Global & Kenyan Church Privacy Policy
Governing the lawful collection, processing, protection, and stewardship of church congregation records.
ChurchMate is engineered to honor the sacred trust placed in church leadership. We strictly abide by the Kenya Data Protection Act, 2019, the General Data Protection Regulation (GDPR), and global data privacy standards. We treat congregant data, tithe records, and spiritual counseling notes with the highest standard of technical confidentiality. We never sell, monetize, or profile church data for commercial or political advertising.
1. Regulatory Scope & International Harmonization
1.1. This Privacy Policy sets out the principles and operational rules governing the processing of personal data by Quantum Kenya Limited (trading as ChurchMate) in its provision of church management software.
1.2. This Policy complies with and enforces the statutory safeguards required by:
- Kenya: The Data Protection Act, 2019 (Act No. 24 of 2019), the Data Protection (General) Regulations, 2021, and the guidelines issued by the Office of the Data Protection Commissioner (ODPC);
- European Union & United Kingdom: Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and the UK Data Protection Act 2018;
- United States: The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and the Children's Online Privacy Protection Act (COPPA);
- Pan-African: The African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention).
2. Legal Status: Data Controller vs. Data Processor
Data Controller
Your Church is the Data Controller for all congregation records (members, tithes, prayers, fellowships). Your Church determines why and how member records are gathered, and is responsible for lawful notice to congregants.
Data Processor
ChurchMate acts strictly as the Data Processor on behalf of the Church. We process congregation data solely according to the Church's documented instructions and the binding Data Processing Addendum.
Note on Direct Account Data: ChurchMate acts as an independent Data Controller solely in respect of billing contact details, administrative sign-up logs, and technical telemetry collected directly from church administrators for account servicing and invoicing.
3. Lawful Grounds for Processing Personal Data
3.1. Under Section 30 of the KDPA and Article 6 of the GDPR, personal data is processed under the following lawful bases:
- Contractual Performance (Art. 6(1)(b) / KDPA §30(1)(b)): Providing core church management tools, account authentication, M-Pesa automated transaction reconciliation, and offline multi-device data synchronization;
- Legitimate Ecclesiastical Interests (Art. 6(1)(f) / KDPA §30(1)(c)): Maintaining accurate registers of church communicants, scheduling worship services, and tracking pastoral care visits;
- Legal & Statutory Compliance (Art. 6(1)(c) / KDPA §30(1)(a)): Complying with financial accounting requirements, anti-fraud verifications, and lawful tax reporting;
- Explicit Consent (Art. 6(1)(a) / KDPA §30(1)(a)): For optional automated SMS reminders, newsletters, and specialized prayer network communications.
4. Special Protection for Religious Belief Data
4.1. Under Section 44 and 45 of the Kenya Data Protection Act, 2019 and Article 9 of the GDPR, information revealing religious or philosophical beliefs constitutes Sensitive Personal Data (Special Category Data).
4.2. Ecclesiastical Exemption Safeguards: In accordance with Section 45(1)(d) of the KDPA and Article 9(2)(d) of the GDPR, processing of religious belief data within ChurchMate is lawful provided that:
• (a) The processing is carried out in the course of its legitimate activities by a church, religious body, or non-profit entity;
• (b) Appropriate technical safeguards (strong database tenant isolation and encrypted backups) are maintained;
• (c) The processing relates solely to members, former members, or regular communicants who have regular contact with the Church in connection with its religious purposes;
• (d) The personal data is not disclosed outside the Church without the verified consent of the data subject.
5. Children's Privacy (Sunday School & Junior Ministries)
5.1. Mandatory Parental Consent: Pursuant to Section 33 of the KDPA and Article 8 of the GDPR, the processing of personal data relating to a child (under 18 years in Kenya; under 16/13 years in the EU/US) is permitted only where verified consent has been granted by a parent or legal guardian.
5.2. Church administrators recording minor records for Sunday School, baptism classes, or youth camps warrant that they have secured verified parental consent prior to entering children's names, dates of birth, or family associations into the platform.
6. Categories of Personal Data Collected
| Category | Data Elements | Primary Purpose |
|---|---|---|
| Member Identity | Full name, gender, date of birth, marital status, national ID (marriage registers) | Congregation roll, pastoral care, and statutory church registers |
| Contact Details | Mobile phone number, email address, residential estate, cell fellowship group | Church announcements, pastoral check-ins, automated SMS alerts |
| Financial & Tithes | Tithe numbers, M-Pesa transaction reference codes, donation amounts, bank deposit slips | Accounting transparency, instant SMS receipts, council financial reporting |
| Ecclesiastical Records | Baptism dates, confirmation status, marriage register entries, pastoral counseling notes | Spiritual milestones and canonical governance |
| Telemetry & Technical | IP address, browser user-agent, session cookies, offline synchronization timestamps | Security monitoring, brute-force prevention, offline sync resolution |
7. Authorized Sub-Processors & Data Sharing
7.1. ChurchMate engages trusted third-party sub-processors solely to deliver essential communications and financial infrastructure:
- Telecommunications & M-Pesa: Safaricom PLC (Daraja API for secure STK pushes and instant tithe validation);
- SMS Gateways: Africa's Talking Limited and MSpace Solutions (for transactional church broadcasts and attendance SMS receipts);
- Cloud Infrastructure: Dual high-availability bare-metal servers located in tier-3 certified data centers with enterprise physical and digital perimeter security.
8. Cross-Border Data Transfers (Kenya KDPA §48 & GDPR Chapter V)
8.1. Kenyan Law Compliance: Pursuant to Section 48 of the KDPA, personal data may only be transferred outside Kenya where: (a) the destination country maintains an adequate level of data protection; or (b) appropriate safeguards (such as binding Standard Contractual Clauses) are in place.
8.2. Global Transfers: For international churches and cloud backups, ChurchMate implements standard contractual clauses and end-to-end cryptographic hashing, ensuring data subject rights remain fully enforceable regardless of the physical server location.
9. Data Subject Rights & Fulfillment Mechanism
9.1. Every congregant and user possesses enforceable statutory rights under Part IV of the KDPA and Chapter III of the GDPR:
How to Exercise Rights: Church members should first contact their parish administration (the Data Controller). If the church fails to act, members may contact the ChurchMate Data Protection Officer at dpo@churchmate.net.
10. Security Incident Protocol & 72-Hour Breach Notification
10.1. Pursuant to Section 43 of the Kenya Data Protection Act, 2019 and Article 33 of the GDPR:
• In the event of a confirmed personal data breach, ChurchMate shall formally notify the affected Church within forty-eight (48) hours of becoming aware of the incident.
• ChurchMate will furnish the Church with detailed incident logs, categories of affected records, and remediation measures to enable the Church to notify the Office of the Data Protection Commissioner (ODPC) within seventy-two (72) hours as mandated by Kenyan law.
• Where a breach poses a high risk to the rights and freedoms of church members, affected congregants will be communicated to without undue delay.
11. Data Protection Officer & Regulatory Supervisory Contacts
If you have questions, regulatory inquiries, or complaints regarding this Privacy Policy, please contact:
ChurchMate Data Protection Officer
Quantum Kenya Limited
Attn: Office of the Data Protection Officer
Email: dpo@churchmate.net
Support: privacy@churchmate.net
Telephone: +254 718 317 877
Kenyan Supervisory Authority
Office of the Data Protection Commissioner (ODPC)
Britam Tower, 12th & 13th Floor, Upper Hill, Nairobi
P.O. Box 30920 - 00100, Nairobi, Kenya
Email: complaints@odpc.go.ke / info@odpc.go.ke
Website: www.odpc.go.ke