In short
- If you ask your parish for a Mass, your parish decides what happens with your details. Pewbook runs the system for them.
- We collect only what's needed to arrange the Mass, and nothing for advertising.
- Intentions aren't shown on public pages unless your parish publishes them, and never if you ask for them not to be.
- Everything is held in the UK or EU, apart from the few services listed in our sub-processors.
- You can ask to see, correct or delete your details, and you can complain to the ICO.
If you ask your parish for a Mass
Who is responsible
Your parish is the "controller": it decides what happens with your request. Pewbook runs the system for the parish as its "processor". If you have a question about your request or your details, please contact your parish first. If you write to us instead, we'll pass your message on to them.
What we collect
- Your name and email address, and your phone number if you choose to give it.
- The intention (who the Mass is for) and what it's for, such as a birthday or someone who has passed away.
- The Mass you chose: its date, time and church.
- Whether the intention may be printed in the parish newsletter, and, if your parish allows it, whether you agree to it being offered together with others.
- If you tick "Remember me", a random code kept on your phone or computer (in the browser's storage, not a cookie). We keep a coded version of your email address and a shortened hint of it, such as j•••@g•••.com, so we can recognise you next time.
Your internet address is used for a short time to stop too many requests coming from one place, and isn't stored. That's all.
Why this is special
An intention can show your religious belief, so the law treats it as "special category" data and protects it more. Your parish may use it because it's a not-for-profit religious body and you're one of its members or regular contacts (UK GDPR Article 9(2)(d)). Where that doesn't apply, it relies on your explicit consent, which you give by sending the request.
Who can see it
Your parish's staff can see your request. On public pages, a Mass only ever shows as "Available" or "Taken". Your intention is published, for example in the newsletter, only if your parish publishes intentions, and never if you untick "Include this intention in the parish newsletter".
We don't use advertising or tracking cookies, and we don't sell or share your details. If we count visits to pages, we do it ourselves, without cookies and without identifying you.
Where it's kept, and for how long
Your details are held in the UK or EU. The outside services we use are listed in our sub-processors.
- If you don't confirm your email, your request is deleted after 24 hours.
- Your email address and phone number are deleted 12 months after the Mass is celebrated. If a request is declined or cancelled, your name, email and phone number are deleted 12 months later.
- The intention and the Mass stay in the parish's Mass register, which church law requires the parish to keep, for as long as the parish needs it.
- If you chose "Remember me", it lasts for the time your parish sets. You can forget the device at any time.
Your rights
You can ask to see your details, to have them corrected, or to have them deleted. The parish may need to keep its register entry for your Mass, but it can still remove your contact details. You can also object to how your details are used. Ask your parish, or email us and we'll pass it on.
If you're unhappy with how your details have been handled, you can complain to the Information Commissioner's Office at ico.org.uk.
If you work for a parish, or sign one up
Who is responsible
For staff accounts, sign-up details and billing contacts, Pewbook is the controller.
What we collect
- Your name, email address and role (admin, clergy or volunteer).
- Login records: when a login link was sent and used. Your login is kept on your own device, in the browser's storage.
- The audit log: a record of who changed what in your parish's records, and when.
- Billing details for paid modules, through Stripe. We never see card or bank numbers.
Why we use it
To provide the service your parish has signed up for (our contract with your parish), and to keep it secure, through login records and the audit log (our legitimate interests).
How long we keep it
While your parish's account is active. When an account ends, we keep the data for 30 days so the parish can export it, then delete it, as our terms describe.
Your rights
You have the same rights as above: to see, correct and delete your details, and to object. You can complain to the ICO at ico.org.uk.
Contact us
Lewis Cummins, trading as Pewbook
33 Appleyard Close, Cheltenham, GL51 9FF
[email protected]