1. Purpose and scope
Uniteo makes it easier to discover churches, gatherings and Christian content. Some features may concern your personal life and reveal religious beliefs or activities. This information calls for particular protection.
This policy explains the processing carried out by SafeSpace Media for the uniteo.org website and for the official spaces or applications that refer to it. The features available depend on the space and their activation. A feature described as future is not considered active merely because it appears in this policy.
Information specific to a feature may be presented when it is used. New processing that requires information or consent must be explained before it is implemented. External services opened from Uniteo apply their own rules.
The Swiss FADP applies to processing within its scope. The GDPR applies where its conditions are met. We distinguish between these frameworks and the rights they confer; a general statement of compliance is no substitute for implementing them.
2. Controller and contact
For processing whose purposes and means it determines, the controller is the SafeSpace Media association, Rue de la Gare 14, 2830 Courrendlin, Switzerland, UID CHE-230.366.234. Any request concerning your data may be sent to info@uniteo.org, marked “Data protection”.
A church may be the controller for processing it decides on itself, for example to manage its teams, activities or registrations. When Uniteo acts solely on its instructions, an agreement must specify the processing and responsibilities. Joint controllership is examined if decisions are actually made together. The classification follows from how things actually operate, not solely from the name of the contract.
3. Browsing and security data
Accessing the service involves processing technical information: IP address, date and time of requests, resource requested, browser or application information, errors and events necessary for security. This information enables pages to be delivered, access to be maintained, incidents to be diagnosed and abuse to be limited.
The public presentation website does not store question text or raw IP addresses in its quota counter. This counter uses an identifier derived from the IP address through a cryptographic mechanism and request metadata. This identifier is pseudonymised; it must not be described as anonymous. Other technical layers may produce logs necessary for their operation and security.
4. Account, personal space and contact details
Where account creation is available, the data needed may include your name or display name, email address, authentication details, language, country and privacy choices. Mandatory fields are distinguished from optional fields.
Depending on the features used, the personal space may contain favourites, churches followed, notes, listening progress, registrations, notification preferences and conversations with Barnabé. An account is not inherently a public profile.
A saved personal address is optional and private. It must not be disclosed to a church merely because you follow it. Searching by locality also lets you search for a place without sharing your precise location.
Where a device location feature is offered, you choose whether to grant permission and can change it in the device settings. This permission does not constitute agreement to all other uses of location. The technical recipients involved in a new map integration must be disclosed before the relevant processing.
5. Purposes and grounds for processing
Necessary data is used to provide the features requested, create and secure accounts, synchronise selected items, process registrations, prepare and distribute authorised publications, generate Barnabé's responses, answer requests, manage contracts and invoices, prevent abuse and comply with legal obligations.
Under Swiss law, processing must, in particular, respect the stated purpose, proportionality, transparency, accuracy and security. Where consent is necessary, it must be freely given, informed and sufficiently specific; it must be express for sensitive processing where required by law.
Where the GDPR applies, the grounds are determined for each purpose: performance of the contract or requested pre-contractual steps for features necessary to the service; legal obligation for the relevant records; an assessed legitimate interest for protecting access, preventing abuse and defending rights; consent for optional processing that requires it. A balancing assessment must take account of people's expectations and vulnerability, particularly those of minors.
Data revealing religious beliefs or other special categories also requires a condition under Article 9 of the GDPR. Explicit, specific consent is used where it is the condition relied upon. SafeSpace Media's status as an association does not amount to a general exemption.
Refusing data that is genuinely necessary may prevent the corresponding feature from being used. Optional processing with no necessary connection to that feature must not be imposed in exchange for access to it.
6. Faith, sensitive data and freedom of choice
An isolated visit does not prove a belief. However, follows, notes, registrations and exchanges may reveal religious activities, a health condition or intimate information. We limit their use to the stated purposes.
Following a church does not mean joining that community, a denomination or SafeSpace Media. It does not allow the church to obtain automatically a list of its followers by name, your contact details, your notes or your conversations.
SafeSpace Media neither sells nor rents your personal notes, private conversations or information revealing your faith. This information is not used to target advertising based on your beliefs or vulnerability.
Reading this policy or accepting the terms of use does not constitute blanket consent to all processing. Specific choices are presented separately where necessary. Withdrawal of consent applies to the future; it does not render earlier lawful processing unlawful. The feature that actually depends on that consent may become unavailable.
7. Barnabé and AI services
Barnabé is a computer assistant using artificial intelligence, restricted to people aged 18 and over. Its responses are generated using the services of Infomaniak Network SA in Switzerland, as part of Uniteo's integration.
A request may send your message, operating instructions and relevant context to the AI service. Depending on the space and your permissions, this context may include previous exchanges, public content or a selected document. Access to private notes and saved location is not authorised merely by opening Barnabé; the corresponding features require a separate choice when offered.
Data sent must be limited to what the feature needs. Do not include another person's name or details if a general question is sufficient. Do not entrust the service with secrets or documents that you have no right to send to it.
The terms of Infomaniak's AI API provide for temporary processing of content necessary to fulfil requests and exclude the use of prompts and responses to train its AI systems. They distinguish content from the operational and billing metadata necessary for the service.
These rules do not mean that nothing is retained within Uniteo. A conversation in a signed-in space may be saved so that it can be retrieved. The public presentation website's visitor journey does not, by itself, create a history in an account; its exchanges remain separate from the quota counter and technical logs. Personal memory, where offered, must be identifiable, editable and deletable in accordance with the features and rights available.
SafeSpace Media does not use private conversations, notes or memory items to train general-purpose AI models. Technical access necessary for the service does not permit their reuse for a purpose unrelated to the one stated.
Requests concerning this data should be sent to info@uniteo.org. We coordinate the necessary steps with the provider. A change affecting recipients, countries or purposes requires appropriate prior information and fresh consent where required.
8. Age and protection of young users
Browsing public pages is not subject to a general minimum age of 18. Accounts for minors, where offered, must comply with the rules on capacity, information and consent applicable to the feature and country concerned. Parental permission is obtained where necessary; it does not replace the personal rights of a young person capable of judgement.
Barnabé remains restricted to people aged 18 and over. Access control concerns age; a date indicating an age below 18 results in refusal of access. Missing or invalid information, or information that does not establish adulthood, does not permit the feature to be opened. This rule also applies to access without an account. Parental agreement does not create an exception for Barnabé.
The self-declaration check offered in the visitor journey is not documentary verification of identity or age. Age information must remain private, be limited to this purpose and not be sent to the AI provider. The date entered is removed from the form after the check and is not recorded by the service. Measures must remain proportionate to the risk and allow errors to be corrected.
Accounts and features intended for minors require accessible information and appropriate settings. Conditions for consent to online services may vary by country where the GDPR applies. Optional collection of sensitive data cannot be approved through simple general acceptance of the terms.
Images, voices and information about minors in a publication are a separate matter: their interests, rights and the necessary permissions must be respected. Their representatives do not automatically obtain unlimited access to their personal data.
9. Visibility, teams and organisers
Content deliberately published in a public space may be viewed, indexed and reused within legal limits. Check contact details, images and voices before publication.
Personal notes and conversations are not public. Authorised people or providers may access them where strictly necessary for an authorised intervention, security, requested support or a legal obligation. “Private” means restricted access; it is not a guarantee of pastoral professional secrecy or end-to-end encryption.
Professional access rights depend on the roles assigned. Organisations must remove access that is no longer necessary. Registering for a gathering is distinct from following a church: the data sent to the organiser must be disclosed before confirmation.
10. Providers and disclosure of data
Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Genève, Switzerland, hosts the website, databases, files and backups. Its AI services are used to generate responses and perform requested processing in enabled features. The categories concerned correspond to the services entrusted to it: operational data, account data and hosted content; messages and context necessary for AI.
Hostpoint AG, also referred to as Hostpoint SA, Neue Jonastrasse 60, 8640 Rapperswil-Jona, Switzerland, hosts SafeSpace Media's mailboxes used for Uniteo. Messages, attachments and metadata necessary for email may be concerned. Storage of these mailboxes is stated to be in Switzerland.
Providers acting on our instructions must be bound by appropriate obligations concerning confidentiality, security, assistance, sub-processing and the end of processing. The applicable terms and agreements are separate from their policies concerning their own visitors and customers.
Swiss hosting does not mean that every external data flow remains in Switzerland. Correspondents' email providers, services opened at your request and resources loaded from other domains may process data elsewhere. A new integration involving other recipients or countries must be described before it is used.
Where a transfer under our responsibility is to a country without recognised adequate protection, a safeguard or legally permissible exception is necessary, together with consideration of any useful supplementary measures. The countries concerned and the safeguard relied upon must be disclosed for the transfer in question. A “worldwide” clause does not replace this assessment. You may request information about safeguards, subject to legitimately confidential information.
Data may be disclosed to an authority, an adviser or another recipient where required by a legal obligation or where justified necessity to assert or defend rights permits it. Only necessary items are concerned.
11. Correspondence, newsletters and communications
Your messages and attachments are used to answer the request, follow it up and manage the resulting obligations. Access to mailboxes is limited to people authorised for their duties. Hosting a mailbox does not constitute general permission to analyse all correspondence using AI: any such assistance must be governed by a stated purpose and an appropriate justification.
Account verification, security alerts and contractual information are distinguished from promotional messages. An optional newsletter is based on the stated choice or a situation expressly permitted by applicable law; a simple, free means of unsubscribing must be provided.
Creating an account, following a church or accepting the terms does not automatically subscribe you to Uniteo's or churches' newsletters. Minimal information recording an objection may be retained to respect your choice and avoid unintended resubscription.
12. Cookies, local storage and external services
Necessary technologies may be used to secure access and remember a choice. The public presentation website saves the language preference in the browser's local storage under the name uniteo-public-language; it remains until replaced or deleted by the browser. Local data can be deleted in the device or browser settings.
When you first send a message to Barnabé, if no valid age status is stored, the visitor journey checks the declared date of birth to determine whether you are at least 18. Uniteo neither retains this date nor sends it to the AI provider. A signed cookie named uniteo_barnabe_age stores only the declared status “adult” or “minor”, the version of the check and the creation and expiry times, for a maximum of 30 days. It contains neither a date of birth nor conversation text. This declaration-based check does not verify your identity or your age against documents. A minor status results in refusal of access to Barnabé; missing or invalid information does not allow access.
Remembering your age status is separate from your agreement to the processing of messages. Access to Barnabé requires a valid adult status and your explicit agreement. A second signed cookie, uniteo_barnabe_access, then enables access for a maximum of 30 minutes. It contains confirmation of adulthood, the version of the agreement and technical session data, without a date of birth or conversation text. When it expires, fresh agreement is requested; a valid age status can be reused without entering your date of birth again. Renewing your agreement does not extend the lifetime of the age cookie.
Both cookies are restricted to the service, protected from being read by scripts (HttpOnly), transmitted only over a secure connection (Secure) and restricted to same-site requests (SameSite=Strict). They are used neither for advertising nor for tracking across websites or services.
You can withdraw your agreement at any time: access is closed and the uniteo_barnabe_access cookie is deleted, without deleting the stored age status. You can also correct your age declaration or choose to forget it; choosing to forget it deletes both cookies. You can also delete them in your browser settings. A new age declaration is required after the age cookie is deleted or expires.
Some versions may store favourites locally. Their presence on the device does not result in automatic synchronisation: import into an account, where offered, is subject to a separate choice.
The public presentation website does not require consent to an advertising tool in order to be viewed. Any optional measurement tool, identifier or external content requiring consent must be explained and disabled until that choice is granted. Necessary security logs are distinguished from optional audience measurement.
An image or resource loaded from another domain may disclose technical data to its provider as soon as it is displayed. A link to Spotify, Apple, YouTube or a church website leads to another service when opened. New integrations are assessed and information about them must be accessible before processing that requires a choice.
13. Sources of directory information
Professional information may be provided by a church or obtained from public sources to present a location and verify a listing. Information relating to a person remains personal data even when it is public.
We take account of the source, accuracy and requests for correction. Information required when data is collected indirectly is provided under the applicable conditions and within the applicable time limits. The presence of an address on the Internet does not constitute general permission for electronic marketing.
14. Retention and deletion
Data is retained for the period necessary for the stated purpose, then deleted or rendered effectively anonymous, subject to legally justified retention. The following criteria apply according to its nature.
- Account, favourites, notes and progress: while the space is made available and for as long as these items are necessary for the chosen feature; their deletion or closure of the account triggers a review of the data to be erased and any exceptions.
- Personal conversations and memory: to allow their use in the space concerned, until the requested deletion or the end of the space, subject to items specifically necessary for an obligation or dispute. They are not retained as a training database for general-purpose models.
- Requests and correspondence: during resolution and useful follow-up of the request; afterwards, only items necessary for a contract, an obligation or a dispute are retained for that reason.
- Technical and security logs: for diagnosing, preventing and handling incidents. Front-end server logs currently follow a daily rotation of 14 archives, or approximately two weeks; other logs and backups may follow separate cycles depending on their function. Longer retention of items relating to an incident must be justified and limited.
- Public presentation website quota counter: a rolling 24-hour window with periodic purging of expired records; no question text is retained in this counter.
- Relevant accounting records: in principle ten years from the end of the financial year, in accordance with applicable obligations; this rule does not justify retaining all notes or conversations for ten years.
- Evidence of choices and objections: for the period necessary to demonstrate and respect the choice, with limited content.
Closure of an account does not, by itself, prove that all support tickets, attachments, files and copies have been erased. Requests covering these items are examined separately where necessary. Other people's rights and publications that an organisation is entitled to retain must be distinguished from purely personal data.
Backups follow separate technical cycles and are not used as an ordinary history. Their retention must be limited and justified. In the event of restoration, erasure requests must be reapplied to avoid lasting reintroduction of data. You may request information applicable to your situation from info@uniteo.org.
15. Security and incidents
SafeSpace Media must implement technical and organisational measures appropriate to the risks: management of authorisations, protection of communications, access restrictions, backups, maintenance and incident handling. The measures must be reviewed in light of the actual processing and risks.
No system eliminates every risk. An incident is assessed and the required notifications are made to the authorities and people concerned. Where required by the GDPR, notification to the authority takes place under the conditions and within the time limit of its Article 33; the FADP's notification conditions are examined separately.
Report suspected unauthorised access to info@uniteo.org. Do not include your password in a message. Appointing a provider does not remove SafeSpace Media's own obligations.
16. Your rights
Depending on applicable law and the conditions met, you may request information and access to your data, rectification, erasure or cessation of unlawful processing, withdraw consent and obtain the handover or transmission of the data concerned. Where the GDPR applies, its rights to restriction, objection and portability may be exercised in the situations it provides for. Objections to direct marketing are respected.
Write to info@uniteo.org or to the association's postal address. Proportionate identification may be necessary before disclosure or a sensitive operation; we do not request supporting documents unrelated to this verification. Other people's rights are protected when a copy is provided.
Requests are free of charge in principle. Access requests under Swiss law are normally handled within 30 days; those under the GDPR within one month, with the extensions and conditions provided for by that regulation. A restriction, additional time or refusal must be justified and explained in accordance with applicable law.
A role as the last person responsible for a church may require continuity of access to be arranged with support; it does not remove your personal rights. If a church is the controller for the processing concerned by the request, we help you identify the appropriate contact and forward the request where permissible and necessary.
17. Automated decisions and complaints
Barnabé is an assistance tool. It is not tasked with deciding your membership of a church, your spiritual worth or your access to human support. Refusal of access on age grounds may be challenged in the event of an error by contacting support.
If a solely automated decision produces the effects covered by law, specific information and the rights to express your point of view and request human review are provided in accordance with the applicable provisions.
You may report any difficulty to us. You may also contact the Federal Data Protection and Information Commissioner, whose website is www.edoeb.admin.ch, or the competent supervisory authority where the GDPR applies. These steps do not limit other legal remedies.
18. Changes
The version date appears in the document. Changes to processing or the law may require an update. Important changes are announced appropriately before they apply where necessary. Amending this policy does not replace required consent or retrospectively make a new, incompatible purpose lawful.