Terms & Policies
Privacy Notice
This site handles records of a person’s baptism, marital and canonical status, family relationships, and religious formation. This notice says plainly what we do with all of it.
2. Privacy Notice
Effective [Effective date]. Last revised [Last revised].
2.1 Our commitment
This site handles records of a person’s baptism, marital and canonical status, family relationships, and religious formation. Much of that is sensitive by any standard — it discloses religious belief and affiliation, and often family history that a person has told no one else.
We treat all of it as confidential. We do not sell it. We do not rent it. We do not trade it. We do not use it for advertising, and we do not permit anyone else to.
Certain comprehensive state privacy statutes, including Maryland’s, apply only above processing thresholds far larger than a parish program will ever reach, and their exemptions for nonprofit organisations are narrow. Rather than reason from thresholds, we commit to the substantive protections below regardless of whether any statute compels them.
2.2 What we collect
From public pages, automatically: IP address, browser and device type, pages viewed, referring page, and timestamps, in server and security logs.
From you, when you give it: name; email; phone; mailing address; date and place of birth; baptismal status and baptismal record; prior denominational affiliation; confirmation and first communion status; marital status and any canonical marriage or annulment information the Program requires; sponsor and godparent details; emergency contact; parent or guardian details where the participant is a minor; accessibility or accommodation needs you choose to disclose; documents you upload; and your correspondence with us.
From administrators: attendance, session participation, rite dates, document sufficiency status, and internal notes on formation progress.
2.3 What we do not collect, and do not want
Do not send us, and do not upload:
- Social Security numbers or any government identification numbers
- Payment card numbers or bank account details
- Medical records, diagnoses, treatment information, or insurance information
- Immigration or citizenship documentation
- Anything about a third party who has not consented
If you send any of it, we will delete it and ask you to resubmit without it. Nothing on this site is a HIPAA-covered transaction, and this site is not a health record system.
2.5 Why we use what we collect
To administer enrolment; to schedule and record sessions and rites; to verify prior sacraments; to prepare the canonical documentation the Archdiocese requires; to communicate about the Program; to arrange accommodations; to keep the site secure; to satisfy legal obligations; and to maintain the sacramental registers of the Parish.
We do not use it for anything else without asking you first.
2.6 Who sees it
Inside the Parish: clergy, the catechetical team, and office staff, on a need-to-know basis only. Access is by role, and it is logged.
The Archdiocese: only the specific records required for canonical purposes — for example, documentation submitted in connection with reception, confirmation, dispensation, or dossier requirements. Those transfers happen under archdiocesan policy, and the Archdiocese’s own handling of the record is governed by its policy, not this notice.
Vendors: only providers strictly necessary to operate the site — hosting, email delivery, file storage — under written terms requiring confidentiality, prohibiting use of the data for their own purposes, and prohibiting sale. Current providers are listed at available on request.
Law enforcement or courts: only where legally compelled, or where necessary to prevent imminent harm. Where the law permits notice, we will notify you.
Never: advertisers, data brokers, list vendors, political organisations, or anyone paying for access.
2.7 Sacramental registers are different, and this matters
The Parish maintains permanent sacramental registers under canon law. Once a baptism, reception, confirmation, or marriage is entered, that entry is a permanent canonical record.
Those registers are not part of this website, are not subject to deletion or amendment at a person’s request, and are not governed by this notice. A request to correct a register entry is a canonical process handled by the Parish and the Archdiocese, not a website request. Section 2.9 governs website data only.
Records of a person who withdraws before a sacrament is celebrated are website and administrative records, and §2.9 applies to them fully.
2.8 How long we keep website data
| Category | Retention |
|---|---|
| Server and security logs | 90 days |
| Inquiry correspondence, no enrolment | 24 months, then deleted |
| Enrolment file, program completed | 7 years after completion, then reduced to the canonical minimum |
| Enrolment file, withdrawn or not admitted | 24 months, then deleted on request or on schedule |
| Uploaded documents | Retained only until the canonical purpose is satisfied and the record is transmitted or entered; the portal copy is then deleted |
| Minor participant records | Held to the retention above, or until 2 years after the participant reaches 18, whichever is longer |
| Sacramental register entries | Permanent — see §2.7 |
| Administrator access logs | 3 years |
These periods are the Parish’s schedule for this site. Where archdiocesan records policy requires a longer period for a particular record, that policy governs.
2.9 Your rights over website data
You may ask us to:
- confirm whether we hold personal data about you;
- access a copy of it;
- correct anything inaccurate;
- delete it, subject to §2.7 and to records we must keep by law;
- obtain it in a portable format;
- stop non-essential communications at any time.
Write to [Privacy contact email] or 2900 Olney Sandy Spring Rd, Olney, MD 20832. We will respond within 45 days, and will tell you if we need a single 45-day extension. We will verify your identity before acting, proportionately to the sensitivity of what you are asking about. There is no charge for a reasonable request.
If we decline a request, we will say why and how to appeal. Appeals go to [Privacy appeal contact (must not be the original decision-maker)], who did not decide the original request, and are answered within 45 days. If an appeal is denied you may contact the Office of the Maryland Attorney General, Consumer Protection Division.
2.10 Security
We use encryption in transit, encryption at rest for uploaded documents, role-based access control, multi-factor authentication for administrator accounts, access logging, and periodic access reviews.
No system is perfectly secure, and we do not claim otherwise. If a breach of unencrypted personal information occurs, we will investigate and provide notice as the Maryland Personal Information Protection Act requires, and to the Archdiocese as its policy requires.
2.11 Minors
Section 3 governs and takes precedence for any participant under 18.
2.12 Mobile numbers and text messages
A mobile number is treated differently from the rest of your record, because a carrier requires us to say plainly what we do with it — and because it is the one piece of contact information most often traded by organisations that should know better.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and consent are never shared with anyone.
In practice that means:
- We do not sell, rent, trade, or lend your mobile number, to anyone, for any price.
- We do not share it with advertisers, data brokers, list vendors, political organisations, other parishes, or any affiliate — for marketing, promotion, or anything else.
- We do not share your opt-in consent, or the fact that you consented, with any third party for their own use.
- The only party that ever sees your number is the messaging carrier that delivers the text, which handles it solely to deliver that message and is contractually barred from using it for any purpose of its own.
What we send. Weather closings and cancellations, schedule changes, reminders about outstanding paperwork, requests for a specific form, and occasional programme announcements. Never marketing, fundraising, political, or promotional messages.
How often. Message frequency varies. In most months you will receive no texts at all; in a week of bad weather or a rescheduled rite you may receive several. We do not send routine or marketing texts.
What it costs. Message and data rates may apply. The parish charges nothing; your carrier may, depending on your plan.
How to stop. Reply STOP to any message, remove the number from your portal profile, or ask the office. Any of the three works, and none of them affects your place in the Program.
How to get help. Reply HELP to any message, write to [Text-message HELP contact (email or phone)], or telephone [Parish telephone number].
Giving us a mobile number is entirely optional. Everything sent by text is also posted in the student portal, and closings are published on the website, so nobody who declines misses anything.
The full campaign terms are at Text Message Program Terms.
2.13 Changes to this notice
Posted here with a revised date. Material changes are emailed to portal account holders at least 14 days before taking effect.
3. Minors’ Privacy and Parental Rights (OCIT)
Effective [Effective date]. Last revised [Last revised].
3.1 Scope
This section governs any participant under the age of 18, including teens in OCIT and any minor enrolled in the adapted rite. Where it conflicts with §2, this section controls.
3.2 No account without a parent or guardian
We do not knowingly create an account for anyone under 18 without verified consent from a parent or legal guardian. A minor’s enrolment is completed by the parent or guardian, who provides the information, accepts the participant terms on the minor’s behalf, and receives the account credentials or a linked parent account.
Although the federal Children’s Online Privacy Protection Act is directed principally at commercial operators, we apply its standards voluntarily to any participant under 13: verified parental consent before collection, collection limited to what the Program actually needs, no conditioning participation on disclosing more than necessary, and deletion on parental request.
We do not sell the personal data of any participant under 18, do not use it for targeted advertising, and do not profile it.
3.3 What a parent or guardian may do, at any time
- Review everything we hold about the minor
- Correct it
- Direct that it be deleted, subject to §2.7
- Refuse further collection while continuing the minor’s in-person participation
- Withdraw the media consent in §3.5
- Receive a copy of these policies in printed form on request
Requests: [Privacy contact email].
3.4 Communication with minors
Communication with a minor participant about the Program takes place through the portal or with a parent or guardian included. Catechists and volunteers do not initiate private one-to-one electronic communication with a minor participant, on this site or on any personal account, messaging service, or social platform. This mirrors the Archdiocese’s child protection requirements, and it is not waivable by a minor.
If a minor sends a message that raises a safety concern, we will act on it under the reporting obligation in the administrator terms.
3.5 Photographs and recordings of minors
No photograph, video, audio recording, or name of a minor participant is published on this site, on social media, or in any parish publication without separate, specific, written consent from a parent or guardian.
That consent is a distinct document, not a checkbox buried in enrolment. It is revocable at any time in writing. On revocation we will remove the material from anything we control going forward; we cannot recall material already distributed, printed, or copied by others, and we say so plainly rather than promise otherwise.
Consent may be given for one purpose and withheld for another — for example, permitted in a printed parish bulletin but not on a public web page.
3.6 Safe environment
Every adult with access to minor participants’ records, or with a role involving contact with minors, must satisfy the Archdiocese’s child protection requirements before that access is granted, including background screening, safe environment training, and acknowledgment of the applicable code of conduct. Access is provisioned only after compliance is confirmed, and it is revoked immediately if compliance lapses.