Privacy Policy
Last Updated: February 23, 2026
1. Overview and Scope
1.1 Who We Are
Entity: 508 Ministry PMA, a Private Membership Association
Role: Private Membership Association and Data Steward
Scope: This policy applies to all Members of the Association, including ministry administrators, staff members, and visitors to the Association website. All interactions occur within a private membership context.
1.2 Constitutional and Legal Standing
The Association operates under the protections of the First Amendment (freedom of religion and free exercise thereof), the Fourteenth Amendment (due process and equal protection), and the right of free association as recognized by the United States Constitution. The Association also operates under the protections of the Religious Freedom Restoration Act (RFRA), 42 U.S.C. sections 2000bb et seq. The Association is not a public accommodation or commercial enterprise. All data handling occurs within a private membership context and is governed by the PMA Terms of Service, the governing membership agreement of this Association.
1.3 Information Covered
This Privacy Policy applies to all information collected through:
- The Association website (508ministry.com)
- The ministry management software platform
- Email, telephone, and other electronic communications between Members and the Association
- Mobile applications (if applicable)
- Third-party integrations and services authorized by the Member
1.4 Consent
By becoming a Member of this Association and using our Services, each Member consents to the collection, use, and disclosure of information as described in this Privacy Policy and the PMA Terms of Service. If a Member does not agree with these policies and practices, that Member should not use the Association's Services.
2. Information We Collect
2.1 Information Members Provide Directly
Account Registration Information
- Organization name and type
- Contact information (name, email address, phone number)
- Mailing address
- Ministry leadership and authorized representatives
- Username and password
- Payment information (processed securely through third-party providers)
Ministry Data
Information Members input into the platform, including:
- Congregation member information (names, contact details, demographic data)
- Donor information and giving history
- Event attendance records
- Volunteer information and schedules
- Financial transactions and budgets
- Ministry documents and files
- Communications and messages sent through the platform
- Custom data fields created by the Member's organization
Communications
- Support tickets and Member service inquiries
- Feedback and survey responses
- Email correspondence with the Association team
- Training session participation and questions
2.2 Information Collected Automatically
Technical Information
- IP address and geolocation data
- Browser type and version
- Operating system
- Device identifiers
- Screen resolution and device type
- Referring website or source
Usage Data
- Pages visited and features used
- Time spent on pages
- Click patterns and navigation paths
- Search queries within the platform
- Login frequency and session duration
- Error logs and diagnostic data
Performance Data
- Page load times
- Server response times
- Application performance metrics
- Network connectivity data
2.3 Information from Third Parties
- Payment processors (transaction confirmations)
- Email service providers (delivery and engagement metrics)
- Analytics services (aggregated usage statistics)
- Social media platforms (if a Member chooses to connect accounts)
- Third-party integrations authorized by the Member (accounting software, etc.)
3. How We Use Member Information
3.1 To Provide and Improve Services
- Create and manage Member accounts
- Deliver the software platform and features
- Process payments and maintain billing records
- Provide Member support and respond to inquiries
- Send service-related communications (system updates, security alerts)
- Troubleshoot technical issues and fix bugs
- Analyze usage patterns to improve functionality
- Develop new features and services
3.2 For Security and Fraud Prevention
- Monitor and prevent security threats
- Detect and prevent fraudulent transactions
- Verify identity and authorization
- Enforce the PMA Terms of Service and related agreements
- Protect against malicious activity
- Maintain system integrity and availability
3.3 For Communication
- Send administrative communications about Member accounts
- Notify Members of platform updates and new features
- Provide training resources and best practices
- Send marketing communications (with Member consent)
- Conduct Member satisfaction surveys
- Respond to Member requests and inquiries
3.4 For Compliance and Legal Obligations
- Comply with applicable laws and regulations
- Respond to legal requests and court orders
- Maintain records for tax and accounting purposes
- Enforce the Association's rights and protect its property
- Comply with data protection and privacy laws
3.5 For Analytics and Research
- Analyze aggregated usage trends
- Conduct statistical analysis
- Improve Member experience
- Benchmark performance metrics
- Research and development (using anonymized data)
4. Data Security Measures
4.1 Technical Safeguards
Encryption
- In Transit: 256-bit SSL/TLS encryption for all data transmission
- At Rest: AES-256 encryption for stored data
- Database: Encrypted database storage with separate encryption keys
- Backups: Encrypted backup files with secure key management
Infrastructure Security
- Secure cloud hosting with SOC 2 Type II certified providers
- Firewall protection and intrusion detection systems
- Regular security audits and penetration testing
- Distributed Denial of Service (DDoS) protection
- Geographic data redundancy and disaster recovery
- Network segmentation and isolation
Application Security
- Multi-factor authentication (MFA) options
- Role-based access controls (RBAC)
- Session management and timeout controls
- Protection against SQL injection and XSS attacks
- Regular security patches and updates
- Secure coding practices and code reviews
4.2 Organizational Safeguards
- Personnel background checks and security training
- Strict access controls limiting data access to authorized personnel
- Confidentiality agreements for all staff and contractors
- Incident response and breach notification procedures
- Regular security awareness training
- Third-party vendor security assessments
4.3 Physical Safeguards
- Secure data center facilities with 24/7 monitoring
- Biometric and badge access controls
- Video surveillance and security personnel
- Environmental controls (fire suppression, climate control)
- Secure disposal of hardware and media
4.4 Data Breach Response
In the unlikely event of a data breach affecting Member information, the Association will:
- Immediately investigate and contain the breach
- Notify affected Members within 72 hours of discovery
- Provide detailed information about the breach and affected data
- Offer guidance on protective measures
- Notify relevant authorities as required by law
- Take corrective action to prevent future incidents
5. Third-Party Services and Sharing
5.1 Service Providers
The Association shares information with trusted third-party service providers who assist in operating the platform:
Infrastructure and Hosting
- Cloud hosting providers (AWS, Google Cloud, Microsoft Azure)
- Content delivery networks (CDN)
- Database management services
Payment Processing
- Payment gateways and processors (Stripe, PayPal, etc.)
- Banking and financial institutions
- Fraud detection services
Communication Services
- Email service providers
- SMS/text messaging services
- Member support platforms
Analytics and Monitoring
- Website analytics (with anonymized IPs)
- Application performance monitoring
- Error tracking and diagnostics
5.2 Contractual Protections
All third-party service providers are contractually required to:
- Use data only for specified purposes
- Maintain appropriate security measures
- Comply with applicable privacy laws
- Not sell or share data with other parties
- Return or delete data upon termination
5.3 Third-Party Integrations
If a Member chooses to integrate third-party applications (accounting software, email marketing tools, etc.), the Member authorizes the Association to share relevant data with those services. The Association recommends reviewing the privacy policies of any third-party services a Member connects.
5.4 Legal and Regulatory Disclosures
The Association may disclose information when required by law or in response to:
- Valid subpoenas, court orders, or legal processes
- Government or regulatory requests
- Law enforcement investigations
- Protection of rights, property, or safety
- Enforcement of the PMA Terms of Service
The Association will assert all applicable constitutional protections, including the right of free association and religious liberty protections under the First Amendment and RFRA, before disclosing Member information in response to government requests, to the fullest extent permitted by law.
5.5 Business Transfers
In the event of a merger, acquisition, reorganization, or sale of assets, Member information may be transferred. The Association will notify Members of any such change and provide options regarding their data.
5.6 We Do Not Sell Member Data
The Association does not sell, rent, or trade Member personal information to third parties for marketing purposes. Member ministry data remains confidential and is used solely to provide services within the private membership framework of this Association.
7. California Consumer Privacy Act (CCPA) Compliance
7.1 California Residents' Rights
If a Member is a California resident, the Member has the following rights under the CCPA:
Member CCPA Rights
- Right to Know: Request disclosure of personal information the Association collects, uses, and shares
- Right to Delete: Request deletion of personal information
- Right to Opt-Out: Opt-out of the "sale" of personal information (Note: The Association does not sell personal information)
- Right to Non-Discrimination: Equal service regardless of exercising privacy rights
- Right to Correct: Request correction of inaccurate personal information
7.2 Categories of Information Collected
- Identifiers: Name, email, phone, IP address
- Commercial Information: Payment history, subscription details
- Internet Activity: Usage data, browsing behavior
- Professional Information: Organization affiliation, role
- Sensitive Information: Account credentials (encrypted)
7.3 How to Exercise Your Rights
To exercise CCPA rights, Members may contact the Association at:
- Email: support@508ministry.com or legal@508ministry.com
- Submit request through Member account settings
- Phone: (888) 534-4145
The Association will respond within 45 days and may request verification of identity to process the request.
7.4 We Do Not Sell Personal Information
508 Ministry PMA does not sell personal information as defined by the CCPA. The Association has not sold personal information in the preceding 12 months.
8. General Data Protection Regulation (GDPR) Compliance
8.1 Legal Basis for Processing
For Members in the European Economic Area (EEA), the Association processes personal data based on:
- Contract Performance: To provide services the Member has requested under the PMA Terms of Service
- Legitimate Interests: To improve services, prevent fraud, and maintain security
- Consent: For marketing communications and optional features
- Legal Obligations: To comply with applicable laws
8.2 Member GDPR Rights
Member GDPR Rights
- Right of Access: Obtain confirmation and copies of personal data
- Right to Rectification: Correct inaccurate personal data
- Right to Erasure: Request deletion ("right to be forgotten")
- Right to Restriction: Limit processing in certain circumstances
- Right to Data Portability: Receive data in a structured format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent at any time
- Right to Lodge a Complaint: File a complaint with supervisory authorities
8.3 International Data Transfers
If a Member is located outside the United States, Member data may be transferred to and processed in the US. The Association protects such transfers through:
- Standard Contractual Clauses approved by the European Commission
- Privacy Shield Framework (where applicable)
- Appropriate technical and organizational safeguards
8.4 Data Protection Contact
For GDPR-related inquiries, Members may contact:
Email: legal@508ministry.com
8.5 Supervisory Authority
Members have the right to lodge a complaint with their local data protection authority if they believe the Association has violated privacy rights.
9. Data Retention and Deletion
9.1 Retention Periods
The Association retains Member information for as long as necessary to provide services and comply with legal obligations:
- Active Accounts: Duration of membership plus 30 days
- Financial Records: 7 years for tax and accounting compliance
- Support Communications: 3 years for quality assurance
- Usage Logs: 2 years for security and analytics
- Marketing Data: Until consent is withdrawn or 2 years of inactivity
- Legal Holds: Duration of litigation or investigation
9.2 Data Deletion Process
Upon account termination or deletion request:
- 30-day grace period for data export
- Secure deletion of all personal and ministry data
- Retention of anonymized data for analytics (no personal identifiers)
- Deletion certification available upon request
9.3 Backup Data
Deleted data may persist in encrypted backups for up to 90 days but will not be accessible or used except for disaster recovery purposes.
10. Member Privacy Rights and Choices
10.1 Access and Correction
Members can access and update their information through:
- Account settings in the Member dashboard
- Data export tools for comprehensive data downloads
- Contacting the Association support team for assistance
10.2 Marketing Communications
Members can opt-out of marketing emails by:
- Clicking "unsubscribe" in any marketing email
- Updating preferences in account settings
- Contacting support@508ministry.com
Note: Members cannot opt-out of essential service communications (security alerts, billing notices, etc.)
10.3 Account Deletion
Members may request account deletion at any time by:
- Using the account closure feature in settings
- Contacting support@508ministry.com
- Sending written notice to the Association mailing address
10.4 Data Portability
Members may export their data in standard formats using the data export tools available in the Member account dashboard.
11. Children's Privacy
11.1 Age Restrictions
The Association's Services are not directed to individuals under 18 years of age. The Association does not knowingly collect personal information from children under 18 without parental consent.
11.2 Ministry Youth Programs
If a Member's ministry serves minors and uses the platform to manage youth programs:
- The Member is responsible for obtaining parental consent
- The Member must comply with COPPA and applicable youth privacy laws
- The Association recommends limiting data collection to necessary information only
- Members should use privacy settings to restrict access to minor information
11.3 Parental Rights
Parents have the right to:
- Review their child's personal information
- Request deletion of their child's data
- Refuse further collection or use of their child's information
12. Changes to This Privacy Policy
12.1 Updates and Revisions
The Association may update this Privacy Policy periodically to reflect changes in practices, technology, legal requirements, or other factors. The Association will notify Members of material changes by:
- Posting the updated policy with a revised "Last Updated" date
- Sending email notifications to account administrators
- Displaying a prominent notice in the platform dashboard
- Providing at least 30 days' notice before material changes take effect
12.2 Member Acceptance
Continued use of the Association's Services after the effective date of changes constitutes acceptance of the updated Privacy Policy. If a Member does not agree with changes, the Member may terminate the account before the effective date.
12.3 Version History
Previous versions of this Privacy Policy are archived and available upon request. Contact legal@508ministry.com for historical versions.
13. Contact Us
If Members have questions, concerns, or requests regarding this Privacy Policy or the Association's privacy practices, please contact us:
508 Ministry PMA
Email: support@508ministry.com
Legal Inquiries: legal@508ministry.com
Phone: (888) 534-4145
Website: www.508ministry.com
Mailing Address:
508 Ministry PMA
1603 Capitol Ave, Suite 413
Cheyenne, WY 82001
Response Time: The Association strives to respond to all privacy inquiries within 5 business days. For urgent security or data breach concerns, contact us immediately.
13.1 Governing Law
This Privacy Policy shall be governed by the general principles of contract law and the constitutional protections applicable to private membership associations within the United States of America, without regard to conflict of laws principles.