Privacy notice
How ChapelHQ handles your personal data, under Malaysia’s Personal Data Protection Act 2010 (PDPA).
Who holds your data
ChapelHQ. For any data question, contact the church office.
What we hold
Your name, contact details (email, phone), household links, group memberships, event sign-ups, serving schedule and availability, any room or equipment bookings you request, anything you send us through one of our forms, language and WhatsApp preferences, a log of messages we’ve sent you, and any giving the office has recorded for you. We also keep internal pastoral notes — these are not shown anywhere in the member app, but they are part of your record, so they are included if you download your data or ask us for it. Giving records are visible to administrators only; you can always see your own giving on your profile.
Why we hold it
Solely to run church life — organising groups, events and serving rotas, and communicating with you about them. We do not sell your data or share it for marketing.
Where it lives
In a secured PostgreSQL database. Messages are sent via Resend (email) and, where you opt in, WhatsApp.
Your rights
You can view and download everything we hold on you, and request correction or deletion, at any time from your profile. If you would rather ask the office by phone, email or in person, that works too — we log it the same way and the same 30 days apply. We action deletion requests within 30 days after verifying your identity.
What deletion does and doesn’t remove
Your name, contact details, birthday, household links, pastoral notes and message history are erased, your sign-in is deleted, and you come off every group, rota date and sign-up. Giving records are kept — the church needs them to keep its accounts straight for past years — but they are no longer linked to your name, and totals for past years do not change.
Children’s data
For children in our care we hold a profile (date of birth, allergies, medical notes and photo consent), the guardians authorised to collect them, and a check-in/out history. This is used solely to keep children safe during church activities. Access is restricted to authorised staff, every action on a child’s record is logged, pickup is verified with a one-time code, and children’s data is never included in another member’s data download. Parents may review or update their child’s record through the office.
Consent
We message you about church activities you’re part of. WhatsApp updates are opt-in and can be switched off any time in your profile.