Last updated: 15 October 2026
Who is responsible for your information
Heralds to Hearts is referred to in this policy as “we”, “us” or “our”. Our website is developed and maintained in South Africa. Heralds to Hearts is the responsible party for the personal information we process in operating Heralds to Hearts.
This policy explains how we handle information when you visit our website, use its resources or contact us. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). For privacy enquiries or requests, email hello@heraldstohearts.org.
Our Information Officer can be reached at hello@heraldstohearts.org. Under POPIA the head of a private body is its Information Officer by default, and must be registered with the Information Regulator before acting.
Information we receive
You can browse the website and use the designated free lessons without an account. Other available lessons and their downloads require sign-in. There is no online payment facility.
When you create an account or sign in: Microsoft Entra External ID verifies your email address using an emailed one-time code. The site receives your verified email address and an account identifier. We use these to recognise your account, manage your profile and provide access to member resources. Enter your code only on the Microsoft sign-in page.
When you save your profile: we store your name and surname, verified email address, and any church or ministry name, website and description of your setting and intended use that you choose to provide. Church or ministry details and the description are optional. A profile may reveal a religious association; please include only information you want to share with us and do not name children or describe other people’s private circumstances. Completing these optional details is not a condition of lesson access.
Email updates: the profile includes a separate, optional choice to receive emails from us. We record your choice, the notice version and when it changed. You can withdraw that permission by clearing the email-updates checkbox and saving your profile, or by emailing us. Your choice does not affect access to lessons or the codes needed to sign in.
When you contact us: we receive your email address, any name you provide, your message and any attachments. Providing this information is voluntary, but without enough information to understand and answer your enquiry we may be unable to help. Please send only what is needed.
When your browser requests a page or download: our hosting and delivery services process technical information such as your IP address, the requested address, request time, browser information and response details. We use Microsoft Azure Blob Storage and Azure Front Door to host and deliver the site. Where diagnostic logging is enabled, request and security records may also be retained to investigate faults or abuse.
When fonts load: the website requests fonts from Google Fonts. Your browser connects to Google and sends technical request information, including your IP address and browser information. See Google’s Privacy Policy for information about Google’s processing.
Why we use information
We use enquiries to respond to questions, handle permission requests, consider corrections and resolve complaints. We use technical information to deliver pages and downloads, keep the website reliable and investigate misuse. We may also keep relevant records to meet legal obligations or establish, exercise or defend legal rights.
We use account details to provide sign-in and member access. We use the optional ministry information to understand the settings in which our curriculum is used. We use the email preference to respect your choice about receiving updates.
Depending on the activity, our lawful basis is consent, steps requested towards an agreement, a legal obligation, or a legitimate interest in responding to correspondence and operating a secure website. Sensitive information requires an additional lawful justification. Visiting the site is not blanket consent to unrelated processing.
We do not sell personal information, use it for targeted advertising or automatically add people who contact us to a marketing list. We do not make decisions with legal or similarly significant effects about visitors through automated profiling.
Cookies and similar technologies
The sign-in library uses browser session storage to keep your sign-in state and tokens. We also temporarily store the page to return to after sign-in. Microsoft’s sign-in pages use cookies and related technologies to operate and secure authentication. Sign out when using a shared device.
With your permission, we use Microsoft Clarity to understand how visitors use the website and improve its navigation and resources. Clarity provides usage measurements, heatmaps and session replays based on page views, clicks, scrolling and browser or device information, including which religious resources you visit. Clarity loads only after you select “Allow analytics”; before that, or if you decline, we do not load Clarity or send it usage data. We keep advertising consent disabled. The profile content is marked for masking, and we do not send account identifiers or profile details through Clarity’s identification features. Clarity is not loaded on sign-in callback URLs containing authentication details.
We remember your choice for up to 180 days in a first-party preference cookie, shared between heraldstohearts.org and www.heraldstohearts.org. You can reopen “Privacy settings” in the footer to change your choice. If you withdraw permission after allowing analytics, we clear the site’s Clarity cookies and reload the page to stop collection. Withdrawal does not erase information already collected. If your browser blocks the preference cookie, you may be asked again on the next page. Declining analytics does not affect sign-in or your access to lessons.
Microsoft receives the usage data collected by Clarity and processes it under the Microsoft Privacy Statement, which explains Microsoft’s uses of information, including advertising-related uses where applicable. See Clarity’s cookie information for details. Your email-updates preference is separate from analytics and cookie permissions.
Azure Front Door can set cookies for routing or security when those features are enabled. These are different from advertising cookies. You can manage cookies through your browser; blocking a necessary security cookie may prevent access to a protected page. We will update this notice if the site introduces additional cookies, analytics or other collection features, and obtain consent where required.
Who may receive information
Information may be accessed by people authorised to handle website administration or correspondence, and by service providers that support hosting, delivery, analytics, email and security. Microsoft provides Clarity for usage analytics, Entra External ID for authentication and sign-in codes, Azure Functions for account and resource requests, Table Storage for profiles and email preferences, and Blob Storage and Front Door for website resources. Google receives the font requests described above. Profile records are stored separately from the public website files. We limit access according to the work involved and require appropriate safeguards from providers processing information on our behalf.
We may disclose relevant information where the law requires or permits it, including to respond to a lawful request or protect someone from harm. We do not publish your correspondence or identify you in a story or testimonial without separate permission.
Processing outside South Africa
Development and maintenance in South Africa do not mean that all information stays in South Africa. Azure Front Door operates a global delivery network. Microsoft Clarity and authentication services, Google Fonts and email services may also process information in other countries.
Transfers must meet POPIA’s requirements, through adequate protection under applicable law or a binding agreement, or another permitted basis. Microsoft’s Data Protection Addendum describes its contractual data-protection arrangements. Contact us for information about the providers and safeguards relevant to your enquiry.
Children and sensitive information
Our resources help adults teach children, but we do not ask children to register, submit work or tell us about personal experiences. Please do not send identifying details about children or other people, or accounts of health, sexual matters, abuse or religious beliefs, unless they are necessary and you have a lawful basis to share them. Never send sexual images of a child.
If we receive children’s or other sensitive information, we will assess the lawful basis for handling it, restrict access and retain or delete it as the law requires. We may need consent from a legally competent person or another applicable authorisation. We cannot promise absolute secrecy where disclosure is legally required.
Keeping information secure and deciding how long to keep it
We take reasonable technical and organisational steps to protect personal information. No website or email system can promise complete security. Where a security compromise requires notification, we will notify the Information Regulator and affected people as required by POPIA.
We keep information only as long as needed for the purpose for which it was collected, related follow-up, legal obligations or a genuine dispute. Retention depends on the type of record and those needs. We then delete, destroy or de-identify it, subject to lawful retention and backup arrangements.
Your rights and how to raise a concern
You may ask whether we hold your personal information, request access, ask for correction or deletion where applicable, object to qualifying processing, or withdraw consent where we rely on it. These rights are subject to lawful limits; withdrawing consent does not undo processing that was lawful before withdrawal.
You can update your profile and email preference from My profile. For a copy of your stored information or to request deletion of your profile and sign-in account, contact us at the address below. Account deletion is handled by request; there is no automatic deletion button on the website.
Email hello@heraldstohearts.org and explain your request. We may ask for proportionate proof of identity or authority before releasing information. Please do not send an identity document unless we request it through an appropriate process. We will explain any lawful restriction, prescribed procedure or applicable fee.
You may complain directly to the Information Regulator (South Africa), whether or not you have contacted us first. Its published POPIA complaints email is POPIAComplaints@inforegulator.org.za.
Changes to this policy
We will update this page when our practices change and revise the date above. Where a change requires additional notice or consent, we will provide it. A policy update does not itself authorise a new use of information.