Privacy policy · Khadija Center

Note! This policy must be reviewed and approved by the data controller before it is published. Remaining points are noted in the internal working material.

Data controller

Khadija Center, org. no. 802517-5491, Kista Torg 7, 164 42 Kista, is the data controller for the processing of your personal data. The association is represented by its chairperson.

Contact for data protection matters: info@khadijacenter.se,076-407 52 54.

What this policy covers

Khadija Center processes personal data in four contexts on this website: when you register as a regular visitor, when you become a member, when you apply to volunteer, and when you send a message via the contact form. Each context is described separately below.

Information about religious belief

Khadija Center is a mosque. The fact that you register as a visitor, become a member, or apply to volunteer with us can in itself reveal something about your religious belief. Such information is sensitive personal data under Article 9 of the GDPR and is subject to stronger protection.

We process it under the exemption for religious organisations in Article 9(2)(d), which permits processing in the course of our legitimate activities and relating to our members, former members and persons who have regular contact with us.

The exemption applies as long as the data stays within the association. Disclosing it requires your explicit consent. We do this in one context: the visitor register is shared with the faith community we are affiliated with, and with the community's auditor, as material for the application for state grants. This is described under Registration as a regular visitor and under Who receives the information. Membership details, volunteer applications and messages are not shared.

Children and young people

Under Section 4 of the Act on Faith Communities (1998:1593), a child who has turned 12 cannot join or leave a faith community without their own consent. We apply the same principle to registrations on this website: a child who has turned 12 must consent themselves to being registered as a visitor or becoming a member.

Anyone who fills in a form on behalf of someone else — for example, a guardian registering their child — is responsible for ensuring that the person being registered has consented to the registration, and for a child aged 12 or older, that the child has consented themselves.

When a child under 13 is registered as a regular visitor, the registration is not activated immediately. We ask for a guardian's email address and check whether it matches a person already registered as an adult visitor with us. If there is a match, we send a confirmation email only to the address already on file — never to an address typed freely into the form — and the guardian confirms by entering their name and date of birth and explicitly declaring that they are the child's guardian. This is a self-declaration: Khadija Center checks that the details match our records, but does not verify legal guardianship. If no matching adult is found, or the details do not match, the registration is reviewed manually by Khadija Center before the child is activated. Unconfirmed registrations are removed automatically after seven days.

Registration as a regular visitor

Information we collect:

Full name, street address, postal code, city, date of birth and phone number (required).
Email address and the last four digits of your personal identity number (optional).

Purpose:

To know who our regular visitors are and be able to stay in touch about our activities.
To form the basis for the application for state grants to faith communities. The application is made by the faith community Khadija Center is affiliated with, and since 1 January 2025 personal data about the individuals the application is based on is required. We therefore share the visitor register with the faith community and with its auditor, who reviews the material and issues the certificate that accompanies the application. The authority that decides on the grant receives the application and the certificate — not our register. By registering you confirm that you have visited Khadija Center at least three times during the past year.
To keep the register up to date by checking it against the State Personal Address Register (SPAR), so that deceased and emigrated individuals can be removed. This check is done at most once a month and at least once a year.

Legal basis:

Your consent, which you give when you submit the registration. For information relating to religious belief, the exemption in Article 9(2)(d) also applies.
Your explicit consent to share your information with the faith community and its auditor ahead of the grant application, and with SPAR when checking the register. You can withdraw this at any time. If you withdraw it, you are not included in the material for the grant, and you remain a registered visitor for as long as you wish.

Membership

Information we collect:

Full name, date of birth and email address (required).
Phone number and the last four digits of your personal identity number (optional).
Chosen monthly amount, payment status and identifiers from our payment service provider.

Purpose:

To administer your membership and receive your membership fee.
To record payments for accounting purposes.
To be able to distinguish you from another member with the same name, so that fees, receipts and changes are applied to the right person. This is why we also ask for the last four digits here — they are not used for the grant application and are not shared with the faith community.

Legal basis:

Performance of the membership agreement for administering the membership and fee.
Legal obligation for accounting of payments.

The membership register is not shared with the faith community, the auditor, or any authority. If you are both a member and a registered visitor, only the visitor registration is included in the material for the state grant.

Your personal identity number

The field for the last four digits appears on both the registration page and the membership page, and is optional on both. If you provide them, together with your date of birth we have your full personal identity number.

As a registered visitor we process it so we can reliably identify you during the check against SPAR and when the community's auditor reviews the visitor material ahead of the grant application. As a member we process it only internally, so as not to confuse you with another member with the same name. Membership details are not shared with the faith community or the auditor.

Under Swedish law, a personal identity number may be processed without consent only when it is clearly justified with regard to the purpose, the importance of secure identification, or some other significant reason. We consider that requirement to be met, but we still ask for the information on a voluntary basis and process it on the basis of your consent.

If you choose not to provide the digits, you can still register and become a member. We then rely on name, address and date of birth instead, which works but produces more uncertain matches.

We are currently testing two ways of asking for this information on the registration page, to see which one leads to more people completing the registration. Which variant you see is randomised on each page load — not linked to you or stored between visits — and we only count how many people saw each variant and how many completed the registration. No cookie is set for this.

Volunteer application

Information we collect: name and phone number (required), email address and the skills and free text you choose to provide (optional).

Purpose: to be able to contact you when we need volunteers and to match needs against your skills.

Legal basis: your consent.

Contact form

Information we collect: name (required), email address, phone number, subject and the content of your message.

Purpose: to answer your question and, if needed, follow up on the matter.

Legal basis: your consent. Please avoid writing sensitive information about your health or other people in the message.

Technical log to protect the forms

To stop mass submissions and repeated login attempts, we store a one-way computation of your IP address when a form is submitted. The computation cannot be reversed back to the address, and we never store the IP address in plain text. The legal basis is our legitimate interest in protecting the website from misuse.

Who receives the information

Within the association, only trusted staff have access to the information. Outside the association:

Hostinger — the web host that runs the website and database on our behalf, as data processor.
Stripe — payment service for membership fees. Stripe receives your name and email address and handles the payment itself. Your card details are given directly to Stripe and never pass through our systems.
Affiliated faith community — the faith community Khadija Center is affiliated with. Receives the visitor register as material for its application for state grants and is itself the data controller for how the information is processed there.
The community's auditor — reviews the visitor material and issues the certificate that accompanies the application. The auditor is bound by confidentiality and is itself the data controller for the review.
The State Personal Address Register (SPAR) — for checking the visitor register, so that deceased and emigrated individuals can be removed. SPAR is administered by the Swedish Tax Agency.
The authority for support to faith communities — decides on the state grant and receives the community's application together with the auditor's certificate. Our registers are not shared with the authority.

Disclosure to the faith community and the auditor applies only to the visitor register. Membership details, volunteer applications and messages via the contact form are not shared with anyone outside the association, other than the web host that runs the system for us and the payment service that receives the membership fee.

We never sell your information and do not share it with anyone else for marketing purposes.

Transfers outside the EU and EEA

Stripe is an international group and may process data outside the EU and EEA. Such transfers take place under Stripe's contractual terms, based on the European Commission's standard contractual clauses. All other processing takes place within the EU and EEA.

How long we retain the information

Visitor registration: 5 years after your most recent contact with us.
Volunteer application: 5 years after your most recent contact with us.
Membership details: for as long as the membership runs, and 5 years thereafter.
Accounting records for payments: 7 years, under the Swedish Bookkeeping Act. We cannot shorten this period even at your request.
Messages via the contact form: until the matter is closed, then for at most 5 years.
Technical log: the computed IP address is stored for one hour and then deleted. The corresponding log of failed login attempts in the admin panel is deleted after 24 hours.

You can request that your information be deleted earlier than this at any time.

Security

The information is stored in a database accessible only to authorised staff. The website uses encryption during transfer, the admin interface requires a password and locks out after repeated failed attempts, and IP addresses are never stored in plain text.

Your rights

Find out what information we hold about you and request a copy.
Have incorrect information corrected.
Have your information deleted.
Withdraw consent you have given, without affecting the processing carried out before that.
Object to or request restriction of the processing.
Receive the information you provided in a machine-readable format and transfer it to someone else.

Complaints

If you believe we are processing your information incorrectly, you can contact the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), the supervisory authority.

Cookies and external services

The website does not use any of its own cookies for tracking, statistics or marketing.

On the Find us page, a map from Google Maps is shown. When the map loads, Google may set cookies and process information, including your IP address, under its own terms. If you want to avoid this, you can choose not to visit that page or block third-party cookies in your browser.

When you type your street address into the registration form, our server sends the text to Geoapify to suggest addresses as you type. This never happens directly from your browser and sets no cookies — only the search text, not your name or other information, reaches Geoapify. If it doesn't work, you can type the address as plain text instead.

Changes

We may update this policy. The current version is shown at the top of the page. For significant changes that affect you, we will notify you specifically if we have your contact details.