Privacy policy.

This is an English translation of our privacy policy; in case of any discrepancy, the Polish version is binding.

1. Controller

The controller of the personal data collected through this website is Kościół Chrześcijański „RIVER” w Warszawie, ul. Włościańska 10B lok. 54, 01-710 Warszawa, NIP 5252508568, REGON 142924731. For any matter concerning personal data, write to kontakt@kosciolriver.pl.

2. Forms

The “First visit” and “Contact” forms are optional. You can also simply come on Sunday or send an email.

• The visit form collects your name, phone number or email address, the number of people and a note, if you add one.
• The contact form collects your name, email address, subject and message.
• We use this data only to reply to your message and to prepare for your visit. We do not sign you up for a newsletter and do not use the data for marketing.
• Legal basis: Art. 6(1)(f) GDPR, i.e. our legitimate interest: replying to your message.
• The message goes to the kontakt@kosciolriver.pl inbox. A copy stays on the website server so that it is not lost if email delivery fails.
• To limit the number of submissions from a single address, the server stores a hash of the IP address (not the address itself) and the time of submission.
• We keep the data for as long as needed to handle your matter. The server deletes the copy of a submission after 12 months.

3. Protecting the forms from spam

The forms are protected by Cloudflare Turnstile, a service of Cloudflare, Inc. It checks whether a form is being sent by a person rather than a program. Turnstile loads as soon as you open a page with a form (First visit and Contact, in both language versions of the website). Cloudflare then processes your IP address and information about your browser and device. Without this verification the form will not be sent. Legal basis: Art. 6(1)(f) GDPR, i.e. protecting the website from spam and abuse. Cloudflare may process data outside the European Economic Area under the rules of Chapter V GDPR. Details: Cloudflare privacy policy.

4. Video, photos and maps

• Videos on the home page and on sermon pages load only after you click. The player then connects to YouTube (Google) via the youtube-nocookie.com domain. Details: Google privacy policy.
• Event photos load from the server of Sanity, the system we use to manage the website content.
• Links to maps (Google Maps), payments (Stripe) and social media lead to external services. The website does not embed them, so data reaches them only after you click.

5. Server logs and cookies

The hosting server records the IP address, time, address of the page visited and browser type in its technical logs. Legal basis: Art. 6(1)(f) GDPR, i.e. the security and proper operation of the website. The website itself does not set cookies and does not use analytics or advertising tools. We serve fonts from our own server.

6. Who has access to the data

The data can be accessed by the people at River Church who reply to messages and by companies that provide services to us: website hosting, email and the services described in sections 3 and 4. We do not sell data or pass it on to other entities for marketing purposes.

7. Your rights

• the right to access your data and receive a copy of it,
• the right to rectify your data,
• the right to erasure of your data and to restriction of processing,
• the right to object to processing based on legitimate interest,
• the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

Providing data in the form is voluntary. Without a name and contact details, however, we will not be able to reply.

Last updated: October 31, 2026.