Version 1.0 of 16 October 2026. These documents describe Contals as it is built today (early access). Contals is operated by Unique-P GmbH, Burengasse 11, 4655 Stüsslingen, Switzerland; the data processing agreement is part of our terms of service.
In short: your organization is the controller for its boards; Contals processes the data on your behalf. Stored data lives in Cloudflare’s EU jurisdiction. Cloudflare is a US company, so we say “EU data residency”, never “sovereign”. Every measure below is marked as implemented, prepared or planned – we do not promise what is not built.
The documents
| Document | What it answers |
|---|---|
| Data processing agreement (DPA) | The contract under the Swiss revFADP and GDPR Art. 28, with addenda for Switzerland and the EU and an optional addendum for church data protection law (KDG, DSG-EKD) |
| Technical and organizational measures | How data is protected: storage, access control, encryption, backups, deletion, logging – with status |
| Subprocessors and recipients | Who processes data for Contals, where, and on which transfer basis; recipients you connect yourself |
| Records of processing: template | Example entries for your own record of processing activities |
| Sensitive boards: guide and DPIA checklist | What not to store, recommended settings for pastoral care, prayer requests and youth work, a DPIA checklist |
| FAQ for data protection officers | Short answers to the questions church DPOs ask, including the CLOUD Act |
Who can use Contals for what
| Organization | Our assessment (not legal advice) |
|---|---|
| Free churches, Christian works, associations and foundations in Switzerland | Suitable with the DPA; keep pastoral content out |
| Church bodies in Germany under the KDG or the DSG-EKD | Suitable in principle since the recent reforms; the DPA has an optional church-law addendum that you activate on request |
| Charities and associations in the EU | Suitable with the DPA |
| Swiss Landeskirchen and Kirchgemeinden under cantonal data protection law | Only for non-sensitive coordination: cantonal supervisors require encryption with your own keys for special personal data at US-related providers, which Contals does not offer |
| Organizations elsewhere, for example in the UK or the USA | Usable: the terms, the privacy policy and the DPA apply everywhere, but they are written for Swiss and EU law; the specific rules of other countries (for example the UK GDPR or US state privacy laws) are not assessed separately |
| Anyone: pastoral counselling, confessions, safeguarding cases | Not suitable – keep these in a dedicated system |
If something goes wrong: incidents and data breaches
- Report vulnerabilities and incidents to security@contals.com. We confirm within two working days.
- We contain an incident with the tools we have: signing out devices, revoking tokens and access, disabling integrations, blocking traffic, rotating keys.
- We inform you without undue delay – our target is 48 hours after we become aware – by e-mail to your organization’s owners and your privacy contact: what happened, which data and people are affected, likely consequences, what we did and what you should do.
- You decide on notifying your supervisory authority (GDPR: 72 hours; revFADP: as soon as possible; church law accordingly) and the people affected. We provide facts and drafts.
- We document every breach and review it within two weeks.
What is still open
- A review of these documents by an external lawyer. They are in force as version 1.0; changes are announced as the documents describe.
- A representative in the EU under Art. 27 GDPR: appointed before Contals serves its first customer in the EU.
- Cloudflare’s confirmation that its point-in-time recovery data (30 days) stays in the EU; our own backups do.
- Earlier versions of card titles and descriptions stay in the board history for up to 13 months (edited and deleted comments are erased from it at once).
- The storage rules for the event archive (90 days), the backups and nightly board copies (35 days), the files of running imports (7 days) and the audit archive (2 years) are decided and written down; they are switched on in the production account at the launch.
- An external penetration test.
Questions: privacy@contals.com. See also security & privacy and the privacy policy.