EasySadaqa Privacy Policy

Last updated: October 2026

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

EasySadaqa
Owner: Ahmed Fahim Abajtit
Adalbertsteinweg 23
52070 Aachen
Germany

Email: info@easysadaqa.de
Phone: +49 152 22 81 49 54
VAT ID: DE460683811

No Data Protection Officer has currently been appointed. Privacy-related inquiries may be directed to the contact details above.

2. Scope of This Privacy Policy

This Privacy Policy explains how personal data is processed in connection with:

  • The EasySadaqa website at easysadaqa.eu
  • The customer portal at portal.easysadaqa.com
  • The API at api.easysadaqa.com
  • The administration platform at admin.easysadaqa.com
  • The EasySadaqa mobile application for iOS and Android, distributed through the Apple App Store and Google Play Store
  • The EasySadaqa Android tablet and donation terminal application
  • User registration and account management
  • Donation collection and payment integrations
  • Customer inquiries and contractual relationships
  • Technical integrations with third-party service providers
  • Support, security, monitoring and administration

3. Data Controller and Data Processor Roles

Depending on the circumstances, EasySadaqa processes personal data either as an independent data controller or as a data processor acting on behalf of its customers.

EasySadaqa generally acts as a data controller for:

  • Website and mobile application operation
  • User registration and account administration
  • Customer inquiries and contractual relationships
  • Billing and accounting
  • Customer support and communications
  • IT security and fraud prevention
  • Internal administration and compliance
  • Lawful marketing and business development activities
  • Referral and partnership relationships where EasySadaqa determines the purposes and means of processing

EasySadaqa generally acts as a data processor under Article 28 GDPR when customers use its systems to manage personal information relating to their members, donors, employees, representatives or other individuals.

In these situations, the respective customer remains responsible for determining the purposes and legal basis of processing. EasySadaqa processes such information according to the customer’s instructions and the applicable Data Processing Agreement.

4. Categories of Personal Data

Depending on the services used, EasySadaqa may process the following categories of personal data:

  • First name and last name
  • Email address
  • Telephone number
  • Mosque or organization name
  • Organization address
  • Account credentials and authentication information
  • User roles and permissions
  • Contractual and billing information
  • Device information and technical identifiers
  • Application usage and security logs
  • Transaction references and payment metadata
  • Customer support communications
  • Uploaded logos, banners, images, documents and other content
  • Membership, contribution, donation and receipt information where applicable

Because EasySadaqa may be used by religious organizations, certain information may reveal or suggest religious affiliation. Such information may constitute special-category personal data under Article 9 GDPR and must be processed only where an appropriate legal exception applies.

5. Purposes and Legal Bases of Processing

We process personal data for the following purposes:

  • Providing and operating our websites, applications and APIs
  • Registering and authenticating users
  • Managing customer accounts and organizations
  • Providing donation terminal management features
  • Enabling payment integrations
  • Providing technical support
  • Sending transactional emails and service notifications
  • Maintaining system security
  • Preventing fraud and unauthorized access
  • Meeting legal and accounting obligations
  • Maintaining documentation and protecting legal claims
  • Improving technical reliability and service performance

The legal bases for processing may include:

  • Article 6(1)(a) GDPR — Consent
  • Article 6(1)(b) GDPR — Performance of a contract or pre-contractual measures
  • Article 6(1)(c) GDPR — Compliance with legal obligations
  • Article 6(1)(f) GDPR — Legitimate interests
  • Article 9(2) GDPR — Where applicable to special-category data
  • Section 25 TDDDG — Where applicable to accessing or storing information on user devices

6. Website Access and Server Logs

When accessing our websites or online services, the following technical information may be processed:

  • IP address
  • Date and time of access
  • Requested pages or resources
  • Referrer URL
  • Browser type and version
  • Operating system
  • Hostname and technical connection information

This information is processed to maintain service availability, security, stability, troubleshooting and fraud prevention.

The legal basis is Article 6(1)(f) GDPR. Server and security logs are generally retained for up to 90 days unless longer retention is necessary for legitimate security, legal or technical reasons.

7. WordPress and Website Components

Our website is based on WordPress and may use components such as Blocksy, Polylang, Contact Form 7, Elementor, PRO Elements, GreenShift, All-in-One WP Migration and Backup, and other technical extensions.

These components may process technical connection information necessary for website functionality.

Non-essential cookies or third-party requests are activated only where the applicable legal requirements, including consent requirements, have been satisfied.

8. Cookies and Consent Management

Our website uses cookies and similar technologies for essential functionality, user preferences and, where enabled, analytics or integrations.

Essential technologies may be used under Section 25(2) TDDDG and the applicable GDPR legal basis.

Non-essential cookies and comparable technologies requiring consent are activated only after valid consent has been obtained.

Users may withdraw their consent through the website’s cookie settings.

9. Contact Forms, Email, Telephone and WhatsApp

When contacting EasySadaqa, we may process:

  • Name
  • Organization
  • Email address
  • Telephone number
  • Message content
  • Relevant technical communication metadata

This information is used to respond to inquiries, provide assistance and manage contractual or pre-contractual communications.

Where WhatsApp is used, Meta or WhatsApp may independently process information according to their own privacy policies. WhatsApp communication is optional.

10. Mobile Application Registration and Organization Information

The EasySadaqa mobile application is intended for authorized representatives of mosques, associations, nonprofit organizations and other participating organizations.

The application will be available for supported iOS and Android devices through the Apple App Store and Google Play Store.

10.1 Information Collected During Registration

When registering an account, users may be required to provide:

  • First name: To identify the account holder.
  • Last name: To identify the account holder.
  • Phone number: For account-related communications, support and security-related contact where applicable.
  • Email address: For authentication, account notifications and communication.
  • Mosque or organization name: To associate the account with the relevant organization.
  • Organization address: For organizational identification, account administration and contractual purposes.

10.2 Purposes of Registration Data

Registration information is used to:

  • Create and maintain user accounts
  • Identify authorized representatives
  • Associate users with their organizations
  • Manage access permissions
  • Provide customer support
  • Communicate important service information
  • Manage contractual relationships
  • Prevent unauthorized access and misuse

The primary legal basis is Article 6(1)(b) GDPR where processing is necessary for contractual or pre-contractual purposes. Article 6(1)(f) GDPR may apply to legitimate security and administrative interests.

10.3 Data Accuracy

Users are responsible for providing accurate registration and organizational information and keeping it up to date.

10.4 Account Access and Authentication

We may process account identifiers, authentication credentials, login events, access permissions and security information to protect user accounts.

Where supported, device-based authentication features may be used. Biometric verification performed locally by the operating system does not necessarily require EasySadaqa to receive or store biometric data.

11. Administration, Login, Two-Factor Authentication and Passkeys

For account administration and security-sensitive access, EasySadaqa may process:

  • Name and email address
  • Username
  • User roles and permissions
  • Login timestamps
  • IP addresses
  • User-agent information
  • Security events
  • Two-factor authentication information
  • WebAuthn and passkey-related information, including credential identifiers and public keys

This processing supports authentication, access control, accountability and fraud prevention.

12. EasySadaqa iOS and Android Mobile Application

The EasySadaqa mobile application allows authorized users to access and manage supported EasySadaqa services.

Depending on the features enabled, these services may include:

  • Managing organizational accounts
  • Connecting supported payment terminals
  • Initiating donation payments
  • Using compatible SumUp integrations
  • Managing donation-related settings
  • Viewing transaction statuses and relevant references
  • Accessing organization-specific configuration
  • Receiving operational and security-related information

12.1 Mobile Device Information

Depending on the device, operating system, permissions and application configuration, the following technical information may be processed:

  • Device model and manufacturer
  • Operating system and version
  • Application version
  • Technical device identifiers or tokens
  • Connection and pairing information
  • Application activity and synchronization status
  • Error reports and technical logs
  • Transaction and integration metadata

12.2 Application Permissions

The mobile application may request permissions necessary for enabled functionality, including:

  • Internet and network connectivity
  • Bluetooth connectivity for supported payment devices
  • Notifications, where supported and enabled
  • Other permissions required for specific features, where applicable

Permissions are requested according to the requirements of the relevant operating system and the features being used.

12.3 Bluetooth and Payment Terminal Connectivity

Where supported, EasySadaqa may use Bluetooth to communicate with compatible payment terminals.

Technical information relating to device discovery, connection status and pairing may be processed to establish and maintain the connection.

12.4 Tap to Pay

Where available and supported, the application may provide Tap to Pay functionality through authorized payment service providers and compatible devices.

Payment processing, authorization and related financial operations are performed by the relevant payment service provider.

EasySadaqa does not operate as an independent payment service provider and does not store complete payment card numbers.

12.5 Application Distribution

The application may be distributed through:

  • Apple App Store
  • Google Play Store

Apple and Google may independently process information associated with app downloads, installation, updates, purchases, diagnostics and platform services according to their own privacy policies.

13. Android Tablet Application and Donation Terminal Operation

The EasySadaqa Android tablet application may process:

  • Device or hardware identifiers
  • Manufacturer, model and operating system
  • Application version
  • Device tokens
  • Pairing information
  • Battery status and last activity
  • Technical and crash logs
  • Synchronization and configuration information
  • Transaction metadata

This information is used for terminal operation, synchronization, technical support, security, remote maintenance and device management.

14. Android Tablet Permissions

Depending on its configuration, the Android tablet application may use permissions for:

  • Internet access and network status
  • Bluetooth connections
  • Foreground services
  • Displaying interface elements over other applications
  • Installing application packages
  • Wallpaper functionality
  • Accessibility-based navigation or control features

Accessibility functionality, where enabled, is intended to provide navigation and system-related application controls. It is not designed to read the content of unrelated applications.

15. Technical Logs and Transaction Metadata

To maintain reliable and secure services, EasySadaqa may process:

  • Timestamps
  • Status codes
  • Transaction references
  • Device identifiers
  • Application versions
  • Technical error messages
  • Connection and synchronization information
  • Relevant operational metadata

We aim to limit the collection of technical information to what is necessary for the intended purposes.

Technical device, application and security logs are generally retained for up to 90 days unless longer retention is necessary for security, troubleshooting, contractual or legal reasons.

16. Payment Service Providers and SumUp Integration

EasySadaqa integrates with external payment service providers, particularly SumUp.

Depending on the integration, the following information may be processed:

  • Merchant identifiers
  • OAuth or authorization tokens
  • Transaction references
  • Payment amounts and currencies
  • Transaction timestamps
  • Transaction statuses
  • Payment terminal connection information
  • Technical API metadata

EasySadaqa does not store complete payment card numbers and does not independently process card payments as a payment service provider.

Payment processing, merchant verification, KYC/AML checks, fraud prevention, authorization, payouts, refunds and chargebacks are generally handled by the relevant payment service provider under its own responsibilities.

EasySadaqa may also process limited information as an independent controller in connection with its referral or partner relationships.

Additional information about payment processing can be found in the relevant payment provider’s privacy policy.

17. Membership, Contributions and Donor Data

Where customers use EasySadaqa to manage memberships, donations or contributions, the following information may be processed:

  • First and last name
  • Date of birth, where applicable
  • Contact information
  • Contribution and payment information
  • Donation references
  • Project information
  • Export data
  • PDF and CSV records
  • Organizational associations

Such processing is generally performed on behalf of the respective customer, who remains responsible for establishing the appropriate legal basis and providing required privacy information to affected individuals.

18. Donation Receipts, Documents, Logos and Signatures

For document generation and donation receipts, EasySadaqa may process:

  • Recipient names
  • Organization names
  • Postal addresses
  • Telephone numbers
  • Donation amounts and dates
  • Document issuance information
  • Logos, stamps and signatures
  • Uploaded images and text

These details are used to generate documents, provide requested functionality, synchronize information and support customers.

19. Design Requests and Uploaded Content

Customers may upload logos, banners, images, videos, documents, signatures and other materials for personalization or design-related services.

This information may be processed to fulfill requests, communicate with customers and provide content on supported devices.

Customers are responsible for ensuring that uploaded materials comply with applicable legal requirements, including copyright, trademark and data protection law.

20. Artificial Intelligence and Development Support

EasySadaqa may use AI-assisted tools for software development, troubleshooting, technical documentation and internal quality assurance.

We aim to avoid transferring personal information to AI tools or to minimize, anonymize or pseudonymize such information where appropriate.

Production databases, customer information, donor records, membership information, complete payment information, API keys, passwords, database backups and uploaded customer documents should not be transferred to AI providers without appropriate legal review, safeguards and agreements.

EasySadaqa does not use customer data to train its own AI models.

21. Nominatim and OpenStreetMap

For address entry or location-related features, EasySadaqa may use Nominatim based on OpenStreetMap.

Depending on the implementation, search terms, IP addresses, timestamps and technical browser information may be transmitted to the service provider.

The processing supports address search and location resolution.

22. Google reCAPTCHA

Google reCAPTCHA may be used to protect forms and online services against spam, abuse and automated requests.

Depending on the implementation, Google may process IP addresses, device information, browser information and interaction metadata.

Where access to or storage of information on a user’s device requires consent under applicable law, the service will be used only after obtaining the required consent.

23. Google Analytics and Google Tag Manager

Our website may use Google Analytics and Google Tag Manager to evaluate website usage, manage technical integrations and improve services.

Google Analytics may process:

  • IP addresses
  • Browser and device information
  • Operating system
  • Referrer information
  • Pages visited
  • Session duration
  • Interaction behavior
  • Approximate location information
  • Technical identifiers

Google Analytics is activated only where the required consent has been obtained.

Google Tag Manager is used to manage website tags. Depending on the configuration, it may load additional services subject to their applicable consent requirements.

The relevant Google service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. International transfers may occur subject to applicable GDPR safeguards.

24. Local Fonts and Frontend Resources

Where technically possible, EasySadaqa hosts fonts, stylesheets, JavaScript files and other frontend resources on its own infrastructure.

This helps reduce unnecessary connections to external providers.

Technical access information may be processed to deliver and maintain these resources.

25. Transactional Emails Through Brevo

EasySadaqa may use Brevo to send transactional emails, including:

  • Account verification emails
  • Password reset messages
  • Security notifications
  • Contract-related communications
  • Customer support messages

The information processed may include email addresses, names, message content and technical delivery information.

The applicable legal basis may be Article 6(1)(b) or Article 6(1)(f) GDPR.

26. Hosting, Backups and System Recovery

EasySadaqa uses hosting, storage and backup infrastructure to maintain service availability and recover systems in the event of failures.

Backups may contain personal information processed through our websites, applications, APIs, databases and customer services.

Backup data is retained only as necessary for recovery, security, documentation or legal obligations. Backup retention is generally up to 90 days unless longer retention is justified.

27. Recipients and Service Providers

Where necessary, personal data may be shared with:

  • Hosting and infrastructure providers
  • Email and communication providers
  • Backup and storage providers
  • Payment service providers
  • Technical integration partners
  • Shipping and logistics providers
  • IT security and monitoring providers
  • Analytics and consent management providers
  • Development and technical support providers
  • Public authorities or legal advisers where legally required

Depending on the services actually used, providers may include IONOS, Brevo, Jottacloud, SumUp, Google Ireland Limited, Nominatim/OpenStreetMap and DHL.

Where service providers process personal data on our behalf, the required Data Processing Agreements are concluded in accordance with Article 28 GDPR.

28. International Data Transfers

Where personal data is transferred outside the European Union or European Economic Area, EasySadaqa observes the requirements of Articles 44–49 GDPR.

Depending on the circumstances, appropriate safeguards may include:

  • European Commission adequacy decisions
  • Standard Contractual Clauses
  • Other legally recognized transfer safeguards

International transfers may be relevant when using Google services, communication platforms, analytics tools or AI-assisted development services.

29. Data Retention

Personal information is retained only for as long as necessary for the relevant processing purposes or to meet legal obligations.

General retention principles include:

  • Server and security logs: Generally up to 90 days.
  • Application and device logs: Generally up to 90 days.
  • Account and registration information: For the duration of the account relationship and any applicable subsequent legal retention period.
  • Contractual, billing and tax records: According to applicable statutory retention requirements, which may extend up to 10 years.
  • Support communications: As necessary to resolve requests and satisfy legitimate documentation or legal requirements.
  • Customer-managed personal data: According to customer instructions and applicable Data Processing Agreements.
  • Consent records: For as long as necessary to demonstrate compliance.

30. Account Deletion and Data Removal

Users may request deletion of their EasySadaqa accounts and associated personal information by contacting:

info@easysadaqa.de

Requests will be reviewed and processed in accordance with applicable data protection laws.

Some information may need to be retained where required by accounting, tax, contractual or other legal obligations.

Where an account is linked to an organization, the deletion of an individual user’s account does not automatically require deletion of organizational records or data belonging to other users.

Where EasySadaqa acts solely as a data processor, deletion requests may need to be handled by the responsible customer organization.

31. Requirement to Provide Personal Data

Certain personal information is necessary to register an account, establish a contractual relationship or provide requested services.

Without the required information, some EasySadaqa features may not be available.

32. Automated Decision-Making

EasySadaqa does not carry out solely automated decision-making, including profiling, within the meaning of Article 22 GDPR.

33. Your Data Protection Rights

Subject to applicable legal requirements, individuals have the following rights:

  • Right of access — Article 15 GDPR
  • Right to rectification — Article 16 GDPR
  • Right to erasure — Article 17 GDPR
  • Right to restriction of processing — Article 18 GDPR
  • Right to data portability — Article 20 GDPR
  • Right to object — Article 21 GDPR
  • Right to withdraw consent at any time, without affecting the lawfulness of prior processing
  • Right to lodge a complaint with a supervisory authority

To exercise your rights, please contact:

info@easysadaqa.de

Where EasySadaqa acts solely as a data processor, requests may be forwarded to the responsible customer organization where appropriate.

34. Right to Object and Supervisory Authority

Where processing is based on Article 6(1)(f) GDPR, individuals may object to processing based on grounds relating to their particular situation.

Individuals may object at any time to processing for direct marketing purposes.

If you believe your personal data is being processed unlawfully, you may lodge a complaint with a competent data protection supervisory authority.

For North Rhine-Westphalia, Germany, the competent supervisory authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
Germany

Website: www.ldi.nrw.de

35. Data Security and Changes to This Privacy Policy

EasySadaqa implements appropriate technical and organizational security measures in accordance with Article 32 GDPR.

Depending on the service and risk assessment, these measures may include:

  • Access controls and permissions
  • Encryption
  • Role-based authorization
  • Security monitoring and logging
  • Backup and recovery procedures
  • Security updates and patch management
  • Multi-factor authentication
  • Availability and resilience measures
  • Periodic review of security controls

For security reasons, detailed internal protection measures are not publicly disclosed.

We may update this Privacy Policy when our services, technical integrations, processing activities or applicable legal requirements change.

The current version published through our services shall apply.

EasySadaqa
Privacy inquiries: info@easysadaqa.de
Website: https://easysadaqa.eu