
Notification preferences

2.3 – Pastoral Data

- Pastoral visit records (dates, notes, follow-up actions)
- Prayer points derived from pastoral visits (only where explicitly shared by the pastor)
- Members Database records: names, contact details, member type, age bracket, gender, marital status, key dates, tags, and any pastoral notes
Pastoral visit notes and Members Database records may contain references to health conditions, family circumstances, or other sensitive matters. This data is classified as special category data under UK GDPR and is processed under the conditions set out in section 4 below.

2.4 – Technical and Analytics Data

IP address and browser type (collected automatically by our web server and passed to Google Analytics in anonymised form)
Login timestamps
Analytics data collected via Google Analytics 4, including pages visited, time spent on pages, referring source, device type, browser, and approximate geographic location (country/city level). This data is associated with a randomly generated identifier, not your name or email address.
Cookie Policy — see our Cookie Policy for full details of the cookies we use.

3 – How We Collect Your Data

We collect personal data in the following ways:

Directly from you, when you register an account, complete your profile, enter pastoral visit notes, add members to your church database, create events, post pulpit cover requests, or use any other platform feature.
From your church pastor or administrator, who may add you to their church’s Members Database as a member, attender, or contact (see section 4.4 for further information about your rights in this context).
Automatically, through cookies and server logs when you use the website.
Via Google Analytics 4, which collects anonymised data about how you navigate and use the website when you have given your consent to analytics cookies.

4 – Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

4.1 – Contract

Processing your account data, profile information, and activity data is necessary for the performance of the contract between you and Concentric IT Ltd (our Terms of Use). Without this processing, we cannot provide the platform services.

4.2 – Legitimate Interests

We process certain data where it is in our legitimate interests to do so, and where we have assessed that those interests are not overridden by your rights and interests. Before relying on legitimate interests as a legal basis, we have carried out a Legitimate Interests Assessment (LIA). You may request a copy of any relevant LIA by contacting us at dp@pastorsnetwork.co.uk.

We rely on legitimate interests for:

Sending notification emails about pulpit cover slots, swap requests, and Ask for Help requests within your networks
Maintaining platform security and preventing misuse
Improving the platform based on usage patterns (aggregated and anonymised)

Weekly digest email: We also send a weekly digest email summarising platform activity relevant to you. Where you are an existing user of the platform, we rely on the soft opt-in under Regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR) as our basis for sending this email, in addition to our legitimate interest under UK GDPR. You can unsubscribe from the weekly digest at any time by using the unsubscribe link in the email or by updating your notification preferences in your account settings.

4.3 – Consent

Where we rely on consent, you have the right to withdraw it at any time (see below for how to do this). We rely on consent for:

Publishing your profile information in the platform directory (visible to other registered users). You can withdraw this consent at any time by navigating to Settings → Profile Visibility and toggling your directory listing to “Hidden”. Your profile will be removed from the directory immediately.
Sharing your contact details with a church when you accept a preaching slot. You provide consent at the point of acceptance. If you later wish to withdraw your consent for a specific acceptance and have your details removed from that church’s records, please contact us at dp@pastorsnetwork.co.uk. Note that where a church has already received your details, we will request that they delete them, but we cannot guarantee retrospective deletion of data held independently by the church as a separate data controller.
Analytics cookies. We use Google Analytics 4 to understand how visitors use the website, but only where you have given your consent via the cookie consent banner. You can withdraw this consent at any time by clearing your cookie preferences through your browser settings and revisiting the site. See our Cookie Policy for full details.

4.4 – Special Category Data and the role of Churches as Data Controllers

Pastoral visit notes, prayer points, and Members Database records may contain special category data (religious beliefs, health information). We process this data under the following conditions:

Article 9(2)(d) UK GDPR: processing is carried out in the course of the legitimate activities of a not-for-profit body with a religious aim, and the processing relates solely to members or former members of that body, or to persons who have regular contact with it in connection with its purposes, and the personal data is not disclosed outside that body without the consent of the data subjects.
Article 9(2)(a) UK GDPR: the data subject has given explicit consent to the processing of their personal data for one or more specified purposes.

Important: churches as independent data controllers

When a church administrator adds congregation members and other individuals to the Members Database, the church acts as the data controller for those individuals’ data. Concentric IT Ltd acts as the data processor on the church’s behalf, processing that data only in accordance with the church’s instructions and our Data Processing Agreement (DPA).

This means that if you are a congregation member or contact who has been added to a church’s Members Database — and you have not yourself registered an account on Pastors Network — the church, not Concentric IT Ltd, is primarily responsible for your data and for having a lawful basis to process it. The church is also responsible for informing you that your data is held in the platform and explaining your rights.

However, as data processor, we are committed to assisting churches in meeting their obligations. If you believe your personal data is held in a church’s Members Database on this platform and you wish to exercise your rights (including the right to access, correct, or erase your data), you may:

Contact your church directly, as they are your data controller; or
Contact us at dp@pastorsnetwork.co.uk and we will assist in identifying the relevant church and facilitating your request.

Our full Data Processing Agreement, which sets out the obligations on both the church (as controller) and Concentric IT Ltd (as processor), is available by contacting us: dp@pastorsnetwork.co.uk

5 – How We Use Your Data

We use your personal data for the following purposes:

To create and manage your account on the platform
To display your profile in the directory to other registered users in your networks (where you have consented to directory visibility)
To match you with pulpit cover opportunities and swap requests
To send you email notifications about platform activity (controllable via your notification preferences)
To send you the weekly digest email (see section 4.2 for the legal basis and opt-out mechanism)
To enable your church to manage its pastoral visits, members database, building log, and other operational tools
To provide the BookShare book-ordering coordination service
To generate visiting preacher information documents for the churches you are visiting
To maintain the security and integrity of the platform
To analyse how the website is used and improve its content and navigation, using anonymised analytics data collected via Google Analytics 4 (where you have consented to analytics cookies).

Automated decision-making and profiling

We do not make any automated decisions about you that produce legal or similarly significant effects within the meaning of Article 22 UK GDPR. The pulpit cover matching feature uses your profile information (including preaching experience, network memberships, and location) to suggest relevant opportunities, but all decisions are made by human users. No profiling with significant effects on individuals takes place. If our approach changes, we will update this policy and inform you before any such processing begins.

6 – Who We Share Your Data With

We do not sell your personal data to anyone. We share data in the following limited circumstances:

With other registered users within your church networks, as part of the directory, pulpit cover, and event coordination features. You control your visibility through your notification preferences and block list.
With the church whose preaching slot you accept (your name, email, and profile information are shared so the church can contact you with practical details). See section 4.3 for how to withdraw this consent.
With our web hosting provider, 20i, which stores the data on servers located in the UK.
With Google Ireland Limited, as our Google Analytics 4 provider, where you have consented to analytics cookies. Google may process this data outside the United Kingdom. Google relies on Standard Contractual Clauses as the transfer safeguard. See Google’s Privacy Policy for further information.
With law enforcement or regulatory authorities, if required by law.

Other than the Google Analytics transfer described above, we do not transfer personal data outside the United Kingdom. If this changes in the future, we will update this policy and ensure appropriate safeguards are in place.

7 – How Long We Keep Your Data

We retain your personal data for as long as your account is active on the platform. The specific retention periods that apply to each category of data are set out in our Data Retention Policy.

In summary:

Account and profile data: retained until you delete your account or request that we remove it.
Pastoral visit records: retained for the period configured by your church pastor in their settings, after which they are archived or deleted.
Members Database records: retained until the church administrator removes them.
Notifications: automatically deleted after the retention period configured in platform settings (default: 90 days).
Inactive accounts: accounts with no login activity for 12 months will be flagged for review and the account holder notified before any deletion takes place.
Platform backups: retained for a maximum of 30 days, then permanently deleted.

8 – Your Rights

Under UK GDPR, you have the following rights. Please note that not all rights apply in every circumstance; where a right is qualified or limited, we will explain this when you make a request.

Right of access: You can request a copy of all personal data we hold about you.
Right to rectification: You can ask us to correct inaccurate data. You can also update most of your own data directly through your profile.
Right to erasure: You can ask us to delete your data, subject to any legal obligations we have to retain it.
Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
Right to data portability: Where we process your personal data on the basis of consent or contract, and the processing is carried out by automated means, you can request your data in a structured, commonly used, machine-readable format. This right applies to data you have provided to us directly; it does not apply to data that has been inferred or derived from your activity, or to data processed on the basis of legitimate interests.
Right to object: You can object to processing based on legitimate interests (including profiling for direct marketing purposes). We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Right to withdraw consent: Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. See section 4.3 for the specific mechanisms for withdrawing consent.
Rights in relation to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. As noted in section 5, we do not engage in such processing.

To exercise any of these rights, contact us at dp@pastorsnetwork.co.uk. We will respond within one calendar month (or within three months for complex or numerous requests, with notification within the first month).

If you are not satisfied with how we handle your request, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

9 – Data Security

We take the security of your data seriously. We protect your personal data through:

Encrypted connections (HTTPS/TLS) for all data in transit
Password-protected user accounts with role-based access controls
Pastoral visit privacy controls (private by default; shared only at the pastor’s explicit instruction)
Separate access levels for pastors, administrators, and lay preachers
Regular platform updates and security patches
Firewalls
Two-factor authentication for pastors

While we take all reasonable precautions, no system is completely secure. If we become aware of a data breach that poses a risk to your rights, we will notify the ICO within 72 hours and inform you without undue delay.

10 – Children’s Data

The platform is primarily designed for use by pastors, church administrators, and lay preachers, who will typically be adults. However, we recognise that the Members Database will in many cases contain records relating to children.

Platform accounts: We do not knowingly register children under the age of 18 as users of Pastors Network. Under the UK GDPR and the ICO’s Age Appropriate Design Code (Children’s Code), anyone under 18 is considered a child for the purposes of online data protection. If we become aware that a child under 18 has registered an account without parental or guardian consent, we will take steps to remove that account and the associated data. If you believe a child has registered without appropriate consent, please contact us at dp@pastorsnetwork.co.uk.

Members Database records: Where a church administrator adds a child to their church’s Members Database, the church is the data controller for that child’s record and is responsible for ensuring it has an appropriate lawful basis — which will ordinarily require the consent of a parent or guardian for children under 13, and may require the child’s own consent or assent for older children, depending on their capacity. Concentric IT Ltd processes such records only on the church’s instructions as data processor.

11 – Cookies

We use cookies and similar technologies on this website. Full details of the cookies we use, why we use them, and how to control them are set out in our Cookie Policy.

Under the Privacy and Electronic Communications Regulations 2003 (PECR), we will only set non-essential cookies with your prior consent, which we obtain via the cookie consent banner displayed on your first visit to the site.

12 – Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users by email of any significant changes. The date at the top of this policy shows when it was last updated. Previous versions of this policy are available on request.