Privacy Policy Statement

About This Policy

This Privacy Policy applies to the Altar Accounting mobile application (the "App"), available on Google Play.

• App name: Altar Accounting
• Provided by (data controller): International Central Gospel Church (ICGC), Accra, Ghana
• Contact: headoffice@centralgospel.com

In this policy, "we", "us" and "our" refer to International Central Gospel Church, and "you" refers to the user of Altar Accounting.

Introduction

The Data Protection Act, 2012 (Act 843) clearly sets out the rules and principles governing the collection, use, disclosure, and care for personal data or information by an organisation (Data controller) and a data user (Data processor).

The Act also establishes the Data Protection Commission as an independent statutory body to ensure and enforce compliance.

The International Central Gospel Church is committed to protecting the privacy and personal data of our members, visitors, donors, volunteers, and all individuals who interact with us.

This Privacy Policy outlines how the Altar Accounting mobile application ("Altar Accounting" or the "App") collects, uses, stores, and protects personal information in accordance with applicable data protection laws. By using Altar Accounting, you agree to the collection and use of information in accordance with this policy.

The International Central Gospel Church (ICGC) is committed to protecting the privacy and security of users of the Altar Accounting mobile application ("Altar Accounting" or the "App").

Section 1 — About the Application

Altar Accounting is a financial reporting and oversight tool designed for authorized church leadership.

The App enables authorized users to view financial information relating to their respective assemblies, including:

• Total offerings received
• Total expenses incurred
• Cash book balances
• Financial summaries
• Detailed receipt transactions
• Detailed expense transactions

The App is a read-only application. Users cannot create, modify, approve, or delete financial transactions through the App.

Section 2 — Information, Use and Protection

A. Information We Collect

While you interact with the system, we may collect the following categories of personally identifiable information that can be used to contact or identify you.

i. Personal Information

To provide secure access to the App, we may collect:

• Full Name
• User ID
• Church Email Address
• Assembly or Region Assignment
• User Role
• Login Credentials (encrypted)

ii. Technical Information

When you use the App, we may automatically collect:

• Device information
• Device model
• Operating system version
• Application version
• IP address
• Login timestamps
• Activity logs
• Error and diagnostic information

iii. Financial Information Displayed

The App displays financial information originating from the Altar Accounting web application. Such information may include:

• Income records
• Offering summaries
• Expense records
• Cash balances
• Transaction details

The App does not create or alter financial records.

B. How We Use Information

We use collected information to:

• Authenticate users
• Authorize access to assembly financial records
• Improve application performance
• Monitor system security
• Detect and prevent unauthorized access
• Generate audit logs
• Support troubleshooting and technical support
• Comply with legal, regulatory, and organizational requirements

C. Legal Basis for Processing

We collect and process your data based on one or more of the following lawful grounds:

• Your consent (e.g., subscribing to a newsletter).
• Legitimate church administration purposes
• Internal financial oversight
• Security and fraud prevention
• Compliance with applicable laws and organizational policies
• For vital interests (e.g., emergencies).

D. Data Sharing and Disclosure

We do not sell your data or trade user information. We may share personal data:

• To protect the rights, security, and integrity of ICGC systems
• With government authorities or legal institutions when required by law.
• With authorized ICGC Church leadership or relevant departments on a need-to-know basis.
• With authorized third-party technology service providers supporting the application, who are required to maintain appropriate confidentiality and security measures.

E. Data Security

We take appropriate technical and organizational measures to protect personal data from loss, misuse, unauthorized access, disclosure, or destruction. Security measures may include:

• Encrypted communications (HTTPS/TLS)
• Secure authentication
• Role-based access control
• Audit logging
• Session timeouts
• Password protection

Despite our efforts, no electronic system can be guaranteed to be completely secure.

F. Data Retention

User information shall be retained only for as long as necessary to:

• Maintain application services
• Meet legal and regulatory requirements
• Support audit and compliance processes
• Protect church financial records

When information is no longer required, it will be securely deleted or anonymized.

Section 3 — User Responsibilities & Children's Privacy

A. User Responsibilities

Users are responsible for:

• Keeping login credentials confidential
• Securing devices used to access the App
• Reporting lost or stolen devices immediately
• Reporting suspected unauthorized access

Users must not:

• Share passwords
• Give unauthorized persons access to financial information
• Circumvent security controls

B. Children's Privacy

Altar Accounting is intended solely for authorized adult church leaders and personnel.

The App is not directed toward children under the age of 18, and we do not knowingly collect personal information from children.

Section 4 — Third-Party Services

The third-party providers used by us will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us.

Altar Accounting may utilize third-party technologies for:

• Hosting
• Authentication
• Analytics
• Application performance monitoring
• Security management

Such providers shall only have access to information necessary to perform services on behalf of ICGC and are required to safeguard the information appropriately.

In particular, remember that certain providers may be located in or have facilities that are located in a different jurisdiction than either you or us. So if you elect to proceed with a transaction that involves the services of a third-party service provider, then your information may become subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located.

As an example, if you are located in Canada and your transaction is processed by a payment gateway located in the United States, then your personal information used in completing that transaction may be subject to disclosure under United States legislation, including the Patriot Act. Once you leave the system or are redirected to a third-party website or application, you are no longer governed by this Privacy Policy or our Terms of Service.

Links

When you click on links on our system, they may direct you away from Altar Accounting. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements.

Section 5 — Data Protection Act (DPA)

Effective May 10, 2012, the Data Protection Act (843) expands the Ghanaian residents' (Data Subjects) rights concerning their personal data.

ICGC is ready to assist our members in becoming or remaining compliant with GDPR after this crucial transition.

1) Lawful, fair and transparent processing

ICGC is to process the personal data in a lawful, fair and transparent manner.

• Lawful means all processing should be based on a legitimate purpose.
• Fair means companies take responsibility and do not process data for any purpose other than the legitimate purposes.
• Transparent means that companies must inform data subjects about the processing activities on their personal data.

2) Limitation of purpose, data and storage

ICGC is expected to limit the processing, collect only that data which is necessary, and not keep personal data once the processing purpose is completed. This would effectively bring the following requirements:

• Forbid processing of personal data outside the legitimate purpose for which the personal data was collected
• Mandate that no personal data, other than what is necessary, be requested
• Ask that personal data should be deleted once the legitimate purpose for which it was collected is fulfilled

ii. Data Subject Rights

The data subjects have been assigned the right to ask the company what information it has about them, and what the company does with this information. A data subject has the right to:

• Access your personal data.
• Request correction or deletion of your data.
• Withdraw consent at any time (where processing is based on consent).
• Object to or restrict certain types of processing.
• Complain to the Data Protection Supervisor at the Head Office regarding data issues

iii. Consent

As and when the company has the intent to process personal data beyond the legitimate purpose for which that data was collected, a clear and explicit consent must be obtained from the data subject. Once collected, this consent must be documented, and the data subject is allowed to withdraw their consent at any moment.

Also, for the processing of children's data, GDPR requires explicit consent of the parents (or guardian) if the child's age is under 16.

Section 6 — Personal Data Breaches

ICGC must maintain a Personal Data Breach Register and based on severity, the regulator and data subject should be informed within 72 hours of identifying the breach.

How to handle a breach according to the DPA

i. Privacy by Design

ICGC should incorporate organisational and technical mechanisms to protect personal data in the design of new systems and processes; that is, aspects of privacy and protection should be ensured by default.

ii. Data Protection Impact Assessment (DPIA)

To estimate the impact of changes or new actions, a Data Protection Impact Assessment will be conducted when initiating a new project, change, or product.

The Data Protection Impact Assessment is a procedure that needs to be carried out when a significant change is introduced in the processing of personal data. This change could be a new process, or a change to an existing process that alters the way personal data is being processed.

iii. Data transfers

The controller of personal data has the accountability to ensure that personal data is protected and GDPR requirements are respected, even if processing is being done by a third party.

This means controllers have the obligation to ensure the protection and privacy of personal data when that data is being transferred outside the company, to a third party and / or other entity within the same company.

Section 7 — Changes & Contact

A. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The most current version will always be available at our church office and/or on our website.

B. Contact Us

If you have any questions or concerns about this Privacy Policy or your data, please contact: