PRIVACY POLICY

LoveUnlimited Ministries

Version: 13 October 2026

1. Who we are and where this Policy applies

LoveUnlimited Ministries is a Christian ministry operated by Stichting LoveUnlimited Ministries, a foundation registered in the Netherlands under Chamber of Commerce (KvK) number 18084212. Stichting LoveUnlimited Ministries is the controller of the personal data described in this Policy, unless a particular service clearly identifies another controller.

Our contact and correspondence address is: Nijverheidsweg 12, 7005 BJ Doetinchem, the Netherlands. Privacy-related questions and requests may be sent to info@zalving.nl. For Revival FM-related correspondence, you may also use info@revivalfm.com.

This Policy applies, to the extent Stichting LoveUnlimited Ministries determines the purposes and means of processing, to the websites and activities we operate through anointingoil.eu, anointingoil.nl, anointingoil.org, zalving.nl, love-unlimited.nl, love-unlimited.de, love-unlimited.org and revivalfm.com, together with associated pages, forms and checkout environments that we operate. A purchase may begin on another domain and be completed through the central checkout at zalving.nl; this does not change the identity of the controller. This Policy covers our online shop, educational and ministry activities, customer contact, donations and Revival FM activities where we are the controller. A third-party website or service reached through a link may have its own privacy policy. Some of our websites have different technical infrastructures and may therefore use different cookies and service providers. Specific information is provided at the relevant point of collection and in the website-specific Cookie Policy.

2. What personal data we collect

Depending on how you interact with us, we process your name, billing and delivery addresses, country, email address, telephone number, order details, purchased products, delivery preferences, returns, refunds and customer-service history; account and login information if you create an account; payment-related information such as transaction references, payment status and limited payment-method details supplied by our payment providers; donation amount, frequency and associated administration; and information you voluntarily include in correspondence, contact forms, artist submissions, collaborations, testimonies or prayer requests. If you contact Revival FM as an artist, we may also receive your artist or stage name, submitted recordings, accompanying files, rights information and communication details.

When you use our websites or radio stream, technical data may be generated, such as IP address, browser and device type, approximate location derived from technical information, language preference, access times, security logs and website or streaming requests. Cookies and similar technologies may process further information as explained in Section 9 and the Cookie Policy for the relevant website. We do not normally receive or store complete payment-card numbers: these are handled by the applicable payment service, although it may share a limited transaction record with us.

We obtain most information directly from you or automatically when you interact with our websites and streams. We may also receive transaction status and fraud-check results from payment providers; fulfilment, delivery and return updates from logistics partners; and donation payment confirmations from donation platforms. Where you contact us through a third-party platform or publicly submit music or media material, we receive the information you choose to transmit through that channel. We do not routinely purchase data sets or obtain inferred religious-belief profiles from external data brokers. If data is obtained indirectly in a way that triggers Article 14 GDPR, we provide the applicable source and other information within the required time unless a lawful exception applies. If you provide information about another individual, please do so only when you have an appropriate reason and have considered that person's privacy.

Information required and optional. A valid delivery address, contact details necessary to reach you about an order and the relevant payment information are required to complete and deliver a purchase; without these details we may be unable to accept or fulfil it. Certain financial records are required by law. A newsletter subscription, non-essential cookies, a prayer request, a testimony, an artist submission and optional account-profile fields are voluntary. Refusing an optional request does not prevent you from making an ordinary shop purchase. If a specific form needs another mandatory field, the reason and consequence of not providing it are explained at the collection point.

3. Why we use personal data and our legal bases

We process personal data only for specified purposes and under an applicable legal basis. The purposes and main bases under Article 6 GDPR are:

• Purchases and customer accounts: to accept orders, manage the checkout, take payment, deliver products, deal with returns and provide transactional customer support — performance of a contract or steps requested before entering one (Article 6(1)(b)).
• Accounting, tax, fraud-related statutory duties and legally required records: compliance with a legal obligation (Article 6(1)(c)), where applicable.
• Enquiries, ordinary correspondence, artist submissions and operational relationships: our legitimate interests in responding, operating the ministry and managing submitted material (Article 6(1)(f)), or contractual steps where relevant. We consider the impact on the individuals involved and their right to object.
• Website, store and streaming security: our legitimate interests in operating, troubleshooting and securing these services (Article 6(1)(f)), and legal obligations where applicable.
• Requested newsletters and marketing communications: consent (Article 6(1)(a)) where required; a limited existing-customer exception may be used only where permitted by applicable electronic-marketing law and with an effective opt-out. We do not treat making a purchase or submitting a prayer request as blanket consent to marketing.
• Donations: processing a donation requested by you and maintaining its administration (Article 6(1)(b) where applicable), meeting legal obligations (Article 6(1)(c)), and our legitimate interests in donor administration and accountability (Article 6(1)(f)), subject to Section 4 where sensitive information is involved.
• Non-essential cookies, personalisation or advertising: consent where required by law (Article 6(1)(a)). Strictly necessary technical functions do not depend on marketing consent.
• Legal claims and disputes: our legitimate interests in establishing, exercising or defending claims (Article 6(1)(f)), or a legal obligation where applicable.

Where consent is our basis, you may withdraw it at any time without affecting processing already carried out lawfully. For legitimate-interest processing we rely, as applicable, on our interests in secure and reliable operations, answering correspondence, handling submissions, preventing misuse, preserving proportionate evidence and maintaining appropriate administrative relationships, after weighing the affected person's rights and expectations. Individuals may object under Article 21 GDPR. We do not repurpose data incompatibly with the reason for which it was collected. Before any new incompatible purpose is pursued, we assess its legality and provide further information and, where needed, obtain a new valid basis or consent.

4. Sensitive information, faith and prayer requests

We are a Christian organisation. A purchase, donation, enquiry or visit to a Christian website must not automatically be treated as proof of a person's religious beliefs. We do not create religious-belief profiles based solely on the products someone views or purchases, and we do not use prayer requests or other confidential ministry correspondence for advertising audiences.

You may voluntarily share a prayer request, testimony or other personal message. Such material can contain information about religion, health or other special categories protected by Article 9 GDPR. Where we invite you to submit this information through a dedicated form, we will seek separate, explicit consent to process any special-category information for the stated pastoral or ministry purpose, unless another applicable Article 9 exception can properly be relied upon. In the limited circumstances permitted by Article 9(2)(d), a not-for-profit body with a religious aim may process appropriate information concerning members, former members or people who have regular contact with it, subject to the conditions and safeguards in that provision. We do not rely on that exception as a general permission to process every visitor's information. In particular, the Article 9(2)(d) exception does not permit disclosure outside the religious non-profit body without the relevant person's consent. A separate Article 6 basis is also needed. We assess whether an express-consent mechanism and a suitable secure collection route are in place before requesting sensitive information.

Prayer requests and pastoral communications must be routed and stored separately from routine order fulfilment and marketing data, with access limited to appropriately authorised persons who need the information for the stated purpose. They are not passed to order fulfilment, advertising or general mailing-list systems as part of normal processing. We will not publicly publish an identifiable testimony, personal story or prayer request without an appropriate legal basis and, where required, specific permission. If someone sends sensitive information unexpectedly, we will assess whether it is necessary to retain it and minimise or delete it where appropriate. Please avoid including sensitive information about other individuals without an appropriate basis for doing so.

5. Orders, payments and delivery

Our commerce platform and checkout use Shopify, with zalving.nl serving as the central checkout domain for relevant purchases. Shopify receives and processes customer, shopping, transaction and technical information to support the store. Shopify's role depends on the service concerned: it acts as our processor for ordinary merchant services covered by its Data Processing Addendum, but it may act as an independent controller for its consumer services or certain Enhanced Services, where enabled. See Shopify's Consumer Privacy Policy and its privacy controls. Where Shopify Network Intelligence and associated Enhanced Services are enabled, Shopify may process customer interactions as an independent controller for those services, including certain cross-merchant insights and personalisation. The particular features, lawful basis, consent and objection/opt-out facilities must be reflected in our live shop privacy settings and cookie controls; users can also consult Shopify's privacy portal at https://privacy.shopify.com. An ordinary use of Shopify checkout does not, by itself, establish that every Enhanced Service is activated.

Payments may be processed through Shopify Payments and its underlying financial and payment-processing partners, including Stripe where applicable. If a separate Stripe integration is enabled, Stripe may also receive the data needed to process that transaction. Payment providers may act as independent controllers for purposes including fraud prevention, anti-money-laundering checks, financial compliance and disputes. We receive the transaction information reasonably needed to administer your order, rather than complete card details.

Orders delivered to European destinations are fulfilled from stock within the European Union. Necessary recipient, address, contact, parcel and delivery information is shared with Intrapost and the relevant carriers or delivery partners. Orders for delivery to the United States and Canada are fulfilled from Houston, Texas, through Abba Oil / our US fulfilment arrangement. For those orders we disclose the information necessary to fulfil and deliver the purchase, such as your name, delivery address, contact details, ordered items and shipping instructions. We do not disclose the content of unrelated pastoral or prayer correspondence to fulfilment partners. Shipping and payment providers may also process information in accordance with their own legal obligations and privacy notices.

6. Donations, Revival FM and other ministry activities

Where we accept donations, we process the donor details, amount, date, payment status and communication preferences necessary to administer the gift and provide any requested receipt. Revival FM currently identifies Donorbox as a donation service; when a donation is made through Donorbox, the information entered into that service is also handled under its applicable privacy terms, together with any relevant payment provider's terms. Other donation channels, if offered, are identified at the point of use. We do not automatically add donors to promotional mailing lists or disclose donation histories as religious profiles.

For Revival FM, we process listener messages, requests, technical streaming information and, where submitted, artist details, music materials, editorial correspondence and relevant permissions. We use such material for station operations, reviewing submissions, responding to enquiries, broadcasts and rights administration, as appropriate. An identifiable voice recording, photograph, testimony or interview may require additional privacy and publication information or permission at the point of collection. Publicly accessible broadcasts and content may remain accessible or be shared by listeners after publication; we will explain the intended use before seeking sensitive or personal contributions.

7. Service providers and other recipients

We share personal data only where reasonably necessary and lawful. Hosting of an informational site, an externally hosted Lovable application and processing in a Shopify checkout may occur in different technical environments even where the same domain name is used. Depending on the relevant website or activity, recipients include:

• Linulex, which provides hosting for most of our other self-hosted domains and associated server functions, where used. Linulex states that its servers are located in the Netherlands;
• Strato, solely for hosting revivalfm.com and its associated site infrastructure;
• Lovable, for development and deployment of the Lovable-built sites, and any actually connected hosting, database or infrastructure components. The precise production data location depends on the deployed configuration;
• Shopify and relevant store applications, for commerce, accounts and checkout;
• Shopify Payments, Stripe where applicable, and relevant banks or other financial partners, for payments, refunds, fraud checks and statutory compliance;
• Microsoft 365, for email, documents, internal correspondence and administration;
• Intrapost, delivery carriers and their necessary logistics partners, for European deliveries;
• Abba Oil / our Houston fulfilment arrangement, and US/Canadian delivery carriers, for orders delivered to those countries;
• Donorbox, where its donation service is used, including on Revival FM;
• providers of an active newsletter, cookie-consent, security, accounting or streaming service, but only where those services are actually deployed;
• professional advisers, auditors, insurers, competent authorities or other recipients where a lawful and necessary reason exists.

A provider may be our processor, a sub-processor or an independent controller depending on the actual service and processing purpose. For instance, a shipping carrier or regulated payment institution may determine some of its own statutory processing purposes; a technical host normally handles site data under our instructions. Where a provider processes personal data on our instructions, we require the contractual safeguards applicable under Article 28 GDPR. We do not disclose confidential prayer-request content to fulfilment partners or advertising providers. We do not sell customer lists for money. Any legally relevant sharing for targeted advertising, including through an enabled Shopify Enhanced Service, must be separately disclosed and controlled as required by the law applying to the individual.

8. International transfers

Our ordinary Linulex hosting is advertised as located in the Netherlands, and Strato is used specifically for revivalfm.com; however, the location of an informational website's server does not determine the location of all data processed through its integrated services. Although we are based in the Netherlands and European orders are shipped from EU stock, not every technical or operational service is necessarily located within the European Economic Area. Personal data may be transferred to, stored in, or accessed from other countries, including the United States and Canada, for example through Shopify and its providers, payment services, international technical support, donation services or the Houston fulfilment arrangement. The selected region for any Lovable-connected hosting or database and any permitted remote access must also be taken into account.

Where Chapter V GDPR applies, we use an appropriate transfer mechanism. This may be an applicable adequacy decision under Article 45 (including, within its scope, Canada's recognised commercial organisations or a US recipient with a current, applicable certification under the EU–US Data Privacy Framework), or appropriate safeguards under Article 46, such as the European Commission's Standard Contractual Clauses together with supplementary measures where needed. An adequacy decision for certain recipients does not mean that every company in that country is automatically covered. We verify the recipient's actual status, purpose and onward transfers rather than assuming that US or Canadian location alone supplies a valid basis. Where relevant, you can request information or a copy of the applicable safeguards, subject to lawful redactions, through our privacy contact address. We do not regard an overseas shipping address, by itself, as a blanket waiver of data-protection rights.

9. Cookies, analytics and embedded content

Our websites and checkout may use strictly necessary technologies to maintain sessions, remember shopping carts, apply security controls, process purchases and retain applicable consent choices. Other technologies, where actually installed, may provide audience measurement, embedded audio or video, personalisation or advertising. The active cookies and comparable technologies, their providers, purposes, lifetimes and any access by third parties are described for each site in the relevant Cookie Policy / Cookie Settings, which must reflect the actual live configuration. Different domains may have different cookie inventories. Essential cookies are distinguished from analytics, personalisation and advertising technologies.

Where legally required, non-essential technologies are blocked until valid consent has been obtained. Rejecting them must be a real and accessible choice, and consent can be withdrawn through the relevant website's cookie settings as easily as it was given. Privacy-friendly analytics may be used without consent only where the legal requirements for that exception are met. Embedded players, third-party videos, social media features and payment or donation widgets may involve separate providers; the relevant notice and consent mechanism must reflect their actual behaviour. Browser settings alone are not a substitute for our own consent obligations. No box for non-essential consent is pre-ticked. The initial interface must offer a sufficiently clear way to reject non-essential processing and to change preferences subsequently. Relevant choices must also be passed to integrated tools where technologically required, including Shopify's privacy interfaces when used.

10. Marketing and communication preferences

Service messages, such as order confirmations, delivery updates, donation receipts and responses to your enquiries, are distinct from promotional newsletters. We send promotional emails or similar messages only where we have a lawful basis and comply with applicable electronic-marketing rules. Every promotional email contains an effective means to unsubscribe. Where we rely on a legally permitted existing-customer exception, it is limited to the prerequisites and scope of that exception, and an opt-out is provided when details are obtained and in each message. We retain only the limited information necessary to respect an opt-out and demonstrate how any consent was obtained. If you subscribe through one of our brands, we will explain the scope of that subscription; we will not assume that subscribing to one ministry or radio newsletter automatically authorises unrelated marketing from every other brand. For Canadian recipients, we apply the applicable requirements of Canada's Anti-Spam Legislation, including consent, sender identification and an unsubscribe mechanism.

11. How long we retain information

We do not retain personal data for longer than necessary for the stated purpose, except where a law or a proportionate legal-claims need requires more. We use the following statutory periods or criteria. Operational deletion periods for non-statutory categories must be recorded in our internal retention schedule and implemented in the relevant mailboxes, platforms, systems and backups before a fixed duration is promised publicly:

• Order, invoice, financial and donation accounting records: normally seven years under Dutch administrative retention rules, or ten years where a particular regime such as the applicable EU One Stop Shop recordkeeping rules requires it. We keep only the information required for that purpose, not every associated support message or sensitive free-text field.
• Customer accounts: while an account is used and for the time reasonably needed afterwards to close it, resolve outstanding orders and preserve mandatory records.
• Ordinary enquiries and customer-service messages: while necessary to handle the matter and any proportionate follow-up, or for an evidenced dispute/claim. The ordinary operational period must be specified in the adopted internal schedule.
• Prayer requests and confidential pastoral correspondence: only while necessary for the request and agreed follow-up, subject to earlier removal of unnecessary sensitive details. Any ongoing pastoral relationship or longer retention requires a documented lawful basis and special-category condition. The exact default deletion period must be adopted and technically implemented.
• Artist submissions and other unpublished editorial material: until review and a proportionate editorial follow-up are complete, unless retained lawfully for continuing broadcast or rights administration. The default deletion period must be documented.
• Published interviews, recordings and testimonies: for the stated publication and archival purpose, subject to relevant rights, permissions, legitimate interests and applicable erasure or objection rights.
• Newsletter information: until you unsubscribe or the relevant basis ceases; minimal suppression and consent records may be retained for as long as reasonably needed to respect preferences and establish compliance.
• Technical and security logs: for a limited, documented period appropriate to the security purpose, extended only when required for investigation or a specific legal obligation.
• Cookies and similar technologies: for the periods stated in the applicable website-specific cookie information.

Where a statutory retention duty applies, the information is restricted to that duty after the original operational purpose ends. We review backup and processor retention settings, and design erasure workflows so deleted live records do not unnecessarily reappear on restore. If a deletion request is valid, we instruct the relevant processors as required; lawful backup or mandatory-record retention may take longer and must be restricted appropriately. Specific cookie lifetimes are stated separately in each site's actual Cookie Policy.

12. Security and confidentiality

We use risk-appropriate technical and organisational safeguards relevant to each active system, such as role-based access restrictions, individual user accounts, suitable authentication and multifactor authentication where configured, secure connections, updates, backup arrangements, confidentiality requirements and access restricted to those with an operational need. We review data flows between Lovable forms, Shopify, email, shipping and other integrated systems to minimise unnecessary copying. Additional safeguards apply to confidential prayer requests and other sensitive correspondence. We evaluate suppliers and seek appropriate data-processing and international-transfer arrangements. No website or transmission method can be guaranteed absolutely secure; if we become aware of a personal-data breach, we assess it and notify the competent authority and affected individuals where the GDPR or other applicable law requires us to do so.

13. Your privacy rights

Subject to applicable law, you may request access to your personal data, correction, deletion, restriction of processing, data portability or information about the applicable international-transfer safeguards. You may object to processing based on legitimate interests and object at any time to the use of personal data for direct marketing. Where processing is based on consent, you may withdraw it at any time. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where a lawful exception applies. We do not make such decisions ourselves as part of ordinary ministry or webshop operations; payment and fraud providers may conduct their own assessments under their applicable notices and legal responsibilities.

To exercise a right, email info@zalving.nl and describe your request. You may also use info@revivalfm.com for Revival FM matters. We may request proportionate information to verify your identity, but please do not send a copy of an identity document unless we specifically explain why it is necessary and how to provide it securely. We normally respond without undue delay and within one month, subject to permitted extensions where justified and communicated to you. Rights are not absolute: for example, some information must be kept to meet a legal obligation or defend a legal claim. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at https://autoriteitpersoonsgegevens.nl or, where applicable, another competent supervisory authority in your country of residence or work.

Additional privacy rights may apply under relevant US state, Canadian federal or provincial law. We assess requests from residents of those jurisdictions under the law actually applicable to our organisation, without suggesting that every regional statute automatically applies to every visitor.

Automated processing. Our ordinary shop and ministry administration are not intended to make decisions about you solely by automated means with legal or similarly significant effects. Payment services may independently apply fraud or risk checks under their own notices; where our actual configuration ever involves Article 22 decision-making or profiling requiring additional disclosure, we will provide the relevant meaningful information about the logic, significance and anticipated consequences before deployment.

14. Children

Our store and ministry websites are not directed at children as independent purchasers or donors. We do not knowingly solicit children's personal or sensitive information without the permissions required by applicable law. Where consent is the basis for a service offered directly to a child, the relevant national age and parental-authorisation requirements apply. A parent or guardian who believes a child has supplied personal information without the necessary permission may contact us for review and appropriate action.

15. Changes to this Policy and contact

We may update this Policy when our activities, suppliers, technologies or legal obligations change. The date at the top identifies the version. Material changes will be brought to your attention where required by law, and any newly required consent will be obtained before the corresponding processing begins. A new version does not retrospectively provide a legal basis for earlier unlawful processing.

Privacy contact: Stichting LoveUnlimited Ministries, Nijverheidsweg 12, 7005 BJ Doetinchem, the Netherlands; info@zalving.nl. For Revival FM-specific correspondence: info@revivalfm.com.