GRACE CHURCHWARSZAWA
GRACE CHURCH
Who is responsible for personal data, why it is needed and how to contact us.
Version dated 30 October 2026
The controller is KOŚCIÓŁ CHRYSTUSOWY GRACE CHURCH W WARSZAWIE, a religious organisation in Poland. Registered address: ul. Elektronowa 10, 03-219 Warszawa, Polska. NIP: 5242919933; REGON: 388889530.
For questions about data, messages or photographs, email grace.church.warsaw@gmail.com or call +48 663 048 293. The worship address, Władysława Skoczylasa 10/12, differs from the registered address.
For ordinary enquiries, the church uses the name, email address and message you provide to respond. The legal ground is its legitimate interest in handling correspondence you initiate, Article 6(1)(f) GDPR.
Prayer requests are handled on the basis of consent, Article 6(1)(a). Voluntarily sharing information about your own health, faith or other sensitive circumstances requires explicit consent under Article 9(2)(a). Please avoid diagnoses, documents and other people’s personal data unless needed for your request. You do not have to be a church member to contact us.
Hosting processes technical request data, including IP address, time, requested page and browser information, to deliver and secure the site — Article 6(1)(f). Bank records of donations received are used for accounting and applicable legal obligations, Article 6(1)(c), and for resolving transfer enquiries, Article 6(1)(f). The website does not collect payment card details.
Selecting “Send” transmits your message over an encrypted HTTPS connection and saves it in a private WordPress database on the church hosting. The record includes the request type, language, name and email if supplied, message, time and the acknowledged information or explicit consent version. The confirmation means the request was saved; it does not guarantee a response time or delivery of an email notification. Authorised people may receive an email notification containing the request number and a link to the protected dashboard, without the visitor’s name, email or message text. Access to prayer requests is separate from access to ordinary enquiries. There is no public list of submissions. Spam protection uses a signed temporary token, a hidden control field and a short-lived rate limit based on an HMAC derivative of the IP address. The limit lasts up to 20 minutes; WordPress periodically clears technical identifiers, which are not attached to the message or used for advertising. Form text is not saved in cookies, localStorage or sessionStorage.
Your name is optional. An email address is needed for a reply; it may be omitted on the prayer form. You can use the site without a form and describe a request without sensitive details. Sending a message does not subscribe you to a mailing list.
Sent correspondence is accessible to authorised church representatives who need it to respond or pray. Requests are not intended for publication: open distribution or public reading that identifies a person requires a separate agreement.
Technical providers include Hostinger for hosting and Google for Gmail. Transfers are processed by PKO Bank Polski and the banks involved in the transfer. Your own email provider also processes an email when you send it. Data may be disclosed to authorities where required by law.
Providers’ infrastructure may involve processing outside the European Economic Area. Such transfers require safeguards under Chapter V GDPR, such as an adequacy decision or standard contractual clauses. You may request information about applicable safeguards and how to obtain a copy at the contact address. Provider documents: Hostinger and Google.
Ordinary correspondence is kept while the enquiry and necessary follow-up communication are being handled. Prayer requests are kept for as long as needed for the request or until consent is withdrawn. Once the purpose ends, data is to be deleted or anonymised unless another lawful ground requires retention.
Bank and accounting documents are kept for the periods required by applicable accounting and tax rules. Technical logs are retained as needed for security and incident handling; backups follow the provider’s replacement cycle. Information needed for a specific legal claim may be retained until its resolution or the relevant limitation period expires. You can ask the church about the period applicable to your enquiry.
Where provided by GDPR, you may access your data and obtain a copy, correct it, request deletion or restrict processing. You may object to processing based on legitimate interests. For automated processing based on consent, data portability applies where its legal conditions are met.
You can withdraw consent at any time by emailing the church, without affecting the lawfulness of earlier processing. Proportionate identity verification may be needed to handle a request. Requests are generally answered within one month; the law allows an extension for complex cases with reasons provided.
You may complain to the competent data protection authority, including Poland’s President of the Personal Data Protection Office. Message data is not used for profiling or solely automated decisions producing legal or similarly significant effects.
If you recognise yourself in a photograph or video and have a question about publication, email us with a link to the page. Attending a service does not by itself give permission for every use of your image.
Maps and Facebook open through separate links, after which the provider’s own rules apply. Technical storage is explained on our cookies page. This policy is updated when website features change; the version date appears above.