1. Who is responsible for your information?
City on the Hill is the controller of personal information handled for its own website, directory, applications, communications and programmes. An independently listed business is normally a separate controller for information it collects through its own website or services.
Questions about this policy can be sent to info@cityonthehillglobal.com.
2. The laws and principles we follow
We aim to comply with the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and related privacy and electronic-communications rules where they apply. We process personal information lawfully, fairly and transparently; collect it for clear purposes; minimise what we use; keep it accurate; retain it only as long as needed; and protect it appropriately.
3. Information we may collect
- Contact details: name, email address, telephone number, organisation and role.
- Profile and application information: biography, business details, location, services, website, images, video links, credentials and verification evidence.
- Communication information: enquiries, feedback, event interests and correspondence.
- Transaction information: service, event or membership purchased, payment status, invoice and refund records. Payment-card data should be handled by the payment provider rather than stored by us.
- Technical information: IP address, browser, device, security logs, pages requested and necessary cookie or similar identifiers.
- Public-source information: relevant information from company websites, professional profiles or registers used to review or maintain a listing.
4. Faith and other sensitive information
Participation in a Christian ecosystem or information supplied for verification may reveal religious or philosophical beliefs, which can be special-category data. We minimise this information and process it only where an appropriate legal basis and special-category condition applies, such as explicit consent. You may withdraw consent where consent is the basis, although this may affect a verification or service that genuinely depends on the information.
Please do not send health, criminal-record or other highly sensitive information unless we specifically request it through an appropriate secure process.
5. Why we use information and our lawful bases
- To answer enquiries and take steps at your request: contract steps and legitimate interests in communicating with people interested in the ecosystem.
- To assess, publish and maintain profiles: contract, legitimate interests in operating a trusted directory, and consent where required.
- To provide memberships, events or paid services: contract and legal obligations relating to records, tax, refunds and disputes.
- To protect the website and users: legitimate interests in security, fraud prevention, moderation and service integrity.
- To improve and understand the service: legitimate interests using proportionate service data, and consent for optional analytics where required.
- To send marketing: consent where required, or another lawful route permitted for relevant business communications, always with an opt-out.
- To comply with law and establish legal claims: legal obligation and legitimate interests.
We decide and document the lawful basis before using information for a purpose. We do not use solely automated decisions that produce legal or similarly significant effects.
6. Who receives information?
We may share information only as reasonably necessary with:
- website hosting, cloud, email, security, analytics and customer-support providers acting under contract;
- payment, ticketing or event providers where you use those services;
- professional advisers, insurers, auditors or prospective transaction advisers under duties of confidence;
- authorities, regulators, courts or other parties where required by law or necessary to protect rights and safety; and
- the public, where you have applied for information to appear on a public profile.
We do not sell personal information.
7. International transfers
City on the Hill has an international audience and some suppliers may process information outside the UK. Where a restricted transfer occurs, we use an applicable adequacy decision, approved contractual safeguards or another lawful transfer mechanism, together with appropriate risk and security measures.
8. How long we keep information
We keep information only for as long as needed for the stated purpose, including maintaining an active profile, answering an enquiry, providing a service, meeting tax or legal requirements, resolving disputes and protecting legitimate interests. We consider the type, sensitivity, volume and risk of the information when setting and reviewing retention periods. Information is then securely deleted or anonymised.
9. Security
We use proportionate technical and organisational measures intended to protect information against loss, misuse, unauthorised access, alteration and disclosure. No online system can be guaranteed completely secure. If a personal-data breach creates a reportable risk, we will notify the ICO and affected individuals as required.
10. Your data-protection rights
Depending on the circumstances, you may have rights to:
- be informed and obtain access to your personal information;
- correct inaccurate or incomplete information;
- request erasure or restriction;
- object to processing based on legitimate interests and object to direct marketing at any time;
- receive or transfer information under the data-portability right where it applies;
- withdraw consent at any time, without affecting earlier lawful processing; and
- complain about how your information has been handled.
To exercise a right, email us. We may ask for proportionate information to confirm identity and locate the relevant records. Rights can be subject to legal conditions and exemptions, which we will explain if relevant.
11. Cookies and similar technology
The website may use technology necessary for security, network delivery and user preferences. If optional analytics, advertising or similar technology is enabled, we will provide information and seek consent where required. Browser controls can also be used to manage cookies, although blocking necessary technology may affect functionality.
12. Children
The directory and professional ecosystem are not designed for children to use independently. If a programme involves young people, we will provide suitable privacy and safeguarding information for that activity.
13. Complaints
Please contact us first so we can try to resolve the concern. You also have the right to complain to the UK Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint for current guidance and contact routes.
14. Changes to this policy
We review this policy when our activities, technology, suppliers or legal obligations change. The effective date above shows the latest published version. Material new uses of information will be communicated before they begin where required.