Privacy policy

The public website is delivered as a static site through Cloudflare Pages (Cloudflare, Inc.). When you open a page, your browser transmits technically necessary data, in particular your IP address, the date and time, the address requested and details of your browser and operating system. These data are processed to deliver the pages and to protect the website against attacks.

The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

We use no analytics or tracking tools, no advertising cookies and no automatically loaded third-party content. Links to social networks are plain links: no data reach the provider until you click one.

We use only what the website technically needs:

• A session cookie when you sign in. It keeps you signed in, cannot be read by scripts (HttpOnly) and expires after seven days without use; every use of your account extends the session by another seven days.

• Your choice between the light and dark design, kept in your browser's local storage once you switch it. It never leaves your device.

• During registration, your email address in the browser's session storage so that you can request the confirmation link again if you need to. It is deleted when you close the tab.

For a user account we process your name, your email address and your password. The password is stored only as a one-way hash. We send you a confirmation link to confirm your email address.

To admit you as a member we also ask for your first and last name, your parish, your address (street, postcode, town, region, country) and your preferred language, and — where your parish requires it — your date of birth. Authorised people in the diocese or your parish review these details to decide on your admission.

In the members' area we also process the data you enter there yourself or that your parish needs to organise parish life, such as registrations for events. Only people to whom the diocese has granted the corresponding rights have access.

The legal basis is the performance of the user and membership relationship (Art. 6(1)(b) GDPR). Because belonging to a parish reveals your religious beliefs, we additionally rely on Art. 9(2)(d) GDPR (processing by a religious body in the course of its activities for its members). The data are not disclosed outside the diocese without your consent.

The mandatory details are required for an account and membership; without them we cannot set up an account.

With every sign-in we store the IP address and the browser identifier (user agent), so that you can see and end your active sessions and we can detect misuse. To protect against automated attacks we limit the number of requests per IP address. The legal basis is Art. 6(1)(b) and (f) GDPR.

Emails that belong to running your account — such as confirmation links, sign-in codes, password resets and messages about your account — are sent through the Resend service. Your email address and the content of the message are transmitted to Resend for this purpose.

The application interface, the database holding account and membership data, and the background services run on servers in the EU. Images and files are stored in Cloudflare R2 and delivered through Cloudflare. Data processing agreements under Art. 28 GDPR are or will be concluded with every service provider that processes data on our behalf.

Cloudflare and Resend are companies based in the USA, so a transfer of personal data to the USA cannot be ruled out. Such transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses (Art. 45 and 46 GDPR).

The server writes technical operating logs (for example the time, the function called, the result and error messages) to detect and fix faults. These logs are deleted after 30 days.

Security-relevant actions, such as granting or withdrawing rights and admitting accounts, are also recorded in an audit log. It contains only internal identifiers of the people involved — no names, email addresses or IP addresses — and is kept for three years so that we can show who granted which permission (Art. 5(2) and Art. 6(1)(f) GDPR).

• Account and membership data: for as long as your account or membership exists; on your request we delete them unless a legal retention obligation applies.

• Unconfirmed registrations: if you do not confirm your email address within 30 days and have not submitted an application by then, we automatically delete the account together with the name, email address and password hash.

• Rejected or withdrawn applications: 180 days after the decision we automatically delete all details (name, date of birth, address and the rest of the application) and empty the account. Only timestamps, status and history codes without names or addresses remain as a record. At your request this happens immediately.

• Sessions: they end seven days after you last used them.

• Operating logs: 30 days.

• Audit log: three years.

You can ask for your account to be deleted at any time by emailing info@kopten.at.

You have the right of access, rectification, erasure and restriction of processing, the right to data portability and the right to object to processing based on legitimate interests. You may withdraw any consent you have given at any time with effect for the future. To do so, contact info@kopten.at.

If you believe that the processing of your data breaches data protection law, you can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

Last updated: October 2026.