Privacy policy

This privacy notice is issued on behalf of Westminster Theological Centre (WTC), and when.we mention “We”, “Us or “Our” in this privacy notice, we are referring to the relevant charity that is responsible for processing your data.

This privacy notice describes how WTC Shop (the "Site", "we", "us", or "our") collects, uses, and discloses your personal information when you visit, use our services, or make a purchase from wtctheology.myshopify.com (the "Site") or otherwise communicate with us (collectively, "Services"). For purposes of this Privacy Policy, "you" and "your" means you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy.

WTC is a charity registered in England and Wales, number 1123573. We are also a company limited by guarantee, number 6506007. Our Site is owned and operated by WTC whose registered address is:

16-17 Clarence Parade
Cheltenham
Gloucestershire
GL50 3PA

The Trustees for WTC are the data controllers and are responsible for general data
protection matters and complaints arising from day-to-day matters.

We have appointed a Data Protection Lead to oversee questions related to this privacy notice. Queries related to Data Protection should be directed to the Data Protection Lead (see the section “How to Contact Us”).

How We Collect and Use Your Personal Information

This notice applies to the personal information We collect about you directly or that We collect from third parties. It sets out:

  • What information We collect, and from whom
  • How We use that information
  • Direct Marketing
  • Lawful Basis
  • How do We store your data how long We keep it for
  • How your information is protected
  • How do We share your data
  • International transfers of personal data
  • Cookies
  • How you can control your data
  • Summary of your rights in relation to the information We hold about you
  • Contact Us
  • How to complain

This website is not intended for children, and We do not knowingly collect data relating to children.

What Data Do We Collect?

We collect personal information you give Us when you:

  • Basic contact details including your name, address, phone number, email.
  • Order information including your name, billing address, shipping address, payment confirmation, email address, phone number.
  • Account information including your username, password, security questions.
  • Shopping information including the items you view, put in your cart or add to your wishlist.
  • Customer support information including the information you choose to include in communications with us, for example, when sending a message through the
    Services. 

Where We request information from you, this will be explained in the relevant forms or pages, or over the telephone. You may choose to provide additional information when you interact with Us or to a third party who refers you to Us. We store customer feedback and information on our customer databases.

How Do We Use Your Data?

All personal data is stored securely in accordance with the DPA 2018 (the UK’s General Data Protection Regulation). We use your data to provide the best possible products and services.

This includes:

  • Processing your order, payments, returns and exchanges.
  • To administer and manage our relationship with you, such as responding to
    communications
  • Responding to communications from you
  • To send transactional and service messages in relation to an event
  • Analysing your use of Our Site and gathering feedback to enable Us to continually improve Our Site and your user experience
  • To comply with legal or regulatory requirements
  • To help us establish, exercise, or defend legal claims
    In some cases, the collection of data may be a statutory or contractual requirement, and We will be limited in the products and services We can provide you without your consent for Us to be able to use such data.

Direct Marketing

"Under the new Data (Use and Access) Act 2025 (DUAA), we can send you electronic mail (emails, texts, social media messages) about our charitable purposes and ways you can support us if you have previously shown interest or offered support to our charity.

Your choices and rights: When you provide your details, we will always give you a clear and straightforward way to say "no" to marketing. Every message we send will also include an easy way to opt out (e.g., an unsubscribe link). You can stop receiving these communications at any time by following the opt-out instructions or contacting us."

We will not, however, send you any unsolicited marketing or spam, and we will take all reasonable steps to protect your rights and comply with our obligations under the DPA 2018, the GDPR, and the Privacy and Electronic Communications Regulations 2003.

To set your preferences on how Shopify send you marketing information, please follow this
link https://privacy.shopify.com/en

Lawful Basis

Under the UK’s GDPR, we will ensure that your personal data is processed lawfully, fairly, and transparently, without adversely affecting your rights. We will only process your personal data if at least one of the following bases applies:

You have given consent and explicit consent to the processing of your personal data for one or more specific purposes as listed below:

  • Marketing Material

Processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering a contract, as listed below:

  • Purchasing items
  • Send you communications about your purchase
  • Send you communications about changes to our services or our terms and
    conditions.
  • To help Us recover any debts that may be owed to Us by you.


Processing is necessary for compliance with a legal obligation to which we are subject, as listed below:

  • To provide the legal and regulatory authorities with specific information they
    appropriately request from us within their legal authority, and to help ensure we are combating Fraud and Financial Crime
  • Send you communications about changes to our services or our terms and
    conditions.
  • To help Us recover any debts that may be owed to Us by you.

Processing is necessary for the purposes of our legitimate interests or those of a third party, except where those interests are overridden by the data subject's fundamental rights and freedoms, which require the protection of personal data.

  • We rely on our legitimate interests for the following reasons:
  • Keeping our records up to date;
  • Communicating with you under the DUAA 2025
  • Presenting our content and communications most effectively and sustainably for you and your devices;
  • Complying with legal and or regulatory requirements;
  • To enable us to communicate with you, answering queries and providing relevant news and updates about your purchase
  • Processing complaints and enquiries

How do We store and how long do We keep it for

Personal data that we process for any purpose, or purposes shall not be kept for longer than is necessary for that purpose or those purposes. Our retention of your personal data is linked to your actions. Unless a longer retention period is required or permitted by law, we will only hold your Personal Information on our systems for the period necessary to fulfil the purposes outlined in this Notice, or until you
request that the information be deleted (see the section “Summary of Your rights").

Even if you ask us to delete your Personal Information, we reserve the right to retain your personal data where such retention is necessary for compliance with a Statutory obligation (for example to maintain a copy for legal, tax or regulatory purposes,) but in such event, we will do so only as long as necessary to fulfil those Statutory obligations.

How do We protect your data

Data security is of great importance to Us, and to protect your data, we have implemented appropriate physical, electronic, and managerial procedures to safeguard and secure data collected through Our Site.

All your data is stored electronically in a secure database or in a locked filing cabinet and can only be accessed by authorised people. All users of our system are trained in GDPR.

Where we engage third parties to process personal data on our behalf, they do so upon writing. They are contracted to implement appropriate technical and organisational measures to ensure data security.

For information on how Shopify secure your data, please follow the link Shopify Security -Shopify UK .

How do We share your data

We are committed to not sharing your data and will only do this if it is in your legitimate interest to ensure we provide you with the support and information required to make an informed decision about a service(s) or product(s).
We will not sell your data to any unconnected third parties.

We may contract with third parties to supply products and services to you on Our behalf. These may include payment processing and search engine facilities.

We might share your information across different parts of WTC for research, and analysis.

In some cases, third parties may require access to some or all of your data. Where any of your data is required for such a purpose, we will take all reasonable steps to ensure that your data will be handled safely, securely, and in accordance with your rights, Our obligations, and the obligations of the third party under the law.

We currently contract with:

 Third Party Name Used to Privacy Notice
WTC Consulting CRM https://wtc-consulting.co.uk/privacynotice
Shopify Online Shop Shopify Privacy Policy - Shopify UK
Mailchimp Newsletter https://www.intuit.com/privacy/statement/
Xero Invoicing & accounts https://www.xero.com/uk/legal/privacy/


We may also have to share your personal data with the parties set out below.

  • Professional advisers including lawyers, bankers, auditors and insurers based in the UK who provide legal, consultancy, banking, insurance and accounting services.
  • HM Revenue & Customs, regulators and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances.
  • We may share your personal information where we need to, where someone’s life is at risk, or we are required to do so by law.
  • Sell any or all of our college or assets or we buy another business or assets in which case we may disclose your personal data to the prospective buyer or seller.
  • Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

International transfers of personal data

We may need to transfer some personal data to the third parties described above who are located outside of the UK. In such cases, we will take appropriate measures to ensure your data remains protected. If the organisation is based outside of the UK and in a country that is not protected by an adequacy decision (providing an adequate level of data protection), we will take appropriate safeguards such as implementing the ICOs International Data Transfer Agreement (IDTA).

If you have any questions or need more information regarding international transfers of your personal data, please contact us, see the section “How to Contact Us.”

Automatic collection, Cookies and aggregate information collected from Shopify website

For specific information about the Cookies that we use related to powering our store with Shopify, see https://www.shopify.com/legal/cookies

How can you control your data?

You will be given the ability to opt-out of receiving emails from Us, which you may do by unsubscribing using the links provided in Our emails or by emailing us.

You may withdraw your consent for Us to use your personal data at any time by contacting Us, and We will delete Your data from Our systems. However, you acknowledge this may limit Our ability to provide the best possible products and services to you (see the section on How to Contact Us).

Please tell us as soon as any of your contact details change so that we can keep our records up to date.

You can make changes to your Shopify account by following this link Shopify Help Center | Managing your Shopify account

Summary of your rights

As a data subject, you have several rights and control over how your data is used. 

  • You can request access to, deletion of, or correction of, your personal data held by Us
  • You can ask for a copy of the data you have given Us
  • You can require Us to amend or change incorrect or incomplete data
  • You can require Us to delete or stop processing your data, where the data is no longer necessary for the purposes of processing
  • You can object to the processing of your data where We are relying on its legitimate interests as the legal ground for processing
  • You can ask Us to stop processing data for a period if data is inaccurate or there is a dispute about whether your interests override the company's legitimate grounds for processing data

To enforce any of the foregoing rights or if you have any other questions about Our Site or this Privacy Notice, please contact Us using the details set out in the section “How to Contact Us”.

How to contact Us

Should you have any questions about this statement or wish to make a complaint, please contact us in writing, through our website Contact Us, or by emailing us at
dataprotection@wtctheology.org.uk.

Please ensure that your query is clear, particularly if it is a request for information about the data We hold about you.

How to complain

If you are unhappy with the way that we have processed or handled your data, please contact Us as above.

If this does not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). The ICO is the supervisory body authorised by the Data Protection Act 2018 to regulate the handling of personal data within the United Kingdom. The contact details for the Information Commissioner’s Office are:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: 0303 123 1113 
Website: https://ico.org.uk/concerns/

Changes to Our Notice

We may change this Privacy Notice as we may deem necessary from time to time, or as may be required by English law. Any changes will be immediately posted on Our Site, and you will be deemed to have accepted the terms of the Privacy Notice on your first use of Our Site following the alterations. We recommend that you check this page regularly to keep up to date.

Last updated September 2026