Legal

Privacy Policy

Last updated: 2 October 2026

This policy describes how Biserica Poarta Regelui (the data controller) collects, uses and protects your personal data, in accordance with Regulation (EU) 2016/679 (GDPR).

1. Who we are

The data controller is Biserica Poarta Regelui, based in Cluj-Napoca, Romania. You can contact us at [email protected] or at 0752 108 979.

2. What data we collect

We collect data in two ways:

Data you provide

Through the contact and sign-up forms: your name, email address, phone number (optional) and the message you send us. This data is transmitted to Planning Center (our contact-management processor).

Data provided by parents for their children

Through the consent form for parents of our young people: the parent’s or guardian’s name, email address and phone number, and for each child their full name and phone number, together with a record of the consent given (the consent wording, date and time). This data is transmitted to Planning Center (see section 8).

Technical data

Cloudflare, our hosting and security provider, may process your IP address and HTTP request information (User-Agent, timestamp) for security and reliability purposes. Cloudflare Web Analytics collects aggregated traffic data without using tracking cookies or identifying individual users.

3. Purpose of processing and legal basis

We process your data for the purposes and on the legal bases below (GDPR, Art. 6):

  • Responding to enquiries - legal basis: consent [Art. 6(1)(a)] or legitimate interest [(f)].
  • Organising the launch team - legal basis: consent [Art. 6(1)(a)].
  • Young people’s participation in youth events and communication with parents (including adding them to the youth WhatsApp group) - legal basis: consent of the parent or legal guardian [Art. 6(1)(a) and Art. 8].
  • Website security (Cloudflare) - legal basis: legitimate interest [Art. 6(1)(f)].
  • Aggregate traffic statistics (Cloudflare Web Analytics) - anonymised data; does not constitute personal data.
4. Third-party processors

We use the following authorised third-party processors:

  • Cloudflare, Inc. (USA) - hosting, CDN, security and anonymous traffic analytics.
  • Planning Center Online, LLC (USA) - managing contact data and sign-up forms.
  • Stripe, Inc. (USA) - payment processing (card data does not pass through our site; Stripe is the controller for payment data).
  • Sanity AS (Norway/USA) - content management system (CMS).
5. International transfers

Some processors (Cloudflare, Planning Center, Stripe) process data in the United States of America. These transfers are protected by the Standard Contractual Clauses (SCCs) adopted by the European Commission or by other appropriate mechanisms under the GDPR.

6. Data retention

Form data is kept for at most 2 years from collection or until the purpose is fulfilled, after which it is deleted. You can request deletion at any time (see section 7).

7. Your rights

Under the GDPR, you have the right to:

  • Access - to know what data we hold about you.
  • Rectification - correction of inaccurate data.
  • Erasure - to ask us to delete your data.
  • Portability - to receive your data in a structured format.
  • Objection - to object to processing based on legitimate interest.
  • Withdrawal of consent - at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing): www.dataprotection.ro.

8. Children's personal data

Our site is not intended for children under 16 and we do not knowingly collect data from them without the consent of a parent or legal guardian.

We receive data about children who take part in our youth events only from a parent or guardian, through the consent form for parents, and only with their consent. In Planning Center we keep the child’s name and phone number, marked as a minor and linked to the parent in a household (family), in order to organise youth activities and stay in touch with parents.

The child’s phone number is used to add them to the youth WhatsApp group, where we announce our events. WhatsApp is a service of Meta Platforms Ireland Limited, which processes data under its own privacy policy; phone numbers in the group are visible to the group’s other members.

The parent or guardian may withdraw consent at any time by writing to us at [email protected]. The child is then removed from the WhatsApp group and their data is deleted, unless the law requires us to keep it. The rights in section 7 also apply, and the parent may exercise them on the child’s behalf.

9. Changes

We may update this policy from time to time. The updated version will be published on this page with a new update date. Significant changes will be communicated by email if we hold your address.

10. Contact

For any question about the processing of your data: [email protected] · 0752 108 979.