Version 2026-10-10.3 · English original
For the website, the Fier-Worship customer account, contracting, billing and direct support, the controller is:
Fier-Worship
Alaimo Aleandro
Grabenstrasse 6
45888 Gelsenkirchen, Germany
Phone: +49 (0) 151 15468060
Email: support@fier-app.de
If a data protection officer is appointed, the current contact details will be published here.
Fier-Worship is an organizational service for churches and worship teams. For team, member and content data that a customer enters into the Service, the customer is normally the controller and Fier-Worship is its processor under the Data Processing Agreement (DPA). The customer, not Fier-Worship, must give team members and other data subjects the required information and establish a lawful basis.
Fier-Worship is independently responsible for its own prospective-customer, account-holder, contract, payment, support, security and website data. This notice covers both situations and identifies the relevant role.
We process IP address, date/time, requested page, browser and operating-system information to deliver the service, prevent abuse and investigate faults. The basis is Art. 6(1)(f) GDPR (security and reliable operation). Application session and device records are removed after 30 days of inactivity. Infrastructure logs are restricted to the period necessary for security and fault investigation.
We process contact details, organization details, selected plan and duration, plan dates and status, member and song counts used for entitlement enforcement, invoices and payment-status information to create and administer the contract, provide support and meet legal obligations. Bases are Art. 6(1)(b) and (c) GDPR. Invoices are retained for the applicable statutory period, ordinarily eight years from the end of the year of issue under German law. Technical payment idempotency markers are normally retained for up to eight years to prevent duplicate entitlement application, payment replay and unresolved-payment fraud; they are not accounting records and may be removed earlier with account closure where no longer required. Other account data are deleted or anonymised when no longer needed, subject to the retention rules below.
Support messages send the name, email address, subject and message to our support mailbox. We use them to answer the request (Art. 6(1)(b) or (f) GDPR). Please do not send special-category data through support unless necessary. Correspondence is erased when no longer needed.
For payments we use PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal processes payment information under its own privacy terms for the payment transaction. The basis is Art. 6(1)(b) GDPR.
Leader sign-in is protected by an authenticator app (TOTP). We do not send login codes by email and we do not send marketing emails.
When a leader registers a new church, the acceptance of the Terms and the DPA and the acknowledgement of this notice are recorded with the document version, the date and time and the requesting IP address. The basis is Art. 6(1)(b) and (c) GDPR (contractual evidence and legal obligations); the record is kept for the duration of the account plus the applicable statutory retention period.
Depending on the features selected by the customer, this can include names and contact details of leaders and team members, roles, instruments and assignments, events and availability, songs, setlists and lyrics, chat messages, notifications, share links, and account/device security data.
Information about religious belief or activity may constitute special-category data under Art. 9 GDPR. The customer must only collect data that are necessary and must identify its Art. 6 GDPR basis and, where applicable, an Art. 9 GDPR condition, and must inform the people concerned.
Fier-Worship processes such data only on the customer’s documented instructions and as described in the DPA. Access is role-based and scoped to the customer’s organization. Data are transmitted with TLS. TOTP secrets and other sensitive application fields are encrypted at rest and session tokens are stored only as hashes; member device keys are generated and kept in the member’s browser and only their public part reaches the server.
Push notifications: if a user opts in through the browser, the application stores the push subscription and sends notifications through the browser/vendor push service. Permission can be withdrawn in browser settings. The subscription is deleted immediately when permission is withdrawn or delivery is permanently invalid, and otherwise after 90 days without renewal.
The application, database and file storage run on Cloudflare’s global network (Cloudflare, Inc. / relevant group entities). Providers receive technical data only as needed to provide their services. Cloudflare’s network is global: where a recipient is outside the EEA or may access data from there, the applicable GDPR transfer mechanism (EU Standard Contractual Clauses) and supplementary measures are in place before the transfer. Application data are encrypted in transit (TLS) and sensitive fields are encrypted at rest regardless of processing location. A current list of processors/sub-processors for customer-controlled data is in the DPA; questions may be sent to support.
We do not sell personal data and do not use advertising analytics or behavioural marketing trackers.
Fier-Worship uses only storage needed for operation and security: the authentication/session cookie, a member device key stored in the browser (non-extractable), language/interface choices, the last sign-in email prefill, the cookie-notice record and offline application caches. The legal basis for strictly necessary access/storage is § 25(2) TDDDG and Art. 6(1)(b) or (f) GDPR. They can be removed through browser settings; doing so can require a new sign-in or device authorisation. Any non-essential technology requires a separate choice before it is used.
Customer-controlled operational data that remain necessary for an active customer relationship are processed on the Controller’s documented instructions and deleted when that relationship ends, unless a stated period or legal obligation applies. The active application applies these default technical periods: sessions after 30 days of inactivity; abandoned temporary import files and orphaned storage objects are removed automatically; notifications and push subscriptions after 90 days; stale share links after 30 days; stale stage screens after 30 days. Chat messages are retained according to the retention setting configured by the customer; by default until an administrator deletes them. When an account is deleted, the related operational data are removed, except for legally required retention, a documented legal hold and documented backup cycles.
Account and billing data are retained for the applicable statutory periods described above. Backups and external provider systems may remain until their documented rolling cycle expires.
Where Fier-Worship is controller, you may request access, rectification, erasure, restriction, portability and object to processing based on Art. 6(1)(e) or (f) GDPR. You may withdraw consent at any time where consent is the basis; this does not affect prior processing. Contact us at the address above. You may complain to the competent supervisory authority, in particular the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.
For team/member data for which your church or organization is controller, exercise these rights first with that controller. Fier-Worship will assist the controller under the DPA.
Accepting the Terms and DPA, and acknowledging this notice, records the date, time and document version. This is contractual evidence and an information acknowledgement; it is not presented as a blanket GDPR consent. The English text is the contractual original. The customer remains responsible for providing member-facing information in a language members can understand and for any mandatory local-language documents.
Leader accounts require the person to be at least 16 years old; the Service is not directed at children. Member data of minors may only be entered where the customer has a valid legal basis and, where required, parental consent. The customer, not Fier-Worship, is responsible for that basis.
New versions of this notice are recorded with a version string. Where a new version requires acknowledgement, it will be requested explicitly, with each document confirmed separately.