Privacy Policy

ChurchVex is church management software made by DzataTech Solutions (“DzataTech”, “we”, “us”), a company based in Ghana. This policy explains what personal data is held in ChurchVex, who is responsible for it, and how it is protected. It is written with Ghana’s Data Protection Act, 2012 (Act 843) in mind.

1. Who is responsible for what

There are two roles, and it matters which is which.

• Your church is the data controller. A church decides whose information to record in ChurchVex — its members, visitors, staff and givers — and what to do with it. The church is responsible for having a lawful reason to hold that information, and for telling its members how it is used.
• DzataTech is the data processor. We store and process that information on the church’s behalf, only to provide ChurchVex to the church, and only on the church’s instructions. We do not sell it, rent it, or use it to advertise to anyone.

For a small amount of information — the accounts of people who register a church, billing contacts, and messages sent to us through this website — DzataTech is the controller, and this policy tells you how we handle it.

2. What a church stores in ChurchVex

Depending on which features a church uses, ChurchVex may hold:

• Member and visitor records — names, phone numbers, email addresses, home address, date of birth, gender, marital status, occupation, baptism and confirmation dates, emergency contact, photos, notes, department membership, and visitor follow-up notes.
• Attendance — which services, meetings and events a person checked in to, and when.
• Giving and finance — tithes, offerings, dues payments, campaign contributions and expenses the church records, including who a gift is attributed to.
• Events — registrations and attendance.
• Messages — church chat messages, and a log of SMS and email the church sent (recipient, content and send status).
• Files — documents and images the church uploads.
• Staff accounts — the name, email address, role and sign-in history of each person given a ChurchVex login.

Giving records reveal a person’s religious affiliation, which is sensitive personal data under Act 843. Churches should only record what they need, and should restrict who can see finance records through ChurchVex roles.

3. Consent from members

Because the church is the controller, the church is responsible for obtaining any consent it needs from members and visitors before recording their details or contacting them, and for honouring requests to stop. ChurchVex gives churches the tools to do this:

• Members who have a ChurchVex login can choose, under Communications → My Preferences, whether they receive SMS and email and which kinds of message they receive.
• When a church sends a message, it can choose to respect those preferences, skipping anyone who has opted out.
• Automated messages — such as dues reminders and the weekly schedule SMS — are switched off by default, and are only sent once a church switches them on.

4. SMS and email

• SMS is delivered through Africa’s Talking. To send an SMS we pass them the recipient’s phone number, the message and the church’s sender name.
• Email is delivered through SendGrid (Twilio). To send an email we pass them the recipient’s address and the message.

Both act as our sub-processors, only to deliver the message.

5. Payments

Online payments — members giving online (for churches in Ghana), and churches paying for plans and SMS credits — are handled by Paystack.

Card and mobile money details never touch ChurchVex servers. Payment details are entered on Paystack’s own secure checkout page. ChurchVex only receives the result: whether the payment succeeded, the amount, a payment reference, and the payer’s email address or name where Paystack provides it. Paystack processes payment data under its own privacy policy and the payment-card industry’s security standard (PCI DSS).

6. Who else sees the data

We share personal data only with the sub-processors that make ChurchVex work, and only what each one needs:

Sub-processor	What for
Paystack	Payments
Africa’s Talking	Sending SMS
SendGrid (Twilio)	Sending email
[Hosting provider — to confirm]	Hosting the servers and databases ChurchVex runs on, in [region — to confirm]

Within a denomination, district, regional and national leaders can see summaries of the churches under them. A branch church can choose to share summaries (for example, headcount or giving totals) with its mother church. These features never show another church an individual member’s record or who gave what.

We will disclose personal data to authorities only when Ghanaian law requires it.

7. How the data is protected

• Each church’s records are kept separate from every other church’s, and every request is checked against the church it belongs to.
• Access inside a church is controlled by roles. Each person sees only what their role allows.
• Staff can protect their sign-in with two-factor authentication. Passwords must be strong, and an account is locked for 15 minutes after repeated failed sign-in attempts.
• Traffic between your browser and ChurchVex is encrypted (HTTPS).
• ChurchVex keeps an audit log of changes and security events.

No system is perfectly secure. If we become aware of a breach affecting a church’s data, we will tell the church without undue delay so that it can meet its own obligations, and we will notify the Data Protection Commission where Act 843 requires it.

8. How long data is kept

• Church records are kept for as long as the church uses ChurchVex.
• Deleted records — members, tickets and similar — are moved to the church’s Trash, where they can be restored, rather than being erased immediately.
• Deleted files are permanently erased 30 days after they are deleted.
• Audit logs are kept for 30 days (general activity), 90 days (record changes), 180 days (errors) and 365 days (security events), then erased automatically.
• If a church stops paying for a plan, its account becomes read-only after 7 days and is suspended after 30 days. Suspension does not delete the church’s data.

Deleting a church’s account. ChurchVex does not yet have a button for a church to delete all of its data itself. A church can ask us to delete its account and data by emailing [email protected] from its registered admin address. We will confirm the request, then delete the data [within a period to be confirmed], apart from anything the law requires us to keep, such as invoices.

9. Your rights

Under Act 843 you have the right to know what personal data is held about you, to have it corrected, and to object to or ask for its deletion.

• If you are a church member or visitor, your church controls your record. Please ask your church first. If your church does not respond, contact us and we will help the church to handle your request.
• If you are a church admin, a staff user or a billing contact, or you wrote to us through this website, contact us directly.

You can also complain to Ghana’s Data Protection Commission.

10. This website

churchvex.com does not use analytics, advertising trackers or cookies. When you send us a message through the contact form, your name, email address, optional phone number and church name and your message are emailed to our support mailbox so we can reply. They are not added to any mailing list.

The ChurchVex app (app.churchvex.com) stores sign-in information in your browser so that you stay signed in.

11. Changes to this policy

When we change this policy we will update the date at the top, and tell church admins about significant changes before they take effect.

12. Contact

DzataTech Solutions, Ghana — [email protected] [To confirm: registered address, and DzataTech’s registration number with the Data Protection Commission.]