Privacy Policy
Last updated: 2026-10-08
This policy explains how Masjida ApS handles personal data when Masjida decides how and why it is used: for mosques and organisations that use Masjida, their administrators, people who contact us, and visitors to masjida.com, minmoske.dk and mojdzemat.ba.
Are you a member, donor or event guest of a mosque?Then the mosque is responsible for your data, and Masjida only processes it on the mosque's behalf. Each mosque publishes its own privacy notice on its website, at /privacy (for example yourmosque.mymasjida.com/privacy). Section 9 below summarises how we handle that data as a processor. The Masjida mobile app has its own app privacy policy.
Who we are
Masjida ApS
Åbenråvej 10, 4200 Slagelse, Denmark
CVR: 44177099
Email: [email protected]
Masjida has not appointed a data protection officer, as it is not required to. Contact us at the email address above about anything in this policy.
What data we collect, and why
| Who | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Mosque and organisation administrators | Name, email, phone (optional), password (stored as a bcrypt hash), role, when you accepted our terms, marketing preference, last login | Giving you access to the admin dashboard and running the service | Contract - Art. 6(1)(b), or our legitimate interest in serving our customer - Art. 6(1)(f) |
| Customers (mosques and organisations) | Organisation name, address, registration number (e.g. CVR), contact details, plan, invoices and payment status | Providing the service, billing subscriptions and transaction fees, bookkeeping | Contract - Art. 6(1)(b); legal obligation (bookkeeping) - Art. 6(1)(c) |
| People who use our contact form | Name, email, phone (optional), mosque name, your message | Answering your enquiry and following up on it | Legitimate interest - Art. 6(1)(f) |
| Customers who opt in to product news | Name and email | Sending news about Masjida | Consent - Art. 6(1)(a); you can withdraw it at any time |
| Everyone using our websites and dashboard | IP address, browser and request information in server logs | Security, preventing abuse and fixing errors | Legitimate interest - Art. 6(1)(f) |
We do not use analytics, tracking pixels, advertising cookies or any other behavioural tracking, and we never sell personal data.
Who we share data with
We use the following providers to run Masjida:
| Provider | What for | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, database, file storage and our own email server | Germany (EU) |
| Stripe Payments Europe Ltd | Collecting subscription and fee payments from customers | Ireland (EU); Stripe, Inc. in the USA |
| OpenStreetMap Foundation (Nominatim) | Turning an address into map coordinates when a mosque is registered | United Kingdom |
We also share data with authorities, courts or professional advisers where the law requires it or where it is needed to establish or defend legal claims.
Transfers outside the EU/EEA
Our own systems and all customer and member data are hosted in Germany. Stripe, Inc. is based in the USA; transfers to it rely on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. The United Kingdom has an adequacy decision from the European Commission.
How long we keep data
| Data | How long |
|---|---|
| Administrator accounts | While the account is active; deleted when the customer account is closed or the person is removed as an administrator |
| Customer account data | For the duration of the subscription, then up to 30 days so it can be exported |
| Invoices and other accounting records | 5 full financial years after the year they belong to (Danish Bookkeeping Act) |
| Contact-form messages | Up to 24 months after our last contact with you |
| Server logs | Up to 12 months |
Your rights
You have the right to:
- access the data we hold about you and get a copy of it (Art. 15);
- have incorrect data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a machine-readable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw consent at any time, without affecting earlier processing (Art. 7(3)).
Write to [email protected]. We answer within one month. You can also complain to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk, or the data protection authority where you live.
Cookies and browser storage
We only use storage that is strictly necessary for the service, so no consent banner is needed.
| Name | Where | Purpose | Duration |
|---|---|---|---|
| masjida_session | Admin dashboard (cookie, httpOnly) | Keeps you logged in. Encrypted; scripts cannot read it. | 7 days |
| masjida-locale | Admin dashboard (cookie) | Remembers your language during registration | 1 year |
| NEXT_LOCALE | Websites and mosque sites (cookie) | Remembers your language choice | 1 year |
| Form drafts | Admin dashboard (session storage) | Keeps a half-filled registration or checkout if you reload the page | Until the tab is closed |
| Theme | Admin dashboard (local storage) | Remembers light or dark mode | Until cleared |
Security
- All connections are encrypted with HTTPS.
- Passwords are hashed with bcrypt; login tokens are kept in an encrypted, httpOnly cookie on the server side and never exposed to browser scripts.
- National ID numbers (e.g. CPR) and payment provider credentials are encrypted in the database (AES-256-GCM).
- Each mosque's data is separated from all other mosques, and access is limited by role.
- We do not log passwords, tokens or national ID numbers.
Member data we process for mosques
When a mosque uses Masjida to manage members, donations and events, the mosque is the data controller and Masjida is its data processor under Art. 28 GDPR. We process that data only on the mosque's instructions, under a data processing agreement, and never for our own purposes. The mosque's own privacy notice describes what it collects and why.
Mosque membership can reveal religious belief, which is special-category data under Art. 9 GDPR. Each mosque is responsible for its legal basis - normally Art. 9(2)(d), processing by a not-for-profit religious body concerning its members and people in regular contact with it.
Masjida's software enforces default retention periods for member data: former members' profiles are erased 24 months after their membership ends, event guest details after 24 months, and accounting records after 5 full financial years.
Member data is hosted with Hetzner Online GmbH in Germany. The payment providers a mosque connects (Stripe, Vipps MobilePay, Mollie) process payment data under their own terms as independent controllers. Masjida takes a small fee on online donations; it is shown to the donor at checkout.
If you are a member and cannot reach your mosque about your data, contact us and we will help pass on your request.
Changes to this policy
We may update this policy. The date at the top shows the current version. We will tell customers about material changes by email before they take effect.