This is a translation provided for convenience. In case of discrepancy, the Spanish version prevails.
1. Data controller
This policy explains how Congrega processes the personal data of people who visit www.congrega.es, sign up for its webinars, contact us or contract the Congrega CRM application, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
- Controller: Tiago Manuel Lezcano Barrios
- Trade name: Congrega Software (Congrega CRM)
- Tax ID (NIF): Y5568974K
- Address: Calle de Soria, 2, 2º A, 28941 Fuenlabrada (Madrid), España
- Email: soporte@congrega.es
For any privacy question, write to soporte@congrega.es.
2. What data we process and where it comes from
We only process data you give us directly or that is generated when you use the website and the application:
- Contact and identification data: first name, surname, email and, optionally, phone, which you give us in the contact or webinar sign-up forms.
- Data about your church: church name, denomination, country and city, your message and, if you write one, the question you want to ask in the webinar.
- Customer data: billing details (name or company name, tax ID, address), contracted plan and payment history. Payments are made by bank transfer, so we also process the details shown on it (account holder and originating account).
- User account data: name, email, role within the church and encrypted password of the people who access the application.
- Technical and usage data: IP address, browser, pages visited and access and activity logs in the application, obtained through cookies and server logs. More information in the Cookie policy.
Data about each church's members entered in the application is not processed by Congrega on its own behalf: see section 4.
3. Why we use your data, on what legal basis and for how long
Each use of your data has a legal basis under article 6 GDPR and a retention period:
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Manage your webinar sign-up and send you the session link. | Contact details, church and your question. | Your sign-up request (art. 6.1.b GDPR). | 24 months after the webinar, unless you become a customer. |
| Answer your enquiries and send you the information or quote you ask for. | Contact details, church and your enquiry. | Your request (art. 6.1.b GDPR). | 24 months after the last communication. |
| Provide the contracted service: set-up, user accounts, support and service notices. | Customer data and user accounts. | Performance of the contract (art. 6.1.b GDPR). | For the duration of the contract. |
| Invoice and meet accounting and tax obligations. | Billing and payments. | Legal obligation (art. 6.1.c GDPR). | 6 years (art. 30 of the Spanish Commercial Code). |
| Protect the website and the application against unauthorised access, fraud and automated (spam) sign-ups. | Technical data and access logs. | Legitimate interest in the security of the service (art. 6.1.f GDPR). | 12 months. The IP address stored with a webinar sign-up is kept as long as the sign-up. |
| Measure website use to improve it. | Technical data (analytics cookies). | Your consent to cookies (art. 6.1.a GDPR). | See the Cookie policy. |
We do not use your data to make automated decisions or build profiles with effects on you, and we never sell it.
Where processing is based on your consent, you can withdraw it at any time (for cookies, with the “Cookie settings” link in the footer). Withdrawing it does not affect what we did before with your consent.
When a period ends, we block the data for as long as needed to deal with possible legal liabilities and then delete it.
4. Data churches store in the application
Each church that contracts Congrega CRM is the controller of the data about its members, families, attendees and volunteers that it enters in the application. Congrega acts as data processor (art. 28 GDPR): it stores and processes that data only to provide the service and following the church's instructions.
Specifically, Congrega undertakes to:
- Process that data only to provide the service, never for its own or commercial purposes.
- Not disclose it to third parties, except to the providers needed for the service (section 5) or where required by law.
- Require confidentiality from everyone who may access it.
- Apply appropriate security measures, bearing in mind that this data may reveal religious beliefs, a special category of data (art. 9 GDPR).
- Help the church respond to its members' rights and notify it without delay of any security breach.
- When the contract ends, give the church, if it asks within the following 30 days, a copy of its data in a commonly used format (for example, Excel), and then delete it, unless the law requires it to be kept.
These obligations are set out in the data processing agreement Congrega signs with each church.
If you are a member of a church that uses Congrega and want to access, correct or delete your data, contact your church, which decides on it. If you write to us, we will forward your request to the church.
5. Who we share data with
We do not give your data to third parties for their own purposes. It is only accessed by the providers we need to provide the service, under a data processing agreement that obliges them to protect it and use it only according to our instructions:
- Website and application hosting, and email for soporte@congrega.es: IONOS (data in the EU).
- Sending automated emails (webinar confirmation, new users, password reset): Google, through Gmail (data in the EU and US).
- Holding webinars: Microsoft, through Microsoft Teams (data in the EU and US).
- Subscription payments: BBVA (data in Spain).
- Tag management and web analytics, only if you accept cookies: Google, through Google Tag Manager and Google Analytics (data in the EU and US).
- Fonts and technical libraries for the website: Google Fonts, jsDelivr, cdnjs (Cloudflare) and code.jquery.com, which receive your IP address when the page loads (data in the EU and US).
If you click the WhatsApp link, the conversation is governed by WhatsApp's (Meta's) privacy policy.
We may also disclose data to the Tax Agency, courts or other authorities when required by law.
International transfers. Some providers may process data outside the European Economic Area, mainly in the United States. In those cases we only work with companies certified under the EU-US Data Privacy Framework or that sign the standard contractual clauses approved by the European Commission, which guarantee protection equivalent to European standards.
6. Your rights
You may exercise these rights at any time and free of charge over the data Congrega processes as controller:
- Access: know what data about you we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data.
- Objection: ask us to stop processing it, for example for commercial communications.
- Restriction: ask us to keep it but not use it.
- Portability: receive your data in a commonly used electronic format.
- Withdraw your consent where processing is based on it.
To exercise them, write to soporte@congrega.es with the subject “Data protection”, stating which right you want to exercise. We will only ask for an identity document if we have reasonable doubts about your identity. We will reply within one month at most.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security, minors and changes
Security. We apply technical and organisational measures to protect data: encrypted connections (HTTPS), encrypted passwords, role-based access within each church, separation of each church's data and regular backups.
Minors. The website and contracting Congrega are aimed at adults who manage a church. We do not knowingly collect data from children under 14 through the website. If a church records data about minors in the application, the church is responsible for obtaining the consent of their parents or guardians.
Changes. We may update this policy to reflect legal or service changes. We will always publish the version in force on this page and, if the change is significant, notify our customers by email.