Operator agreement

POPIA section 21 requires a written contract between each church (the responsible party) and Hellocura (the operator). This is that contract. A church accepts it when its pastor applies to bring the church onto Lineage, and Lineage records which version it accepted and when.

1. Parties and roles

The church: the church named in the application to join Lineage, represented by the pastor who accepts this agreement for it, the responsible party. The church decides what personal information is kept and why.

Hellocura (Pty) Ltd: registration number 2026/164195/07, 47 707 Road, Montford, Chatsworth, Durban, KwaZulu-Natal, 4092, represented by Nevana Phalynn Pillay, Managing Director and Information Officer, the operator. Hellocura provides Lineage and processes personal information only on the church’s behalf.

The church’s Information Officer under POPIA is usually the pastor (see section 4). Hellocura’s Information Officer is reached at hello.curateam@gmail.com or 065 861 6164.

2. What Lineage processes for the church

• Members and leaders: names, contact details, roles, clearances (Child Protection Register Part B and Sex Offenders Register checks, with expiry dates), fellowship membership and attendance.

• Children in Next Gen: names, birth dates, guardians, room, attendance, marks, check-in and pickup records, and accident and incident reports, as described on form NG-C1. A child is recorded by name only when a current guardian has said Yes and none has said No; otherwise the child is checked in by tag number only.

• Visitors: welcome cards, kept 6 months unless the visitor joins.

• Private notes: members’ Bible study notes, readable only by the member who wrote them – not by the church or by Hellocura’s app screens.

• Giving: designated-fund contributions and s18A tax receipts. Lineage never holds or moves money.

• Religious belief: church membership itself reveals it. Hellocura processes it only for the church’s own aims (POPIA s28) and never supplies it to anyone else (s28(3)), including other churches on Lineage.

3. Hellocura’s duties

1. Instructions only. Hellocura processes the church’s personal information only with the church’s knowledge or authorisation, and for no purpose of its own (POPIA s20(a)).

2. Confidentiality. Hellocura and its staff treat the information as confidential and disclose it only where the law requires it (s20(b)).

3. Security. Hellocura keeps reasonable technical and organisational measures in place (s19, s21(1)), including:

   • access rules enforced inside the database, so a screen can never show more than a person’s role allows;

   • children’s records only for leaders with both current register checks;

   • a signed consent form can never be changed afterwards;

   • an audit log of who changes or removes sensitive records, kept 5 years;

   • one-time sign-in codes, with no passwords to steal;

   • nobody who is signed out can read any table;

   • encryption in transit and in backups, with encrypted off-site backups every night;

   • the church’s data kept separate from every other church’s.

4. Breaches. If Hellocura has reasonable grounds to believe someone unauthorised has accessed or acquired the church’s personal information, it tells the church’s Information Officer immediately (s21(2)) and helps the church notify the Information Regulator and the people affected (s22).

5. Requests from people. Hellocura helps the church answer requests to see, correct or delete personal information (s23-25).

6. Sub-operators. Hellocura uses these service providers, each bound to equivalent protection:

   Provider	What it does	Where
   Supabase	Database, file storage and sign-in	Ireland (EU)
   Vercel	Runs the Lineage website	Dublin, Ireland (EU), with a worldwide network for page delivery
   Brevo	Sends sign-in and reminder emails	European Union
   Cloudflare R2	Stores encrypted nightly backups, each kept 30 days	European Union (EU jurisdiction)

   Hellocura tells the church before adding or changing a sub-operator.

7. Outside South Africa. The information is stored in the European Union, under the General Data Protection Regulation and each provider’s data processing agreement. Hellocura relies on these as adequate protection (s72(1)(a)), and the church also obtains guardians’ consent on NG-C1 (s72(1)(b)).

4. The church’s duties

1. Have a lawful reason for what it keeps. For children, that means a guardian’s Yes on NG-C1, or a legal duty such as recording an accident (POPIA s35).

2. Have an Information Officer (by default the head of the church, usually the pastor) and register them with the Information Regulator.

3. Record each leader’s Child Protection Register (Part B) and Sex Offenders Register checks, with expiry dates, before they see children’s records. The pastor needs both checks too.

4. Look at the clean-up list Lineage shows 7 days before records are removed, and keep any record listed by mistake, with a reason. Lineage removes records automatically each night once their keeping period ends (s14).

5. Answer members’ requests to see, correct or delete their information within 30 days, with Hellocura’s help (s23-25).

6. Report suspected abuse to the authorities as the Children’s Act requires (s110), and record it in Lineage. Safeguarding records are never removed automatically.

7. Tell Hellocura straight away if it suspects a leader’s sign-in has been misused.

4a. How long information is kept

The keeping periods are set out in the Lineage privacy policy and applied automatically every night, for example: children’s records while the child attends plus 12 months; adults who left, 12 months then names removed; fellowship registers, 2 years; giving and tax receipts, 5 years; ordinary incident reports until the child turns 21; safeguarding reports never removed automatically. The church can ask Hellocura to keep a record longer where the law requires it.

5. Ending the agreement

Either party may end this agreement with 30 days’ written notice. Within 30 days after it ends, Hellocura gives the church a full copy of its information in a common file format. Within 30 days after that, Hellocura deletes it, unless the law requires it to be kept, and confirms the deletion in writing.

6. Accepting this agreement

The church’s pastor accepts this agreement for the church online, by ticking the box on the Lineage sign-up page and confirming that they are authorised to accept it on behalf of the church. Lineage records the version accepted and the date and time, and keeps that record with the church once it is approved. Hellocura is bound by this agreement from the day it approves the church.