Privacy notice

Draft for legal review. This text describes what the website actually does; the parish’s lawyer must check it and complete the parts in square brackets before it is relied upon.

Who is responsible

The controller of the personal data collected through this website is the parish: [legal name, legal form, registered address and registration number of the parish — to be completed]. Contact details are on the contacts page; see also the imprint. [Data protection officer, if one is appointed — to be completed.]

The website runs on a platform operated on the parish’s behalf by [platform operator — to be completed], which processes the data only on the parish’s instructions.

What we process and why

• Visiting the website. For each request the servers record technical data — IP address, time, the page requested, browser type and any error — to deliver the pages, protect the site against abuse and fix faults. These logs are kept for up to 7 days [to be confirmed for production]. There is no analytics, no advertising and no profiling.

• Donations. What you enter in the form — name, e-mail address and message, all optional — together with the amount, currency, purpose, page language, PayPal’s order and transaction numbers and the payment status. You pay on PayPal’s page (or with Apple Pay or Google Pay through PayPal); your card details and PayPal login never reach us. We use this to record and account for the donation and, if you gave an e-mail address, to be able to contact you about it. PayPal sends the payment receipt.

• Names for prayer. The names you submit (up to ten), whether for health or for repose, and the service. If you ask for a reading report, your e-mail address — it is deleted as soon as the report has been sent. A donation added to a list is processed as described above. The names are kept only so that they can be read in the church [how long read lists are kept — to be completed].

Legal basis

• Donations and names for prayer: carrying out your request (Article 6(1)(b) GDPR); keeping donation records as accounting and tax law require (Article 6(1)(c) GDPR).

• Names for prayer may reveal religious belief. They are processed by a religious body in the course of its legitimate activities and are not disclosed outside the parish (Article 9(2)(d) GDPR) [to be confirmed by the lawyer].

• Server logs: the parish’s legitimate interest in a safe, working website (Article 6(1)(f) GDPR).

Who receives the data

• PayPal, which processes the payment as an independent controller under its own privacy statement. With Apple Pay or Google Pay, Apple or Google also process the payment under their own terms.

• The e-mail service that delivers reading reports, and the hosting and infrastructure providers of the platform, as processors [providers — to be completed].

Parish staff see donor details only with the rights the parish has given them. The data is not sold and not used for advertising. [Transfers outside the European Economic Area, if any — to be completed.]

How long we keep it

Donation records: as long as accounting and tax law require [period — to be completed]. The e-mail address for a reading report: until the report is sent. Server logs: up to 7 days.

Cookies and third-party content

See the cookie notice. Videos from YouTube or Vimeo load only after you press play.

Your rights

You may ask for access to your data, its correction or erasure, restriction of processing and data portability, and you may object to processing based on legitimate interest — write to the parish using the contacts page. You may also lodge a complaint with a data protection supervisory authority; in Greece this is the Hellenic Data Protection Authority.

Changes

This notice is updated whenever the website’s processing changes; the date of the last change is shown below.