PRIVACY POLICY

Open Heaven Christian Church Online Community
Last Updated: June 16, 2025

Open Heaven Christian Church (“Open Heaven,” “Church,” “we,” “us,” or “our”) operates https://openheavenchristianchurch.com (the “Platform”).

This Privacy Policy describes how we collect, process, use, disclose, retain, and safeguard personal data in compliance with applicable U.S., EU, UK, and other data protection laws.

1. Religious Organization Status

Open Heaven is a private Christian religious ministry. Certain information shared on the Platform may constitute religious belief data.

Where applicable under GDPR Article 9, such data may qualify as special category data. Processing occurs only:

With explicit user consent; or
Where manifestly made public by the user; or
As necessary for legitimate religious ministry purposes consistent with applicable law.

Participation is voluntary.

2. Data Protection Principles

We process personal data according to:

Lawfulness, fairness, and transparency
Purpose limitation
Data minimization
Accuracy
Storage limitation
Integrity and confidentiality
Accountability

We collect only data reasonably necessary for ministry operations and platform functionality.

3. Categories of Personal Data Collected

A. Identifiers

Name
Email address
Username
IP address

B. Technical Data

Device information
Browser type
Operating system
Log files
Session metadata

C. User Content

Prayer requests
Chat messages
Audio/video participation
Profile information

D. Financial Data

Processed by third-party payment processors. We do not store full card details.

E. Sensitive Data (If Voluntarily Provided)

Religious beliefs
Spiritual concerns
Prayer topics

F. Government Identification Data

We do not intentionally collect health, biometric, or government identification data unless voluntarily disclosed by the user.

4. Lawful Bases for Processing (GDPR/UK GDPR)

Processing is based on:

Article 6(1)(b) – Performance of a contract
Article 6(1)(f) – Legitimate interests (community moderation, fraud prevention, religious mission)
Article 6(1)(c) – Legal obligations
Article 6(1)(a) – Consent

Where special category data is processed:

Article 9(2)(a) – Explicit consent
Article 9(2)(d) – Legitimate religious activities (where applicable)

Users may withdraw consent at any time, subject to legal limitations.

5. How We Use Personal Data

We process personal data to:

Provide and maintain the Platform
Facilitate prayer and ministry services
Moderate communications
Protect community integrity
Detect and prevent fraud or abuse
Comply with legal requirements
Enforce Terms of Service
Improve functionality and security

We do not sell personal data.

We do not engage in profiling for automated decision-making with legal or similarly significant effects.

6. Cookies and Tracking Technologies

We use cookies strictly for:

Session management
Security
Performance analytics
Preference storage

Where required by law, we obtain consent prior to placing non-essential cookies.

Users may withdraw cookie consent via the consent banner or browser controls.

7. Third-Party Processors

We use third-party processors for:

Hosting
Analytics
Communication services
Payment processing
Embedded media

We enter into Data Processing Agreements (DPAs) where required by law.

Processors are contractually required to implement appropriate safeguards.

8. Audio and Video Communications & Recording Compliance

The Platform does not automatically record sessions unless clearly disclosed.

Users who independently record sessions act as independent data controllers and bear sole responsibility for:

Obtaining legally valid consent
Complying with GDPR, UK GDPR, CPRA, wiretap laws, and all applicable regulations

The Church:

Does not control user-made recordings
Does not store or distribute user-made recordings
Is not liable for unlawful recording activities

Recording users agree to indemnify the Church for violations.

9. International Data Transfers

Personal data may be transferred to and processed in the United States.

For EEA/UK users, transfers rely on:

Standard Contractual Clauses (SCCs), where required
Adequacy decisions (if applicable)
Supplementary safeguards where necessary

Users acknowledge U.S. data protection laws may differ from those in their jurisdiction.

10. Data Retention Policy

We retain personal data only as long as reasonably necessary for:

Ministry operations
Legal compliance
Dispute resolution
Enforcement of agreements

Inactive accounts may be deleted after a reasonable dormancy period.

Certain legal records may be retained as required by law.

11. Data Security Measures

We implement:

Encryption in transit (TLS/SSL)
Access controls
Role-based permissions
Monitoring and intrusion detection
Secure hosting environments

Despite safeguards, no system is fully secure.

12. Data Breach Notification

In the event of a data breach:

We will assess scope and risk.
Where legally required, notify authorities within mandated timelines (e.g., 72 hours under GDPR).
Notify affected users when required by law.

13. Your Privacy Rights

A. GDPR / UK GDPR Rights

You may request:

Access
Rectification
Erasure
Restriction
Data portability
Objection
Withdrawal of consent

You may lodge a complaint with your local supervisory authority.

B. California (CPRA)

You may request:

Access to collected personal data
Correction
Deletion
Information about categories of data collected
Confirmation that data is not sold or shared

We do not sell or share personal data for cross-context behavioral advertising.

C. Additional U.S. State Privacy Laws

Where applicable (e.g., Virginia, Colorado, Connecticut, Utah):

You may have rights to:

Confirm processing
Access data
Correct inaccuracies
Delete data
Opt-out of targeted advertising (not applicable here)

We do not conduct targeted advertising profiling.

Appeal rights may be exercised by submitting a written request through our Contact page.

14. Identity Verification for Rights Requests

To protect user privacy, we may:

Verify identity before fulfilling requests
Request additional documentation
Deny requests where legally permitted

Requests are fulfilled within legally mandated timelines.

15. Children’s Privacy

The Platform is intended for individuals 18 years or older.

We do not knowingly collect personal data from minors.

If discovered, such data will be promptly deleted.

16. Automated Decision-Making

We do not engage in automated decision-making that produces legal or similarly significant effects.

17. Do Not Track

We do not respond to “Do Not Track” browser signals.

18. Policy Updates

We may update this Privacy Policy at any time.

Changes become effective upon posting.

Continued use constitutes acceptance.

19. Governing Law

This Privacy Policy is governed by the laws of the State of Arkansas, consistent with our Terms and Conditions of Service.

20. Contact & Data Inquiries

Privacy inquiries and rights requests must be submitted through the official Contact page on the Platform.