Streetapp GDPR provisions

Please note :

1. In the context of the following, any separate organisation, church or individual purchasing Streetapp ("the app") and registering to collect data is considered a "client".
2. The client is both the collector and processor of personal data collected through the app.
3. A "team member" is anyone the client registers in the admin area of the app to collect data and only registered team members have access to the data collection form.
4. In the context of UK GDPR regulations, Interface Websites acts as a joint controller with the client. This is because both client and Interface Websites make decisions on what data is collected and how it is collected, stored and processed.

These are the GDPR measures included in the app by default :

• All data collected by the client through the app is held on a secure dedicated web server
• Each client has their own separate and password-protected database for holding the information.
• All databases are backed up (a) on the server itself and (b) on a remote Amazon cloud secure storage area.
• The maximum time any data is held in backup storage is three months.
• Data processing (carried out by the client and not by me) takes place on a password-protected admin area.

Processing consists of the following possible actions and processes :

• Editing or deletion of contacts' personal data
• Editing or deletion of team members' personal data
• Downloading a .csv file of all contacts' personal data for passing to a local church (which may be the client) or storage elsewhere
• One-click deletion of all contact data once it is no longer required (eg once passed to a local church)
• Automatic deletion of all still-existing contact data after six months
• Manual or auto-deletion does not erase existing backups, but the erasure works its way down the chain as more backups are made
• Backups of data are not available to the client once deleted from the admin area

Data collection by the client has the following safeguards :

• Data cannot be saved unless boxes for age (16+) and permission to collect data are both ticked
• Minimal personal data is collected, restricted to name, sex, mobile and/or email, postcode or home town.
• Team members can record prayer responses and other notes before submission.
• Team members can see name and mobile number ONLY for contacts they themselves have recorded
• A new contact receives an automated SMS or email confirming their data has been saved and will be passed to a local church (team members would need to emphasise that this is the only destination for personal data).

The above data collection and processing measures assume that the client is the collector and "hands on" processor of personal data. They should therefore have their own GDPR policy in place and will have briefed their team members on their responsibilities. If requested by the client, it is possible to include links within the app to policy pages or documents. This could be to enable the team member to remind themselves of measures or to enable contacts to view the policy for themselves.

Under the latest update to regulations, the client is responsible for providing clear paths to deletion of data at the contact’s request or for complaints by contacts on the way their data has been handled. I have made provision for the inclusion of extra links in SMS or emails sent to contacts should the client require these.