Privacy Policy

1. Organization & Data Controller

The data controller responsible for your personal information is:

2. Information We Collect & Data Minimization

Following the principle of data minimization, we only collect data that is strictly relevant and necessary:

• Contact Inquiries & Small Group Placement: Name, email address, optional phone number, and ministry interest (e.g., attending a Tuesday gathering, joining a discipleship pod).
• Newsletter Subscription: Email address for weekly devotional emails and gathering updates.
• Event RSVPs: Name, email, guest count, and optional notes (e.g., dietary considerations or ride-share needs).
• Prayer Requests: Name (or anonymous), and prayer request description shared with our pastoral intercession team.
• Leader Portal Accounts: For authorized ministry leaders, login email and bcrypt-hashed password credentials.
• Technical Session Cookies: Essential session cookies (connect.sid), CSRF defense tokens (csrf_token), and UI language preference (lang).

We do not collect Social Security numbers, government identification, financial card numbers on our servers, or intrusive device tracking identifiers.

3. Legal Bases for Processing (GDPR & US State Laws)

We process your personal information under the following legal frameworks:

• Consent: When you voluntarily submit a contact form, join a small group, sign up for our newsletter, or submit a prayer request. You may withdraw consent at any time.
• Legitimate Religious & Ministry Interests: Facilitating spiritual fellowship, organizing weekly worship services, pastoral care, and member coordination.
• Legal Compliance: Retaining records where required by applicable federal, state, or Maryland laws.

4. Third-Party Service Providers (Subprocessors)

We carefully vet third-party tools to ensure strict privacy safeguards:

We do not utilize Meta Pixel, TikTok tracking, Google Analytics advertising features, or third-party behavioral profiling scripts.

5. Age Requirements & Children's Privacy (COPPA)

Our Young Adults ministry platform is designed for individuals who are 18 years of age or older, or between ages 13 and 17 with explicit parental or legal guardian consent.

In compliance with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect, solicit, or maintain personal information from children under the age of 13. If we discover that personal data of a minor under 13 has been submitted without verified parental consent, we will promptly delete that information from our database. Parents or guardians may contact us at privacy@eucmaryland.org to request immediate deletion.

6. Data Retention & Erasure Schedule

We retain personal information only for as long as needed to fulfill ministry engagement:

• Newsletter Subscribers: Retained until you click "Unsubscribe" (which takes effect immediately).
• Event RSVPs: Retained for 90 days following event completion for attendance analytics, then purged or anonymized.
• Contact & Prayer Submissions: Retained for active pastoral follow-up, or until you submit a deletion request.

7. Your Privacy Rights (Right to be Forgotten & Deletion)

Regardless of your geographic location, you enjoy full sovereignty over your personal data:

8. Email Communications & CAN-SPAM Compliance

Every automated email broadcast sent by our ministry strictly conforms to the U.S. CAN-SPAM Act:

• Truthful sender information (EUC Young Adults <info@eucmaryland.org>).
• Non-deceptive, accurate subject lines.
• Clear physical postal address of Emmanuel United Church of MD in the email footer.
• A functional, instant 1-click unsubscribe link in every non-transactional email.

9. Data Processing Agreements (DPAs)

To safeguard personal data transferred to our hosting and operational vendors, Emmanuel United Church of Maryland maintains binding Data Processing Agreements (DPAs) containing Standard Contractual Clauses (SCCs) with our cloud service providers, including:

• Google LLC (Google Cloud / Firebase): Compliant with EU Standard Contractual Clauses and ISO/IEC 27001, 27017, and 27018 certifications for cloud database storage and access controls.
• IONOS Inc.: Encrypted SMTP transmission agreement for automated ministry emails and password assistance.

10. Security Measures & Data Breach Response Protocol

We employ comprehensive technical and organizational safeguards to protect your personal information, including 256-bit TLS/SSL encryption in transit, strict HTTP security headers (HSTS, Content Security Policy, Permissions Policy), bcrypt password hashing, and encrypted database stores.

11. Payments, Subscriptions & Recurring Charges

Our digital platform does not sell subscriptions, software licenses, or recurring memberships. We do not store credit card numbers on our servers. All community events are 100% free of charge. Any voluntary charitable offerings made to the church are non-recurring, one-time contributions.