VultionPrivacy Policy
Version 2.1 · Effective 3 October 2026
About this policy
Vultion Ltd (“Vultion”, “we”, “us”, “our”) provides Vultion, a records management service for churches and church networks. We are committed to protecting the privacy of the individuals whose personal data we handle.
This policy explains what personal data we collect, why we collect it, how we use and disclose it, how long we keep it, and the rights available to you under the Nigeria Data Protection Act 2023 (the “NDPA”) and the General Application and Implementation Directive 2025 (the “GAID”) issued by the Nigeria Data Protection Commission (the “Commission”).
We act in two different capacities, and which one applies to you determines who answers your request.
- We are a data controller when you create an account, visit our websites, request a demonstration, or otherwise deal with us directly. We determine why and how that personal data is processed. Sections 2 and 5 to 12 apply in full.
- We are a data processor when a church or church network uses the Service to keep records about its members, attenders, donors and others. That organisation is the data controller, it determines what is recorded and why, and we process that personal data only on its documented instructions and for no purpose of our own.
For the purposes of this policy:
- personal data means any information relating to an identified or identifiable natural person;
- sensitive personal data has the meaning given in section 65 of the NDPA and includes data revealing religious or philosophical beliefs, and data concerning health;
- data subject means the individual to whom personal data relates; and
- processing means any operation performed on personal data, including collection, storage, use, disclosure and deletion.
Where to take a request. Where we are the controller, see section 11. Where a church is the controller, direct your request to that church; we will refer any request we receive to it and assist it in responding.
We review this policy from time to time. We will post any change on this page and, where a change is material, notify the administrators of affected workspaces. Terms used but not defined in this policy have the meanings given to them in the NDPA, or in our Data Processing Agreement.
What information we collect and process
Information you provide to us
We collect personal data that you give us directly. This happens when you create an account, sign in, request a demonstration, submit an enquiry, or correspond with us.
| Category | Details |
|---|---|
| Account data | Your name, email address, password, and the organisation your account belongs to. |
| Authentication data | One-way cryptographic hashes used to verify a password. We do not store passwords in a form we are able to read, which is why a forgotten password can be replaced but not recovered. |
| Enquiry data | Your name, organisation, email address, and the content of any message you send us. |
| Organisation settings | The organisation’s name and any logo it uploads. |
Information we process on behalf of churches
The Service allows a church or church network to keep a record of its people and its work. When a church uses the Service, it submits or collects personal data about its members, attenders, donors, volunteers and others, and we process that data on the church’s behalf and on its instructions. We call this a workspace record.
A church determines what is recorded. In practice a workspace record may contain:
| Category | Details |
|---|---|
| Identity and contact | Name, email address, telephone number, postal address, household composition. |
| Personal characteristics | Date of birth and gender, where recorded. |
| Involvement | Group, team and ministry membership; membership status. |
| Attendance | Records of attendance at services and meetings. |
| Financial | Donations, standing pledges, expense records and fund allocations. No card or bank details are stored by the Service; payments are taken by a third-party payment provider and only the fact and amount of the gift are recorded. |
| Pastoral | Notes concerning pastoral care provided or required, and updates to them. Notes may be marked confidential, restricting access to individuals designated by the church. |
| Consent | Whether an individual has consented to being contacted, and the date on which consent was given or withdrawn. |
| Form submissions | Information submitted through event registration, check-in and list registration forms, comprising the fields presented on the form and the answers provided. |
Each church controls and is responsible for the data it processes using the Service, and for complying with any law that requires it to give notice, make disclosure, or obtain consent before submitting personal data to us. If you have a question about personal data a church holds about you, please contact that church.
Information we collect automatically
We keep a limited record of activity necessary to operate the Service securely. This comprises authentication and session information, and the internet protocol address from which a request is made. We keep it to detect unauthorised access, to investigate security incidents, and to diagnose faults.
Information we do not collect
It is as important to state what is absent. We do not collect or process:
- analytics or behavioural data about how visitors use our websites;
- advertising identifiers, or data about your activity on other websites;
- location data beyond the internet protocol address a request arrives from;
- personal data from data brokers, commercial datasets, or enrichment products — we neither buy nor sell personal data; and
- the content of a church’s email correspondence, except where a feature expressly requires it and the church has connected the account (see section 13).
How we use personal data
To provide the Service
We use account data to create and administer your account, to authenticate you when you sign in, and to provide support. We use a workspace record to deliver the features the church has asked for, and for no other purpose.
To communicate with you
We send service messages that are integral to the Service — verification codes, password reset codes, and notifications about your workspace. These are not marketing and cannot be unsubscribed from while the account exists.
Where you have asked us to contact you, or where you have not objected, we may send information about the Service. Every such message carries a way to stop receiving them, and we act on it.
To secure and protect the Service
We use account data and activity records to verify accounts, to detect and prevent unauthorised access and misuse, and to investigate security incidents. We may use personal data to enforce the terms on which the Service is provided.
To comply with law and defend claims
We may process personal data where we are required to by law, and where necessary to establish, exercise or defend legal claims.
Our lawful bases
Section 25(1) of the NDPA permits processing only where a lawful basis applies. Where we act as a controller we rely on the following. Where we act as a processor, the church relying on the basis is the controller, not us.
| Purpose | Lawful basis | Explanation |
|---|---|---|
| Creating and administering an account | Performance of a contract | Section 25(1). An account cannot be provided without the data required to create it. |
| Delivering service messages | Performance of a contract | Section 25(1). Verification codes and notifications are integral to the Service and have been requested. |
| Responding to enquiries and arranging demonstrations | Legitimate interests | Section 25(1). Our legitimate interest in responding to a person who contacts us. You may object at any time; see section 11. |
| Maintaining security and preventing misuse | Legitimate interests | Section 25(1). Our legitimate interest in protecting the Service and the people whose data it holds. |
| Complying with legal obligations | Legal obligation | Section 25(1), where we are required to retain or disclose data by law. |
| Establishing or defending legal claims | Legitimate interests | Section 25(1). Our legitimate interest in the establishment, exercise or defence of legal claims. |
Where we rely on consent, it must be freely given, specific, informed and unambiguous. A pre-ticked box is not consent, and neither is silence. Consent may be withdrawn at any time and as easily as it was given, and withdrawal does not affect processing carried out lawfully before it.
What we do not do with personal data
- We do not sell personal data, or rent it, or trade it.
- We do not use it for advertising, ours or anyone else’s.
- We do not use the contents of a church’s workspace to train machine learning models or to develop products of our own.
- We do not disclose it to a third party except as section 5 describes.
Sensitive personal data
Section 65 of the NDPA defines sensitive personal data to include data revealing religious or philosophical beliefs, and data concerning health. Membership of a religious congregation may reveal religious belief, and pastoral notes may additionally record health, family circumstances or safeguarding matters.
We do not determine the purposes for which such data is recorded — the church does. A church is responsible for identifying and documenting a condition for processing sensitive personal data, which under the NDPA ordinarily means the explicit consent of the individual, or a condition available to a not-for-profit body with a religious purpose in respect of its own members and contacts.
We process sensitive personal data only on the church’s instructions, only so far as necessary to provide the Service, and subject to the measures described in section 7.
Children’s personal data
A congregation will ordinarily include children, and a workspace record may therefore contain personal data relating to individuals under the age of 18. A church is responsible for ensuring it has a lawful basis for holding that data, and for obtaining any consent required from a person with parental responsibility.
We do not knowingly collect personal data from children for our own purposes, and the Service is not directed at children. If you believe a child’s personal data has reached us other than through a church’s use of the Service, please contact us and we will delete it.
International transfers
Sections 41 to 43 of the NDPA permit personal data to be transferred out of Nigeria only where the recipient country, territory or organisation ensures an adequate level of protection, or where one of the derogations in section 43 applies. Section 42 empowers the Commission to make adequacy determinations and to approve transfer instruments. We are required to document the basis on which any transfer is made.
Our infrastructure is located in the European Economic Area: the database is hosted in Ireland, and the application is served from Dublin. Our email delivery provider is established in France. Certain of our providers are established in the United States and may access data from there in the course of providing support.
Where we transfer personal data out of Nigeria we do so on one of the following bases, and we record which:
- an adequacy determination made by the Commission under section 42, where one exists for the recipient country;
- a transfer instrument approved by the Commission, being contractual clauses, binding corporate rules, an approved code of conduct, or a certification mechanism; or
- a derogation under section 43, which is available only for occasional and limited transfers and not for routine processing.
The absence of a determination is not a finding of adequacy. We do not treat a country as adequate merely because no determination has been made about it, and where no determination exists we rely on an approved instrument rather than on an assumption.
Where a church is established in the United Kingdom or the European Economic Area, additional safeguards apply to transfers out of those jurisdictions, being the standard contractual clauses issued under Commission Implementing Decision (EU) 2021/914 and the International Data Transfer Addendum issued by the United Kingdom’s Information Commissioner’s Office. A copy of the safeguards we rely on may be obtained from us using the details in section 18.
How we store and secure personal data
Section 28 of the NDPA requires appropriate technical and organisational measures to protect personal data, and a data privacy impact assessment before processing likely to result in a high risk to data subjects. Our measures include:
- encryption of data in transit using transport layer security;
- storage of passwords as one-way cryptographic hashes only;
- enforcement of data isolation at the database layer, so that a query executed on behalf of one church cannot return the records of another;
- role-based access control, so that a user is granted only the permissions their role requires;
- restriction of access to production systems to personnel who require it to operate the Service;
- encryption of any credential that grants access to a third-party account, under a key separate from the one used to sign authentication tokens; and
- maintenance of the Service and its dependencies to address known vulnerabilities.
No method of transmission or storage is entirely secure and we cannot guarantee absolute security. Where a personal data breach occurs that is likely to result in a risk to the rights and freedoms of individuals:
- we will notify the Commission within 72 hours of becoming aware of it, as section 40 of the NDPA requires;
- where the breach is likely to result in a high risk, we will communicate it to the affected individuals without undue delay, together with the measures they can take to mitigate it;
- we will notify the church concerned immediately, so that it can meet its own obligations as controller; and
- we will record the facts of the breach, its effects, and the remedial action taken.
Retention of personal data
We retain personal data only for as long as necessary for the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting obligation. Where a period ends we delete the data or render it irreversibly anonymous; where neither is immediately possible we store it and isolate it from further use until deletion becomes possible.
For data held in a church’s workspace the retention period is determined by the church, which is the controller. A church may delete a record at any time, and deletion in the Service removes it.
| Data | Retention period |
|---|---|
| Account data | For the duration of the account, and for 6 years after closure, being a period within which contractual claims may ordinarily be brought. |
| Enquiry data | For 2 years from the date of the enquiry, or until deletion is requested, whichever is earlier. |
| Workspace records | As determined by the church. Until deleted by the church, or until the workspace is closed. |
| Form submissions | As determined by the church. A registration submitted through a public form is retained independently of any contact record it was matched to, because it constitutes the church’s record of who registered or attended. |
| Authentication and security records | For 12 months. |
Where a workspace is closed, we delete or irreversibly anonymise the data it contained within 90 days, unless we are required to retain it by law.
Your rights
Section 38 of the NDPA gives data subjects the following rights, subject to the conditions and exceptions in the Act. Which of them you may exercise against us, and which against a church, depends on the capacity in which we hold the data — see the preamble.
| Right | What it means |
|---|---|
| Information | To be told, at the time your data is collected, who is processing it and why. |
| Access | To be told whether we process your personal data, and to receive a copy of it together with information about how it is used. |
| Rectification | To have inaccurate personal data corrected, and incomplete data completed. |
| Erasure | To have personal data deleted where there is no continuing lawful reason for its retention. |
| Restriction | To require that processing be limited, for example while the accuracy of data is being verified. |
| Portability | To receive personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller. A church may export its people and giving records to a spreadsheet at any time. |
| Objection | To object to processing carried out on the basis of legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests. |
| Withdrawal of consent | Where processing is based on consent, to withdraw it at any time, as easily as it was given. Withdrawal does not affect processing carried out lawfully before it. |
| Automated decisions | Not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect. See section 12. |
| Redress | To complain to the Commission, and to seek redress in the Federal High Court where your rights under the Act have been infringed. |
Exercising your rights and complaints
Where we are the controller
For your account, or for an enquiry you have made, submit your request to support@vultion.com. We will respond without undue delay and in any event within one month of receipt. That period may be extended by two further months where a request is complex or where we have received a number of requests from you, in which case we will tell you about the extension and why, within the first month.
We may ask you to verify your identity before acting on a request. That is a security measure and not an obstacle: it prevents your data being disclosed to somebody impersonating you. No fee is charged except where a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act.
Where a church is the controller
For records a church keeps about you, direct your request to that church. It is the controller, it can act on your request directly, and it is answerable to the Commission for it. If you submit such a request to us we will refer it to the church and assist it in responding.
Complaints
If you consider that our processing infringes the NDPA, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), which is the supervisory authority established by the Act. You may also seek redress in the Federal High Court. We would ask that you raise any concern with us first, so that we have the opportunity to address it.
Automated decision-making and profiling
We do not make decisions producing legal effects, or similarly significantly affecting you, based solely on automated processing. We do not undertake profiling for the purposes of advertising or behavioural analysis.
The Service includes features that allow a church to define rules which create reminders or records within its own workspace. These operate on the church’s instructions, produce no legal or similarly significant effect, and are subject to human review by the church.
Google products and integrations
The Service allows a church to connect a Google account so that the Service can send email on that church’s behalf. This section describes what we access when a church does so.
What we request, and what we do not
We request the narrowest permission Google offers for sending mail, and nothing further. With the permission a church grants us we are able to send a message from the connected account. We are not able to read the mailbox, its contents, its metadata, its settings, its contacts, its calendar, or its other Google services, because we never ask for the permissions that would allow it.
We do not request, and will not request, permission to read or modify a church’s mailbox. A church may revoke the connection at any time from its own Google account settings, and from within the Service.
How we use Google user data
Google user data obtained through the connection is used solely to send the messages the church has composed and instructed us to send. We do not use it for advertising, we do not sell it, we do not transfer it to third parties except as necessary to transmit the message, and we do not use it to train machine learning models or for any purpose unrelated to providing the sending feature.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Storage and retention of Google credentials
Connecting an account stores an access token and a refresh token. These are encrypted at rest, under a key held separately from the key used to sign authentication tokens, and are accessible only to the systems that send mail. They are deleted when the church disconnects the account or closes its workspace.
A refresh token is durable access to a church’s mailbox. We treat it as the most sensitive credential the Service holds, and it is protected accordingly.
Human access to Google user data
We do not permit our personnel to read Google user data. Access is limited to the automated sending path. The narrow exceptions are where we have the church’s explicit consent, where access is necessary for security purposes such as investigating abuse, or where we are required to do so by law — and in each case access is logged and limited to what the purpose requires.
Google’s own processing
Google processes data in connection with the connection under its own terms and its own privacy policy, as an independent controller. This section governs what we do; it does not govern what Google does.
Anti-spam and acceptable use
Our commitments
The Service may not be used to send unsolicited commercial email in breach of applicable law. Every campaign message sent through the Service carries a mechanism by which the recipient can stop receiving further messages, and we act on complaints we receive.
We investigate reports of misuse, and we may suspend or terminate a workspace that uses the Service to send mail unlawfully or in breach of the terms on which the Service is provided.
A church’s responsibilities
A church sending messages through the Service is the sender. It is responsible for having a lawful basis to contact each recipient, for the accuracy of what it sends, for including any identification required by law, and for honouring withdrawals promptly and permanently. Unsubscribing a recipient from a church’s communications is the church’s obligation, and we provide the features that make it possible.
Transactional messages
Service messages relating to an account — verification codes, password resets, workspace notifications — are integral to the Service and cannot be unsubscribed from while the account exists.
Reporting misuse
If you have received a message you did not ask for from a church using the Service, please tell us at support@vultion.com as well as unsubscribing. We would rather know.
Third-party integrations and links
Integrations you authorise
A church may connect third-party applications to its workspace. Granting an application permission grants that third party access to workspace data, which may include the ability to view, store or modify it. We are not responsible for the practices of a third-party integration, and we encourage churches to review the permissions they grant and the privacy notice of the application concerned.
Links
The Service may contain links to websites operated by third parties. This policy applies only to the Service. We are not responsible for the privacy practices of any third party, and we encourage you to read the privacy notice of any website you visit.
Accessibility
If you are unable to read this policy because of a disability, or need it in another format, please contact us using the details in section 18 and we will provide it in a form you can use.
Changes to this policy
We may amend this policy from time to time, to reflect changes in the Service, in law, or in regulatory guidance.
The version number and effective date at the top of this page are revised whenever the policy is amended, and the current version is always published here. Where an amendment materially changes how personal data is processed, we will notify the administrators of affected workspaces so that churches may inform the individuals concerned.
Contact us
Questions, requests and complaints concerning this policy or the processing of personal data should be addressed to:
Data Protection Officer
Vultion Ltd
Lagos, Nigeria
support@vultion.com
If you are a member or attender of a congregation, please read the preamble first: where a church is the controller of the data in question, that church will be able to assist you more quickly than we can.
This policy is governed by the laws of the Federal Republic of Nigeria. Where it is translated, the English version prevails.