Privacy policy

This policy describes which personal data vakitpost (https://vakitpost.caradag.com) processes, for what purpose and for how long. The German version is binding.

1. Controller

CARadag, [PLATZHALTER: owner or authorised representatives], Elias-Holl-Str. 6, 86836 Obermeitingen, Germany, e-mail: [PLATZHALTER: contact address], phone: +49 151 41902513.

No data protection officer has been appointed because there is no legal obligation to do so. [PLATZHALTER: to be confirmed by the lawyer]

2. Roles

• We are the controller for your vakitpost account (login, security, operation).
• We are a processor for the content a mosque association ("association") creates and publishes with vakitpost: Instagram connection, logos, images, captions, schedules and posts. The association is the controller for this content; we conclude a data processing agreement with it (see "DPA").

3. Data we process

3.1 Visiting the website

When you visit the site, our hosting provider processes technically necessary data (IP address, time, requested address, browser identifier) in server logs to deliver the site and fend off attacks. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation). Retention: [PLATZHALTER: server log retention at ALL-INKL.COM].

3.2 Account

For an account (by invitation only) we store name, e-mail address, language, a hash of the password and the times of login and password change. For administrators additionally an encrypted secret for two-factor login and hashed recovery codes. When the terms of use and the DPA are accepted, we store the version, time, name and role of the accepting person.

Legal basis: Art. 6 (1) (b) GDPR (contract of use). The data is kept until the account is deleted.

When you set a password, we check whether it appears in known data breaches. We send only the first five characters of a SHA-1 hash of the password to the "Pwned Passwords" service (Have I Been Pwned). Neither the password nor your e-mail address leaves our server; you cannot be identified. Legal basis: Art. 6 (1) (f) GDPR (protection of your account).

3.3 Instagram connection (on behalf of the association)

When an association connects its Instagram account, Meta provides us with the Instagram user ID, username, account type and an access token. We store the token encrypted (AES-256-GCM). We use only the permissions instagram_business_basic (to display username and account type) and instagram_business_content_publish (to publish posts and stories that the association has scheduled or approved). We do not read messages, comments, followers or insights.

To publish, we send Meta the image URL, the caption and the account ID. Meta Platforms Ireland Ltd. processes this data under its own terms; data may be transferred to the USA (adequacy decision EU-US Data Privacy Framework).

3.4 Design, schedules and posts (on behalf of the association)

We store the association's name and city, selected prayer-time source, language, colours, logo, background images, uploaded images, captions, schedules and posts. Generated images are publicly accessible at an unguessable address because Instagram downloads them from there.

If uploaded images show people, the association is responsible for ensuring that publication is lawful.

3.5 E-mails

We send e-mails for invitations, passwords, post approval, account notices and operational alerts to administrators. The sending log stores only recipient, type and status, not the content.

3.6 Security and operational logs

We log security-relevant events (login, permission changes, release, deletion). IP addresses are stored there only as a non-reversible hash. We count failed login attempts to prevent password guessing. Legal basis: Art. 6 (1) (f) GDPR.

3.7 Prayer times

We obtain prayer times from public sources (including İmsakiyem, EzanVakti, the website and interface of the Turkish Presidency of Religious Affairs). These sources receive only location identifiers, no personal data.

4. Cookies

We set only technically necessary cookies: a session cookie (__Host-vakitpost_session, encrypted), a cookie protecting against forged forms (XSRF-TOKEN) and, on request, a "remember me" cookie (30 days). No consent is required for these (§ 25 (2) no. 2 TDDDG). We use no analytics, advertising or tracking services and load no fonts or scripts from third-party servers.

5. Recipients

6. Retention

Posts already published on Instagram are stored by Instagram; the association deletes them there.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Write to the address above. How to delete your data yourself is described under "Data deletion".

If your request concerns an association's content, we forward it to the association and support it in answering.

You may lodge a complaint with a data protection supervisory authority, for example the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

8. Security

All connections are encrypted (TLS). Access tokens and backups are additionally encrypted; administrators log in with a second factor. Details are listed in the annex to the DPA.

9. Changes

We update this policy when the service changes. The version published here applies.

Tarih: 2026-10-23 · Sürüm 1

Bağlayıcı olan Almanca metindir.