Privacy Policy
Katolika processes data about people's religious lives. Such data is sensitive in law. This document explains what is collected, why, for how long, and what rights you can exercise.
1. Who processes your data
This depends on the type of data.
PRESTIGGIO SARLU, LOT AMP 516 Ambatolampy-Tsimahafotsy, Ambohidratrimo, 105 Antananarivo, Madagascar, is the controller for data it collects on its own behalf: user accounts, connection logs, audience measurement, billing.
Each parish, deanery or diocese using the Platform is the controller for the data it places in its space: sacramental registers, member directories, published content. Prestiggio acts only as a processor in that respect.
In practice: for a question about your baptismal record, contact the parish concerned. For a question about your account, contact Prestiggio.
2. Legal framework
Le traitement est soumis a la **loi malagasy n° 2014-038 du 9 janvier 2015** sur la protection des donnees a caractere personnel, dont l'article 6 vise les traitements dont le responsable est etabli sur le territoire malagasy. L'autorite de controle est la **Commission Malagasy de l'Informatique et des Libertes (CMIL)**, dont les attributions ont ete precisees par le decret n° 2023-1541 du 6 decembre 2023. Les serveurs etant situes dans l'Union europeenne et certaines personnes concernees pouvant y resider, le **Reglement general sur la protection des donnees (UE) 2016/679** peut egalement trouver a s'appliquer. Les garanties decrites ci-apres sont alignees sur le plus exigeant des deux regimes.3. Data processed
3.1 Account data
Surname, first name, email address, hashed password, profile photograph where applicable, associated parish, assigned role, display language.
Where you authenticate through Google, Facebook or LinkedIn: the provider's identifier, plus the name, email address and photograph it transmits. No password from those services is received or stored.
3.2 Sacramental register data
Surname and first names, date and place of birth, date and place of celebration, parentage, godparents, the minister of the sacrament, later marginal entries (confirmation, marriage, ordination, death), record number and register references.
This data reveals religious affiliation. It constitutes sensitive data under l'article 9 du RGPD et des dispositions correspondantes de la loi n° 2014-038, which in principle prohibits processing data revealing religious beliefs outside statutory exceptions.
Processing rests on the following grounds: it is carried out by a body with a religious aim, in the course of its legitimate activities, with appropriate safeguards, and relates solely to its members or to persons in regular contact with it; the data is not disclosed to outside third parties without the data subjects' consent. It also meets the canonical obligation to keep parish registers (canons 535 and 877 of the Code of Canon Law).
3.3 Operational data
IP address, timestamps, pages visited, browser and device type, error and security logs.
3.4 Uploaded content
Photographs, sound recordings, scanned documents, announcement texts, minutes of meetings and celebrations.
Images and recordings featuring identifiable people are published only with their agreement, obtained by the user entity.
4. Purposes and grounds
| Purpose | Ground |
|---|---|
| Creating and managing accounts | Performance of a contract |
| Keeping sacramental registers | Legitimate activity of a religious body; canonical obligation |
| Issuing record extracts | Legitimate activity; request from the data subject |
| Publishing news and announcements | Legitimate interest of the community |
| Producing pastoral reports | Legitimate interest; aggregated data where possible |
| Preserving and presenting archives | Archival and historical purposes (art. 14, loi n° 2014-038) |
| Securing the service | Legitimate interest; legal obligation |
| Billing subscriptions | Performance of a contract; accounting obligation |
No data is used for advertising. No data is sold, rented or transferred to third parties.
5. Recipients
Within a user entity, access is limited by the roles its administrator defines. Registers are accessible only to persons the parish has authorised.
Entity spaces are partitioned. One parish cannot access another's data.
Technical providers acting on the publisher's behalf are:
- CONTABO GmbH (Allemagne) — server hosting;
- Google, Meta, LinkedIn — only if you choose delegated authentication, and solely to verify your identity;
Data may be disclosed to the competent ecclesiastical authority (diocese) where canon law so provides, and to judicial authorities on a valid legal request.
6. Transfers outside Madagascar
Les donnees sont hebergees en Allemagne, Etat membre de l'Union europeenne. Ce transfert est encadre par la loi n° 2014-038, qui l'autorise notamment lorsque le pays destinataire assure un niveau de protection adequat. L'Union europeenne offre un cadre de protection au moins equivalent a celui prevu par le droit malagasy.7. Retention periods
| Data | Period |
|---|---|
| User account | Duration of activity, then 12 months |
| Connection logs | 12 months |
| Sacramental registers | Retained permanently |
| Published content | Until withdrawn by the user entity |
| Accounting records | 10 years |
| Backups | Rolling 90 days |
Permanent retention of registers needs explaining. A baptismal record is an ecclesiastical civil-status record whose evidential value has no expiry: it is required throughout a person's life for admission to other sacraments, and after death it retains archival, genealogical and historical value. Canon law requires it to be kept in perpetuity. L'article 14 de la loi n° 2014-038 admet expressement la conservation a des fins de gestion des archives ou a des fins historiques, statistiques ou scientifiques, sous reserve de garanties appropriees.
The right to erasure does not extend to these registers. A person may instead request a marginal entry, notably in the case of a formal act of defection from the Catholic Church: the record is not deleted, and the entry is noted in the margin.
8. Deceased persons
A substantial share of the digitised records concerns people who have died, some of them decades ago. la loi n° 2014-038 and the GDPR protect living natural persons; they do not apply to the deceased.
These records are nonetheless handled carefully, because they reveal information about living people — parentage, kinship, family religious affiliation. Public dissemination of recent records is restricted, and a closure period applies before any wider release for genealogical purposes.
The heirs of a deceased person may request correction of manifestly erroneous information concerning them.
9. Minors
The registers contain data about minors, since baptism is usually conferred in early childhood. This data is collected from parents or the holder of parental authority at the time of the celebration.
Records concerning minors, or persons who have recently reached majority, are not made publicly viewable. Access is limited to persons authorised by the parish and to the data subject or their legal representatives.
Account registration is subject to the age conditions set out in the Terms of Service.
10. Security
The following measures are in place: encrypted communications (TLS), passwords hashed with a one-way derivation function, logical partitioning of spaces, role- and policy-based access control, logging of register access, regular encrypted backups, restricted and monitored administrator access, network filtering and intrusion detection.
In the event of a data breach likely to create a risk to individuals, the publisher informs la CMIL and the user entities concerned as soon as possible, and the data subjects where the risk is high.
11. Your rights
You have rights of access, rectification, objection, restriction, erasure within the limits set out in section 7, and portability for data you have provided.
For account data: admin@katolika.net. For register data: contact the parish concerned, whose details appear on its space.
A response is provided within thirty days at most. Proof of identity may be requested where there is reasonable doubt as to who is making the request.
You may lodge a complaint with la **Commission Malagasy de l'Informatique et des Libertes (CMIL)**.
12. Cookies
The Platform sets only the cookies strictly necessary for it to work: authentication session, identification of the parish space being viewed, language preference, and cross-site request forgery protection.
La Plateforme utilise **Matomo**, un outil de mesure d'audience installé sur notre propre infrastructure. Aucune donnée n'est transmise à un tiers. Matomo est configuré selon les conditions d'exemption de consentement définies par la délibération n° 2020-091 de la Commission nationale de l'informatique et des libertés : adresse IP tronquée avant enregistrement, absence d'identifiant utilisateur, absence de suivi entre sites, désactivation des journaux de visite, des profils de visiteurs et des enregistrements de session, conservation des données brutes limitée à vingt-cinq mois. La mesure produit des statistiques agrégées — pages consultées, provenance, type de terminal, pays — et ne permet pas de vous identifier. Cette configuration nous dispense de recueillir votre consentement préalable. Vous pouvez néanmoins vous y opposer à tout moment, ou en activant le signal « Do Not Track » de votre navigateur, que nous respectons. La délibération citée relève du droit français et ne s'impose pas à nous. Nous en appliquons volontairement les exigences, celles-ci constituant le référentiel le plus protecteur disponible en la matière.13. Changes
This policy may change. Substantial changes are notified to account holders at least thirty days before they take effect. Each version is dated and numbered.
14. Contact
Any question about this policy: admin@katolika.net.
Delegue a la protection des donnees : Landry Rakotoarivelo, direction@prestigg.io.Version 1.0 — in force since 2026-09-01. This is a translation; the French version prevails.