Privacy policy

This Privacy Policy explains how EcclesiaOne handles personal data. EcclesiaOne is a platform for the administration of Catholic dioceses, parishes, religious institutes, societies, and schools. It is operated by Orravo Web Technologies ("Orravo", "we", "us", "our"), RC 9634991, a company registered in Nigeria with its registered office in Abuja, Nigeria. We do not publish a street address. Written correspondence should be sent to the email address in section 14.

This policy is written to the Nigeria Data Protection Act 2023 (the "NDPA") and, for users and institutions outside Nigeria, the EU General Data Protection Regulation and the UK GDPR ("GDPR"). Where a right or rule applies only under the GDPR, the text says so.

1.Who is responsible for your data

EcclesiaOne is used by religious and educational institutions to run their own records. This creates two different relationships, and which one applies changes who is accountable to you.

Your diocese, parish, religious institute, society, or school is the data controller for the records it keeps about you as a member, parishioner, donor, student, or guardian. That institution decides what to record about you and why. Orravo acts as its data processor for those records, meaning we host and process the data on the institution's instructions. For requests about your parishioner, sacramental, school, or membership records, contact your institution first. Their contact details appear on their EcclesiaOne site or office.

Orravo is the data controller for the data it needs to run the platform itself: your login account and credentials, security and audit logs, billing and subscription records for paying institutions, support correspondence with us, and the error and diagnostic records the platform generates when something fails. This policy covers both relationships and notes which is which where it matters.

If you are unsure who controls a particular record, contact us at [email protected] and we will direct your request to the right party.

2.The personal data we process

EcclesiaOne is a system of religious record-keeping, so by design it processes data that data-protection law treats as sensitive. The categories below reflect what the platform is built to hold. Not every institution uses every feature, so not all of this will apply to you.

2.1 Identity and contact data

Names and former names, date of birth (which may be marked as estimated), sex as recorded for canonical purposes, photographs, email addresses, phone and WhatsApp numbers, home and household addresses, GPS coordinates of a household, place of birth, hometown or village, state of origin, local government area, nationality, occupation, and family relationships within a household.

2.2 Religious and sacramental data (sensitive)

Religious affiliation is the central subject of the platform. We process, on behalf of institutions:

• Sacramental records: baptism, confirmation, first communion, marriage, anointing of the sick, holy orders, religious profession, and funeral records, including the canonical details attached to each (for example the form of marriage, dispensations, banns, and delegation chains).
• Catechesis and formation: catechumen status, sacrament-preparation cohorts and assessments, and marriage-preparation records.
• Pastoral and spiritual records: pastoral cases and notes, spiritual-direction and counselling records, and confession bookings. Pastoral cases and notes are encrypted so that only the assigned priest can read them.
• Marriage tribunal (annulment) cases, including grounds, narratives, and decisions.
• Vocations and discernment records, and records held by religious institutes.
• Household catholicity status and canonical marital status.

2.3 Health and safeguarding data (sensitive)

Medical-release consents for minors, safeguarding clearances for adults who work with children, safeguarding incident reports, and information recorded as part of funeral arrangements such as date of death.

2.4 Children's data

Where institutions run catechesis or schools, the platform holds data about minors: minor profiles with date of birth and display preferences, parental and guardian consents, school enrolment and attendance, grades, discipline records, and a log of interactions between adults and minors on the platform. Children's data is covered in more detail in our separate Children's Privacy Notice.

2.5 Financial data

Donation and pledge records, contribution history, school-fee assignments and payments, facility-booking fees, and (for paying institutions) billing records. Card payment details are handled by our payment processors and tokenized; Orravo does not store full card numbers. We may store a card's last four digits, brand, and expiry for display and renewal purposes.

2.6 Account, security, and technical data

Email address, hashed password, two-factor authentication settings and recovery codes, session records, IP address, browser and device information, device push tokens for mobile notifications, login timestamps, and consent timestamps and the policy versions you accepted. We keep audit logs of significant actions taken on records, showing who acted, what they acted on, when, and in many cases the values before and after the change. Session records separately hold the IP address and browser information the session was created from, and you can see your own active sessions in your account.

2.7 Content you create

Forum posts and replies, prayer-wall entries, reactions, marketplace listings and inquiries, course progress, survey and census responses, and any free-text notes or messages you write.

2.8 Data digitized from paper registers

Where an institution uses the optical character recognition (OCR) feature, images of historical sacramental registers and the data extracted from them are processed. This is described in our AI and Automated Processing Notice.

3.Where the data comes from

We obtain personal data from you directly when you register, claim a record, give, or use a feature; from your institution when it enters or imports records about you; from other members in limited cases (for example a head of household recording household members, or a parent recording a child); and automatically from your device when you use the platform (for example IP address and session data).

4.Why we process your data and our lawful basis

Under the NDPA and the GDPR we must have a lawful basis for each purpose.

Purpose	Lawful basis (NDPA / GDPR)
Creating and securing your account, authenticating you, preventing abuse	Legitimate interests; performance of a contract; legal obligation for security
Keeping sacramental and canonical records	The institution's legitimate interests and, for sensitive religious data, processing carried out by a not-for-profit body with a religious aim in respect of its members (NDPA s.30; GDPR Art. 9(2)(d)); consent captured at sign-up where applicable
Pastoral, tribunal, vocations, and safeguarding records	Religious-body exemption above; substantial public interest and safeguarding grounds for incident records; consent where given
Processing children's data	Parental or guardian consent, with the protections in our Children's Privacy Notice
Taking donations and issuing receipts and tax letters	Performance of your request; compliance with financial and tax record-keeping obligations
Billing institutions for subscriptions	Performance of the subscription contract; legal obligation for accounting records
Sending you service messages and notifications	Performance of a contract; legitimate interests; your communication preferences (see the Communications Consent document)
Sending optional or marketing messages	Consent, which you may withdraw at any time
Diagnosing faults and improving the platform	Legitimate interests
Meeting legal, regulatory, and audit obligations	Legal obligation

Where we rely on consent, you may withdraw it at any time without affecting processing that already took place. Where we rely on legitimate interests, we have weighed those interests against your rights, and you may object as described in section 8.

5.Special protection for religious data

Because EcclesiaOne records religious belief and practice, most records on the platform are sensitive personal data. The platform is operated for Catholic institutions and their members, which is the basis on which this sensitive data is processed under NDPA s.30 and GDPR Art. 9(2)(d). Sacramental records are generally retained permanently as part of the canonical and historical record of the Church (see section 9). We do not sell sensitive data, and we do not use it for advertising.

6.How we share data

We share personal data only as follows.

• Within your institution and the Church structure it belongs to. Parish records may be visible to authorized diocesan staff; cross-parish sacramental lookups are possible where a legitimate canonical need exists and are logged.
• With service providers (processors) who help us run the platform. These include payment processors, messaging and email providers, cloud hosting and storage, and an AI provider for the optional OCR feature. Our current providers are listed in the Sub-processor List. We require them by contract to protect your data and to use it only on our instructions.
• With platform staff at Orravo who operate, support, and secure the service. Our administrators can, where strictly necessary for support, access tenant data and in limited cases act on behalf of a user. Such access is logged.
• Where the law requires it, for example in response to a lawful request from a court or regulator, or to establish, exercise, or defend legal claims.
• To protect people, including disclosures to authorities in safeguarding situations.

We do not sell your personal data.

7.International transfers

Orravo is based in Nigeria. Some of our service providers process data outside your country. In particular, the optional OCR feature sends register images to a provider that processes them in the United States, and some messaging, email, and hosting providers operate outside Nigeria and the EU. Where we transfer personal data across borders, we rely on an adequacy decision where one exists, or on appropriate safeguards such as standard contractual clauses, and we apply the transfer rules in NDPA Part VIII. You can ask us for details of the safeguards that apply to a particular transfer.

8.Your rights

Subject to the conditions and exemptions in the NDPA and, where it applies, the GDPR, you have the right to:

• be informed about how your data is used (this policy);
• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased in certain circumstances;
• restrict or object to certain processing, including direct marketing;
• data portability for data you provided, where the processing is based on consent or contract and is automated;
• withdraw consent where processing relies on it; and
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects. EcclesiaOne does not make such decisions about you; the OCR feature only assists staff, who review the output.

Some rights are limited for sacramental and canonical records, which form a permanent record and may not be erased on request. Where this applies we will explain it to you.

To exercise a right over records your institution controls, contact the institution. To exercise a right over data Orravo controls, or if you are unsure, contact us at [email protected]. We respond within the time limits set by the NDPA and the GDPR. The platform also provides self-service tools for some requests, including data export and, for users who were minors, a process to remove childhood content after they reach adulthood.

9.How long we keep data

We keep personal data only as long as needed for the purposes above and to meet legal and canonical obligations. In summary:

• Sacramental and canonical records are kept permanently, consistent with the Church's obligation to preserve these registers.
• Account, security, and audit records are kept for the life of the account and for a period afterward for security and legal reasons.
• Billing and financial records are kept for the period required by tax and accounting law.
• Childhood content not part of the canonical record can be removed after a former minor reaches adulthood, as described in the Children's Privacy Notice.
• Data you delete may persist in a backup copy until that copy is superseded or removed.

Full periods are set out in our Data Retention and Deletion Schedule.

10.How we protect data

We protect personal data using measures described in our Security Statement, including hashed passwords, optional two-factor authentication, encryption of pastoral and spiritual notes, tamper-evident sacramental registers, access controls based on role, and audit logging. No system is perfectly secure, and we cannot guarantee absolute security.

11.Cookies

We and the institutions that publish sites on EcclesiaOne use cookies and similar technologies. Non-essential cookies are used only with your consent. See our Cookie Policy for details.

12.Children

The platform processes children's data only where an institution runs catechesis or a school, and only with parental or guardian consent and the protections in our Children's Privacy Notice. We do not knowingly let children create their own accounts outside that structure.

13.Changes to this policy

We may update this policy. When we publish a new version, the version number and date shown on this page change. Where a change is significant, or where the law requires it, we will ask you to review and accept the updated policy when you next sign in.

14.How to contact us and how to complain

For privacy questions, contact [email protected]. Postal correspondence can be addressed to Orravo Web Technologies, Abuja, Nigeria, but email reaches us fastest and is the route we ask you to use. We have not appointed a Data Protection Officer. Data-protection enquiries are handled by the company and should be sent to [email protected].

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC). If you are in the EU or the UK, you may also complain to your local data-protection supervisory authority or to the UK Information Commissioner's Office.