1.0 Your rights, this notice & our approach
The EU General Data Protection Regulation (GDPR) gives you rights over the information we hold about you. Integritetsskyddsmyndigheten (IMY), the Swedish privacy authority, explains these rights on its website.
This privacy notice tells you what to expect when Grace Church Stockholm collects personal information.
We are committed to safeguarding the privacy of your information. We do all that we can to ensure that your data is processed fairly and lawfully and used for the intended purpose. We aim to ensure that the data we hold is accurate, adequate, relevant, not excessive and is not kept longer than is necessary in relation to the purpose it is held.
We will store your information securely on our systems, we restrict access to employees and volunteers and contractors who have a ‘need to know’ (i.e. if they can directly help, information is required for them to fulfil their role or if they have a legal responsibility) and we direct them in handling the information securely and appropriately in line with our policies.
We only use your information when the law allows it: because you gave your consent, because we need it to do something you asked for, because the law requires it, or because the church has a legitimate interest that does not override your rights.
Being part of a church says something about what you believe, and the GDPR treats religious belief as sensitive information. As a not-for-profit church, we may hold this information about members, former members and people in regular contact with us, and we do not share it outside the church without your consent.
Some of the providers we use are based outside the European Economic Area. ChurchSuite hosts its service in the UK, which the EU recognises as protecting personal data to an adequate standard. Our providers in the US, such as Google and Netlify, rely on the EU-U.S. Data Privacy Framework or the EU’s standard contractual clauses.
Further information about the privacy approaches of the third-party providers we use are shown via webpage links found in this notice.
We keep our privacy notice under regular review. This privacy notice may change from time to time. If we make a change to it that we believe materially reduces your rights, we will provide you with notice (for example, by email). We may also provide notice of changes in other circumstances as well.
This privacy notice was last updated on 22 October 2026.
2.0 Queries, concerns & subject access
You can contact us to find out if we hold any personal information about you, to update or change your personal details, to request a copy of any personal information held, or to request that your data is erased (unless data retention is required for legal purposes).
To make a request to Grace Church for any of the above, or to find out more about our privacy notice or related queries, email us at: hej@gracechurch.se
If you have a concern or complaint about the way we are collecting or using your personal data, you should raise your concern with us (using the contact info above) in the first instance or directly to Integritetsskyddsmyndigheten (IMY).
3.0 Connecting with Grace Church
3.1 Direct communications
We send emails to our church family through ChurchSuite, our church management system. When an email list needs your consent, such as a newsletter, we ask for it when you sign up. You can unsubscribe from our emails at any time, and every email tells you how.
We use ChurchSuite and Google Workspace to store contact information, record consent and send these emails. We keep your details until you unsubscribe or ask us to remove them. More about how these providers handle data: ChurchSuite and GDPR, ChurchSuite privacy notice, Google Workspace and GDPR.
Alongside this, there are groups of people (e.g. team leaders, team members, small group members) where a legitimate interest is shared with Grace Church. We hold their contact information in ChurchSuite so these groups can keep in touch, and you can leave a group or ask us to remove your details at any time. Contact hej@gracechurch.se for more information or to make a request.
Personal information may also be shared through our notices slideshow at our Sunday gatherings. This will however only be shown if consent has been received from the individuals involved.
3.2 Connecting via our website
Grace Church uses its website to inform people and to let visitors get in touch with us. Netlify hosts our website.
When you send a form on our website, such as a message, a prayer request or a note that you plan to visit, Netlify stores it, checks it for spam with Akismet and emails it to hej@gracechurch.se. We delete the copy on Netlify within two days. We may add your name and contact details to ChurchSuite so we can follow up with you.
Our church operations team and elders read the prayer requests sent through the website. The requests stay in the church’s email inbox, and you can ask us to delete yours at any time. Please share only what you are happy for them to know.
If you accept when our website asks, it uses Google Analytics to see which pages help people. Google Analytics sets cookies, and we have turned off its advertising features. Nothing from Google Analytics loads until you accept, and you can change your answer at any time under Cookie settings at the bottom of every page. The website uses no other analytics or advertising cookies.
A few parts of the website load from other services: the sermons come from Podbean, the calendar from ChurchSuite and the map from Google Maps. The map only loads when you ask for it, and Google may set cookies when it does. These services can see your IP address, as any website you visit can.
All content on the site (e.g. words, photos) is only published if consent has been received. If links are provided to other websites (on our website), they are not covered by this privacy notice. Please review the privacy notices /policies on the sites you visit.
3.3 Connecting via social media / video channels / WhatsApp
We use Instagram, TikTok, Facebook (including Messenger), YouTube and WhatsApp to connect with those who are part of, or interested in, Grace Church. As with our website, we will only publish ‘new’ content if we have the consent from those people the content refers to. Please refer to the privacy policies of these providers for more information: Instagram, TikTok, Facebook, YouTube, WhatsApp.
3.4 Connecting via email
Grace Church uses Gmail (Google Workspace) for email communication, which has built-in security measures. We will use your email address to correspond with you over the content of your inquiry until a conclusion is reached. The nature of the content of your email will determine how long it is kept for. We will not add your address to any direct communications list (see section 3.1) unless you have given your consent for us to do so. If at any time you wish to remove your email address from our systems then please contact us as per section 2.0. Google Privacy Policy.
3.5 Events
We use ChurchSuite, Facebook, Doodle and Eventbrite to run event sign-ups and the emails that go with them. Event planning documents are stored on Google Drive. These privacy statements can be found in sections 3.1 and 3.3 or here: Doodle, Eventbrite. We will ask you for contact information and your preferences according to the type of event being run. The information we collect is only used to facilitate the contract between us (by you attending the event). This information will not be used for any other purposes or passed onto any other third parties unless you have consented for us to do so. We will hold any data you provide us, which is specific to the event, until all aspects of the event are completed.
3.6 Financial transactions & management
Grace Church uses Swish, bank giro and bank transfers to help facilitate its financial transactions, donations and financial management. Depending on how you give, this involves your name, phone number, address or bank details.
We bank with Swedbank who process all payments. Records are kept as a minimum for the period required to meet statutory compliance or until the contract is completed. Financial reports are stored on Google Drive with restricted access. Please refer to these privacy policies for more information: Swedbank. Swish. Bankgirot.
In order to maintain statutory compliance, certain information is shared with Skatteverket (the Swedish tax authority).
4.0 Day to day running
4.1 General operation & systems
In order to facilitate the operation of Grace Church, we use ChurchSuite and Google Drive. The third-party privacy policies can be found here: ChurchSuite privacy notice, Google Workspace and GDPR.
Certain documents are required for the daily running and administration of church activities and volunteers, as well as tracking numbers attending and demographics. These include our attendee contact list, volunteer lists and rotas. These are stored in ChurchSuite and on Google Drive, and access is limited to team leaders and volunteers on a need to know basis as per section 1.0.
If paper documentation containing personal information is required to carry out general operations, it is securely stored and securely destroyed when no longer needed. As with the online/electronic systems, access is restricted according to the ‘need to know’ principle as outlined in section 1.0.
Any physical promotional literature produced involving personal information (including photos) will always require the consent of the individual involved.
4.2 Employment & HR
Recruitment documents (e.g. CV) and employment documents (e.g. contracts and payslips) will contain / require personal information to be held. This information is held because of a statutory and legal responsibility to do so, and to carry out contractual requirements.
Personal information will also need to be held for volunteers, especially those with specific responsibilities. All of this information is held in line with principles outlined in section 1.0 and is held until all statutory responsibilities have been fulfilled.
Employment and HR documentation are stored in Google Drive. In addition, MaxPA is used to facilitate payroll. Where a role involves work with children, we may ask the person to show us an extract from the Swedish police record (belastningsregistret). MaxPA.
5.0 Acknowledgements
Our thanks to Relational Mission, on whose Privacy Notice this is based.
6.0 Contact information
Grace Church Stockholm
Organisation number 802476-1200
Jyllandsgatan 215, Kista
hej@gracechurch.se