Privacy Policy
Last updated: October 2026
1. Who We Are (Data Controller)
Syrische Gemeinde in Deutschland - "SGD" e.V.
Haberstraße 1
53121 Bonn, Germany
Registered at: VR 12726 – Amtsgericht Bonn
Email: [email protected]
The association has not designated a Data Protection Officer, as this is not required for our processing activities (Art. 37 GDPR, § 38(1) BDSG).
2. What Data We Collect and Why
We collect only the data necessary to operate the community platform. New accounts are manually reviewed by an association administrator before access is granted; your profile data is stored during this review period.
Providing your phone number and name is required to create an account. Without this data, we cannot offer you access to the platform.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Phone number | Identify you and send a one-time login code (OTP) | Art. 6(1)(b) — contract performance |
| Name and profile photo | Display your identity to other community members | Art. 6(1)(b) — contract performance |
| Text messages and media files | Deliver messages within community chats | Art. 6(1)(b) — contract performance |
| Voice recordings | Send voice messages inside chats | Art. 6(1)(a) — your consent, obtained when the app requests microphone permission |
| Device push token (FCM) | Send you notifications about new messages | Art. 6(1)(a) — your consent when granting notification permission |
| Per-installation device identifier | Detect duplicate account registrations across devices | Art. 6(1)(f) — legitimate interest in preventing circumvention of the account review process |
| Event registration without an account (name, phone number and/or email) | Organise a public event you registered for on the website and tell you about changes to it | Art. 6(1)(a) — your consent on the registration form |
| Registration for a paid event (name, phone number, email, payment method, amount, payment reference, ticket status) | Matching your payment, emailing you the payment details and your ticket with a QR code, reminding you to pay, checking the ticket at the door, and telling you about changes. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. processes your payment under its own responsibility. | Art. 6(1)(b) – providing the event place you booked; for the bookkeeping record Art. 6(1)(c) – legal retention duty (§ 147 AO, German Fiscal Code) |
| Anonymous usage statistics (website) | Understand which pages are visited so we can improve the website — collected only if you consent via the cookie banner | Art. 6(1)(a) — your consent |
| Anonymous usage statistics (mobile app) | Understand which features are used so we can improve the app (via Firebase Analytics) | Art. 6(1)(f) — legitimate interest in improving the platform based on aggregate usage data |
| Crash and error reports | Diagnose and fix app crashes and technical issues (via Sentry) | Art. 6(1)(f) — legitimate interest in maintaining app stability and fixing bugs |
| Community safety and moderation records | Document administrator decisions to enforce community rules and protect members | Art. 6(1)(f) — legitimate interest in protecting community members and enforcing platform rules |
| IP address and request logs | Security and abuse prevention | Art. 6(1)(f) — legitimate interest in detecting and preventing security threats |
We do not collect location data, contacts, browsing history, or any data unrelated to community communication.
3. How Long We Keep Your Data
- Messages and media: retained while your account is active. You can delete individual messages at any time.
- Account data (name, phone number, profile photo): retained until you request account deletion.
- Removed or replaced profile photos: the previous photo is kept for 30 days so it can be restored if it was removed by mistake, then it is deleted for good.
- Server logs: retained for a maximum of 30 days for security purposes.
- Voice recordings: stored as message media and subject to the same retention as messages.
- Community safety records: retained for up to 12 months after the relevant moderation action, then deleted, or upon a valid erasure request under Art. 17 GDPR.
- Event registrations without an account: deleted 30 days after the event, or earlier on request.
- Registrations for paid events: contact details and ticket deleted 30 days after the event. The payment (name, amount, date, reference) is kept as a bookkeeping record for 10 years, as § 147 AO (German Fiscal Code) requires.
4. Who We Share Data With
We do not share your personal data with third parties for commercial purposes. We share data only with the following processors to operate the service:
| Processor | Purpose | Location |
|---|---|---|
| Google Firebase (FCM) | Push notifications and app usage analytics | EU / USA (Standard Contractual Clauses) |
| Sentry (Functional Software, Inc.) | Crash and error reporting | EU / USA (Standard Contractual Clauses) |
| Cloudflare, Inc. | Network delivery and security, bot protection on forms (Turnstile), cookie-free page-view statistics on the website (Web Analytics) | EU / USA (Standard Contractual Clauses) |
| netcup GmbH | Server hosting | 🇩🇪 Germany |
All other data (messages, files, profiles) is stored on our own server in Germany and is not shared with any third party.
Website Statistics and Cookies
We collect our own anonymous usage statistics, described below, only if you have explicitly agreed via the cookie banner. Without your consent, this data is not collected and no cookies are set for this purpose. The cookie-free page-view count by Cloudflare is described at the end of this section.
We record: the pages you visit, your approximate location (country and city, derived from your IP address), and your device type and browser. Your IP address itself is not stored — it is used only briefly to determine the location and then discarded immediately. A more precise location than the city is not possible from an IP address and is not attempted.
The legal basis is your consent under Art. 6 (1)(a) GDPR and § 25 (1) TDDDG (Telecommunications-Digital-Services-Data-Protection Act, formerly TTDSG). You can withdraw your consent at any time, with effect for the future, via the Cookie settings link at the bottom of the page.
To derive the location from the IP address we use ipinfo.io (ipinfo.io LLC, USA). Any transfer to the USA is based on the EU Standard Contractual Clauses.
The anonymous statistics data is deleted automatically after 180 days at the latest.
In addition, our network provider Cloudflare (Cloudflare, Inc., USA) counts page views on this website with Cloudflare Web Analytics, without your consent and without cookies. Nothing is stored on or read from your device, and no profile of you is built. Cloudflare records which page was opened, the referring page, the browser and device type, the country, and how fast the page loaded; according to Cloudflare, your IP address is not stored for this. We only see aggregated figures. The legal basis is our legitimate interest in understanding how the website is used and keeping it fast and reliable (Art. 6 (1)(f) GDPR). Any transfer to the USA is based on the EU Standard Contractual Clauses.
5. Your Rights Under GDPR
Under the GDPR and the German Federal Data Protection Act (BDSG), you have the following rights:
- Access — Request a copy of your personal data
- Rectification — Correct inaccurate data
- Erasure — Request deletion of your account and all associated data
- Restriction — Ask us to limit processing while a dispute is resolved
- Portability — Receive your data in a machine-readable format
- Objection — Object to processing based on legitimate interest
- Withdraw consent — For push notifications, disable them in the app Settings at any time. For voice recording, revoke microphone permission via your device settings.
We do not make decisions about you based solely on automated processing — including profiling — that produce legal or similarly significant effects (Art. 22 GDPR).
Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.
To exercise any of these rights, email us at [email protected]. We will respond within one month. For complex or numerous requests, we may extend this by up to two additional months and will inform you of any extension.
You also have the right to lodge a complaint with the German supervisory authority (LDI NRW): www.ldi.nrw.de
6. Permissions This App Requests
| Permission | Why it is needed |
|---|---|
| Internet | Required to connect to the community server. |
| Microphone (RECORD_AUDIO) | Only used when you choose to record a voice message. The app never records in the background. |
| Notifications | To alert you about new messages. Can be disabled in your device settings at any time. |
| Camera / Photo library | Only when you choose to upload a profile photo or share an image in a chat. |
7. Children
This app is intended for members and guests of the Syrian community in Germany aged 16 or older. We do not knowingly collect data from anyone under 16. If you believe someone under 16 has created an account, contact us at [email protected] and we will delete it promptly. If you apply for membership before you turn 18, a parent has to consent: we store the name, email address and phone number of the parent you name, and their consent, with your application, and delete them together with it.
8. Changes to This Policy
We may update this policy when the app changes. We will notify users of significant changes via an in-app message. The date at the top of this document always reflects the latest version.
9. Contact
Syrische Gemeinde in Deutschland - "SGD" e.V.
Haberstraße 1, 53121 Bonn