Privacy Policy

Last updated: August 10, 2026

This Privacy Policy describes our policies on the
collection, use, and disclosure of information about you in connection with
your use of our sites and services, including those offered through our
websites, communications (e.g., emails, phone calls, texts), and mobile
applications (collectively, the “Service”). The terms “we,” “us,” and “our”
refer to Waterfront Church DC., a District of Columbia corporation, operating
at www.waterfrontchurchdc.com (the “Site”).

Please carefully review this Privacy Policy before you use
or submit any information through or in connection with our Service. By
creating an account, making a donation, subscribing to newsletters and lists,
registering for an event, class, or group, or otherwise actively submitting
information to us, you acknowledge the collection, use, and disclosure of your
information as described in this policy. Where required by applicable law, we
will obtain your affirmative consent before processing your personal information.

To the extent permitted by law, the English version of this
Privacy Policy is binding, and any translations are provided for convenience
only. In the event of a discrepancy, the English version controls.

Contents

Who we are

Waterfront Church DC is the data controller responsible for
your personal data. We have appointed a Privacy Officer who oversees questions
in relation to this Privacy Policy. If you have any questions about this
Privacy Policy, including any requests to exercise your legal rights, please
contact our Privacy Officer using the details in the “Contact Us” section
below.

Personal information we collect

We collect the following categories of personal information
in connection with the Service and our ministry activities:

Device Information

When you visit or use our Service, we automatically collect
certain information about your device, including your web browser type, IP
address, time zone, and cookies installed on or permitted by your device. As
you browse the Site, we collect information about the pages you view, search
terms or websites that referred you to the Site, and how you interact with the
Site.

Transaction and Donation Information

When you make a purchase, donation, or registration through
the Site, we collect your name, billing address, shipping address (if
applicable), payment information (such as credit card numbers), email address,
and phone number (“Transaction Information”). Payment card data is processed
directly by our PCI-DSS compliant payment processor and is not stored on our
servers.

Contact and Communication Information

We collect data when you subscribe to our publications or
email lists, register for events, classes, and/or groups, make donations,
submit prayer requests, complete contact forms, or otherwise communicate with
us (“Contact Information”).

Ministry and Membership Information

In connection with our ministry activities, we may collect
additional information, including church membership status, small group
participation, volunteer history, event attendance records, ministry
involvement, and giving history. We treat this information with the same care
as all other personal information described in this policy.

Mobile Application Data

If you use our mobile application, we may collect
information about your device, app usage patterns, and any information you
provide directly through the app, including content you view, notifications you
interact with, and in-app preferences.

Sensitive or Special Categories of Information

We do not routinely collect sensitive or special categories
of personal data, including details about your race or ethnicity, religious or
philosophical beliefs, sex life, sexual orientation, political opinions, trade
union membership, health information, or genetic or biometric data (“Special
Information”). We also do not routinely collect information about criminal
convictions or offenses.

There may be circumstances in which we request Special
Information, for example, in connection with specific ministry programs, prayer
requests, or health-related accommodations for events. In those circumstances,
we will inform you of the purpose and will seek your explicit consent before
collecting and using such Special Information. We will not use Special
Information for targeted advertising without your express opt-in consent.

Keeping Your Information Accurate

It is important that the personal information we hold about
you is accurate and current. Please keep us informed if your personal
information changes. You may update your information at any time by visiting
your profile
in church center or by contacting us directly.

When we refer to “Personal Information” in this Privacy
Policy, we mean all of the categories described above. It does not include data
where identity has been removed (anonymous data). Unless otherwise prohibited
by applicable law, we may collect, use, and share anonymous data without your
knowledge or consent.

Cookies and related technologies

“Cookies” are data files placed on your device or computer,
often including an anonymous unique identifier. For more information about
cookies and how to disable them, visit http://www.allaboutcookies.org.

We use the following categories of cookies:

“Log files” track actions occurring on the Site and collect
data including your IP address, browser type, Internet service provider,
referring/exit pages, and date/time stamps. “Web beacons,” “tags,” and “pixels”
are electronic files used to record how you browse the Site. These may be
provided by third-party services including Google Analytics, Facebook, and
similar providers.

How we use your personal information

We will only use your Personal Information in a manner
consistent with this Privacy Policy and as permitted by applicable law.
Specifically, we use your Personal Information to:

Change of purpose

We will only use your Personal Information for the purposes
for which we collected it, unless we reasonably consider that we need to use it
for another reason that is compatible with the original purpose. If you wish to
understand how a new use is compatible with the original purpose, please
contact us.

If we need to use your Personal Information for an unrelated
purpose, we will notify you and either (i) seek your consent, or (ii) explain
the legal basis that allows us to do so. Our goal is to seek your consent
whenever possible. We may process your Personal Information without your
consent only where required or permitted by law.

Sharing your Personal Information

We may share your Personal Information with the following
categories of recipients:

We require all third parties to respect the security of your Personal Information and to treat it in accordance with applicable law. We do not permit our third-party service providers to use your Personal Information for their own purposes.

Behavioral advertising

We may use your Personal Information to deliver targeted communications and advertisements on platforms such as Facebook, Instagram, and Google, primarily to promote Waterfront Church DC events, services, giving campaigns, and ministry programs. This means that if you visit our website, you may see communications from us on other platforms based on that visit.

For more information about how targeted advertising works,
you can visit the Network Advertising Initiative’s educational page at:
http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

Opt-out of targeted advertising

You can opt out of targeted advertising through the
following platform settings:

You can also opt out of participating networks through the
Digital Advertising Alliance at http://optout.aboutads.info/ or the Network
Advertising Initiative at http://optout.networkadvertising.org/.

To opt out of Waterfront Church DC’s  email communications, please use the
unsubscribe link in any email you receive from us, or contact us at info@waterfrontchurchdc.com.

Do not track

Some browsers include a “Do Not Track” (DNT) feature that
signals to websites that you do not want your online activity tracked. Our Site
does not currently alter its data collection or use practices in response to
DNT signals, as there is no consistent industry standard for honoring them.

Global Privacy Control (GPC): Residents of certain states
may use a GPC signal to opt out of the sale or sharing of personal information.
Please see the “State-Specific Privacy Rights” section to learn if your state
allows for GPC signals.

Third-party links

Our Site may include links to third-party websites,
plug-ins, and applications. Clicking on those links may allow third parties to
collect or share data about you. We do not control these third-party websites
and are not responsible for their privacy practices. When you leave our Site,
we encourage you to read the privacy policy of every website you visit.

International transfers

Our services are operated primarily in the United States. If
you are located outside the United States, please be aware that information we
collect about you may be transferred to and processed in the United States,
where data protection laws may differ from those in your country of residence.

Data security

We have implemented reasonable technical and organizational
measures to protect your Personal Information from accidental loss,
unauthorized access, use, alteration, or disclosure. These measures include
encryption of data in transit, access controls limiting data access to those
with a legitimate business need, and regular security reviews. Payment card
data is handled exclusively by our PCI-DSS compliant payment processor and is
not stored on our systems.

We limit access to your Personal Information to employees,
agents, contractors, and third parties who have a legitimate business need. All
such persons are subject to confidentiality obligations and will only process
your Personal Information on our instructions.

We have procedures in place to address any suspected data
breach. In the event of a breach affecting your Personal Information, we will
notify you and any applicable regulatory authority promptly and within the
timeframes required by applicable law. Despite these measures, no security
system is impenetrable, and we cannot guarantee the absolute security of your
data.

Data retention

We retain your Personal Information only for as long as
reasonably necessary to fulfill the purposes for which it was collected,
including to satisfy legal, regulatory, tax, accounting, or reporting
requirements. Specific retention periods include:

We may retain your Personal Information for a longer period
if there is a complaint, an ongoing legal claim, or if we reasonably believe
litigation is possible in respect to our relationship with you.

You may request deletion of your Personal Information at any
time by contacting us. We will honor such requests to the extent permitted by
our legal obligations.

Your Rights

Depending on your state or country of residence, you may
have some or all of the following rights regarding your Personal Information:

To exercise any of these rights, please contact us using the
information in the “Contact Us” section below. We will respond to your request
within 45 days. If we require additional time (up to an additional 45 days), we
will notify you of the extension and the reason for it.

We will not discriminate against you for exercising any of
these rights. We will not charge a fee for processing your data rights request,
except as specifically permitted by applicable state law (e.g., for requests
that are manifestly unfounded or repetitive). We may need to verify your
identity before processing your request but will not require you to create an
account solely for this purpose.

Changes to This Policy

We may update this Privacy Policy from time to time to
reflect changes to our practices or for legal or regulatory reasons. We will
notify you of material changes by posting the updated policy on this page with
a revised date. We encourage you to review this policy periodically.

A change in this policy does not automatically terminate our
right to retain previously collected Personal Information, except to the extent
the updated policy or applicable law specifically requires such limitation.

Minors and Children’s Programs

General Website

Our website and online services are not directed to children
under the age of 13, and we do not knowingly collect Personal Information from
children under 13 through the website without verifiable parental consent, in
compliance with the Children’s Online Privacy Protection Act (COPPA). If we
discover that we have collected Personal Information from a child under 13
without appropriate consent, we will delete it promptly. If you believe we have
inadvertently collected information from a child under 13, please contact us
immediately.

Children’s and Youth Ministry Programs

Willow Creek operates children’s and youth ministry programs
for individuals under the age of 18. In connection with these programs, we may
collect information from parents or guardians, including the child’s name, age,
grade level, health information relevant to program participation (such as
allergies or medical conditions), emergency contact information, and similar
data. This information is used solely for the purpose of safely administering
these programs and is not used for marketing purposes.

Teens and Youth (Ages 13–17)

For participants ages 13–17, we may collect information
directly and/or with parental or guardian consent, as required by applicable
law. We retain the right to share information collected from participants ages
13-17 with parents and/or guardians, as applicable.

Contact us

For questions about this Privacy Policy, to exercise your
rights, or to make a complaint, please contact our Privacy Officer:

Waterfront Church

Attn: Privacy Officer

PO Box 70666

Washington, DC 20024

Email: info@waterfrontchurchdc.com

We will respond to all requests within 45 days. If we
require additional time (up to 45 additional days), we will notify you. If you
are not satisfied with our response, you may have the right to lodge a
complaint with your state’s Attorney General or applicable data protection
authority.

Accessibility

We are committed to making our data rights request process
accessible to individuals with disabilities. If you need an accommodation to
submit a privacy rights request, please contact us at
info@waterfrontchurchdc.com and we will assist you.

State-Specific Privacy Rights

California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA) and
California Privacy Rights Act (CPRA), California residents have the following
rights:

To submit a verifiable consumer request, contact us at info@waterfrontchurchdc.com. We will need to verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf by providing written authorization. We will respond within 45 days; extensions of up to an additional 45 days will be communicated to you in advance.

Virginia Residents (CDPA)

Under the Virginia Consumer Data Protection Act (CDPA),
Virginia residents have the following rights: Right to Access, Right to
Correct, Right to Delete, Right to Opt Out (of targeted advertising, sale of
personal data, or profiling), and Right to Data Portability.

Appeals: If we decline to act on your request, you may
appeal by contacting us at info@waterfrontchurchdc.com within 60 days of our
response. We will provide a written explanation within 60 days of receiving the
appeal. If your appeal is denied, you may contact the Virginia Attorney General
at https://www.oag.state.va.us/consumer-protection/.

Colorado Residents (CPA)

Under the Colorado Privacy Act (CPA), Colorado residents
have the following rights: Right to Access, Right to Correct, Right to Delete,
Right to Opt Out (including via universal opt-out mechanisms such as the Global
Privacy Control), and Right to Data Portability.

Appeals: If we decline your request, you may appeal by
contacting info@waterfrontchurchdc.com. We will respond within 45 days. If
denied, you may contact the Colorado Attorney General at
https://coag.gov/file-a-complaint/.

Connecticut Residents (CTDPA)

Under the Connecticut Data Privacy Act (CTDPA), Connecticut
residents have the following rights: Right to Access, Right to Correct, Right
to Delete, Right to Opt Out (of targeted advertising, sale, or profiling), and
Right to Data Portability.

Appeals: If we decline your request, you may appeal by
contacting info@waterfrontchurchdc.com. We will respond within 45 days. If
denied, you may contact the Connecticut Attorney General.

Utah Residents (UCPA)

Under the Utah Consumer Privacy Act (UCPA), Utah residents
have the following rights: Right to Access, Right to Delete, Right to Opt Out
of sale of personal data and targeted advertising, and Right to Data
Portability.

Iowa Residents (ICDPA)

Under the Iowa Consumer Data Privacy Law (ICDPA), Iowa
residents have the following rights: Right to Access, Right to Delete, Right to
Opt Out of sale of personal data and targeted advertising, and Right to Correct
inaccurate personal data.

Illinois Residents

In addition to the rights available to all users, Illinois
residents have the following additional protections:

Illinois Biometric Information Privacy Act (BIPA): If
we collect biometric identifiers or biometric information from you (including
in connection with our children’s check-in program, if applicable), we comply
with BIPA by: (1) informing you in writing of the specific purpose and length
of term for which biometric data is collected; (2) obtaining your written
consent before collection; (3) not selling, leasing, or profiting from your
biometric data; (4) protecting biometric data with reasonable security
measures; and (5) destroying biometric data within three (3) years of
collection or within one (1) year of your last interaction with us, whichever
occurs first. To exercise rights related to your biometric data, contact info@waterfrontchurchdc.com

Illinois Personal Information Protection Act
(PIPA): In the event of a data breach involving your personal
information, we will notify you in the most expedient time possible consistent
with the needs of law enforcement. Notification will include a description of
the breach, the types of information involved, steps we are taking to
investigate and mitigate harm, steps you can take to protect yourself, and our
contact information.

Indiana, Montana, Tennessee, Texas, Oregon, Delaware, New
Jersey, New Hampshire, Minnesota, Maryland, Kentucky, Nebraska, Rhode Island,
and Other States

Residents of these states may have rights under their
respective state privacy laws, including: Right to Access, Right to Correct,
Right to Delete, Right to Opt Out of sale, targeted advertising, or profiling,
Right to Data Portability, and recognition of Universal Opt-Out Mechanisms
where required by law.

To exercise these rights, please contact us at info@waterfrontchurchdc.com.
We aim to respect consumer privacy and data security regardless of
jurisdiction, and residents of all states may contact us with questions about
the collection, use, and sharing of their personal data.