One Hallelujah
Privacy Policy and Data Protection
Draft — awaiting organisational details
This policy is not final. It is not a finished legal policy while the legal name, lawful bases, providers and retention periods are unconfirmed, or before an authorised administrator approves it.
Still unconfirmed: Legal name; Lawful-basis note; Effective date; Last updated date; Retention for registration records; Retention for contact enquiries; Retention for donation records; Retention for security logs; Retention for consent records; International transfers reviewed; Lawful bases reviewed; Legal name checked; No unearned legal claims; Privacy contact confirmed; Providers identified; Retention periods decided; Supervisory authority considered.
1. Who operates this site
One Hallelujah is the public name of this website. That name is not, by itself, a legal personality, a charity registration or a street address.
Legal name: Not yet entered. This is a placeholder until an administrator completes it.
Legal status: Not yet confirmed. This website does not claim that the operator is a charity, company or other body.
Charity registration number: Not entered. This website does not claim to be a registered charity.
This website does not claim that gifts are tax-deductible or eligible for Gift Aid.
Address: Not yet confirmed.
Contact: Not yet confirmed. Use the contact form.
Privacy email: Not yet confirmed. Use the contact form.
Supervisory authority: Not named. This page does not invent an authority or a registration.
2. What this site processes
The forms and logs below are what the website actually handles today.
Congregation registration. Organisation name, country, city or region, contact name, contact email, an optional telephone number, a self-reported attendance range, preferred language, whether reliable internet is expected, whether an offline pack is needed, and consent to store the record and send event communications.
Individual participation. Preferred language, how the person expects to take part, an optional email address, an optional country, and communications consent when an email is left. The form does not ask for a name.
Contact form. Name, email, an optional country and the message.
Technical and security records. Short error messages and the path where they occurred. Rate limiting stores a salted hash of a network address for a short window, not a profile. A duplicate-submission key can keep the response already given so a repeated click does not create a second registration.
Staff session. An httpOnly cookie is set only after a staff member signs in.
Analytics. Anonymous daily totals can be stored for a page view and for a resource download. A synchronisation status, such as “synchronised” or “limited accuracy”, is stored only when a person chooses to share it. These totals are not treated as proof that someone took part. The site does not ask for a precise location.
Donations. Payment is not yet collected on this website, so donor card data is not processed here. The donation form does not submit a card number, a message or a payment.
3. Why information is used
Records are used to receive registrations, answer enquiries, coordinate the event, protect the website, and send updates that were requested.
Donation accounting is a future purpose. It is not yet active, because no donations are stored. A legal obligation may also apply later, once the organisation has confirmed that it does.
4. Lawful basis
Readiness warning: the organisation must confirm the lawful basis for each purpose before this policy is treated as final. The candidate bases below are unconfirmed placeholders. They are not yet approved.
- Congregation registration and event coordination: candidate basis — contract or legitimate interests (not yet approved).
- Optional event communications: candidate basis — consent (not yet approved).
- Contact enquiries: candidate basis — legitimate interests (not yet approved).
- Security logs and rate limits: candidate basis — legitimate interests (not yet approved).
- A specific legal duty, if one applies: candidate basis — legal obligation (not yet approved).
- Donation accounting: not yet active. No candidate basis is approved.
No lawful-basis note has been recorded.
5. Donations and payment processors
No payment provider is selected for live charges. Card data is not collected on this site. The intended approach is a hosted checkout, for example Stripe. If that is connected later, the provider would process payment data under its own policy. This website is not designed to store full card numbers.
Provider privacy policy: Empty until a provider is configured.
6. Sharing
Data can be processed by the host that serves this website, by an email provider, and in future by a payment provider. This policy does not say that data is never shared. The site is not built to sell personal information.
Email is sent through Resend only when that service is configured on the server. On this deployment, email delivery is not configured. If it is not configured, the site does not send mail.
Staff access depends on role. Analysts see aggregate counts rather than contact details. Country and regional coordinators see personal details only for the places assigned to them. Global administrators and event operations can see contact records.
7. International transfers
Readiness warning: this policy does not claim a storage location. International transfers depend on the hosting provider, the email provider and any future payment provider. Those choices are not confirmed here, so no transfer safeguard is stated.
8. Retention
Until an administrator sets a period, this policy does not state a number of years.
Registration records: The retention period is not yet confirmed.
Contact enquiries: The retention period is not yet confirmed.
Donation records: The retention period is not yet confirmed.
No donation records are stored today.
Security logs: The retention period is not yet confirmed.
Consent records: The retention period is not yet confirmed.
A backup made before a deletion may remain until that backup expires. Backup expiry is not confirmed on this page.
9. Security
The public site is intended to be served over HTTPS. Responses include a strict transport security header, a nosniff header, a referrer policy, and a rule that denies framing.
Staff sessions use an httpOnly cookie named oh_session, with SameSite set to Lax. The secure flag is set when the site runs in production. Passwords are stored as scrypt hashes with a random salt. Actions that change records check the signed-in role. Public forms are rate limited. Secret keys are read from the server environment and are not placed in frontend code.
These measures reduce risk. They are not a certification, and they do not make security perfect.
10. Your rights
You can ask for access, correction or deletion through the contact form. The rights available to you vary by the law that applies. This page does not treat one statute as if it had been adopted for every country.
11. Cookies, local storage and analytics
Ordinary visitors do not receive an account cookie. The oh_session cookie is set only for a signed-in staff member. It is httpOnly.
The browser can store a motion preference (oh-motion), the synchronisation-status choice (oh-sync-consent), and a local copy of the published event time and the last time check so the countdown can continue. A tab can also remember that a page view was already counted, so the same visit is not counted twice.
Page-view totals and resource-download totals are anonymous daily counts. They are not the same choice as synchronisation status. Visiting the site does not count as consent to share that status. The status is sent only after you choose “Share status”. Choosing “Do not share”, or leaving the choice unanswered, means the status is not stored.
This application does not set advertising cookies.
12. Children
The registration form is for a congregation contact. It is not a children's profile. Do not send unnecessary information about children through these forms. The individual form does not ask for a date of birth. This page does not invent an age-gate law.
13. Changes to this policy
No effective date or last-updated date has been set. This policy has not yet been published as final.
14. Complaints and contact
Supervisory authority: Not named. This page does not invent an authority or a registration.
Questions, access requests and complaints can be sent through the contact form. A privacy email has not been entered, so the contact form is the route.