GDPR for churches: your church’s data, protected
We hold sensitive information: faith, families, children, giving. We treat it that way, with access by role and data in the European Union.
Why we take this seriously
Under the GDPR, data about religious beliefs is a special category. In a church, almost everything about a person says something about their faith. So we designed Brado to show each piece of data only to those who need it, and to give each person control over what the church keeps.
What we protect and how
Six measures you can check in the demo.
-
Data in the European Union
The church’s information is stored on servers in the European Union, under European rules.
-
Role-based permissions
Roles with permissions by area and by action, plus custom roles the church creates.
-
Restricted pastoral notes
Restricted care cases are seen only by the owner and whoever is invited.
-
Two-step verification
Administrators sign in with a second verification step, with a deadline to switch it on, and have recovery codes.
-
Activity log
The team’s activity is logged, so you know who changed what.
-
Children’s record
Children’s ministry check-ins and check-outs are recorded and cannot be altered.
Who can see a person’s data?
Each team member has a role. The role defines what they see and what they can do in each area. The rules apply to the data itself and not only to the screens, so a shortcut on screen doesn’t open what the role doesn’t allow.
- Permissions by area and by action (view, create, edit)
- Pastoral, children’s and prayer data with restricted access
- Prayer requests with an anonymity option
- Each team member sees only what their role allows
- The AI assistant is designed not to read pastoral notes, care cases, private prayer requests or sensitive fields
Can I export or delete a person’s data?
Yes. On each person’s record you can export their data to a file, anonymise the record and manage consents. Members can delete their account in the app.
- Export of a person’s data to a file
- Anonymisation of the record
- Data retention configurable by the church
- Consents recorded on the record
What we claim
We don’t show certification badges: we say Brado was designed with the GDPR in mind and show what that means in the product. In the demo you see each measure at work.
Frequently asked questions
Where is my church’s data kept?
On servers in the European Union, under European rules, and each church sees only its own data. Within each church, role permissions decide who sees what, and the team’s activity is logged.
How does Brado approach the GDPR?
Brado was designed with the GDPR in mind: consents, export and anonymisation per person, configurable retention and access by role. We show what each measure does instead of using badges.
Who has access to pastoral notes?
Only people with permission for that area. Restricted care cases are seen only by the owner and whoever is invited, and the team’s activity is logged. Each person sees only what their role allows.
Can I export or delete a person’s data?
Yes. You export that person’s data to a file or anonymise the record. Members can delete their account in the app, and the church sets the retention period.
Is there two-step verification?
Yes, for administrators, with a deadline to switch it on and recovery codes in case you lose your phone. It strengthens access for those with the most permissions over the church’s data. Anyone who signs in with a password also confirms with a second step, such as a code generated on their phone.
Does the AI see pastoral notes?
No. The AI assistant is designed not to read pastoral notes, care cases, private prayer requests or sensitive fields, and it strips email addresses, phone numbers and tax numbers from the text you write. Even so, don’t put personal data in the request, and always review the text before using it. The church can switch the assistant off.
What if we want to leave Brado?
Whoever manages privacy downloads a file with people, families, groups, events and donations, and the church can ask for its data to be deleted. Pastoral, prayer and children’s data are left out of that file and are handled with the team.
Ask your GDPR questions
In the demo we show the permissions, the export and the activity log. Bring your church’s questions.