Who is responsible?
Your church decides which data goes into KerkPoint and what for. That makes the church the controller. KerkPoint is the processor: we store and process the data only to make the schedule work, and for nothing else. That is set out in the data processing agreement.
Which data does KerkPoint process?
- Name and contact details of volunteers and administrators: name, e-mail address and possibly a phone number.
- Schedule data: roles, tasks, availability and who was scheduled when.
- Account data: login details (passwords encrypted), permissions and preferences.
- Messages: notifications and reminders that KerkPoint sends.
KerkPoint does not ask for dates of birth, home addresses or data about children. If you schedule volunteers without an account, only their name is in the schedule.
A sensitive point: faith
From the fact that someone is on a church's schedule, you can tell that they are involved with that church. The GDPR treats that as a special category of personal data. Churches may process it for their own activities (Article 9(2)(d) GDPR). KerkPoint therefore handles this data with extra care and never uses it for anything else.
Where is the data stored?
- Hosting: Strato, in Germany (EU). The application and the database run there.
- E-mail: Vimexx, in the Netherlands, for invitations, notifications and reminders.
- Payments: Mollie, in the Netherlands, only for the church's subscription.
- Error reports: Sentry, to track down technical errors.
Every church has its own, shielded environment. Other churches cannot see your data.
How long do we keep data?
- As long as your church uses KerkPoint.
- After cancelling: at most 6 months, after which the data is permanently deleted.
- Back-ups rotate for at most 30 more days.
- We keep invoices for 7 years, because the law requires it.
Security
- All connections use HTTPS.
- Passwords are stored encrypted. You can also log in with a link by e-mail, or with two-step verification.
- For each user you set what they may see and do.
- An audit log (Premium) shows who changed what.
- Back-ups are made automatically.
Volunteers' rights
Every user can download one file with everything KerkPoint stores about them from their profile, using Download my data, and can delete their account there. That way the church does not have to answer a request for access by hand.
What does your church need to arrange itself?
- Keep the data processing agreement with your GDPR records (or your record of processing activities).
- Tell volunteers that their name and e-mail address are in KerkPoint, and what for. The church's privacy statement is a good place for that.
- Only enter what the schedule needs.
- Remove people who stop from KerkPoint.
The data processing agreement
The data processing agreement describes what KerkPoint may and may not do with the data, how we secure it, what happens in a data breach and which parties we use. It is an English translation; the Dutch text prevails. Download the PDF or read it online. Also read our privacy policy.
Questions about privacy? E-mail info@kerkpoint.nl.