Version of 15 September 2026. Applies to the Pāvila draugi support programme on paviladraugi.lv.
1. Who processes your data
The controller of personal data within the meaning of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) is the parish you donate to:
Latvijas evaņģēliski luteriskās baznīcas Rīgas Svētā Pāvila draudze (LELB Rīgas Svētā Pāvila draudze)
Registration number 90000306537
Augusta Deglava iela 1, Rīga, LV-1009, Latvia
[email protected]
Any question about your data can be raised by writing to this address.
Other organisations help with the programme, but none of them is a controller of your data within this programme. Vivaldi Entertainment produces the Pāvila draugi cards, and Rīgas Mūzikas biedrība compiles website visit statistics. Both do so on behalf of the parish and only as far as necessary (section 4).
2. What data we collect
- Donations. Name, e-mail address, amount (including the chosen amount and fee cover, if ticked), currency, date, type of donation (one-time or monthly), payment status and payment identifiers in the Stripe system. If you donate by bank transfer, the parish sees the payer's name, amount, date and payment reference as they appear in the parish's bank account.
- Participation in the programme and the Pāvila draugi card. Participation status (active or inactive), support level and card colour, start date of participation, card identifiers and the code of the verification link. If you add the card to Apple Wallet or Google Wallet, also the technical identifiers that the device or wallet service sends so that the card can be updated.
- E-mails. E-mail address, interface language, the fact and time of e-mails sent, consent to news and its time (for one-time donors), the fact and time of unsubscribing.
- Partner applications. Company name, contact person, e-mail address, phone number (optional) and a description of the offer.
- Visit statistics. Only with your consent: Google Analytics data on pages visited, device and referral source (section 5).
- Technical web server data. IP address, time of request, page address and browser type, recorded automatically in server logs as on any website.
Payment card details never reach us: Stripe processes them on its side. We do not ask for a personal identity number, home address or date of birth.
We do not process special categories of data, including data on religious beliefs: a donation to preserve the church building says nothing about them and is not interpreted that way.
3. Why and on what basis
- Participation in the programme, the Pāvila draugi card and service e-mails (payment confirmation, the card, sign-in link, payment notices). Basis: performance of a contract, Article 6(1)(b) GDPR. The programme cannot be run without this data.
- The monthly programme letter and special offers for supporters: gratitude, invitations and news on progress towards the goal. Basis: the parish's legitimate interest in keeping in touch with those who support it regularly, Article 6(1)(f) GDPR. Every letter has an unsubscribe link in the footer, which works immediately. Service e-mails about your own support continue to arrive.
- News for one-time donors. Basis: your consent, Article 6(1)(a) GDPR, given with a separate tick box on the payment page. Without the tick we send no news.
- Visit statistics. Basis: your consent, Article 6(1)(a) GDPR. The counter is not loaded until you consent.
- Accounting for donations. Basis: the parish's legal obligation, Article 6(1)(c) GDPR.
- Replying to a partner application and corresponding about cooperation. Basis: legitimate interest, Article 6(1)(f) GDPR.
- Server logs and protecting the website against intrusion and spam. Basis: legitimate interest, Article 6(1)(f) GDPR.
4. Who we share data with
We do not sell data or share it with third parties for advertising. The list of those who receive or process data on behalf of the parish is complete:
- Stripe (Stripe Payments Europe, Ltd., Ireland): processing card donations and monthly payments. Only what the payment requires is shared.
- Postmark (ActiveCampaign, LLC, USA): e-mail delivery. Transfers outside the EEA are based on the European Commission's standard contractual clauses and/or certification under the EU-U.S. Data Privacy Framework.
- Vivaldi Entertainment: producing the Pāvila draugi cards for Apple Wallet and Google Wallet under a contract with the parish. Vivaldi Entertainment is a processor and receives only the data the card needs: name, status, card colour and card identifiers, but not donation amounts.
- Apple and Google: when you yourself add the card to Apple Wallet or Google Wallet, the card data is stored on your device and in the wallet service concerned, and card updates are delivered through Apple or Google. Apple and Google process this data under their own terms.
- Rīgas Mūzikas biedrība (registration number 40008330326): processor of visit statistics on behalf of the parish. Statistics are compiled in the association's Google Analytics property; Google Ireland Limited is a sub-processor, and some data may be transferred to the USA. The association is also a partner offering gratitude to supporters (for example discounts on tickets for okoncert concerts); in that role it has no access to data on donation amounts.
- Hetzner Online GmbH (Germany): hosting of the website and database. The data is physically located in the European Union.
- Cloudflare (Cloudflare, Inc., USA): network, security and content delivery service for the website. Website requests pass through it, so it processes IP addresses and request data. Transfers outside the EEA are based on the European Commission's standard contractual clauses and/or certification under the EU-U.S. Data Privacy Framework.
- Google Fonts (Google): the website's fonts are loaded from fonts.googleapis.com and fonts.gstatic.com, which makes your IP address known to Google.
Most gratitude is passed on through codes in e-mails or by showing the card, and in that case partners do not receive your data. If you yourself sign up for a tour, rehearsal or event, the parish passes your name, e-mail address and, where relevant, the number of people to the organiser (Rīgas Mūzikas biedrība), solely for that sign-up. Partners never see donation amounts.
Data may also be disclosed to public authorities where the law requires it. We disclose only what is mandatory and only upon a duly made request.
5. Cookies and statistics
The website sets two cookies of its own, and both are necessary for it to work:
- pd_lang: stores the chosen interface language, valid for one year.
- pd_consent: stores your answer to the question about visit statistics, so that you are not asked again.
Google Analytics is loaded only with your consent. On your first visit the website asks whether statistics may be collected. If you decline, the counter is not loaded. If you agree, Google Analytics sets its own cookies and receives technical data: the address of the page opened, your IP address and a browser identifier. You can withdraw consent at any time without giving reasons: delete this website's cookies in your browser settings and the question will appear again.
Fonts are loaded from Google Fonts, which makes your IP address known to Google (section 4).
6. How long we keep data
- Donation data: the period is set by accounting requirements.
- Participation and card data, name and e-mail address: while you take part in the programme and as long as needed to run it and for the parish's reporting, or until you ask us to delete them, unless accounting requires them to be kept.
- Address on the news list: until you unsubscribe.
- Record of unsubscribing: kept after it, otherwise sooner or later we would write again.
- Partner applications: while we correspond or cooperate, or until you ask us to delete them.
- Web server logs: 7 days, then rotated.
- Database backups: 30 days. Data deleted at your request disappears from backups within this period.
7. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of what we hold (Article 15);
- rectify inaccurate data (Article 16);
- erase data, the so called right to be forgotten (Article 17);
- restrict processing (Article 18);
- receive your data in a portable format and transmit it to another controller (Article 20);
- object to processing based on legitimate interest, including the programme letters (Article 21); an objection to letters is carried out unconditionally and immediately;
- withdraw consent where processing is based on it, without affecting the lawfulness of earlier processing;
- lodge a complaint with a supervisory authority.
How to exercise them
Write to [email protected] from the address you donated with or use in the programme: that way we will not need to ask you for documents. We reply within one month; if a request is complex, the period may be extended, and we will let you know.
The quickest way to stop programme letters is the link in the footer of any of our e-mails.
Supervisory authority
Datu valsts inspekcija (Data State Inspectorate)
Elijas iela 17, Rīga, LV-1050, Latvia
[email protected] · dvi.gov.lv
8. The Pāvila draugi card and its verification
The card shows a name, status (active or inactive), the year participation began and a QR code. The donation amount and support level are not written on the card, but its colour reflects the size of support so that partners can tell which gratitude to offer.
The QR code opens a verification page. It shows the name as it appears on the card, the status and today's date, but not the amount. The link contains a random code that cannot be guessed, and the page is closed to search engines. Anyone you show the QR code to can see your name and card status.
9. How we protect data
The website works over HTTPS only. The database is accessible only from inside the server and is not exposed to the internet. The administrative area is password protected and closed to search engines.
The card status changes automatically under the 40 day rule described in the terms. We do not use any other automated decision making or profiling.
10. Changes to this policy
The current version is always published on this page; the date is shown at the top. We will notify you by e-mail of material changes affecting data already collected.