1. Introduction

Alto Base is a church management platform operated by Alto Media (Pty) Ltd ("Alto Media", "we", "us", or "our"). This Privacy Policy explains how we collect, use, store, share, and protect personal information when you use the Alto Base platform, including our web application, mobile applications, and related services (collectively, the "Platform").

We are committed to protecting your privacy in compliance with the Protection of Personal Information Act, 2013 (POPIA) of South Africa and, where applicable, the General Data Protection Regulation (GDPR) of the European Union.

By using Alto Base, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this policy, please do not use the Platform.

2. Definitions

• Church or Organisation: The church, ministry, or religious organisation that subscribes to Alto Base.

• Church Administrator: An authorised representative of a Church who manages the Church's Alto Base account.

• Member: An individual whose personal information is stored on the Platform by a Church.

• User: Any person who accesses or uses the Platform, including Church Administrators and Members.

• Personal Information: Information that identifies or relates to an identifiable natural person, as defined under POPIA and GDPR.

• Processing: Any operation performed on personal information, including collection, storage, use, modification, dissemination, or destruction.

• Data Subject: The individual to whom personal information relates.

3. Information We Collect

3.1 Information Provided by Churches and Church Administrators

When a Church subscribes to Alto Base and its administrators input data, we may process the following categories of personal information about Members:

• Full name, title, and preferred name

• Contact details (email address, phone number, physical address)

• Date of birth and age

• Gender

• Marital and family status

• Profile photographs

• Group and ministry involvement

• Attendance records

• Spiritual milestone data (e.g., baptism dates, membership dates, course completions)

• Spiritual health metrics and engagement scores

• Volunteer roles and service history

• Communication preferences

• Notes and pastoral care records entered by Church Administrators

3.2 Information Related to Children

Alto Base includes a children's check-in feature. When Churches use this feature, we may process the following information about minors:

• Child's name, age, and date of birth

• Parent or guardian name and contact details

• Allergies, medical conditions, or special needs (as entered by the Church)

• Check-in and check-out timestamps

• Authorised pick-up persons

Important: We process children's information solely on behalf of the Church. Churches are responsible for obtaining appropriate parental or guardian consent before entering children's information into the Platform.

3.3 Information Collected Automatically

When you use the Platform, we automatically collect:

• Device information (device type, operating system, browser type)

• IP address

• Usage data (pages visited, features used, session duration)

• Log data (access times, error reports)

• Location data (if geo-fencing features are enabled and you have granted permission)

3.4 Information from Third-Party Integrations

If a Church enables integrations, we may receive data from:

• WhatsApp (message delivery status, phone numbers for messaging)

• Payment processors (transaction confirmations — we do not store full payment card details)

• Other third-party services as configured by the Church

4. How We Use Personal Information

We process personal information for the following purposes:

• Platform Operation: To provide, maintain, and improve the Alto Base platform and its features.

• Church Management: To enable Churches to manage their congregations, track attendance, coordinate groups and ministries, and facilitate pastoral care.

• Children's Safety: To operate the children's check-in system and ensure child safety during church services and events.

• Spiritual Health Tracking: To generate spiritual health metrics and engagement insights for Church Administrators.

• Geo-Fencing: To enable location-based attendance tracking and check-in features, only where the User has granted explicit location permission.

• Communication: To facilitate communication between Churches and their Members via the Platform, including WhatsApp messaging.

• Analytics: To provide Churches with aggregated, anonymised insights about engagement and growth trends.

• Billing and Account Management: To process subscriptions, invoicing, and account administration.

• Security: To detect, prevent, and respond to fraud, abuse, security incidents, and technical issues.

• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

5. Legal Basis for Processing

5.1 Under POPIA

We process personal information based on one or more of the following justification grounds under Section 11 of POPIA:

• Consent: Where the Data Subject or their Church has provided consent.

• Contract: Where processing is necessary to perform our obligations under our agreement with the Church.

• Legal Obligation: Where processing is required to comply with South African law.

• Legitimate Interest: Where processing is necessary for our legitimate interests or those of the Church, provided these interests do not override the Data Subject's rights.

5.2 Under GDPR (for EU/EEA Data Subjects)

For individuals located in the European Union or European Economic Area, we rely on the following legal bases under Article 6 of the GDPR:

• Consent (Article 6(1)(a))

• Performance of a Contract (Article 6(1)(b))

• Legal Obligation (Article 6(1)(c))

• Legitimate Interests (Article 6(1)(f))

6. Data Sharing and Disclosure

We do not sell, rent, or trade personal information to third parties.

We may share personal information in the following limited circumstances:

• With the Church: Member data is accessible to authorised Church Administrators within the subscribing Church's account.

• Service Providers: We engage trusted third-party service providers to assist with hosting, analytics, payment processing, messaging (e.g., WhatsApp Business API), and customer support. These providers are contractually bound to protect personal information and may only process it on our instructions.

• Legal Requirements: We may disclose personal information if required by law, regulation, court order, or governmental authority.

• Business Transfers: In the event of a merger, acquisition, or sale of assets, personal information may be transferred to the successor entity, subject to the same privacy protections.

• With Consent: We may share information where the Data Subject has given explicit consent.

7. Data Storage and Security

7.1 Storage

Personal information is stored on secure cloud infrastructure. Data may be stored or processed in South Africa and other jurisdictions where our cloud service providers operate.

Where personal information is transferred outside of South Africa or the EU/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or equivalent mechanisms as required under POPIA and GDPR.

7.2 Security Measures

We implement appropriate technical and organisational measures to protect personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest

• Access controls and role-based permissions

• Regular security assessments and vulnerability testing

• Secure authentication mechanisms

• Audit logging of data access and modifications

• Incident response procedures

Despite these measures, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security of personal information.

8. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by law.

• Active Accounts: Member data is retained for the duration of the Church's subscription.

• Terminated Accounts: Upon termination of a Church's subscription, we will retain data for a period of 90 days to allow for account reactivation or data export, after which it will be securely deleted or anonymised.

• Backups: Backup copies may be retained for a limited additional period in accordance with our backup and disaster recovery procedures.

• Legal Holds: Data may be retained longer if required for legal proceedings or regulatory obligations.

Churches may request data export or deletion at any time by contacting us.

9. Your Rights

9.1 Rights Under POPIA

As a Data Subject under POPIA, you have the right to:

• Access: Request confirmation of whether we hold your personal information and request a copy of it.

• Correction: Request correction or updating of inaccurate or incomplete personal information.

• Deletion: Request deletion or destruction of personal information that is no longer necessary for the purpose for which it was collected.

• Object: Object to the processing of your personal information on reasonable grounds.

• Withdraw Consent: Withdraw previously given consent at any time, without affecting the lawfulness of prior processing.

• Complain: Lodge a complaint with the Information Regulator of South Africa.

9.2 Rights Under GDPR (EU/EEA Data Subjects)

If you are located in the EU or EEA, you additionally have the right to:

• Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.

• Restriction: Request restriction of processing under certain circumstances.

• Automated Decision-Making: Not be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

• Complain: Lodge a complaint with your local supervisory authority.

9.3 Exercising Your Rights

To exercise any of these rights, please contact us using the details in Section 14 below. We will respond within 30 days (POPIA) or one month (GDPR) of receiving your request.

Please note that where personal information has been provided to us by a Church on your behalf, we may direct your request to the relevant Church Administrator, as the Church is the primary controller of that data.

10. Geo-Fencing and Location Data

Alto Base offers optional geo-fencing features that use your device's location to enable automatic attendance tracking and proximity-based check-in.

• Location data is collected only when you have explicitly granted permission through your device settings.

• You may revoke location permission at any time through your device settings.

• Location data is used solely for the geo-fencing features described above and is not used for advertising or shared with third parties.

• We do not continuously track your location. Location data is collected only during active use of geo-fencing features.

11. WhatsApp Integration

Alto Base enables Churches to communicate with Members via WhatsApp using the WhatsApp Business API.

• Messages are sent on behalf of the Church, not Alto Media.

• Phone numbers used for WhatsApp messaging are processed in accordance with this Privacy Policy and WhatsApp's own terms of service.

• Members may opt out of WhatsApp communications at any time by contacting their Church or by using the opt-out mechanism provided in messages.

12. Children's Privacy

We take the privacy of children seriously.

• We do not knowingly collect personal information directly from children. All children's data is entered by Church Administrators or parents/guardians through the children's check-in system.

• Churches are responsible for ensuring that appropriate parental or guardian consent has been obtained before entering children's information into the Platform.

• Parents or guardians may request access to, correction of, or deletion of their child's personal information by contacting their Church or by contacting us directly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify Churches of material changes via email or in-app notification. The updated policy will be effective as of the date indicated at the top of this document.

We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Alto Media (Pty) Ltd
Big Bay, Cape Town, South Africa

Information Officer (POPIA):
Email: privacy@altobase.co.za

General Enquiries:
Email: hello@altobase.co.za

Information Regulator of South Africa:
Website: https://inforegulator.org.za
Email: enquiries@inforegulator.org.za

This Privacy Policy was last updated on 28 June 2026.