> Short, honest answers for data protection officers of churches, works and charities – controller and processor, EU storage, Cloudflare and the CLOUD Act, KDG…

Source: https://contals.com/it/data-protection/faq/  
Language: it

# Data protection FAQ for church DPOs

Short, honest answers for data protection officers of churches, works and charities – controller and processor, EU storage, Cloudflare and the CLOUD Act, KDG and DSG-EKD, Landeskirchen, pastoral data, deletion, breaches.

Ultimo aggiornamento: 16 ottobre 2026

Questa pagina è disponibile in inglese e in tedesco. Fanno fede le versioni inglese e tedesca; in caso di divergenze prevale la versione tedesca.

**Version 1.0 of 16 October 2026.** Contals is operated by Unique-P GmbH, Burengasse 11, 4655 Stüsslingen, Switzerland. These answers summarize the documents of the  [data protection kit](https://contals.com/en/data-protection/) ; the documents themselves are binding.

**1\. Who is the controller and who the processor?** Your organization is the controller for everything on its boards; Contals processes that data on your behalf under a data processing agreement (DPA). Contals (Unique-P GmbH) is controller only for user accounts, sign-in, billing, security logs and its own website ( [privacy policy](https://contals.com/en/privacy/) ).

**2\. Where is the data stored?** In Cloudflare’s EU jurisdiction: board data (Durable Objects), the databases (D1), the event archive and backups (R2) and internal queues. A second, encrypted copy of the backups lies at DigitalOcean in Frankfurt (only data we encrypted; the key stays with Contals). Requests are processed in the Cloudflare data center closest to the user. Some technical metadata (internal object IDs, request logs and analytics such as IP addresses and URL paths) is processed outside the EU, mainly in the USA.

**3\. Cloudflare is a US company. What about the CLOUD Act?** Cloudflare, Inc. is subject to US law, so a US order could in principle reach data stored in the EU; Cloudflare manages the encryption keys at rest and our servers process plaintext. Cloudflare commits in its DPA to notify customers, challenge conflicting orders and disclose only the minimum, and states it has never handed over encryption keys. We say “EU data residency”, never “sovereign”. If your rules require that no US-related provider can access plaintext, Contals does not meet them today.

**4\. On which legal basis are data transferred to the USA?** Cloudflare, Stripe and DigitalOcean (which holds only data we encrypted) state that they are certified under the EU–US and Swiss–US Data Privacy Framework; their DPAs include the EU standard contractual clauses (with Swiss amendments) as fallback. We administer Contals from Switzerland, which the EU recognizes as adequate. A transfer impact assessment summary is part of the DPA (Annex 4). The DPF’s validity is being challenged before the CJEU (C-703/25 P); we will inform customers of changes.

**5\. Can German church bodies (KDG, DSG-EKD) use Contals?** In principle yes. Since the DSG-EKD reform (in force 1 May 2025), processors not bound by church law no longer have to submit to church supervision, and the contract may follow Art. 28 GDPR; the amended KDG (in force 1 March 2026) recognizes GDPR-bound processors. Our DPA has an optional church-law addendum (Addendum C) that voluntarily recognizes the powers of your church supervisory authority: it applies once you activate it with a short request to  [privacy@contals.com](mailto:privacy@contals.com) , which we confirm in writing. Please check the amended wording in your gazette.

**6\. Can Swiss Landeskirchen and Kirchgemeinden use Contals?** For non-sensitive coordination, after your own assessment under cantonal law. For special personal data (including information about religious activities) the Zurich data protection officer (information sheet of February 2026) and privatim (resolution of 24 November 2025) require that a US-related provider cannot access plaintext – which Contals cannot guarantee today.

**7\. Can we store pastoral care notes or prayer requests?** Pastoral counselling content and anything under professional secrecy: no. Prayer requests: only with consent, on a private board marked confidential (no titles in links, nothing to AI or chat, every opening logged), with minimal content and short retention, after a DPIA. See the  [guide for sensitive boards](https://contals.com/en/data-protection/sensitive-boards/) .

**8\. Who at Contals can see our data?** Nobody in normal operations. There is no support tool for reading board content, and the operations area shows only counts and health data. Technically, whoever administers the infrastructure can reach stored data: administrative access is limited to Unique-P GmbH (currently its managing director) and protected by two-factor authentication; access by Cloudflare’s own staff follows Cloudflare’s data processing agreement. Content access for support would need your request for the specific case and is logged.

**9\. Who in our organization can see what?** New boards are private. Each person has a board role (viewer, contributor, editor, admin) checked on the server for every change. Volunteers and guests can never manage a board. Organization and workspace admins manage private boards without seeing content; if they open one anyway (“break-glass”), it is logged and every board member sees it.

**10\. Is data encrypted?** In transit with TLS, at rest by Cloudflare (AES-256). Integration secrets (single sign-on, chat webhooks, AI provider keys) are additionally encrypted by Contals (AES-256-GCM). Push notifications are encrypted end to end for the receiving device. There is no end-to-end encryption of board content with your own keys.

**11\. How does deletion work?** Deleting a board purges it after a 14-day trash period; deleting an account pseudonymizes the person at once and erases the remaining personal data after 30 days. An organization is deleted 30 days after an owner asks for it (read-only and exportable until then); the end of a paid plan deletes nothing – the organization continues on the free plan. Every board keeps 13 months of history; older changes are folded into the board. Copies remain in point-in-time recovery (30 days), the immutable event archive (90 days), the backups of the account databases and the nightly copies of boards (35 days, also the encrypted copy at DigitalOcean); every deletion is recorded (IDs only) and applied again after any restore; the audit log moves to the backup storage after 180 days and is kept there 2 years. Board admins can have done cards archived or deleted automatically a chosen number of days after they were completed (board settings); deleting also erases the cards’ comments and texts from the board’s history. Contact details of people without an account are deleted automatically: bookings and poll addresses at the latest 90 days after the appointment or the poll’s last date. Editing or deleting a comment, or deleting a status update, also erases the old text from the board’s history, search and exports (the archive and the recovery copies keep it until their retention ends). **Known gap:** earlier versions of card titles and descriptions stay in the board’s history for up to 13 months.

**12\. Can we export everything?** Yes: board, workspace and organization exports as JSON with the board history of the last 13 months (texts erased from the history are not in it), at any time; every export is logged.

**13\. Do you use AI on our data?** Not by default. AI features (assistant, card summaries, checklists, labels, translation, the short summary of “since your last visit” – always a button, never automatic) work only with an AI provider your organization configures with its own key, contract and data policy, after an owner or admin switches AI on. Comments and people’s names are off by default, e-mail addresses and confidential boards are never sent, and AI can be switched off per workspace. Your organization chooses the provider and concludes the contract with it (DPA section 7.5). Contals logs no prompts or answers (the usage log counts tokens only); assistant conversations are kept in the person’s own storage for 30 days and can be deleted. Contals never uses customer data to train models; what your provider may do is governed by your contract with it.

**14\. Which subprocessors are there?** Cloudflare (hosting, EU jurisdiction for stored data; e-mail sending from the e-mail launch), DigitalOcean in Frankfurt (a second backup copy, encrypted by us) and Stripe (billing; built, active from the first paid plan); e-mail goes out through Cloudflare Email Service only (no second e-mail provider). Fathom Analytics counts page views on our website and sign-in pages without cookies; it receives nothing from boards and is not a subprocessor of your data. Chat tools or AI providers you connect are your own recipients; push notifications are relayed, encrypted, by the push service of each person’s browser (see question 20). The  [list](https://contals.com/en/data-protection/subprocessors/)  is public and changes are announced 30 days in advance.

**15\. How are we informed about a data breach?** Without undue delay, with a target of 48 hours after we become aware, by e-mail to your organization owners and your privacy contact, so that you can meet your own deadlines (GDPR 72 hours; revFADP “as soon as possible”).

**16\. Do you have certifications or audits?** Contals itself has no certification yet. Cloudflare holds ISO/IEC 27001, 27701, 27018, SOC 2 Type II, BSI C5 and the EU Cloud Code of Conduct. Contals had an internal security review (October 2026); an external penetration test is planned. You can audit us under the DPA.

**17\. Which documents can we get?** DPA (with church-law addendum), technical and organizational measures, subprocessor list, transfer impact assessment, a template for your records of processing, a DPIA checklist for sensitive boards and this FAQ – version 1.0 of 16 October 2026, all public on this website.

**18\. Do you have a data protection officer or a representative in the EU?** Contals has not appointed a data protection officer: at its size and with the processing described here, the law does not require one; requests go to our managing director at  [privacy@contals.com](mailto:privacy@contals.com) . A representative in the EU (Art. 27 GDPR) is not appointed yet. One will be appointed before Contals serves its first customer in the EU and named here; until then, people in the EU reach us directly at privacy@contals.com.

**19\. Can young people use Contals?** Accounts are for people aged 16 and older; younger people only with the consent of a parent or guardian. Everyone confirms this when they sign up (or once after their first sign-in through another provider); Contals stores the date of the confirmation, never a birth date. Children should appear on boards only as minimal content written by leaders (see the records template, activity E).

**20\. Push notifications and e-mails: what do they show, and who delivers them?** Each person decides per kind of event – assignment, mention, due reminder, comment on their card, invitation, status update of a followed board, news from Power-Ups (polls, bookings, cards that can start) – whether it comes in the app, as a push notification, by e-mail or not at all, and sets quiet hours (21:00–07:00 by default) in which neither pushes nor e-mails arrive. Push notifications are off until the person switches them on for a device (never on a device marked as shared). The browser vendor’s push service delivers them – Google for Chrome and for Edge and other browsers on Android, Apple for Safari and for Contals on an iPhone’s Home Screen (iOS 16.4 or later), Mozilla for Firefox, Microsoft for Edge on Windows. Every message is encrypted for that device, so the push service cannot read it; it sees the device address it issued, the time and the size. A notification names the card, the board and who acted – unless the person chose short texts; notifications about confidential boards are always short. Single notifications by e-mail come collected (at most one e-mail per 15 minutes by default, only for what the person has not read), and only on paid plans. Signing out on a device or deleting the account removes its push subscription at once.

 [← Documentazione sulla protezione dei dati](https://contals.com/it/data-protection/)