This policy describes the platform's practices. It is not legal advice and should be reviewed by a qualified adviser before it is relied on for compliance.
Who is responsible
Church CRM is operated by Kitimba Technologies, Uganda. Each church that registers decides what information it records about its members, visitors and staff, and why. For that information the church is the data controller and Kitimba Technologies processes it on the church's behalf to provide the service.
What is stored
- Church staff accounts: name, email, telephone, password (stored only as a one-way hash), sign-in times and the church roles assigned.
- Church records: whatever the church enters - members, households, visitors, attendance, groups, events, pastoral care cases, giving and expenditure, and messages sent.
- Payments to Church CRM: SMS credit purchases and voluntary donations, with the telephone number used for Mobile Money and the provider's transaction reference.
- Security records: an audit log of sensitive actions (sign-ins, permission changes, financial reversals, views of pastoral cases) with the IP address.
How it is used
Only to provide Church CRM to the church: storing and showing its records to its authorised staff, sending the SMS messages and emails the church asks for, processing payments, keeping the service secure, and supporting the church when it asks for help.
We do not sell church or member data, do not use it for advertising, and do not disclose one church's information to another church. Sensitive pastoral records are never used for any purpose other than the church's own pastoral care.
Who can see it
Inside a church, each staff member sees only what their role allows. Pastoral notes and individual giving records are restricted to roles that need them. Platform administrators at Kitimba Technologies see account-level information (church name, status, usage totals) and do not have default access to member, pastoral or giving records.
Messages are passed to sms.ug, and Mobile Money payments to our payment provider, only as needed to deliver them.
Children
Churches may record children (for example in children's ministry or households). Children's details are shown in full only to staff granted permission to see them, and the church should record them only with a parent's or guardian's knowledge.
SMS consent
Church CRM sends SMS only to people the church has recorded as having agreed to receive messages, and never to numbers on the church's opt-out list.
Retention and deletion
Records are kept while the church uses Church CRM. Churches can archive members, configure how long message contents and follow-up notes are kept, export their records at any time, and ask for their account to be closed. See data protection for the procedures.
Your rights
If a church holds information about you, contact that church first to see or correct it. You may also write to support@church.crm.ug and we will pass your request to the church or help directly where we can.