Privacy Policy

Sanctumel SRL - Last update: 7/8/2026

Translation for information only - only the French version is legally binding.

1. Data Controller

Sanctumel SRL, a company incorporated under Belgian law, with registered office at Rue de la Loi 1, 1000 Brussels, Belgium. VAT: BE0999999999. DPO contact: dpo@sanctumel.com

2. Data Collected

As part of the Sanctumel Pay service, we collect:

  • Donation data (mandatory): amount, currency, date, status.
  • Donor identity (optional): name, email, free message.
  • Technical data: IP address (anonymized after 30 days), user agent, timestamp.
  • Stripe identifiers (sessionId, paymentIntent) for accounting traceability.

No banking data is stored by Sanctumel. Card processing is delegated to Stripe (PCI-DSS Level 1).

3. Legal Basis (GDPR Art. 6)

  • Contract performance (Art. 6.1.b): processing the donation.
  • Legal obligation (Art. 6.1.c): accounting retention (7 years in Belgium, 10 years in other EU jurisdictions, 5 years in Canada).
  • Explicit consent (Art. 6.1.a): for collecting name and email.
  • Legitimate interest (Art. 6.1.f): fraud prevention and AML.

4. Religious Data (GDPR Art. 9)

Donating to a church may reveal religious convictions. Processing is based on your explicit consent (Art. 9.2.a) or on membership in the religious body (Art. 9.2.d).

5. Security

  • At-rest encryption AES-256-GCM of personal data.
  • In-transit encryption TLS 1.3 (HTTPS) systematic.
  • JWT RS256 authentication with key rotation.
  • Complete audit trail of all financial actions.
  • Daily encrypted backups.

6. Subprocessors (DPA signed)

  • Stripe Payments Europe Ltd. (Ireland) - Payment processing.
  • Resend Inc. (USA, SCC) - Email delivery.
  • Cloudinary (USA, SCC) - Image hosting.
  • OVH Cloud (France) - Infrastructure hosting.
  • LiveKit Inc. (USA, SCC) - Video conferencing.

7. Retention Period

  • Completed donation: 7 years (Belgium), 10 years (other EU), 5 years (Canada).
  • Technical data: 30 days.
  • Audit logs: 5 years.

8. Your Rights

You may exercise the following rights at any time:

  • Access to your data.
  • Rectification of inaccurate data.
  • Erasure (right to be forgotten) - subject to legal obligations.
  • Restriction of processing.
  • Data portability.
  • Objection to processing.
  • Withdrawal of consent at any time.

To exercise your rights: dpo@sanctumel.com. Response within 30 days.

9. Complaint

You may lodge a complaint with:

10. Transfers Outside EU

Transfers to subprocessors outside the EEA are governed by the Standard Contractual Clauses (SCC) of the European Commission.

11. Cookies

Strictly necessary cookies only (authentication, CSRF security). No tracking or advertising cookies.

12. Changes

This policy may be updated. The date is shown at the top. You will be notified by email of any substantial change.

Sanctumel SRL - Terms of Use · sanctumel.com