Privacy Policy

Version 2026-05-25 · CIS, Diocese and Parish Church Information System · cis.rccph.org

CIS (the Diocese and Parish Church Information System, in this notice the "Service") is operated by Amta Systems and is built for Roman Catholic parish churches and dioceses in the Philippines. It complies with the Philippine Data Privacy Act of 2012 (RA 10173). This notice explains what personal information we hold about parishioners, donors, staff, and users of the Service.

1. What we collect

User accounts: name, email, username, password (hashed), role, parish.
Sacramental records: names, dates and places of birth, parents' names, sponsors, ministers, and other particulars required by canon law. This is sensitive personal information under the DPA.
Financial records: donors, payees, vendors, transaction details.
Mass schedules: celebrants, mass times, intentions where recorded.
Technical data: IP, browser, timestamps of logins and key actions.

2. Why we collect it

To maintain the canonical and financial records of the parish.
To run the service the parish subscribed to.
To keep accounts secure and detect misuse.
To comply with applicable law and canon law.

We do not sell, share, or use parish data for advertising.

3. Who sees it

The users the parish has authorized (parish priest, secretary, bookkeeper, finance council).
Diocesan administrators where the diocese is the Subscriber.
Our hosting provider, under confidentiality.
Authorities, only when legally compelled.

4. How long we keep it

Sacramental records are permanent canonical records and are retained for as long as the parish maintains a subscription. On cancellation the parish has 60 days to export them; thereafter we delete the live data and cooperate with the diocese on transfer to a successor system. Financial records follow Philippine tax-law retention requirements (currently 10 years).

5. Your rights under the DPA

You have the right to:

Be informed about how your personal data is used.
Access a copy of your personal data.
Correct inaccurate data.
Object to processing, or withdraw consent, where applicable.
Have your data deleted when the legal basis ends (note: sacramental records are by their nature permanent and cannot be deleted on request).
Lodge a complaint with the National Privacy Commission (privacy.gov.ph).

6. Sharing sacramental records with parishioners

Requests for one's own baptismal or other sacramental certificate are handled by the parish through the normal canonical process. The Service is only the system the parish uses to maintain and print these records.

7. Cookies

We use cookies to keep you signed in and to remember your last selected entity and date range on list screens. Cookie names start with church_. We do not use tracking or advertising cookies.

8. Security

Passwords are stored hashed (never in clear). The service is served over HTTPS. Access to the underlying server is restricted. We log key actions for audit.

9. Contact

Privacy questions or requests: amtasystems@gmail.com. (A formal Data Protection Officer will be designated before paid subscriptions are opened to additional parishes.)