1. Who Is Responsible
Groundbreakers is responsible for LifeTrack and this website at www.groundbreakersfoundation.org. For GDPR purposes, Groundbreakers is the controller for account, member, leader, group, and discipleship platform data. Connect group leaders may also see and use member information for pastoral follow-up inside their own group.
Signed-in users can send privacy requests directly to platform administrators through the Questions & feedback button. You can also contact your connect group leader or the Groundbreakers team using the contact channel published by your church or organisation. If you do not know who to contact, use the contact details supplied with your invitation or account emails.
2. Data We Collect
Depending on your role and use of the platform, we may collect:
- Account details: first name, last name, email address, password credentials managed by Supabase Auth, role, and sign-in status.
- Group details: church, connect group, leader/co-leader relationships, invite codes, approval status, and notifications.
- Progress data: sessions assigned to you, sessions opened or completed, recommendations, follow-up status, and completion timestamps.
- Workbook data: answers, current step, completion state, and whether responses are shared with a leader.
- Communication data: transactional emails, leader notifications, declined/approved signup notices, catch-up notices, and recommendation notices.
- Support messages: questions and feedback you submit, your account email, the page you sent them from, and their handling status. These are visible to platform administrators.
- Media/access data: video access checks, signed media URLs, guide downloads, and popup view/dismissal/completion events.
- Technical data: authentication cookies, device/browser information included in normal server logs, and local storage used for drafts or preferences.
Sensitive information
Group membership, discipleship activity, progress and workbook answers can reveal religious beliefs, which receive special protection under GDPR. Free-text answers can also reveal health, sexuality or other sensitive information. Avoid unnecessary sensitive details and identifying information about other people. Your workbook sharing choice controls leader access to answers, not the separate progress and group information used for follow-up.
Accepting the Terms, acknowledging this policy or allowing experience cookies is not explicit consent to processing religious-belief data. Such processing needs an applicable Article 6 legal basis and an Article 9 condition.
3. How We Use Data
We use personal data to:
- Create and secure member, leader, and admin accounts.
- Approve or decline member signup requests and prevent duplicate accounts.
- Show each person their own modules, recommendations, workbook drafts, and progress.
- Help leaders follow up with members in their own connect group.
- Send account and security emails, and deliver recommendations, group follow-up and module notifications.
- Respond to support questions, feedback and privacy requests.
- Protect private videos, guides, and account pages from unauthorised access.
- Maintain the platform, troubleshoot errors, and improve the user experience.
Our lawful bases may include consent, performance of the service you request, legitimate interests in running a secure discipleship platform, and legal obligations where applicable. Optional experience cookies are used only with your permission.
5. Your Rights
Depending on your location and the applicable law, you may have the right to ask for access, correction, deletion, restriction, portability, objection to processing, and withdrawal of consent. You can lodge a complaint with a competent supervisory authority, including the Belgian Data Protection Authority / Gegevensbeschermingsautoriteit. See its complaint procedure.
Withdrawal of optional consent does not affect processing that happened before withdrawal. Essential account, security, and access processing may still be needed if you continue using the platform.
To request access, correction, an export, erasure, restriction, objection or withdrawal of consent, send a question through Questions & feedback stating what you need. The team receives it with your account email. Do not send your password, identity documents or workbook answers with the initial request. Submitting a message does not automatically erase or export data. If you cannot sign in, use the contact details in your invitation or account emails.
6. Deletion And Retention
Members can permanently delete their account from Settings → "Delete my member account". This removes your member account, progress, responses, notifications, pending signups, support messages, and Supabase auth account. Leader and admin accounts are deactivated (not fully erased) until any group handover or admin handover is complete — use the contact route below to request full erasure of a leader or admin account.
The team must review erasure requests and explain any records that must be retained and why. Deactivation does not trigger a published automatic deletion schedule. Server records, security logs and backups have separate retention arrangements; ask the team for the applicable periods and criteria. Keeping records for group use alone does not override your privacy rights.
8. Security
We use role-based access, authenticated API routes, Supabase row-level policies and admin service controls, signed media access, password handling through Supabase Auth, and limited leader/admin permissions. No online service can guarantee absolute security, so users should keep passwords private and report suspected misuse quickly.
9. Changes
We may update this policy when the platform, processors, legal requirements, or data practices change. The updated date above shows the latest version.