CCISPay Privacy Notice

This Privacy Notice describes how CCIS Church Management Software, Inc. ("CCIS") handles personal information in connection with the CCISPay online giving service. It applies to donors who make gifts through CCISPay and to church personnel who access the CCISPay administrative interface.

Roles. In respect of donor information, the recipient church is the controller (or, under applicable United States state privacy laws, the business) and determines the purposes for which that information is used. CCIS acts as a processor or service provider to the church and handles donor information only to provide CCISPay, except where stated otherwise in this notice. The church's own privacy practices govern its use of donor information and are not described here.

This notice supplements, and in respect of CCISPay controls over, the general CCIS Privacy Policy.

Payment credentials are collected through payment fields hosted and served by Stripe, Inc. and are transmitted directly to Stripe. CCIS does not receive, process, transmit or store full primary account numbers, bank account or routing numbers, card verification values, or card expiry data on its systems.

CCIS receives from Stripe only a transaction reference, the amount and currency, the payment method type, and a truncated card identifier where Stripe supplies one. CCIS does not receive credentials for, or have access to, any identity documentation a church representative provides to Stripe during account verification.

CCISPay collects the following categories of donor information:

• Identifiers — name, email address, and mobile telephone number where voluntarily provided.
• Transaction records — donation amount, currency, designated fund or funds, date and time, recurrence schedule where applicable, fee-coverage election, payment method type, and the processor's transaction reference.
• Account and authentication records — where a donor uses the donor portal, records relating to sign-in links issued and used, and any optional personal identification number the donor sets.
• Technical records — information generated in the ordinary operation and security monitoring of the service.

Mobile telephone number is optional and is collected to assist the church in matching a gift to an existing donor record. Where a church offers text giving, information about text messages sent to the church's texting number is handled as described under Text giving below.

Donor information is processed to:

• execute the donation and deliver a receipt or acknowledgement;
• record the contribution in the recipient church's contribution records, including matching it to an existing member or donor record where one exists;
• administer recurring donation schedules, including retries, amendments and cancellation;
• authenticate donors to, and operate, the donor portal;
• maintain the security and integrity of the service, prevent and investigate fraud, and comply with legal obligations.

CCIS does not sell donor personal information, does not share it for cross-context behavioural advertising, and does not use it to market to donors. Any communication a donor receives about their giving originates from, and is sent on behalf of, the recipient church.

CCIS discloses donor information only as follows:

• To the recipient church, which is the controller of its own donor records.
• To Stripe, Inc., as payment processor. Stripe's handling of that information is governed by the Stripe Privacy Policy.
• To communications providers engaged by CCIS to deliver transactional email and, where the church has enabled it, text messages. These providers act on CCIS's instructions and may not use the information for their own purposes.
• Where required by law, or to establish, exercise or defend legal claims, or to protect the rights or safety of any person.
• In connection with a corporate transaction, in which case the recipient remains bound by this notice in respect of information transferred.

Mobile telephone numbers and text messaging opt-in data and consent are not shared with third parties or affiliates for their marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

Scope. This section applies to text messages sent to, and replies sent from, a texting number that CCIS operates for a church through CCISPay (the "Program"). The church remains the controller of this information and CCIS acts as its service provider, as described in Who this covers.

Information processed. When you send a text message to a church's texting number, CCIS receives from its messaging provider your mobile telephone number, the content of your message, the church's texting number and a message identifier. CCIS uses your mobile telephone number transiently to determine whether you have opted out, to apply message limits, to apply any test restriction while CCIS is configuring the Program, and to send a reply.

Information retained. CCIS does not retain your full mobile telephone number in CCISPay's records. CCIS retains: (a) the last four digits of the number; (b) a keyed cryptographic hash of the number, computed with a key specific to the church, which allows the Program to recognise a returning number — in particular to honour an opt-out — without retaining the number, and which differs between churches so that records held for one church cannot be matched to those held for another; (c) the date and time of the message and the identifier its messaging provider gave it; (d) the content of the message, with any run of seven or more digits masked except for its last four digits; (e) the keyword matched, the Program's handling outcome, and the content of any reply sent; and (f) records of opt-out and opt-in requests, including the reserved word that was recognised and the date and time. Messages that fail authentication are refused, and a record of a refusal contains neither the sender's number nor the content of the message.

Use. Information relating to the Program is used only to reply to messages you send, to honour opt-out and opt-in requests, to prevent abuse of the Program, to show the church a record of the messages it received and the replies sent, and to maintain the security of the service. It is not used to identify you as a donor, is not associated with your contribution records or your donor portal account, and is not used for marketing.

Disclosure. Information relating to the Program is disclosed to the church that operates the texting number — limited to the last four digits of the number, the masked content of the message, the handling outcome and the reply sent — and to Twilio, Inc., which transmits messages as CCIS's service provider, acts on CCIS's instructions, and retains message records in accordance with its agreement with CCIS and its own privacy policy. Mobile telephone numbers and text messaging opt-in data and consent are not shared with third parties or affiliates for their marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

Retention. The content of messages received and of replies sent is retained for eighteen months. The remainder of each message record — date and time, last four digits, keyed hash, the messaging provider's identifier for the message, keyword matched, handling outcome and kind of reply — is retained for four years, as the record that the reply was requested. Records of opt-out and opt-in requests, and of the assignment of a texting number to a church, are retained for as long as is necessary to honour an opt-out. Records of refused messages are removed when the next refused message is received, and are kept no longer than fourteen days in normal use.

Message frequency and opting out. The Program sends one reply per message you send, sends no recurring or unsolicited messages, and sends no message to a mobile number that has not first texted the church's texting number. Message and data rates may apply. Text STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE or OPTOUT to opt out; text START or UNSTOP to opt back in; text HELP or INFO for help. Further terms are in the CCISPay Text Giving Terms at ccispay.com/legal/sms-terms.

Requests. Requests relating to information described in this section may be made to the church or to privacy@ccissoftware.com and are handled as described in Your choices. Because the full mobile telephone number is not retained, a request may require the number in question in order to locate the records it concerns.

Contribution records. Records of donations are financial records of the recipient church and are retained by the church for the period required by its accounting, audit and tax obligations. They are not deleted on request, as their retention is necessary for the church's compliance with a legal obligation and for the donor's own substantiation of charitable contributions. Retention periods are set by the church.

Authentication records. Records relating to donor portal access are retained for the period necessary to operate and secure the portal, and are deleted when no longer required for that purpose.

Text giving records. Retention of records relating to text giving is described under Text giving above.

Self-service access. CCISPay provides a donor portal through which a donor may, without making a request to any person, review their complete giving history and pledge records, amend, suspend, resume or cancel a recurring donation, update the payment method held for future donations, and set or remove an optional personal identification number. Access is by single-use link issued to the donor's email address.

Donors may have rights under applicable law to access, correct, delete, or obtain a portable copy of their personal information, and to be free from discrimination for exercising those rights.

Because the recipient church is the controller of donor information, requests not satisfied by the self-service functions above — including correction of a donor's name or contact details, issuance of a contribution statement, and requests for erasure — should be directed to the church in the first instance. Where such a request is received by CCIS, CCIS will refer it to the relevant church and assist that church in responding within the period required by law.

Rights of deletion are subject to the retention obligations described above; a church is generally required to retain contribution records notwithstanding a deletion request.

Recurring donations may be cancelled by the donor at any time through the donor portal or by contacting the church.

CCIS maintains administrative, technical and physical safeguards designed to protect donor information against unauthorised access, disclosure, alteration and destruction. These include transport encryption for donor-facing surfaces, the exclusion of payment credentials from CCIS systems as described above, and single-use link authentication for the donor portal with an optional donor-set personal identification number.

No method of transmission or storage is completely secure, and electronic mail in particular is not a secure channel. CCIS will never request payment credentials by email, and donors should not transmit them by that means.

Reporting a vulnerability. Suspected security vulnerabilities may be reported to security@ccissoftware.com. CCIS will acknowledge such reports and investigate them, and asks that reporters allow a reasonable period for remediation before public disclosure.

The CCISPay donor-facing services are intended for adults and are not directed to children. CCIS does not knowingly solicit or collect personal information from a child through those services.

Church membership records. A church's membership records maintained in CCIS church management software may include information about children, entered by the church in the ordinary course of its ministry. That information is not collected by CCISPay from the child, is controlled by the church, and is governed by the church's own privacy policy and by the terms applicable to the church management software, rather than by this notice. Nothing in this section requires or permits the deletion of a church's membership records.

Where CCIS becomes aware that a child has provided personal information through a CCISPay donor-facing service, CCIS will promptly notify the relevant church and, in accordance with applicable law, delete the information so collected.

CCIS may update this notice from time to time. The revision date at the head of this page indicates when it was last changed, and the current version is always published at this address.

Enquiries relating to a particular donation should be directed to the recipient church. Enquiries relating to this notice, including requests concerning personal information, may be sent to:

CCIS Church Management Software, Inc.
PO Box 28202
Chattanooga, TN 37424-8202
privacy@ccissoftware.com

The general CCIS Privacy Policy is available at churchsoftware.net/privacy.