Privacy Policy

Last updated: June 26, 2028

This Privacy Policy describes our policies on the collection, use, and disclosure of information about you in connection with your use of our sites and services, including those offered through our websites, communications (e.g., emails, phone calls, texts), and mobile applications (collectively, the “Service”). The terms “we,” “us,” and “our” refer to Willow Creek Community Church, Inc., an Illinois corporation, operating at www.willowcreek.org (the “Site”).

Please carefully review this Privacy Policy before you use or submit any information through or in connection with our Service. By creating an account, making a donation, subscribing to newsletters and lists, registering for an event, class, or group, or otherwise actively submitting information to us, you acknowledge the collection, use, and disclosure of your information as described in this policy. Where required by applicable law, we will obtain your affirmative consent before processing your personal information.

To the extent permitted by law, the English version of this Privacy Policy is binding, and any translations are provided for convenience only. In the event of a discrepancy, the English version controls.

Contents

1. Who we are
2. Personal information we collect
3. Cookies and related technologies
4. How We Use Your Personal Information
5. Change of purpose
6. Sharing your Personal Information
7. Behavioral advertising
8. Opt-out of targeted advertising
9. Do not track
10. Third-party links
11. International transfers
12. Data security
13. Data retention
14. Your rights
15. Changes to This Policy
16. Minors & Children’s Programs
17. Contact us
18. State-Specific Privacy Rights

Willow Creek Community Church is the data controller responsible for your personal data. We have appointed a Privacy Officer who oversees questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact our Privacy Officer using the details in the “Contact Us” section below.

We collect the following categories of personal information in connection with the Service and our ministry activities:

Device Information

When you visit or use our Service, we automatically collect certain information about your device, including your web browser type, IP address, time zone, and cookies installed on or permitted by your device. As you browse the Site, we collect information about the pages you view, search terms or websites that referred you to the Site, and how you interact with the Site.

Transaction and Donation Information

When you make a purchase, donation, or registration through the Site, we collect your name, billing address, shipping address (if applicable), payment information (such as credit card numbers), email address, and phone number (“Transaction Information”). Payment card data is processed directly by our PCI-DSS compliant payment processor and is not stored on our servers.

Contact and Communication Information

We collect data when you subscribe to our publications or email lists, register for events, classes, and/or groups, make donations, submit prayer requests, complete contact forms, or otherwise communicate with us (“Contact Information”).

Ministry and Membership Information

In connection with our ministry activities, we may collect additional information, including church membership status, small group participation, volunteer history, event attendance records, ministry involvement, and giving history. We treat this information with the same care as all other personal information described in this policy.

Mobile Application Data

If you use our mobile application, we may collect information about your device, app usage patterns, and any information you provide directly through the app, including content you view, notifications you interact with, and in-app preferences.

Sensitive or Special Categories of Information

We do not routinely collect sensitive or special categories of personal data, including details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health information, or genetic or biometric data (“Special Information”). We also do not routinely collect information about criminal convictions or offenses.

There may be circumstances in which we request Special Information, for example, in connection with specific ministry programs, prayer requests, or health-related accommodations for events. In those circumstances, we will inform you of the purpose and will seek your explicit consent before collecting and using such Special Information. We will not use Special Information for targeted advertising without your express opt-in consent.

Keeping Your Information Accurate

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes. You may update your information at any time by visiting: https://portal.willowcreek.org/myaccount or by contacting us directly.

When we refer to “Personal Information” in this Privacy Policy, we mean all of the categories described above. It does not include data where identity has been removed (anonymous data). Unless otherwise prohibited by applicable law, we may collect, use, and share anonymous data without your knowledge or consent.

“Cookies” are data files placed on your device or computer, often including an anonymous unique identifier. For more information about cookies and how to disable them, visit http://www.allaboutcookies.org.

We use the following categories of cookies:

• Essential Cookies: Necessary for the website to function and cannot be switched off. They are usually set in response to actions you take, such as logging in or completing a registration form.
• Analytics/Performance Cookies: Allow us to count visits and traffic sources so we can measure and improve site performance. All information collected is aggregated and anonymous. We use Google Analytics for this purpose.
• Functional Cookies: Enable enhanced functionality and personalization, such as remembering your preferences.
• Targeting/Advertising Cookies: May be set through our site by advertising partners (such as Facebook and Google) to build a profile of your interests and show you relevant communications on other platforms.

You can choose which non-essential cookies we may set by clicking the “Change Cookie Preferences” button on our website. If you block all cookies (including essential cookies), you may not be able to access all parts of our website. Non-essential cookies expire within 12 months, or earlier if specified by the applicable third-party provider.

“Log files” track actions occurring on the Site and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps. “Web beacons,” “tags,” and “pixels” are electronic files used to record how you browse the Site. These may be provided by third-party services including Google Analytics, Facebook, and similar providers.

We will only use your Personal Information in a manner consistent with this Privacy Policy and as permitted by applicable law. Specifically, we use your Personal Information to:

• Ministry Operations: Facilitate your participation in church services and activities, events, classes, small groups, and volunteer activities; process donations and issue tax acknowledgment letters; and administer church membership.
• Transaction Fulfillment: Process purchases, registrations, and donations; communicate with you about your transactions; and screen for potential risk or fraud.
• Communications: Send you information about upcoming services, events, ministry programs, and giving opportunities, based on your preferences and prior engagement with us.
• Site and Service Improvement: Generate analytics about how users interact with the Site, assess the success of our communications, and improve our online services.
• Legal and Regulatory Compliance: Comply with applicable legal obligations, including tax reporting, record-keeping, and responding to lawful government requests.
• Legitimate Interests: Pursue purposes that are necessary for our legitimate ministry interests, provided your fundamental rights and interests do not override those interests.

We will only use your Personal Information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If you wish to understand how a new use is compatible with the original purpose, please contact us.

If we need to use your Personal Information for an unrelated purpose, we will notify you and either (i) seek your consent, or (ii) explain the legal basis that allows us to do so. Our goal is to seek your consent whenever possible. We may process your Personal Information without your consent only where required or permitted by law.

We may share your Personal Information with the following categories of recipients:

• Service Providers: Third-party vendors who assist us in operating the Service, including our church management platform, payment processors, email service providers, and analytics providers. These providers are contractually required to protect your Personal Information and may not use it for their own purposes. Key third-party providers include: Rock RMS, MyWell, Google, etc.. A more complete list is available upon request.
• Ministry Partners: In connection with specific ministry programs, events, or outreach activities, we may share limited information with affiliated organizations or ministry partners. We will identify any such sharing at the time of collection.
• Professional Advisors: Our legal, financial, and other professional advisors, as necessary and subject to confidentiality obligations.
• Business Transfers: If Willow Creek undergoes a merger, acquisition, or asset sale, your Personal Information may be transferred to the successor entity. We will notify you before your information is transferred and becomes subject to a different privacy policy.
• Legal Requirements: When required to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request, or to protect our rights and the safety of our congregation and staff.

We require all third parties to respect the security of your Personal Information and to treat it in accordance with applicable law. We do not permit our third-party service providers to use your Personal Information for their own purposes.

We may use your Personal Information to deliver targeted communications and advertisements on platforms such as Facebook, Instagram, and Google, primarily to promote Willow Creek events, services, giving campaigns, and ministry programs. This means that if you visit our website, you may see communications from us on other platforms based on that visit.

For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s educational page at: http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can opt out of targeted advertising through the following platform settings:

• Facebook/Instagram: https://www.facebook.com/settings/?tab=ads
• Google: https://myaccount.google.com/data-and-privacy
• Microsoft/Bing: https://about.ads.microsoft.com/en-us/resources/policies/personalized-ads

You can also opt out of participating networks through the Digital Advertising Alliance at http://optout.aboutads.info/ or the Network Advertising Initiative at http://optout.networkadvertising.org/.

To opt out of Willow Creek’s email communications, please use the unsubscribe link in any email you receive from us, or contact us at privacyofficer@willowcreek.org.

Some browsers include a “Do Not Track” (DNT) feature that signals to websites that you do not want your online activity tracked. Our Site does not currently alter its data collection or use practices in response to DNT signals, as there is no consistent industry standard for honoring them. However, you may opt out of certain cookies by clicking the Cookie Preferences icon on our website.

Global Privacy Control (GPC): Residents of certain states may use a GPC signal to opt out of the sale or sharing of personal information. Please see the “State-Specific Privacy Rights” section to learn if your state allows for GPC signals.

Our Site may include links to third-party websites, plug-ins, and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. When you leave our Site, we encourage you to read the privacy policy of every website you visit.

Our services are operated primarily in the United States. If you are located outside the United States, please be aware that information we collect about you may be transferred to and processed in the United States, where data protection laws may differ from those in your country of residence.

If you are located in the European Economic Area, United Kingdom, or Switzerland, we will transfer your Personal Information only where we have appropriate safeguards in place, such as Standard Contractual Clauses approved by the European Commission or another lawful transfer mechanism. Please contact us if you would like further information on the specific safeguards we use.

We have implemented reasonable technical and organizational measures to protect your Personal Information from accidental loss, unauthorized access, use, alteration, or disclosure. These measures include encryption of data in transit, access controls limiting data access to those with a legitimate business need, and regular security reviews. Payment card data is handled exclusively by our PCI-DSS compliant payment processor and is not stored on our systems.

We limit access to your Personal Information to employees, agents, contractors, and third parties who have a legitimate business need. All such persons are subject to confidentiality obligations and will only process your Personal Information on our instructions.

We have procedures in place to address any suspected data breach. In the event of a breach affecting your Personal Information, we will notify you and any applicable regulatory authority promptly and within the timeframes required by applicable law. Despite these measures, no security system is impenetrable, and we cannot guarantee the absolute security of your data.

We retain your Personal Information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including to satisfy legal, regulatory, tax, accounting, or reporting requirements. Specific retention periods include:

• Donation and financial records: Retained for a minimum of seven (7) years to comply with tax and accounting requirements.
• Membership records: Retained for as long as you are active in the church community and for a reasonable period thereafter.
• Transaction records: Retained for seven (7) years or as otherwise required by law.
• Communications and marketing data: Retained until you opt out or withdraw consent, or for up to three (3) years following your last interaction with us, whichever is earlier.

We may retain your Personal Information for a longer period if there is a complaint, an ongoing legal claim, or if we reasonably believe litigation is possible in respect to our relationship with you.

You may request deletion of your Personal Information at any time by contacting us. We will honor such requests to the extent permitted by our legal obligations.

Depending on your state or country of residence, you may have some or all of the following rights regarding your Personal Information:

• Right to Access: To request access to the Personal Information we hold about you.
• Right to Correct: To request correction of incomplete or inaccurate Personal Information.
• Right to Delete: To request deletion of your Personal Information, subject to certain legal exceptions.
• Right to Object: To object to processing where we are relying on a legitimate interest as the legal basis.
• Right to Restrict Processing: To ask us to suspend processing of your Personal Information in certain circumstances.
• Right to Portability: To request transfer of your Personal Information to you or a third party in a structured, machine-readable format (where applicable).
• Right to Withdraw Consent: To withdraw consent at any time where processing is based on your consent.

To exercise any of these rights, please contact us using the information in the “Contact Us” section below. We will respond to your request within 45 days. If we require additional time (up to an additional 45 days), we will notify you of the extension and the reason for it.

We will not discriminate against you for exercising any of these rights. We will not charge a fee for processing your data rights request, except as specifically permitted by applicable state law (e.g., for requests that are manifestly unfounded or repetitive). We may need to verify your identity before processing your request but will not require you to create an account solely for this purpose.

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal or regulatory reasons. We will notify you of material changes by posting the updated policy on this page with a revised date. Where we hold your email address, we will also send you an email notification of material changes. We encourage you to review this policy periodically.

A change in this policy does not automatically terminate our right to retain previously collected Personal Information, except to the extent the updated policy or applicable law specifically requires such limitation.

General Website

Our website and online services are not directed to children under the age of 13, and we do not knowingly collect Personal Information from children under 13 through the website without verifiable parental consent, in compliance with the Children’s Online Privacy Protection Act (COPPA). If we discover that we have collected Personal Information from a child under 13 without appropriate consent, we will delete it promptly. If you believe we have inadvertently collected information from a child under 13, please contact us immediately.

Children’s and Youth Ministry Programs

Willow Creek operates children’s and youth ministry programs for individuals under the age of 18. In connection with these programs, we may collect information from parents or guardians, including the child’s name, age, grade level, health information relevant to program participation (such as allergies or medical conditions), emergency contact information, and similar data. This information is used solely for the purpose of safely administering these programs and is not used for marketing purposes.

Teens and Youth (Ages 13–17)

For participants ages 13–17, we may collect information directly and/or with parental or guardian consent, as required by applicable law. We retain the right to share information collected from participants ages 13-17 with parents and/or guardians, as applicable.

For questions about this Privacy Policy, to exercise your rights, or to make a complaint, please contact our Privacy Officer:

Willow Creek Community Church

Attn: Privacy Officer
67 Algonquin Road
South Barrington, IL 60010

Email: privacyofficer@willowcreek.org

We will respond to all requests within 45 days. If we require additional time (up to 45 additional days), we will notify you. If you are not satisfied with our response, you may have the right to lodge a complaint with your state’s Attorney General or applicable data protection authority.

Accessibility

We are committed to making our data rights request process accessible to individuals with disabilities. If you need an accommodation to submit a privacy rights request, please contact us at privacyofficer@willowcreek.org or call us at 847-765-5000 and we will assist you.

California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the following rights:

• Right to Know: You may request disclosure of what personal information we have collected, used, disclosed, and sold or shared about you over the past 12 months, including the categories of personal information, the purposes for collection, the categories of third parties with whom it was shared, and the specific pieces of personal information collected.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions (e.g., to complete transactions, comply with legal obligations).
• Right to Correct: You may request that we correct inaccurate personal information.
• Right to Opt Out of Sale/Sharing: You may opt out of the “sale” or “sharing” of your personal information for cross-context behavioral advertising. [INSERT: “Do Not Sell or Share My Personal Information” link here and on the Site homepage, as required by CCPA.]
• Right to Limit Sensitive Information: You may limit our use of sensitive personal information to what is necessary for the purposes for which it was collected.
• Right to Data Portability: You may request a copy of your personal information in a portable, machine-readable format.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA rights.

To submit a verifiable consumer request, contact us at privacyofficer@willowcreek.org [or toll-free number, if applicable]. We will need to verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf by providing written authorization. We will respond within 45 days; extensions of up to an additional 45 days will be communicated to you in advance.

Virginia Residents (CDPA)

Under the Virginia Consumer Data Protection Act (CDPA), Virginia residents have the following rights: Right to Access, Right to Correct, Right to Delete, Right to Opt Out (of targeted advertising, sale of personal data, or profiling), and Right to Data Portability.

Appeals: If we decline to act on your request, you may appeal by contacting us at privacyofficer@willowcreek.org within 60 days of our response. We will provide a written explanation within 60 days of receiving the appeal. If your appeal is denied, you may contact the Virginia Attorney General at https://www.oag.state.va.us/consumer-protection/.

Colorado Residents (CPA)

Under the Colorado Privacy Act (CPA), Colorado residents have the following rights: Right to Access, Right to Correct, Right to Delete, Right to Opt Out (including via universal opt-out mechanisms such as the Global Privacy Control), and Right to Data Portability.

Appeals: If we decline your request, you may appeal by contacting privacyofficer@willowcreek.org. We will respond within 45 days. If denied, you may contact the Colorado Attorney General at https://coag.gov/file-a-complaint/.

Connecticut Residents (CTDPA)

Under the Connecticut Data Privacy Act (CTDPA), Connecticut residents have the following rights: Right to Access, Right to Correct, Right to Delete, Right to Opt Out (of targeted advertising, sale, or profiling), and Right to Data Portability.

Appeals: If we decline your request, you may appeal by contacting privacyofficer@willowcreek.org. We will respond within 45 days. If denied, you may contact the Connecticut Attorney General.

Utah Residents (UCPA)

Under the Utah Consumer Privacy Act (UCPA), Utah residents have the following rights: Right to Access, Right to Delete, Right to Opt Out of sale of personal data and targeted advertising, and Right to Data Portability.

Iowa Residents (ICDPA)

Under the Iowa Consumer Data Privacy Law (ICDPA), Iowa residents have the following rights: Right to Access, Right to Delete, Right to Opt Out of sale of personal data and targeted advertising, and Right to Correct inaccurate personal data.

Illinois Residents

In addition to the rights available to all users, Illinois residents have the following additional protections:

Illinois Biometric Information Privacy Act (BIPA): If we collect biometric identifiers or biometric information from you (including in connection with our children’s check-in program, if applicable), we comply with BIPA by: (1) informing you in writing of the specific purpose and length of term for which biometric data is collected; (2) obtaining your written consent before collection; (3) not selling, leasing, or profiting from your biometric data; (4) protecting biometric data with reasonable security measures; and (5) destroying biometric data within three (3) years of collection or within one (1) year of your last interaction with us, whichever occurs first. To exercise rights related to your biometric data, contact privacyofficer@willowcreek.org.

Illinois Personal Information Protection Act (PIPA): In the event of a data breach involving your personal information, we will notify you in the most expedient time possible consistent with the needs of law enforcement. Notification will include a description of the breach, the types of information involved, steps we are taking to investigate and mitigate harm, steps you can take to protect yourself, and our contact information.

Indiana, Montana, Tennessee, Texas, Oregon, Delaware, New Jersey, New Hampshire, Minnesota, Maryland, Kentucky, Nebraska, Rhode Island, and Other States

Residents of these states may have rights under their respective state privacy laws, including: Right to Access, Right to Correct, Right to Delete, Right to Opt Out of sale, targeted advertising, or profiling, Right to Data Portability, and recognition of Universal Opt-Out Mechanisms where required by law.

To exercise these rights, please contact us at privacyofficer@willowcreek.org. We aim to respect consumer privacy and data security regardless of jurisdiction, and residents of all states may contact us with questions about the collection, use, and sharing of their personal data.