Privacy Policy (Datenschutzerklärung)

Courtesy translation. Only the German version is legally binding. To read it, choose DE in the navigation.

1. Controller

Wort des Glaubens Kirche (Word of Faith Church) e.V.
Bahnhofstraße 103
67059 Ludwigshafen am Rhein, Germany
Represented by: Okorie Onuma
Email: info@example.com
Phone: +00 000 0000000

2. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent you have given, with effect for the future (Art. 7 (3) GDPR)
• Complaint to a supervisory authority (see below)

To exercise these rights, contact us using the contact details above.

3. Hosting

This website is run on its own server (virtual private server, VPS) provided by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, in a data centre in Nuremberg, Germany. Processing therefore takes place within the European Union. We have concluded a data processing agreement with netcup under Art. 28 GDPR.

Every page request technically transmits the visitor's IP address and browser information (user agent) to the server. The application itself does not write IP addresses to its own log files; the hosting company may log requests on its side.

4. Visitor statistics (without cookies)

For every public page view (excluding the admin area, images/CSS/JS, PDF/API endpoints) we store: the time, the page requested, the referring site reduced to its domain (e.g. “youtube.com”), a rough device type (mobile/tablet/desktop/bot), and a daily-changing hash value calculated from the date, IP address and user agent that cannot be traced back. The raw IP address and raw user agent are not stored; the hash value does not allow visits to be linked across different days.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in simple audience measurement without accessing the device — not a case of § 25 TDDDG).

Retention: The statistics are deleted automatically after 14 months. That covers a full year for year-on-year comparison. An administrator can also delete them at any time, by month or year.

If you agree to the Statistics category in the cookie banner, we additionally record a visitor cookie and a session cookie, rough origin data from the link (UTM parameters), the browser language, a screen-size group and how long a page was viewed — see section 7.

5. Contact, anonymous and “New Convert” forms

Contact form

Your details (name, email address, phone number if given, subject and message) are sent by email to the church and are not stored in the website's database. The email also states the time of the message and the language of the page you used (German or English); your email address is set as the reply address. To send this email we use the email delivery service Brevo: it is transmitted to Brevo encrypted and delivered from there to the church's mailbox. Legal basis: Art. 6 (1) (b) or (f) GDPR. How long the message is kept depends on the church's mailbox, not on the website.

Brevo is provided by Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France. We have a data processing agreement with Brevo under Art. 28 GDPR. Brevo processes the data in the European Union and keeps sending logs (e.g. recipient, time, delivery status) for a limited period. More information: Brevo privacy policy.

Anonymous messages

For this form we record only the message text and the time — no name, no email address, no IP address and no visitor hash; the page is excluded from the visitor statistics. An automatic filter (German and English word lists) may reject grossly abusive submissions before they are stored; rejected messages are not stored. Retention: anonymous messages are deleted automatically 12 months after they arrive, whether or not they have been read.

“New Convert” form

Among other things, this form asks whether you are born again, whether you own a Bible and whether you wish to be baptised. These answers allow conclusions about your religious beliefs and are a special category of personal data under Art. 9 GDPR. We process them only with your explicit consent (Art. 9 (2) (a) GDPR), which you give by ticking the consent box in the form; the time and fact of consent are stored. Your details are first saved as an unconfirmed entry and reviewed by a staff member with the corresponding permission.

Retention: entries that a staff member has not confirmed are deleted automatically 6 months after they were sent. Confirmed entries are kept for as long as you are connected with the church. You can withdraw your consent at any time and ask for your details to be deleted.

Protection against abuse

To keep out spam and automated submissions, the contact form and the anonymous form each allow at most five submissions per hour per IP address. For this the IP address is held only in the server's working memory — not in the database, not in a log file and not together with the message text — and is discarded about one hour after the last request, or at the latest when the server restarts. Both forms also contain a field that is invisible to people and only filled in by programs; a form submitted with that field filled in is discarded without processing. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in keeping the forms working without disruption).

6. Member data, birthdays, photos

Church staff can manage the names and birthdays of church members internally; this information is not shown publicly. Photo galleries, event photos and staff profiles with name, role and short biography are also maintained by the church and may be shown publicly. Consent to publish a member's birthday, a person's photo, or a staff bio is asked in person, privately, or at church, outside of this software. Children are not published.

7. Cookies and consent

On your first visit we show a cookie banner with three categories. “Settings”, “Only necessary” and “Accept all” are shown the same size and with equal weight; no category is pre-selected. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer or on the page /cookie-einstellungen.

Category	Purpose	Lifetime
Necessary	Stores your cookie choice	12 months
Necessary	Stores the language you chose (only after you use the language switch)	12 months
Necessary	Login to the admin area (administrators only)	7 days
Statistics	Tells new and returning visitors apart	12 months
Statistics	Groups page views into one visit	until 30 min. of inactivity
Statistics	Screen-size group (small, medium, large)	12 months
External media	Target language for Google Translate (“googtrans”, German pages only)	12 months
External media	Set by YouTube/Google once you load a video or a map	see provider

As proof of your choice (Art. 7(1) GDPR) we store on the server the date, the banner version and your selection under a random identifier, without IP address or name. This record is deleted automatically when your choice has not changed for 3 years.

The cookies marked “necessary” are set without consent because they serve only to provide a service you have expressly requested or to remember your decision (§ 25 (2) no. 2 TDDDG). All cookies carry the attribute SameSite=Lax.

Without your consent to the “Statistics” category, the cookie-free counting described in section 4 continues unchanged; none of the statistics cookies above are set. A “Sec-GPC” signal (Global Privacy Control) sent by your browser is treated as an explicit refusal as long as you have not made a choice of your own.

In addition we use localStorage to remember your choice between light and dark design (only after you have used the switch), and a service worker that caches image, CSS and JavaScript files so that the site loads faster and works offline. Neither contains personal data.

8. Website language

The website is available in German and English. The language is determined in this order: your own choice via the language switch (“DE” / “EN”) in the navigation; otherwise the language set in your browser; otherwise English.

• Browser language: with every request your browser sends its preferred language (Accept-Language). We read it to show the page in the matching language; it is not stored for this purpose.
• Language cookie: only when you use the language switch do we store a setting with the value “de” or “en” for 12 months, so your choice is kept for your next visit. It contains nothing else. It is set at your express request and is therefore permitted without consent (§ 25 (2) no. 2 TDDDG); it is listed under “Necessary”.
• Contact form: the email to the church notes which language you used the page in (see section 5).
• Translations: the website's fixed texts are written by the church itself. Content entered by staff (e.g. events, prayers, announcements) is mostly available in English only. Only if you have agreed to the “External media” category is it translated automatically with Google Translate on German pages (see section 9); without that consent it is shown in its original language.

Legal basis for processing the language setting: Art. 6 (1) (f) GDPR (legitimate interest in providing the website in the language you want).

9. Embedded third-party content

Fonts and the chart library in the admin area are delivered from our own server; there is no longer any connection to Google Fonts or a CDN.

YouTube videos and the Google Maps map on the contact page are loaded only when you actively click “Load video” or “Load map”, or when you have agreed to the “External media” category in the cookie banner. Only then is a connection made to YouTube (in privacy-enhanced mode, youtube-nocookie.com) or Google Maps and your IP address transmitted to the respective provider. Video preview images are delivered by our own server, not directly from YouTube. The “Watch on YouTube” link opens the video directly on youtube.com, where Google's privacy policy applies.

Google Translate: if you have agreed to the “External media” category and use the website in German, we load Google's translation tool (translate.google.com) to translate content that is only available in English automatically. Your IP address and the text of the page are sent to Google, and a cookie “googtrans” holding the target language is set. Without consent there is no connection to Google. The translation is machine-made and not reviewed; the legal pages (imprint, privacy policy, cookie settings) are never translated. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework).

Legal basis for YouTube, Google Maps and Google Translate: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time in the cookie settings.

More information: Google privacy policy.

10. Data security

Passwords in the admin area are stored only as a hash (bcrypt). Login data is transmitted over HTTPS (where the website is operated over HTTPS). The cookies for login, language and statistics are HttpOnly (not readable by scripts); only the settings the page itself has to evaluate (cookie choice and screen-size group) can be read by the page's own script. When operated over HTTPS, all cookies additionally carry the Secure attribute.

11. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular the one responsible for Ludwigshafen:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP)
Postfach 30 40, 55020 Mainz

As of October 2026.