Our role, and your church’s
For your account and our relationship with your church, we decide how data is used: we are the controller, as described in our privacy policy.
For the people who use your church’s website (who send a message, sign up for news or write to your mailboxes) your church decides how their data is used and is the controller. We are the processor: we store and handle that data only to run your website and mailboxes, on your instructions, and for no purpose of our own.
What your church is responsible for
Have a lawful reason for what you collect, and tell your visitors how you use it, for example on a privacy page on your website.
Collect only what you need, keep it only as long as you need it, and get consent before publishing photographs or details of children.
Decide who on your team can see messages, subscribers and mail, using the roles in your dashboard.
How we protect data
Every church’s data is kept apart from every other church’s, and every request is checked against the signed-in person’s role in that church.
All traffic is encrypted with HTTPS. Passwords are stored only as secure hashes; sensitive values such as domain transfer codes are encrypted when stored.
Our staff reach church data only to support you or keep the service safe, and every staff action is recorded in an audit log.
Every public form is protected against automated abuse, and sign-in is protected against repeated attempts.
Our providers
We use one infrastructure provider for hosting, storage, security, email delivery and domain registration, and one payment provider for card payments; account owners can ask us for their names. We will tell account owners before adding a provider that handles church website data.
If something goes wrong
If a security incident affects your church’s data, we will tell the account owner without undue delay, explain what happened and what we are doing about it, and notify regulators where the law requires.
Exercising rights
If you visited a church’s website and want to see, correct or delete what you sent it, ask that church first: it controls that data and can act on it from its dashboard. If you can’t reach the church, write to us at support@churchwideweb.com and we will help.
Church accounts can download all their data at any time from Export & leave, and ask us about anything else at support@churchwideweb.com.
The law we follow
We follow the Nigeria Data Protection Act 2023 and, where they apply to the churches we serve, other data protection laws such as the GDPR.