GDPR Compliance Statement

1. Our Commitment to GDPR

PrayerConnect is committed to protecting the privacy and rights of individuals in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679. This statement outlines how we comply with GDPR requirements when processing personal data of individuals located in the European Economic Area (EEA) and the United Kingdom.

We believe privacy is a fundamental right and have implemented comprehensive measures to ensure our data processing activities meet the highest standards of data protection.

2. Data Controller Information

For personal data submitted inside a church workspace — including prayer requests, member profiles and community posts — the church is the Data Controller and PrayerConnect acts as its Data Processor, processing that data only on the church's documented instructions under our Data Processing Agreement. Data-subject requests about workspace data should be directed to your church first.

PrayerConnect is an independent Data Controller only for a narrow set of its own records: account credentials, billing details, support correspondence, security and audit logs, and product telemetry.

3. Legal Basis for Processing

We process personal data only when we have a valid legal basis under GDPR. Our processing activities are based on:

3.1 Consent (Article 6(1)(a))

When you explicitly agree to processing, such as:

• Subscribing to newsletters or communications
• Enabling optional analytics cookies
• Sharing prayer requests publicly

3.2 Contract Performance (Article 6(1)(b))

When processing is necessary to fulfill our service agreement:

• Creating and managing your account
• Processing payments and subscriptions
• Providing prayer management features
• Sending essential service communications

3.3 Legitimate Interests (Article 6(1)(f))

When we have a legitimate business interest that doesn't override your rights:

• Improving and securing our services
• Preventing fraud and abuse
• Analyzing service usage to enhance features

3.4 Legal Obligation (Article 6(1)(c))

When we must comply with legal requirements, such as tax obligations or responding to lawful government requests.

4. Your Rights Under GDPR

GDPR grants you specific rights regarding your personal data. We are committed to honoring these rights:

4.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, access to that data along with information about how it is processed.

4.2 Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete data completed. You can update most information directly in your account settings.

4.3 Right to Erasure ("Right to be Forgotten") (Article 17)

You have the right to request deletion of your personal data when:

• The data is no longer necessary for its original purpose
• You withdraw consent (where consent was the legal basis)
• You object to processing and there are no overriding legitimate grounds
• The data was unlawfully processed
• The data must be erased for legal compliance

4.4 Right to Restriction of Processing (Article 18)

You have the right to restrict processing of your data in certain circumstances, such as when you contest the accuracy of the data or have objected to processing.

4.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) and to transmit that data to another controller.

4.6 Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we demonstrate compelling legitimate grounds.

4.7 Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not currently engage in fully automated decision-making.

5. How to Exercise Your Rights

You can exercise your GDPR rights through several methods:

Self-Service Options

• Access & Rectification: View and update your data in your account settings
• Deletion: Delete your account through the account settings page
• Marketing Opt-out: Manage email preferences in notification settings

Contacting Us

For requests that cannot be handled through self-service:

• Contact us through our contact form
• Include your full name, email address, and specific request
• We may need to verify your identity before processing your request

Response Timeframe

We will respond to your request within one month. This period may be extended by two additional months for complex requests, in which case we will inform you of the extension within the first month.

6. Data Protection Measures

We implement appropriate technical and organizational measures to ensure data protection:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest
• Access Controls: Role-based access limiting data access to authorized personnel
• Pseudonymization: Where possible, we separate identifying information from other data
• Regular Audits: Security assessments and vulnerability testing
• Staff Training: Regular privacy and security awareness training
• Data Minimization: We only collect data necessary for specified purposes
• Privacy by Design: Privacy considerations are built into all new features

7. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Communicate the breach to affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms
• Document all breaches and our response actions

Our breach notification will include:

• The nature of the breach
• Categories and approximate number of affected individuals
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact information for further inquiries

8. International Data Transfers

When we transfer personal data outside the EEA, we ensure adequate protection through:

• Adequacy Decisions: Transfers to countries with adequate data protection (e.g., UK, Switzerland)
• Standard Contractual Clauses (SCCs): EU-approved contractual safeguards with service providers
• Additional Safeguards: Supplementary technical and organizational measures where necessary

Our primary infrastructure is hosted in secure data centers with appropriate certifications (ISO 27001, SOC 2).

9. Data Protection Officer

While we may not be legally required to appoint a Data Protection Officer based on our current processing activities, we have designated a privacy contact to handle data protection matters:

10. Filing a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. We encourage you to contact us first so we can address your concerns.

Supervisory Authorities

You may contact the supervisory authority in your country of residence. Some key authorities include:

• UK: Information Commissioner's Office (ICO) - ico.org.uk
• Ireland: Data Protection Commission - dataprotection.ie
• Germany: Federal Commissioner for Data Protection - bfdi.bund.de
• France: CNIL - cnil.fr

A complete list of EU supervisory authorities is available at the European Data Protection Board website.

11. Children's Data

We do not knowingly collect personal data from children under 16 in the EEA (or the applicable age in your jurisdiction) without verifiable parental consent. If you believe we have collected data from a child, please contact us immediately.

12. Updates to This Statement

We may update this GDPR Compliance Statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website and, where appropriate, by email.

13. Contact Us

All privacy enquiries and data-subject requests are handled through our contact form, which is our designated privacy contact point. We do not operate public mailboxes.

• Privacy & data requests: Contact form (Privacy / data request) — we respond within 30 days
• Website: https://prayerconnect.app