Privacy Policy - Kampong Kapor Methodist Church

Personal Data Protection Policy

Version 2 [May 2019]

1. Introduction

Kampong Kapor Methodist Church (‘KKMC’) is committed to safeguarding the personal data entrusted to it by individuals. This policy outlines the principles and practices adopted by KKMC in the collection, usage, and disclosure of personal data in compliance with the Personal Data Protection Act 2012 (‘PDPA’).

2. Policy Statement

2.1 KKMC will collect personal data relevant to the purpose of the collection or if it is mandatory in order to accomplish the purpose in accordance with the PDPA. In compliance with the regulatory requirements, we will:

Respect individuals’ right;
Be open and honest to the individual’s whose data are held by us; and
Provide training and support for staffs and volunteers who handle personal data, so that they may confidently comply with this Policy.

2.2 With reference to the Data Protection Act, KKMC recognizes that our primary commitment is to ensure individuals’ personal data are not misused. We strive to achieve this by ensuring personal data are:

Obtained fairly and lawfully and shall not be processed unless certain conditions are met;
Obtained for specified and lawful purposes and not further processed in a manner incompatible with that purpose;
Adequate, relevant and not excessive;
Accurate and up-to-date;
Kept for no longer than necessary;
Protected by appropriate security and keep with trusted and authorized parties.

KKMC is also committed to being open and transparent and will respond to any legitimate inquiries from individuals regarding usage, storage, and accuracy of their personal data in a timely manner.

3. Definition

3.1 Personal Data

Personal data defined in the PDPA as “data”, whether true or not, about an individual who can be identified from that data; or from that data and other information to which KKMC has or is likely to have access.

This includes personal particulars, medical records, financial records, educational and employment background, etc, whether the data is stored in electronic or non-electronic form.

3.2 Individual

The PDPA defines an individual as “a natural person, whether living or deceased”. At KKMC, individuals include, but not limited, to the followings:

Pastors
Staff (either paid or not paid. Unpaid employee includes volunteers, clergy and laypersons holding office or represents the Church in any way)
Members
Regular worshippers
Visitors
Applicants for baptism, events, activities, services and other programs organized by KKMC
Applicants for employment at KKMC
Donors
Beneficiaries
Students & Interns
Prospects

3.3 Members

3.3.1 The Membership Roll of KKMC includes:

Full Membership
Preparatory Membership
Members Removed by Local Conference Action
Constituency Roll
Affiliate Membership
Associate Membership

3.3.2 With reference to The Book of Discipline of The Methodist Church in Singapore (2017 ed.), ss 136, KKMC shall accurately maintain a record of her membership roll in a permanent church register. The register would include persons who are baptized but yet a member of KKMC.

4. Collection, Usage, and Disclosure

4.1 Purpose Limitation

4.1.1 KKMC collects, uses and discloses personal data for the following purposes:

(a) Planning, organizing and holding church worship services, events, activities, courses,
programs, and services;

(b) Administration and management of Church’s operations, functions, or other internal matters as the case may be, including record keeping;

(d) Staff Administration;

(e) Any other purposes of which the Church may notify individuals from time to time.

4.1.2 Such communication may take the form of voice calls, SMS, other messages receivables on a mobile phone (eg. WhatsApp, Line, WeChat, Skype messages, etc.), email, fax or post.

4.2 Collection of Personal Data

4.2.1 KKMC collects personal data via the followings:

(a) Application to join the church as a member and/or to be baptized, or for employment;

(b) Registration for events, courses or seminars organized by KKMC;

(d) Responding to a request for additional Personal Data;

(e) Personal Data submitted to KKMC for any other reason.

4.3 Consent

4.3.1 KKMC shall seek consent from the individual to collect, use or disclose the individual’s personal data, except in specific circumstances where the collection, use or disclosure without consent is authorized or required by law. Consent may be collected through written documentation (eg.
consent form, written note) or electronically (email consent, any other electronic forms).

4.3.2 In situations where consent cannot be conveniently obtained in written form or electronically, KKMC may opt to obtain verbal consent and such persons shall be approved by the Data Protection Officer (‘DPO’).

4.3.3 KKMC may not be able to provide certain services if individuals are unwilling to provide
consent to the collection, use or disclosure of certain personal data.

4.4 Deemed Consent

KKMC may assume individual to have given consent to the collection, usage, and disclosure of their personal data in situations where the individual has voluntarily provided information for obvious purposes. Such purposes include registering and/or participating in the church worship services, events, activities, courses or programs of KKMC.

4.5 Consent Withdrawal

4.5.1 An individual may withdraw consent to the use and disclosure of personal data at any time unless the personal data is necessary for the Church to fulfill its legal obligations. A written notice of request for withdrawal of consent can be submitted either in electronic or nonelectronic form with proof of identity to the DPO at kkmcpdpa@kkmc.org.sg.

4.5.2 KKMC shall comply with the withdrawal of consent request. Depending on the nature of the withdrawal of consent, KKMC may not be able to provide the services or administer any contractual relationship that is in place. Such withdrawal may also result in the termination of any agreement with KKMC.

4.6 Notification Obligation

4.6.1 Personal Data shall be collected directly from individuals. KKMC may also collect an individual’s personal data from third parties with the individual’s consent or required by law.

4.6.2 Prior or during the collection of personal data, KKMC shall make known to the individual the purpose for which the personal data was collected, except when such personal data is provided by an individual for obvious purposes. (eg. when completing a registration form to participate in an event, where the personal data will be used for communicating, managing and organizing the event).

4.7 Accuracy Obligation

4.7.1 KKMC will take every reasonable effort to ensure that the individuals’ information is kept accurate and complete.

4.7.2 The Church shall deem information submitted by individuals as complete and accurate. Hence, the individuals remain primarily responsible and liable to ensure that all personal data submitted to KKMC is complete and accurate. They are to inform the Church of any change to their personal data in the Church’s record.

4.8 Disclosure and Transfer of Personal Data to Third Parties

4.8.1 KKMC may disclose individuals’ Personal Data to third parties (for example, hotel, tour agency) when required for specific purposes (for example, church camp, retreat). Such transfer shall be done in a manner that is secure and appropriately align with PDPA requirements.

4.8.2 For members of KKMC, personal data may be disclosed at the Local Conference of KKMC and at the Trinity Annual Conference (‘TRAC’) of The Methodist Church in Singapore, or General Conference (‘GC’) with reference to The Book of Discipline of The Methodist Church in Singapore (2017 ed.), ss. 134-143, 154.4, 234.10.

5. Protection of Personal Data

5.1 KKMC keeps all personal data confidential and accessible to only authorized personnel and for authorized purposes. Reasonable and appropriate security measures are taken to ensure the storage of personal data is protected against unauthorized access and theft.

5.2 KKMC has in place an Internal Compliance Manual to guide in the processes and procedures to maintain compliance in all areas of operations.

5.3 In the event of a security breach, the DPO shall be notified. The DPO shall investigate if such breach is a malicious act and shall take appropriate action after consulting with the Church’s Key Management, Digital Kampong Committee, Church Governance Committee and last but not least, the Local Church Executive Committee.

6. CCTV, Video Recording and Photography

6.1 CCTV, video recording and photos captured within the premises of KKMC or captured for during KKMC’s worship services, organized and/or joint organized events, activities, courses, programs, and services are the property of KKMC. It may be used for communications/publicity purposes in print and electronic media, including but not limited to the church bulletins, church website, church newsletter and online photo galleries. Only authorized staff of the KKMC are allowed to access to these personal data.

6.2 By entering KKMC’s premises or participating in KKMC’s worship services, organized or joint organized events, activities, courses, programs and services you are deemed to have given consent for the use of your image captured in any picture or video recording by KKMC for the above-mentioned purposes.

6.3 For more information on the use of photographs and video as well as guideline to social media, please refer to the addendums (Social Media Policy) and (Use of Photographs and Video Policy) of this policy.

7. Access and Correction of Personal Data

7.1 The DPO has oversight of the personal data access or correction requests and ensures that they are processed in accordance with this policy.

7.2 Request for personal data access or correction by individuals, including any inquiries or complaints shall be submitted to the Church in writing to the DPO at the following address:

Kampong Kapor Methodist Church
1 Kampong Kapor Road
Singapore 208673
Tel: 6293 7997
Email: kkmcpdpa@kkmc.org.sg

7.3 The DPO shall verify the identity of the individual or request for additional information before responding to the request for access or correction. A record will be made of such requests and responds for future reference and verification.

Addendum – Social Media Policy

Kampong Kapor Methodist Church (‘KKMC’) Social Media Policy

Purpose of these guidelines

This policy provides parameters in order to guide church staff, church leadership, members and friends of KKMC and volunteers of KKMC (collectively called ‘USERS’) when social media is used on behalf of KKMC or when KKMC is part of a conversation by USERS in their own personal capacity.

Points to note

Users of KKMC information, including but not limited to photos and videos, church publications, are reminded to use Biblical wisdom when utilizing such material in social media, more so when the material or information is sensitive or is private.

Users are reminded that social media posts are often visible to the entire public and can be shared by others in various ways that cannot be controlled at KKMC or by users.

Use of Social Media

In addition to all of KKMC’s policies, including but not limited to confidentiality, human resource, finance, data protection, intellectual property, all relevant legislation including Copyright, Singapore IP Law, Singapore Personal Data Protection Act must be adhered to in the use of social media.

Guidelines

1. Social media posting should never disclose sensitive or confidential information unless verbal or written consent to share said information is obtained from the individual it concerns. This includes but is not limited to health/medical information.

2. USERS should, as far as possible, refrain from posting photos of individuals or identifying those individuals on social media without the verbal or written consent of those individuals. This includes ‘tagging’ of the photos and also reference to the location where the photos were taken.

3. Photos or videos of individuals below the age of 18 will require the consent of their parents or guardians before its use in KKMC social media and where practicable KKMC shall inform the individuals of the desire to use their photos and/or videos and shall take in good faith that such consent has been sought.

4. When any material, including but not limited to photos and videos, are used by USERS in a personal capacity it must be made clear that any views expressed in the social media posting do not reflect the views of KKMC and USERS are to be mindful that they should be personally responsible for the material they publish.

5. USERS should note that KKMC takes the proper and ethical use of social media seriously and shall not hesitate to request that material used in a manner considered to be in breach of this policy be taken off and shall also take all necessary steps to ensure that the interest of all involved is protected.

6. The Pastor- in-Charge is the final decision maker in any questions arising from the above.

Application of Policy

This policy applies to all online and mobile platforms for sharing content and information, whether hosted by KKMC or hosted by others. “Social media” refers to social networking services, short-message services, message boards, wikis, podcasts, image/video sharing sites and other methods for sharing real-time information amount users.

This policy applies to all new social media platforms, whether or not they are mentioned and for the avoidance of doubt all social media platforms are relevant and included.

Addendum – Photo/Video Policy

Kampong Kapor Methodist Church (‘KKMC’) Use of photographs and video

Personal Data

If the image can be used to identify an individual and tell you something about them it is likely that it will be personal data for the purpose of the Singapore PERSONAL DATA PROTECTION ACT 2012 (PDPA), and its regulations. It should be noted that individuals can be identified from their names but may also be identified from contextual information, e.g. location of the photo.

Photos of specific individual/groups

Where an image is clearly of an individual or group of individuals, who are in focus, it will be personal data and consent is required to use it. For best practice consent should be in written form so that a record is kept should there be subsequent disputes, failing which verbal consent should be obtained.

Consent forms, pro verbal request for consent, must explain clearly and fully how the image will be used and how long it will be retained.

It is not normally necessary to obtain the specific permission of all who appear indirectly or inadvertently in the background of the photos and are not participants in the activity of the group being photographed or videoed.

Where it is not practicable to obtain the consent of every individual, whether verbally or in written form, it is necessary to ensure that there are sufficient notices clearly displayed to indicate that photos or videos are taken and may be used for KKMC’s purposes.

Use of photos and videos taken in church or during church events and used in social media platform shall comply with the Social Media Policy of KKMC.

Sample form consistent with the provisions of the PDPA 2012

“By signing this membership (application) form, you agree that KAMPONG KAPOR METHODIST CHURCH may collect, use and disclose your personal data as provided in this (application) form, or (if applicable) as obtained by Kampong Kapor Methodist Church as a result of your membership, for the following purposes in accordance with the Personal Data Protection Act 2012 and our data protection policy available at our website.”

“Photographs and videos may be taken during the event for Kampong Kapor Methodist Church’s news and publicity purposes. Your presence at this event may be deemed as your consent to being photographed. However, at any time and with reasonable notice, you may write in to us at kkmcpdpa@kkmc.org.sg if you wish to withdraw the above consent.”

Appendix – Glossary

Abbreviation
DPO – Data Protection Officer
GC – General Conference
KKMC – Kampong Kapor Methodist Church
PDPA – Personal Data Protection Act 2012
TRAC – Trinity Annual Conference