Privacy policy

Controller: Association Islamique de Dudelange "IHSAN", 12, rue Jean Jaurès, L-3490 Dudelange, Luxembourg. Email: contact@ihsan.lu.

Donations and dues can be transferred to the association account of Association Islamique de Dudelange “IHSAN” (see the details on the donate page).

Contact form: name, email, optional phone, subject, message, language, consent.

Membership application: identity and contact details, address, membership and payment information, consents.

Mekteb enrolment: child and parent/guardian data, contact details, group/status where needed, consent.

Online donations and dues: payment-related data via Stripe (we do not store full card numbers). Bank transfers use the published account details.

Administration (/pro): staff access and audit log data (e.g. email, actions).

Technical: server/access logs (IP, time, resource) in the usual scope for security and operations.

Responding to enquiries and association communication (GDPR Art. 6(1)(b) or (f); (a) where consent applies).

Handling membership and mekteb applications and running association/education activities ((b), possibly (f); consent where required).

Where membership or mekteb enrolment reveals religious beliefs, or you voluntarily provide health-related information (e.g. in free-text fields), processing is based on your explicit consent (GDPR Art. 9(2)(a)) and on the legitimate activities of our religious association with its members and persons in regular contact with it (Art. 9(2)(d)).

Processing donations and dues, accounting and records ((b) and (c)).

Security, abuse prevention and technical operation of the site ((f)).

Hetzner Online GmbH (hosting / EU servers, including Finland).

Hostinger (domain / DNS services).

Email: domain mailbox (contact@ihsan.lu) via Hostinger SMTP, forwarded to association officers’ mailboxes (including Google Ireland Ltd. / Google LLC). Transactional site emails (e.g. contact or donation confirmations) are sent from contact@ihsan.lu. Where this involves transfers to the USA, they rely on the EU-US Data Privacy Framework (adequacy decision under GDPR Art. 45) and/or the European Commission’s Standard Contractual Clauses (Art. 46).

Stripe Payments Europe, Limited (online payments), under Stripe’s terms and privacy notices.

OpenStreetMap Foundation (OSMF), United Kingdom: the Contact page map loads only after you choose “Load map”. The UK benefits from an EU Commission adequacy decision (GDPR Art. 45).

Only authorised association staff access data for their tasks. We share with third parties only when needed (e.g. payment, email delivery), required by law, or with consent.

Contact requests: normally up to 24 months after the matter is closed, unless longer retention is needed.

Membership: for the membership period; accounting/evidence records often up to 10 years where legally required.

Mekteb: while the child is enrolled or linked to the programme, then normally up to 12 months — unless longer retention is organisationally or legally needed. Automatic deletion mid-school-year is not intended; on request by parents or guardians we erase the data under the GDPR (see “Your rights”), unless legal or evidence-related duties prevent shorter retention.

Payment and accounting data: per commercial/tax rules (often up to 10 years) and Stripe requirements.

Server logs: short retention, typically at most 90 days, unless security needs longer.

Admin audit logs: normally up to 2 years.

Under the GDPR you may in particular request access, rectification, erasure, restriction, portability and objection, and withdraw consent (without affecting prior lawful processing).

To exercise rights: contact@ihsan.lu. We may verify your identity proportionately. Parents or guardians may request access to or erasure of mekteb enrolment data on behalf of their child.

Complaint: Commission nationale pour la protection des données (CNPD), Luxembourg — https://cnpd.public.lu

Mekteb enrolments are submitted by parents or legal guardians. Data is used to organise classes and communicate with guardians.

Please only provide data needed for enrolment and care.

We only use children’s photos on the website if a parent/guardian explicitly consented at enrolment (optional field). Consent can be withdrawn at any time.

Please do not enter health data in free-text fields unless it is genuinely needed for care. Such data is processed only on the basis of your explicit consent.

We apply appropriate technical and organisational measures (restricted admin access, TLS encryption (HTTPS), limited permissions). No online service can guarantee absolute security.

We may update this policy when the service, technology or law changes. The version published here with its date applies.