Version 1.0 of 16 October 2026. A starting point for your own record of processing activities (GDPR Art. 30(1), Swiss revFADP Art. 12 with DSV Art. 24, KDG and DSG-EKD). Copy the entries you need, adapt them and delete what you do not do.
Who needs a record? Under the GDPR, organizations with fewer than 250 employees are exempt only if the processing is occasional, unlikely to be risky and does not include special categories – a church that processes data revealing religious affiliation regularly needs a record. Under the revFADP, organizations with fewer than 250 employees are exempt unless they process sensitive personal data on a large scale or carry out high-risk profiling. Church law generally requires records. When in doubt, keep one: it is also the basis of your privacy notice and DPIA.
Part 1 – Common fields (fill in once)
| Field | Your entry |
|---|---|
| Controller (name, address) | [Name of the church / association], [address] |
| Representative / contact person | [name, role, e-mail] – enter the same person as the privacy contact in Contals (organization settings → data protection), so Contals reaches them in an incident |
| Data protection officer (if designated or required) | [name, contact] (church bodies: the competent church DPO) |
| Processor | Unique-P GmbH, Burengasse 11, 4655 Stüsslingen, Switzerland (operates Contals) – data processing agreement as part of the terms of service, accepted in Contals by [owner] on [date], version [date of the DPA] (the organization settings show who accepted which version, and when) |
| Subprocessors | Cloudflare, Inc. (hosting, EU jurisdiction for stored data); DigitalOcean, LLC (a second backup copy in Frankfurt, encrypted by Contals); Stripe (only for billing data of the organization); current list: contals.com/en/data-protection/subprocessors/ |
| Third-country transfers and safeguards | USA (Cloudflare, Inc.: metadata, possible access; Stripe): EU–US / Swiss–US Data Privacy Framework, standard contractual clauses as fallback. Other countries (Cloudflare affiliates for support): standard contractual clauses. Switzerland (Contals is administered from there): EU adequacy decision |
| General description of security measures | Contals TOMs (contals.com/en/data-protection/toms/): EU storage, encryption in transit and at rest, private boards by default, role-based access checked on the server, audit log, backups. Own measures: [who may administer the organization, two-factor sign-in required for everyone, offboarding of leavers, devices, retention rules on sensitive boards] |
Not part of your record: what Contals processes as a controller for itself – user accounts and sign-in, billing, security logs, its website and the cookieless page-view counts on its website and sign-in pages (Fathom Analytics). The privacy policy describes it.
Part 2 – Processing activities (examples)
A. Coordination of ministries, projects and events
| Field | Example entry |
|---|---|
| Purpose | Planning and coordinating ministries, services, events and projects; assigning tasks to staff and volunteers |
| Legal basis | GDPR Art. 6(1)(b)/(f); for data revealing religious affiliation Art. 9(2)(d) (members and regular contacts of a religious not-for-profit body) or consent; revFADP: overriding interest / consent; church law: corresponding provisions |
| Data subjects | Staff, volunteers, members involved in the activity |
| Data categories | Name, e-mail, role in Contals, assigned tasks, comments, status updates, due dates, activity history; per person notification settings and, if switched on, the push subscriptions of their devices |
| Recipients | Members of the respective board; the person themself (notification e-mails and push notifications, nothing named for confidential boards); Contals as processor; the push service of the person’s browser relays push notifications encrypted |
| Retention | As long as the board is used; boards of past events archived and deleted after [e.g. 2 years]; accounts of volunteers who left removed within [e.g. 3 months] |
B. Volunteer scheduling
| Field | Example entry |
|---|---|
| Purpose | Recruiting volunteers and dividing the tasks of services and events among them |
| Legal basis | Art. 6(1)(b)/(f) GDPR, Art. 9(2)(d) where religious affiliation is implied; revFADP: consent or overriding interest |
| Data subjects | Volunteers (each with a free account) |
| Data categories | Name, e-mail, [phone, if you note it on cards], availability, the tasks they took or were given (cards and checklist items with dates) |
| Recipients | Coordinators and members of the board; Contals; Cloudflare Email Service for invitations, sign-in links and the summary e-mail |
| Retention | [e.g. 12 months after the event]; accounts of volunteers who left removed within [e.g. 3 months] |
| Note | People without an account can only answer date polls or book appointments (activity F); a volunteer joins through an invitation or an invite link (a link or QR code for a group; free roles only, with an end date and a limit) |
C. Newcomer follow-up
| Field | Example entry |
|---|---|
| Purpose | Welcoming and following up on new visitors who asked to be contacted |
| Legal basis | Consent (Art. 6(1)(a), 9(2)(a) GDPR; revFADP Art. 6 para. 7) recorded at first contact |
| Data subjects | Visitors, newcomers |
| Data categories | Name, contact details, interests, follow-up notes (factual, minimal) |
| Recipients | Welcome team (private board); Contals |
| Retention | [e.g. 6 months after the last contact unless the person becomes a member] |
D. Prayer requests (only if you use Contals for them)
| Field | Example entry |
|---|---|
| Purpose | Forwarding prayer requests to the prayer team with the requester’s consent |
| Legal basis | Explicit consent (Art. 9(2)(a) GDPR; revFADP Art. 6 para. 7); church law accordingly |
| Data subjects | Requesters and people they mention |
| Data categories | First name or initials, the request (may contain health data); no surnames of third parties |
| Recipients | Prayer team only (private board, marked confidential in its settings) |
| Retention | Short, e.g. delete 3 months after the request |
| Note | Carry out a DPIA (see the sensitive-boards guide); no AI, no chat integrations |
E. Children’s and youth ministry
| Field | Example entry |
|---|---|
| Purpose | Planning groups, camps and leaders’ rosters |
| Legal basis | Art. 6(1)(b)/(f) GDPR; consent of the parents where required |
| Data subjects | Leaders (volunteers); children and young people only as far as needed |
| Data categories | Leaders: name, role, tasks. Children: first names or group lists only if necessary; no health, allergy or incident details in Contals |
| Recipients | Leaders’ board members; Contals |
| Retention | [e.g. end of the season / camp + 6 months] |
| Note | Safeguarding reports and incident records belong in a dedicated, access-restricted system, not on a board |
F. Date polls and appointment bookings (Power-Ups)
| Field | Example entry |
|---|---|
| Purpose | Finding a date with participants; letting people book appointments (e.g. baptism talks, room handovers) |
| Legal basis | Art. 6(1)(b)/(f) GDPR (the person asks to take part or to book); revFADP: overriding interest |
| Data subjects | Members and people without an account who answer a poll or book |
| Data categories | Name, e-mail address (optional for polls), answers to the booking questions, chosen time; on the public poll page members appear by first name (full names only if the organizer switches them on) |
| Recipients | Members of the board (the card with the time and status); the booker’s name, e-mail address and answers only for the board’s editors and admins; people with the link see the organization’s name (or the workspace’s, for an organization with one workspace) and the participants’ first names; Contals |
| Retention | Poll e-mail addresses are erased after the final date was sent, and at the latest 90 days after the poll’s last date; a booker’s details are erased automatically 90 days after the appointment, earlier with “Erase personal data” on the card (which also renames the card) |
| Note | The card is titled with the appointment type; the booker’s name appears in the title only if you switch it on for the type – keep it off for sensitive appointments. Do not offer public booking for pastoral appointments on a normal board |
Part 3 – Not recommended in Contals
- Pastoral counselling notes, confessions, information under professional secrecy (Art. 321 StGB, church law).
- Safeguarding allegations and investigations.
- Health or medical records, membership registers with denomination data (use your church management system).