Privacy Policy

This policy describes how Biserica Poarta Regelui (the data controller) collects, uses and protects your personal data, in accordance with Regulation (EU) 2016/679 (GDPR).

1. Who we are

The data controller is Biserica Poarta Regelui, based in Cluj-Napoca, Romania. You can contact us at contact@poartaregelui.ro or at +40 727 215 676.

2. What data we collect

We collect data in two ways:

Data you provide

Through the contact form, the sign-up forms (new at Poarta Regelui, courses, events, communities, serving teams) and the prayer-request form. Each form collects only the data listed for it in section 4; fields marked "optional" may be left blank. Data from the contact and sign-up forms is transmitted to Planning Center (our contact-management processor). Prayer requests are not: they are sent to us by email (see section 4).

Data provided by parents for their children

Through the consent form for parents of our young people: the parent’s or guardian’s name, email address and phone number, and for each child their full name and phone number, together with a record of the consent given (the consent wording, date and time). This data is transmitted to Planning Center (see section 8).

Technical data

Cloudflare, our hosting and security provider, may process your IP address and HTTP request information (User-Agent, timestamp) for security and reliability purposes. Cloudflare Web Analytics collects aggregated traffic data without using tracking cookies or identifying individual users.

To protect the forms against spam, Cloudflare Turnstile checks that a submission comes from a person rather than a bot. To block repeated automated submissions, we also keep, for a short time, a coded fingerprint (hash) of the email address or IP address used to send a form; it is deleted automatically when that time runs out.

3. Purpose of processing and legal basis

We process your data for the purposes and on the legal bases below (GDPR, Art. 6):

• Responding to enquiries - legal basis: consent [Art. 6(1)(a)] or legitimate interest [(f)].
• Organising the launch team - legal basis: consent [Art. 6(1)(a)].
• Sign-ups (new at Poarta Regelui, courses, events, communities, serving teams) - legal basis: consent [Art. 6(1)(a)]; details for each form in section 4.
• Prayer requests - legal basis: explicit consent [Art. 9(2)(a), together with Art. 6(1)(a)], because a request may reveal religious beliefs or health information.
• Young people’s participation in youth events and communication with parents (including adding them to the youth WhatsApp group) - legal basis: consent of the parent or legal guardian [Art. 6(1)(a) and Art. 8].
• Website security (Cloudflare) - legal basis: legitimate interest [Art. 6(1)(f)].
• Protecting the forms against spam and abuse (Turnstile, submission limits) - legal basis: legitimate interest [Art. 6(1)(f)].
• Aggregate traffic statistics (Cloudflare Web Analytics) - anonymised data; does not constitute personal data.

4. The forms: what each one collects and why

For each form, the list below shows what data is collected, why, on what legal basis, who receives it and how long it is kept. Apart from the technical data in section 2, we collect nothing a form does not ask for.

Contact form

• Data collected: the topic of your message (optional), your name, your email address and your message.
• Purpose: to answer you.
• Legal basis: consent [Art. 6(1)(a)] or legitimate interest [Art. 6(1)(f)] in answering a message you sent us.
• Who receives it: Planning Center (processor), where your message reaches the person who answers it.
• The “Pastoral” topic: a message with this topic does not go to Planning Center. It is sent as an email, through Brevo (our email delivery processor), straight to the church’s pastor, and is kept only in the church’s mailbox.
• Retention: see section 7.

New at Poarta Regelui

• Data collected: your first and last name, email address, phone number and date of birth; optionally, your address (street and number, details, town, postal code); whether this is your first time with us and, if not, how long you have been coming; how you heard about us; and, optionally, what you tell us about how you would like to connect with the community.
• Purpose: to stay in touch after your visit and to help you take your next step in the community, at your own pace.
• Legal basis: consent [Art. 6(1)(a)].
• Who receives it: Planning Center (processor). Your name, email address, phone number, date of birth and address are saved on your contact record; the other answers are saved as a note on an internal follow-up card, seen by the team that welcomes newcomers.
• Retention: see section 7.

I said YES to Jesus

• Data collected: your first and last name, email address and phone number; optionally, your date of birth and address; whether this is the first time you say YES to Jesus or you are renewing your commitment; and, optionally, what you tell us about your decision.
• Sensitive data: your decision concerns your religious beliefs (special category data, GDPR Art. 9). We treat it with discretion: only the pastor or leader who walks with you sees it.
• Purpose: to encourage you, offer you resources and stay in touch with you on your faith journey.
• Legal basis: consent [Art. 6(1)(a)]; for data about religious beliefs, processing by the church, a not-for-profit religious body, in connection with people in regular contact with it [Art. 9(2)(d)].
• Who receives it: Planning Center (processor). Your name, email address, phone number, date of birth and address are saved on your contact record; your decision and what you write are saved only as a note on an internal follow-up card, seen only by the pastor or leader who walks with you.
• Retention: see section 7.

Course sign-up or interest

• Data collected: the course and, if a date has been set, the run you are signing up for; and your first and last name, phone number and email address.
• Purpose: to register you for the course, or to let you know when the next one starts, and to contact you about it.
• Legal basis: consent [Art. 6(1)(a)].
• Who receives it: Planning Center (processor). Your name, phone number and email address are saved on your contact record; the other details are saved as a note on an internal follow-up card, seen by the team that runs the course.
• Retention: see section 7.

Event registration

• Data collected: the event (its title and date, taken from our calendar), your name, email address and phone number, and how many people are coming with you.
• Purpose: to know who is coming, to prepare the event and to contact you about it.
• Legal basis: consent [Art. 6(1)(a)].
• Who receives it: Planning Center (processor). Your name, phone number and email address are saved on your contact record; the other details are saved as a note on an internal follow-up card, seen by the team that organises the event.
• Retention: see section 7.

Community interest

• Data collected: your first and last name, email address and phone number; optionally, your date of birth and address (street and number, details, town, postcode); the areas of the city that suit you; whether you are also part of another church; and an optional message. If you apply as a couple: your partner's first and last name and, optionally, their email address and phone number, which you send us with their agreement (you confirm this on the form).
• Purpose: to help you find a community that suits you and to contact you about it.
• Legal basis: consent [Art. 6(1)(a)].
• Who receives it: Planning Center (processor). Your name, phone number and email address are saved on your contact record (and your partner's on theirs); the other details are saved as a note on an internal follow-up card, seen by the team that coordinates the communities.
• Retention: see section 7.

I want to serve

• Data collected: your first and last name, email address, phone number and date of birth; optionally, your address (street and number, details, town, postcode); where you are right now and why you want to serve; optionally, what encouraged you to take this step, your gifts and experience, whether you are also part of another church, the name of someone in the community who knows you, whether you need support in order to serve, and anything else you choose to tell us (for example, your availability).
• Purpose: to get to know you and find together where you could serve, then to contact you about it.
• Legal basis: consent [Art. 6(1)(a)].
• Who receives it: Planning Center (processor). Your name, email address, phone number, date of birth and address are saved on your contact record; the other answers are saved as a note on an internal follow-up card, seen by the people who coordinate the serving teams.
• Retention: see section 7.

Prayer request

• Data collected: your request (required) and, optionally, a category, your first name, an email address or phone number, and whether you would like someone to talk with you. If you choose to send the request anonymously, we do not ask for your name or contact details.
• Sensitive data: a prayer request may reveal your religious beliefs, your health or other sensitive matters (special categories of data, GDPR Art. 9). Please write only what you are comfortable sharing.
• Purpose: to pray for you and, only if you ask us to, to contact you.
• Legal basis: your explicit consent [Art. 9(2)(a) and Art. 6(1)(a)], given through a separate tick box on the form.
• Who receives it: the request is sent as an email, through Brevo (our email delivery processor), to the church's mailbox, where it is read by the church's pastoral team. It is not published, and it is not stored on the website or in Planning Center.
• Retention: the email is kept in the church's mailbox only for as long as we need it to pray for you and, if you asked, to contact you; it is then deleted.

Your consent

Each sign-up form asks you to tick a consent box that links to this policy; the form is not sent without it. The prayer-request form has its own consent box for sensitive data. You can withdraw your consent at any time by writing to contact@poartaregelui.ro: we will then delete your data from Planning Center, or your prayer request from our mailbox. Withdrawing consent does not affect processing carried out before.

5. Third-party processors

We use the following authorised third-party processors:

• Cloudflare, Inc. (USA) - hosting, CDN, security, anonymous traffic analytics and Turnstile spam protection on the forms.
• Planning Center Online, LLC (USA) - managing contact data and the data from the contact and sign-up forms (section 4).
• Brevo (EU) - delivering prayer requests by email to the church's mailbox (section 4).
• Stripe, Inc. (USA) - payment processing (card data does not pass through our site; Stripe is the controller for payment data).
• Sanity AS (Norway/USA) - content management system (CMS).

6. International transfers

Some processors (Cloudflare, Planning Center, Stripe) process data in the United States of America. These transfers are protected by the Standard Contractual Clauses (SCCs) adopted by the European Commission or by other appropriate mechanisms under the GDPR.

Brevo, which delivers prayer requests by email, processes data in the European Union.

7. Data retention

Form data is kept for at most 2 years from collection or until the purpose is fulfilled, after which it is deleted. You can request deletion at any time (see section 8).

Prayer requests are not kept on the website or in Planning Center; the email we receive is deleted from our mailbox as described in section 4. The anti-spam fingerprints described in section 2 are deleted automatically after a short time.

8. Your rights

Under the GDPR, you have the right to:

• Access - to know what data we hold about you.
• Rectification - correction of inaccurate data.
• Erasure - to ask us to delete your data.
• Restriction - to ask us to limit how we use your data.
• Portability - to receive your data in a structured format.
• Objection - to object to processing based on legitimate interest.
• Withdrawal of consent - at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at contact@poartaregelui.ro. We will respond within 30 days. You also have the right to lodge a complaint with the ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing): www.dataprotection.ro.

9. Children's personal data

Our site is not intended for children under 16 and we do not knowingly collect data from them without the consent of a parent or legal guardian.

We receive data about children who take part in our youth events only from a parent or guardian, through the consent form for parents, and only with their consent. In Planning Center we keep the child’s name and phone number, marked as a minor and linked to the parent in a household (family), in order to organise youth activities and stay in touch with parents.

The child’s phone number is used to add them to the youth WhatsApp group, where we announce our events. WhatsApp is a service of Meta Platforms Ireland Limited, which processes data under its own privacy policy; phone numbers in the group are visible to the group’s other members.

The parent or guardian may withdraw consent at any time by writing to us at contact@poartaregelui.ro. The child is then removed from the WhatsApp group and their data is deleted, unless the law requires us to keep it. The rights in section 7 also apply, and the parent may exercise them on the child’s behalf.

10. Changes

We may update this policy from time to time. The updated version will be published on this page with a new update date. Significant changes will be communicated by email if we hold your address.

11. Contact

For any question about the processing of your data: contact@poartaregelui.ro · +40 727 215 676.