Data Protection and Privacy Policy

Who we are

KAG Uthiru Church Data Protection and Privacy Policy
Last updated: September 13, 2024
1. Introduction
At KAG Uthiru Church(The Church), we are committed to safeguarding your personal data in accordance with Kenya Data Protection Act Cap No.24 of 2019
(KDPA), General Data Protection Regulation(GDPR) and other relevant privacy regulations. This Privacy Policy outlines how we collect, use, disclose, and protect your personal information, and tells you about your privacy rights.

2. Data Controller
The Church is the data controller responsible for ensuring that your personal data is managed in compliance with this policy. If you have any questions or concerns, please contact our Data Protection Officer:
● Contact Name: Data Protection Officer
● Email: uthirukag.it@gmail.com
● Email Subject:“Attention Data Protection Officer”

3. Principles of Collecting & Processing
The Church is committed to processing data by its responsibilities under the GDPR and the DPA as follows:
● Lawfulness, fairness, and transparency – Data is processed lawfully, fairly, and in a transparent manner.
● Purpose limitation – Data is collected for an explicit, specified, and legitimate purpose and not further processed in a manner
incompatible with those purposes.
● Minimization – Data is collected for adequate and relevant purposes and is limited to what is necessary in relation to the purposes for which it is processed.
● Accuracy – Data collected is accurate and, where necessary, kept up to date, with all reasonable steps taken to ensure inaccurate data is erased or rectified promptly.
● Storage limitation – Data should be kept in a form that identifies the data subject for no longer than is necessary for the purposes which it was collected.
● Data Transfer – Data should not be transferred cross-border. Data collected is not to be transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject.
● Data Subject Rights – Data should be processed in accordance with the right to privacy of the data subject

4. What Information We Collect
We collect a range of personal data, including but not limited to:
● Personal Identifiers: Name, address, phone number, email address, etc.
● Demographic Information: Age, gender, marital status, etc.
● Financial Information: Giving history, tithes, gift aid declarations.
● Sensitive Data: Information related to religious beliefs, health data (for pastoral care).
● CCTV Footage: Images and video recordings captured by our CCTV system.
● Live Streaming Footage: Video and audio of church services and events streamed live via YouTube, Facebook, and other platforms.
● Children’s Data: Special protections are applied to data related to children under the age of 18 (see Child Clause below).

5. How We Collect Information
We collect personal information through the following means:
● Direct submission, such as registration for events, giving & giving platforms, or joining the Church membership.
● Digital submission via our website or other online platforms.
● CCTV cameras on our premises for security and safety purposes.
● Video recordings during church services and events that are live-streamed or recorded for later use.

6. CCTV Usage
We use CCTV cameras within our church premises to ensure the safety of our members, visitors, and property. Here are the key details about our CCTV usage:
● Purpose: CCTV is used for security, crime prevention, and protecting
individuals.
● Areas Covered: CCTV cameras monitor public areas such as entrances, parking lots, and common spaces. Worship areas are also covered.
● Retention Period: CCTV footage is retained for 90 days, subject to storage limitations unless required for legal purposes.
● Disclosure: CCTV footage will only be shared with third parties such as law enforcement when legally necessary or in emergencies.
● Erasure Limitation – Future erasure is not possible where the data subject is in a group photo or a video including other people.

7. Live Video Streaming on Social Media
We live stream our church services and events on platforms such as YouTube and Facebook to reach a wider audience as a legitimate interest of the Church.

Key details include:
● Consent: By attending (or allowing your child/children/ward to attend) services or events, you share and agree with the legitimate interest of the Church to reach a wider audience, and you consent to yourself (including your child/children/ward) being recorded and possibly featured in live streaming. Signs will be placed to notify attendees of the live streaming.
● Online Platforms: Services may be broadcast on public platforms, where they may remain available for viewing.
● Children and Vulnerable Adults: Special care is taken to record and broadcast images of children or vulnerable adults in a manner that protects and promotes their rights and best interests.
● Erasure Limitation – Future erasure is not possible where the data subject is in a group photo or a video including other people.

8. Child Protection Clause
Protecting children’s privacy is a priority for us. In line with relevant laws, we implement the following measures:
● Parental Consent: We will not process or share any personal data (including images or recordings) of children under the age of 18
without consent of a parent or guardian.
● Visiting Children: The Church’s workers will reliably share this policy with their parent or legal guardians.
● Live Streaming and Children: Children who participate in church services or events will only be included in live streams with prior parental consent.
We take care to avoid focusing on minors unless necessary.
● Safeguarding: The Church’s workers are trained in child protection and safeguarding to ensure the appropriate handling of children’s data.

9. How We Use Your Information
We process your personal data for the following purposes:
● Administration: Managing church membership, organizing events, and communications.
● Pastoral Care: Providing spiritual guidance and support.
● Financial: Processing givings.
● Security: Monitoring and protecting the premises through CCTV.
● Outreach: Broadcasting services and events on social media to engage with the community.
● Vital Interests: In emergencies, we may process personal data to protect
someone’s vital interests (e.g., to provide emergency care or assist during a health crisis).

10. Legal Basis for Processing Data
We process your data on the following legal grounds:
● Consent: For live streaming, newsletters, or participation in church events.
● Legitimate Interests: For activities like reaching out to the community with the gospel as described in the church strategy and beliefs, CCTV monitoring for security purposes, and general church administration.
● Legal Obligation: To comply with legal or regulatory obligations (e.g., financial reporting, safeguarding laws).
● Vital Interests: In emergencies, we may process personal data to protect someone’s life or well-being (e.g., sharing health-related information with emergency services and appointed church health workers).

11. Data Retention
We retain personal data for as long as necessary for the purposes outlined in this policy:
● CCTV Footage: CCTV Footage: Retained for 90 days, unless required for legal purposes..
● Live Streaming Footage: Services may be available online as long as the platforms retain them or as specified by the church’s policies.

12. Sharing Your Information
We do not sell your personal data. We may share your data:
● With church leadership or workers or volunteers to facilitate pastoral care, event organization, or church operations.
● With service providers such as IT, security, or financial services (under strict confidentiality agreements).
● With law enforcement or emergency services, when required for security, safety, or vital interests.
● With social media platforms like YouTube or Facebook when broadcasting services or events, in accordance with the platform’s privacy policies.

13. Your Data Protection Rights
You have the following rights regarding your personal data:
● Access: You can request access to your personal data.
● Correction: You can request corrections to inaccurate data.
● Erasure: You can request the deletion of personal data, where applicable.
● Object: You can object to the processing of your data in certain circumstances (e.g., live streaming).
● Restriction: You can request restrictions on the processing of your data.
● Data Portability: You can request the transfer of your data to another organization
To exercise these rights, contact Church’s Data Protection Officer uthirukag.it@gmail.com with email subject as “Attention Data Protection
Officer” and also exercise caution given on our Church entrances.

14. Cookies and Website Use
Our website uses cookies to enhance user experience. You can control cookie settings through your browser.

15. Changes to this Policy
We may update this policy from time to time. Any changes will be posted on our
website, and where appropriate.