Privacy Policy

Masjida ApS ("Masjida", "we", "us", or "our") is the data controller responsible for the processing of personal data as described in this privacy policy. Masjida operates the platforms masjida.com, minmoske.dk, and mojdzemat.ba.

Controller vs. Processor

Masjida acts in two different roles depending on the data:

Where a mosque uses Masjida to manage its members, a Data Processing Agreement (DPA) governs the relationship between the mosque (controller) and Masjida (processor). A copy is available on request at [email protected].

We share personal data only when necessary and with appropriate safeguards:

We do not sell, rent, or trade personal data to third parties for marketing or advertising purposes.

If we are legally required to disclose data (e.g., by court order or regulatory request), we will do so only to the extent required by law, and we will notify affected users where legally permitted.

All primary data storage is within the European Union (EU) or European Economic Area (EEA). Where a sub-processor operates outside the EU/EEA (e.g., Stripe in the US), transfers are protected by EU Standard Contractual Clauses (SCCs) or an adequacy decision by the European Commission.

As mosques in different European countries use Masjida, member data is accessible to mosque administrators in their respective country. This intra-EEA access does not constitute a restricted international transfer under GDPR.

6.3 Retention Periods

As a data subject in the EU/EEA, you have the following rights:

• Right of access (Art. 15) — Request a copy of your personal data
• Right to rectification (Art. 16) — Correct inaccurate or incomplete data
• Right to erasure (Art. 17) — Request deletion of your data ("right to be forgotten")
• Right to restrict processing (Art. 18) — Limit how we use your data
• Right to data portability (Art. 20) — Receive your data in a machine-readable format
• Right to object (Art. 21) — Object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)) — Withdraw consent at any time

We will respond within 30 days as required by GDPR. In complex cases, we may extend this by an additional 60 days with notice.

You have the right to lodge a complaint with your local data protection authority. In Denmark, this is the Danish Data Protection Agency (Datatilsynet): www.datatilsynet.dk.

Masjida uses only strictly necessary storage mechanisms. We do not use third-party advertising or tracking cookies.

No cookie consent banner is required because we do not use any cookies for tracking, analytics, or advertising purposes. The storage used is strictly necessary for the service to function.

Masjida does not directly target children. However, mosque memberships may include minors (e.g., family memberships where parents register their children).

• Members under 16 cannot create their own accounts — a parent or guardian must register them.
• The mosque (as data controller) is responsible for obtaining appropriate parental or guardian consent in compliance with GDPR Article 8 and applicable national law.
• Parents or guardians may exercise GDPR rights (access, erasure, etc.) on behalf of their children.

Mosque membership inherently implies religious affiliation, which is classified as special-category data under GDPR Article 9. Processing is permitted under the following bases:

• Art. 9(2)(d) — processing by a not-for-profit body with a religious aim, where processing relates solely to members or former members and data is not disclosed outside the organisation without consent.
• Art. 9(2)(a) — explicit consent of the data subject, obtained at registration.

Each mosque is responsible for ensuring it has a valid legal basis for processing special-category data about its members, and for conducting a Data Protection Impact Assessment (DPIA) where required.

Masjida is a multi-tenant platform. Each mosque's data is logically isolated at both the application and database levels:

We may update this privacy policy from time to time. When we make material changes, we will notify users via the platform and/or by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.