Poimen

Privacy notice

What the Poimen app records, why, and what you can ask us to do about it.

This notice covers the Poimen mobile app and the administration site behind it, both used by First Love Church in the United Kingdom to run church membership, attendance and pastoral care.

It is written to describe what the system actually does, rather than to cover every eventuality in general terms. If something here does not match your experience of the app, tell us, because one of the two is wrong.

Who is responsible

First Love Church decides what member information is collected and what it is used for, which makes it the data controller.

Data protection enquiries: londonfldata@gmail.com

Two kinds of person are described here

Most people in this system never use the app. Leaders sign in and record information; members are the people that information is about. Both are covered.

What we hold

If you are a leader who signs in

• A username and a password, stored only as a cryptographic hash so nobody, including us, can read it.
• Your role and the group you are responsible for.
• A notification token, so the app can send you reminders. It identifies the installation, not you.
• A record of the entries you submit, so corrections can be traced to who made them.

If you are a member of the church

• Name, date of birth, phone number, email address and postal address.
• Marital status and occupation, where recorded.
• A photograph, where one has been taken.
• Which bacenta and ministry you belong to.
• Attendance at services and meetings, including group photographs taken at them.
• Pastoral notes such as visits, follow-up and prayer requests, where a leader records them.
• Where you have registered for a camp or conference, your registration and travel details, and whether payment was made.

Information about your religious life

The system records things such as baptism and progress through the church's teaching programme. Under UK data protection law this is special category data, because it reveals religious belief, and it needs a stronger justification than ordinary information.

Ours is the exemption for religious not-for-profit bodies handling information about their own members and people in regular contact with them, at Article 9(2)(d) of the UK GDPR. It is not shared outside the church on that basis, and we do not use it for anything other than running church life.

Children

The children's ministry keeps records of children who attend, including photographs, so that they can be signed in and out safely and returned to the right adult. Consent is collected from a parent or guardian, and separately for any use of photographs. A parent or guardian can withdraw either at any time by contacting us, and can ask to see or delete what is held about their child.

Contacts a leader imports

A leader can import someone from their phone's contacts into their own follow-up list. Only the entries they specifically choose are read: the app never uploads a phone's address book.

If you have been added to a leader's follow-up list and would rather not be, tell us and we will remove you. You do not have to explain why. Follow-up entries that go nowhere are deleted automatically after a period, without anyone having to remember.

Technical information

• Location, only while the app is open and only to show which bacentas are nearest you. It is not stored as a history of where you have been.
• Ordinary web server logs, including IP address, kept briefly for security and fault-finding.

Why we hold it, and on what basis

Running church membership and pastoral care	Legitimate interests of a church in caring for its members, and Article 9(2)(d) for anything revealing religious belief
Children's ministry and safeguarding	Consent of a parent or guardian, and our duty to keep children safe
Camp and conference registrations	Performance of the arrangement you entered into when you registered
Photographs of individuals	Consent, which you may withdraw
Keeping the system secure	Legitimate interests in protecting the information we hold

Who else sees it

We do not sell personal information and we do not use it for advertising. It is shared only with the services needed to make the app work:

Amazon Web Services	Hosting. The database and photographs are stored in AWS's Ireland region.
Stripe	Payments for camps and conferences. Card details are handled by Stripe and never reach us.
Expo	Delivers push notifications to your phone.
Email delivery	Sends the messages the system generates.

Leaders see only the people they are responsible for. Church administrators can see more, because their job requires it.

How long we keep it

Membership and attendance records are kept while you are part of the church and for a reasonable period afterwards, because church life is not a subscription and people return. Follow-up contacts that have gone nowhere are deleted automatically. If you would like your records removed sooner, ask.

Your rights

You can ask us to:

• show you what we hold about you;
• correct anything wrong, which is worth doing for a misspelled name;
• delete what we hold, where we have no continuing reason to keep it;
• stop using it in a particular way, including withdrawing consent for photographs;
• provide it in a portable form.

Write to londonfldata@gmail.com. We will reply within one month. There is no charge.

If you are unhappy

Please tell us first, because most of it we can put right quickly. If you are still not satisfied you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. You can go to them directly; you do not need our permission.

Changes

If we change how the app uses information we will update this page and change the date at the bottom. Anything significant will be told to you in the app rather than left here to be discovered.