Privacy Policy

1. Two different relationships

This is the most important section in this policy, because our responsibilities differ depending on whose information is involved.

Parish account users. When a parish registers, and when priests, office staff and ministry leaders create accounts, we decide how that account information is handled. For this information we are the data controller.

Parishioner information. When a parish collects registrations, ministry applications, contact details and communication preferences from its parishioners, the parish decides what to collect, why, and for how long. We only store and process that information on the parish's instruction. For this information the parish is the data controller and we are the data processor.

In practice this means we do not decide what a parish asks its parishioners, we do not use parishioner information for our own purposes, and we do not contact parishioners except when carrying out an instruction from their parish.

2. Information we collect

Parish and account information. Parish name, location, worship sites, diocese, and the name, email address and role of each person with an account. Where a parish subscribes to a paid plan, billing contact details and subscription records.

Parishioner information, held on behalf of parishes. Name, contact details, household composition, and the faith background a parish chooses to record, which may include sacramental history, previous parish, and baptism or confirmation dates. Ministry applications, volunteer assignments, communication preferences, and the record of messages sent and delivered.

Technical information. IP address, browser and device type, pages visited, and timestamps. We use this to keep the Platform secure and working, to diagnose faults, and to understand aggregate usage.

We do not buy personal information from third parties, and we do not build advertising profiles.

3. How information is used

Account information is used to provide the Platform, authenticate users, apply the correct permissions to each role, process subscription payments, send service notices such as security alerts and billing reminders, and respond to support requests.

Parishioner information is used only to deliver the functions the parish has asked for: recording registrations, supporting the parish's follow-up with newcomers, managing ministry applications and schedules, and delivering the communications the parish sends.

Technical information is used for security, fault diagnosis, and aggregate service improvement.

We do not sell personal information. We do not share it with advertisers. We do not use parishioner information to market the Platform to anyone.

4. Legal bases

Where the General Data Protection Regulation applies, we rely on the following legal bases for the information we control:

• •Contract, to provide the Platform to a subscribing parish and to administer its account and billing.
• •Legitimate interests, to keep the Platform secure, prevent abuse, and improve the service, balanced against the rights of the people involved.
• •Legal obligation, where we are required to retain records, for example for tax purposes.

For parishioner information, the parish determines the legal basis. Parishes are responsible for ensuring they have a lawful basis for collecting and using the information they enter into the Platform, and for telling their parishioners how that information will be used.

Where Nigerian, Canadian or other national data protection law applies, we handle information in line with the equivalent requirements of that law, including the Nigeria Data Protection Act 2023 and the Personal Information Protection and Electronic Documents Act in Canada.

5. Data ownership: the parish, not the platform

Parishioner information entered into the Platform belongs to the parish community that collected it.

We will not use it for any purpose the parish has not asked for. We will not disclose it to another parish. A parish may export its data at any time in a portable format, and may request deletion of its data at any time. On termination of a subscription, a parish may export its data during the period described in section 8, after which it is deleted.

6. Who else processes information

We use a small number of service providers to run the Platform. Each processes information only as needed to provide their service to us.

We will update this list when it changes and give notice of material changes to parishes before they take effect.

7. Security

Each parish's data is isolated at the database level using row-level security, not only by permission checks in application code. This means a query originating from one parish cannot return another parish's records even in the event of an application-level fault.

We also apply encryption in transit and at rest, role-based access control within each parish, restricted and logged administrative access on our side, and regular dependency and security review.

No system is perfectly secure. If a breach affecting personal information occurs, we will notify affected parishes without undue delay and, where required, the relevant supervisory authority.

8. How long information is kept

Parishioner information is kept for as long as the parish maintains it, because the parish decides retention. We provide tools for parishes to delete individual records.

Account information is kept for the life of the subscription. After a subscription ends, parish data remains available for export for 30 days, then is deleted from live systems within 90 days and from backups within 180 days.

Billing records are kept for 7 years, or as required by applicable tax law.

Technical logs are kept for 90 days.

9. Rights

Depending on where you live, you may have the right to access the personal information held about you, to correct it, to request its deletion, to receive it in a portable format, to object to or restrict certain processing, and to withdraw consent where processing relies on consent.

If you are a parishioner, the parish holds your information and decides how it is used. Please contact your parish directly. If you contact us, we will refer you to your parish and assist the parish in responding.

If you hold a Platform account, contact us and we will respond within 30 days.

Every message sent through the Platform respects the recipient's communication preferences, and parishioners may opt out of parish communications at any time.

You also have the right to complain to your data protection authority.

10. Children's information

Parishes may record information about minors, for example in family registrations, sacramental preparation, or youth ministry.

Where a parish records information about a minor, the parish is responsible for obtaining the consent of a parent or guardian where the law requires it, and for limiting collection to what is necessary. We provide the same protections to this information as to all other parishioner information, and we do not use it for any purpose beyond providing the Platform to the parish.

Platform accounts are for parish staff and ministry leaders and are not intended for anyone under 18.

11. International transfers

The Platform serves parishes in more than one country, and our service providers operate in several jurisdictions. Personal information may therefore be transferred to and stored in a country other than the one where it was collected.

Where information is transferred out of a region with data transfer restrictions, we rely on appropriate safeguards, including standard contractual clauses with our service providers.

12. Cookies

We use cookies that are necessary for the Platform to function, principally to keep users signed in and to protect against cross-site request forgery. We do not use analytics, advertising or other non-essential cookies, and no tracking scripts run on the Platform.

13. Changes to this policy

We will update this policy when our practices change. Material changes will be notified to parish account holders by email before they take effect. The date at the top records the most recent revision.

14. Contact

Questions about this policy, or requests relating to your information:

Yes Catholic Hangout.