Communion

Communion has established specific data privacy practices governing the collection, processing, and retention of personal information. The company collects various data types across multiple channels while maintaining strict policies regarding special categories of personal data. This comprehensive framework outlines data collection methods, retention periods, and user controls while prioritizing information security through rigorous management processes.

Data Collection

Communion collects personal information through multiple channels, including website interactions and service usage. The company maintains strict policies regarding what information is gathered, specifically noting that they do not collect special categories of personal data such as race, ethnicity, religious beliefs, health information, or genetic data.

The types of information collected encompass identity and contact details (including email addresses and usernames), technical data about users' devices and browsing habits, and usage data related to how users interact with Communion's services. This information spans from basic technical details like IP addresses and browser information to more specific usage patterns that help the company improve its services.

The collection of personal data is governed by specific purposes that align with Communion's operational needs. These purposes include registration processes, service delivery, website management, advertising, and customer surveys, with clear distinctions made between data that requires user consent and data that is collected for operational necessity.

Data Collection Channels

Communion utilizes cookies and third-party tracking technologies to gather information, as well as maintaining server logs to track user activity. This dual approach allows for comprehensive data collection while providing users with multiple points of control over their information.

Types of Collected Data

The company collects a detailed array of data types, each serving specific operational purposes. This includes identity and contact information, technical data about users' devices, location data, and usage patterns. Notably, Communion does not collect special categories of personal data under EU GDPR regulations, ensuring compliance with current privacy standards.

From a technical perspective, the collected data spans multiple categories:

• Identity and Contact Data: Name, username, email address

• Technical Data: IP address, browser type, operating system, device information

• Usage Data: Website access patterns, service usage metrics

• Marketing Data: Communication preferences, marketing consent status

Data Collection Practices

The information is gathered through various means, including:

• Surveys and completed membership forms

• Email interactions

• Website interactions and service usage

• Third-party service integrations

This multi-channel approach allows Communion to build a comprehensive profile of user interactions while maintaining a clear framework for data collection and usage. The company operates under strict policies regarding data retention, with all collected information being held for only the minimum period necessary.

Data Processing and Usage

The company processes collected data primarily for website operation, service delivery, and product development purposes, with specific procedures in place for each category. Registration, service delivery, and website management all require the handling of identity and contact data, while advertising and customer surveys necessitate explicit consent from users.

Data processing activities include tracking user behavior for both service development and marketing strategy. To support these functions, Communion relies on a combination of cookies, third-party tracking technologies, and server logs to monitor user interactions across the platform. The company also implements automated systems to detect and prevent fraudulent activities and protect its infrastructure.

The processing of technical data, such as IP addresses and browser information, falls under the category of operational necessity. This data is retained for the minimum required period, typically 6 months to 1 year, unless specified otherwise by legal or regulatory requirements. Financial information, when collected, is held solely for the duration necessary to process transactions.

For most user data, Communion employs a policy of deletion once the primary purpose for collection has been fulfilled. This includes personal information provided through membership forms, emails, and website interactions. The company has established specific retention periods for different data types, ranging from the immediate deletion of tax payment details to 6 months for event participant information.

The use of third-party services is governed by strict guidelines, with data shared only for clearly defined business purposes such as statistical analysis, email delivery, and support services. Information is protected through secure cloud databases and encryption protocols, with regular audits conducted to ensure compliance with privacy standards. The company maintains stringent access controls, limiting data access to the founders@communion.so email address and requiring explicit approval for any data duplication.

Data Retention and Destruction

Data Retention Periods

The company maintains specific guidelines for data retention, determined based on the type and sensitivity of the information collected. Financial information, for example, is held only for the duration necessary to process transactions, typically ranging from a few days to a month. Event participant data is retained throughout the event period and for an additional [Duration] months, while program participant data is kept for the duration of the grant agreement plus any additional time required under grant terms.

Employee-related data is maintained for a comprehensive period of time, including wages, leave, and pension information, which is retained for one month after the end of employment plus an additional 6 months. Recruitment data is held for 1 month after the position recruitment process concludes, and consultant data is kept for the duration of the contract plus an additional 1 month after consultancy services end. Board member data is maintained for the duration of service plus an additional 1 month after their term concludes.

Data Destruction Procedures

Data is systematically destroyed once its retention period has expired, ensuring that information is removed from the company's systems and storage. This process covers multiple categories, from website visitor data to more comprehensive collections. The policy requires explicit approval from Communion's data protection team and legal counsel before any exceptions to standard destruction processes are made. In cases involving potential legal proceedings, data retention may be extended under a litigation hold until released by legal counsel.

Secure Data Storage

All retained data is stored on secure cloud databases with encryption applied during transmission. The company implements comprehensive security measures to protect user information, including physical security protocols and procedural frameworks. The privacy policy outlines strict guidelines for data access, which is limited to the founders@communion.so email address, ensuring that only authorized personnel have access to sensitive information.

Privacy and Security Measures

Communion's privacy framework prioritizes user information security through a combination of policy implementation and technical safeguards. Both the Terms of Service and Privacy Policy emphasize strict guidelines for data handling and use, with specific provisions for secure data storage and access control.

The company implements comprehensive security measures, including physical security protocols and procedural frameworks to protect user information. All retained data is stored on secure cloud databases with encryption applied during transmission, ensuring that even in digital form, information remains confidential. Physical access to sensitive data is strictly controlled, with only authorized personnel, including those at the founders@communion.so email address, having access to personal information.

Security protocols extend to how data is accessed and managed. The company has established robust guidelines for data access, limiting it to the founders@communion.so email address and requiring explicit approval for any data duplication. These controls help maintain tight security while allowing necessary operations to continue.

The privacy framework also includes proactive measures for data protection. Communion employs automated systems to detect and prevent fraudulent activities and regularly conducts security audits to ensure compliance with privacy standards. This proactive approach helps identify potential security weaknesses and address them before they can impact user data security.

To maintain compliance with privacy regulations and company standards, Communion follows a rigorous data management process. When data retention periods expire, it undergoes systematic destruction, ensuring that information is removed from the company's systems and storage. This process covers all categories of retained data, from website visitor information to employee and participant data. The company maintains comprehensive guidelines for data destruction, requiring explicit approval from the data protection team and legal counsel before exceptions to standard procedures are made.

For particularly sensitive situations, such as potential legal proceedings, the company implements a litigation hold to prevent premature data destruction. In these cases, data retention may be extended until released by legal counsel. This approach balances the need for timely data management with the requirement to protect user information in legal contexts.

User Rights and Controls

Under Communion's privacy framework, users maintain significant control over their personal information through multiple avenues. The company provides straightforward mechanisms for users to unsubscribe from communications and manage their account settings, ensuring that contact is maintained solely for non-marketing purposes such as bug alerts, security notifications, account issues, and product updates.

Parents of children under 13 must provide explicit consent before the company shares personal information about their minor child, demonstrating a strong commitment to protecting young users' privacy. Users have the ability to unsubscribe through email directly or via third-party websites, giving them flexible options to manage their preferences.

The company's user controls extend to various aspects of data management, allowing individuals to opt-out of specific data collection activities when desired. While the primary focus is on voluntary information submission through surveys, membership forms, and emails, users have the ability to prevent certain types of data collection by adjusting their account settings.

User Communication and Data Preferences

To manage their data preferences, users can control several key aspects of their interaction with Communion. These preferences include communication frequency, marketing opt-outs, and tracking preferences, all of which can be adjusted through account settings or direct communication with the company.

For third-party communications, users maintain control over their data through established protocols with email service providers and other external partners. The company ensures that these partners adhere to best practices for data management and communication, protecting user information while enabling necessary service operations.

Data Access and Modification

Users retain the right to request modification of their personal information when errors or outdated details are present. The company maintains clear procedures for users to initiate these changes, allowing for prompt updates to their account information.

Data Removal and Unsubscribe Processes

Users have the ability to request the removal of their personal information from Communion's systems through a formal process. This allows individuals to completely remove their data when no longer desired, providing a clear path for data deletion while maintaining company obligations under privacy regulations.

The company also facilitates the unsubscription process through multiple channels, including email and third-party services, ensuring that users can easily manage their communication preferences. These mechanisms are designed to be user-friendly while maintaining the company's obligations regarding data retention and access.