Privacy policy

As of October 2026

This is a translation for convenience. The German Datenschutzerklärung is legally binding.

1. Controller

2. Principles

We only process personal data where this is necessary to run the website, process donations or answer your enquiries, or where you have consented. We do not use tracking or advertising services. To protect against automated access such as AI crawlers, page requests are checked by Content Bridge (section 7). Fonts are served from our own server, and prayer times are calculated by your browser without transferring any data.

3. Hosting and server logs

This website is delivered via Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare processes technically necessary data such as IP address, date and time, page requested, browser and operating system in order to deliver the site securely (Art. 6(1)(f) GDPR). A data processing agreement is in place, and Cloudflare is certified under the EU-US Data Privacy Framework. To prevent abuse, Cloudflare limits how often one IP address can use the donation form within a short time. The administration area is additionally protected by Cloudflare Access, which sets a necessary sign-in cookie there only.

4. Storage in your browser

We do not set cookies ourselves. Your choice in the privacy notice is stored in your browser’s local storage so that we do not have to ask again on every visit. We also remember in local storage for 30 days that you closed the donation notice on the home page. This storage is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG). You can change your choice at any time via “Cookie settings” at the bottom of the page.

5. Donations through this website

For an online donation we process the amount, purpose, time and payment method and, if you choose to provide them, your name and email address. We use the email address for the payment confirmation and for questions about your donation, for example a refund, never for marketing. Payment details such as your card number are entered directly with our payment providers, we do not receive them. Donation records are stored in a Cloudflare database located in Western Europe. Donations made through our former website have been transferred into this system and are processed for the same purposes. Cash donations and bank transfers are recorded there too, with a name only where we know it.

• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, for cards, Apple Pay, Google Pay and PayPal. Stripe loads a script on the donation page that may set cookies for fraud prevention.
• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you choose PayPal, Stripe redirects you to PayPal for confirmation, where PayPal’s privacy notice applies.

Stripe’s script is only loaded once you click “Continue to payment” in the donation form, no data reaches Stripe before that. To match the payment, Stripe receives the amount, purpose and, if provided, your name and email address. Legal basis is Art. 6(1)(b) GDPR and § 25(2) no. 2 TDDDG. For a monthly donation Stripe creates a subscription on our behalf, which you can change or cancel yourself at any time in Stripe’s customer portal by signing in with your email address. A donation to a mosque may reveal your religious beliefs. We process such data as a not-for-profit religious body (Art. 9(2)(d) GDPR) and do not pass it on except to the payment providers named.

Without your explicit consent your donation appears on the wall of gratitude only anonymously as part of the total count. If you wish, we show the name you give on the donation page and later in the new mosque, within a tier based on the sum of your donations (from €1,000, €5,000 or €10,000). The exact amount is never published. For cash or bank transfer donations we only add a name if you explicitly ask us to. Legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you can withdraw at any time by email, the name is then removed. Donation records are kept as long as tax law requires, usually ten years, and at least until the project is completed because of our refund promise.

6. Google Maps

On some pages you can display a Google Maps map (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map only loads after you consent. Your IP address is then transferred to Google, cookies may be set and data may be transferred to the USA. Legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time via “Cookie settings”.

7. Detection of automated access (Content Bridge)

We have page requests checked by Content Bridge GmbH, Schlegelsweg 9c, 22089 Hamburg, Germany. Content Bridge detects whether a request comes from an automated program such as an AI crawler and provides us with reports about it. For each page request our server transmits the time, the requested address including query parameters, the request method, your IP address, your browser identifier (user agent) and the previous page (referrer). Credentials and email addresses in addresses are masked beforehand. Images, fonts and scripts as well as requests to the donation form and the administration area are not transmitted.

Legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in protecting our content and website against mass automated access and in knowing which programs read our content. Content Bridge only evaluates technical characteristics of the request, not the content of the pages visited, and does not build visitor profiles. Nothing is stored on or read from your device for this. Content Bridge processes the data on our behalf under a data processing agreement.

You may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR) by writing to info@moschee-al-ummah.de. More at content-bridge.eu/privacy.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time. Please contact info@moschee-al-ummah.de. You may also lodge a complaint with a supervisory authority, for us the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach.