Skip to content

Language

Legal

Privacy policy

Protecting your personal data matters to us. This policy explains what data we process when you visit our website, open a user account, comment on or react to blog posts or write to us using the contact form – and what rights you have.

We comply with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). We only process the data we actually need for each purpose. We do not sell any data and we do not use any advertising or tracking services.

Controller

The controller responsible for processing data on this website is:

Compassion in the Right Place
c/o David Hassani
Poststrasse 1
8620 Wetzikon ZH
Switzerland
Email: crp.spenden@gmail.com

If you have any questions about data protection or would like to exercise your rights, please write to us at this address.

Hosting with Cloudflare

Our website runs on the infrastructure of Cloudflare, Inc. (USA). The pages are delivered via Cloudflare Workers. We store user accounts, comments, reactions and contact requests in a Cloudflare database (D1), and images from the blog in the Cloudflare R2 storage service. Cloudflare processes this data on our behalf.

For the database and storage, we have chosen data centres in Western Europe. However, because Cloudflare delivers the website through a worldwide network, data may also be processed in other countries, in particular in the USA. Cloudflare is certified under the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework (see Disclosure to third parties and abroad for more details). You can find details in Cloudflare’s privacy policy.

Technical data when you visit the website

When you visit our website, your browser automatically transmits technical data: for example, your IP address, the date and time of access, the page you requested, the page you visited before (referrer) and information about your browser and operating system. Cloudflare needs this data to deliver the website and to protect it against attacks and misuse.

We only use our application’s technical logs to find and fix errors. They are automatically deleted after a few days.

This processing is necessary to operate the website securely (legitimate interest; Art. 6(1)(f) GDPR).

Cookies

We only use cookies that are technically necessary for the functions of this website. We do not use any tracking or advertising cookies – which is why our website has no cookie banner.

Cookie Purpose When it is set Storage period
Session cookies (name contains crp.session) keep you signed in only after you sign in until you sign out, at most 30 days
crp_vid (visitor ID for reactions) makes sure that a reaction without an account is only counted once; contains only a random identifier, no information about you only when you react to a blog post without an account 1 year
crp_staff_mfa confirms the two-factor sign-in of team members only for team members in the administration area at most 12 hours
crp.state protects signing in with Google against misuse only when you choose “Continue with Google” a few minutes

To protect against attacks and automated access, Cloudflare may also set technically necessary security cookies.

You can delete or block cookies in your browser at any time. Without session cookies, however, you will not be able to sign in.

User account

You can use our website without an account. You only need one if you would like to comment on blog posts.

For your account, we store your email address, your name – it appears as your display name with your comments – and, if you sign in with Google, your Google profile picture, if you have one. We also store when you registered and, for each sign-in session, your IP address and information about your browser, so that we can secure sessions and detect misuse. To limit repeated sign-in attempts, we briefly store your IP address; it is deleted after two days at the latest. Expired sessions are deleted daily.

We don’t use passwords. You sign in

  • with an email link: we send you a sign-in link that is valid for 15 minutes, or
  • with Google: Google then sends us your name, your email address and your profile picture. The provider is Google Ireland Limited (Ireland) or Google LLC (USA); Google’s privacy policy also applies.

For team members who write or manage posts, we also store the details needed for two-factor sign-in. We log the changes they make in the administration area so that they remain traceable.

We process this data to provide you with your account (contract; Art. 6(1)(b) GDPR).

Deleting your account: you can delete your account yourself at any time in your account settings. When you do, we delete your account data and sessions. Your comments remain but are anonymised: they are no longer linked to your name or your account. If you would like your comments to disappear as well, delete them yourself beforehand or write to us.

Comments

You can only comment if you have an account. We store your comment with the date and time and display it publicly together with your display name.

We review the first comments of a new account before they appear. We may reject, hide or delete comments, for example if they are offensive, break the law or contain advertising. Other readers can report comments; we review such reports. If you report a comment without an account, we only store a check value (hash) of your IP address, so that each person can report each comment only once; it is deleted together with the comment.

You can delete your own comments at any time. Otherwise, they are kept for as long as the blog post exists.

The legal basis is the provision of the comment function (Art. 6(1)(b) GDPR) and our legitimate interest in a safe and respectful discussion (Art. 6(1)(f) GDPR).

Reactions

You can react to blog posts with a single click, even without an account. We store which reaction you chose on which post, and when. If you are signed in, we link the reaction to your account. Without an account, we only store a check value (hash) of the random identifier from the visitor cookie, so that each reaction is only counted once. Only the number of reactions is shown publicly, never who reacted. To stop anyone manipulating the counts, reactions without an account are limited to 30 per hour. For this purpose, we briefly store a check value (hash) of your IP address; it is automatically deleted after 25 hours at the latest.

Contact form

When you write to us using the contact form, we process your name, your email address, the topic you chose, your message and the language in which you are using our website. We store the message in our database and forward it by email to our association’s mailbox. The emails are sent by Resend, Inc. (USA), and our mailbox is hosted by Google (Gmail).

We only use your details to answer your enquiry (your consent and your enquiry; Art. 6(1)(a) and (b) GDPR). We delete contact requests from our database 12 months after receipt. We keep the forwarded email in our mailbox only for as long as we need it to deal with your enquiry.

To prevent misuse, the form is limited to five messages per hour. For this purpose, we briefly store a check value (hash) of your IP address, not the IP address itself. This check value is automatically deleted after 25 hours at the latest.

Of course, you can also write to us directly by email.

Sending emails with Resend

We send sign-in links, notifications and forwarded contact requests via the Resend service of Resend, Inc. (USA). For this purpose, Resend processes the recipient’s address and the content of the email on our behalf. You can find out more in Resend’s privacy policy.

Spam protection with Cloudflare Turnstile

To protect forms such as the sign-in or the contact form from automated misuse, we use Cloudflare Turnstile. Turnstile uses technical characteristics of your browser and your connection (for example, your IP address) to check whether a request comes from a human. For this purpose, a script is loaded from Cloudflare. The data is only used for this check, not for advertising (legitimate interest; Art. 6(1)(f) GDPR).

Visitor statistics with Cloudflare Web Analytics

To understand how our website is used – for example, which pages are visited and how often – we use Cloudflare Web Analytics. The service does not set any cookies, does not recognise you and does not create profiles. We only see aggregated statistics that do not reveal who visited our website. For this purpose, a small script is loaded from Cloudflare, and your browser transmits technical information such as the page visited, the referrer, loading times and the browser type (legitimate interest; Art. 6(1)(f) GDPR).

YouTube videos

On some pages, we show videos that are hosted on YouTube, a Google service. As long as you do not click on a video, no connection is made to YouTube. Only after you click do we load the video in privacy-enhanced mode via youtube-nocookie.com.

From that moment on, Google receives, among other things, your IP address and information about your browser and the page you are visiting. During playback, YouTube may use cookies or similar technologies. If you are signed in to Google, Google can link the visit to your account. The provider is Google Ireland Limited (Ireland) or Google LLC (USA); Google’s privacy policy applies.

Our website contains links to other websites, for example to media reports. The buttons for sharing posts are also simple links: the website of the respective service is only opened when you click on one of them – no data is transmitted to these services before that. The operators of other websites are responsible for the processing of data on their sites.

Disclosure to third parties and abroad

We only pass on personal data to the service providers named in this policy that process the data on our behalf (Cloudflare and Resend), or if we are legally obliged to do so. Google processes data when you sign in with Google and in our association mailbox (Gmail) under its own terms and is itself responsible for that processing.

Some of these service providers are based in the USA. For companies certified under the Swiss-U.S. Data Privacy Framework, the Swiss Federal Council recognises an adequate level of data protection; for people in the EU, the same applies to the EU-U.S. Data Privacy Framework. If a service provider is not certified, we base the transfer on the European Commission’s standard contractual clauses, which are also recognised in Switzerland.

How long we keep data

  • Contact requests: 12 months after receipt
  • User account: until you delete it or we delete it, for example in the event of misuse
  • Sign-in sessions: at most 30 days
  • Sign-in links by email: valid for 15 minutes
  • Comments: until you or we delete them or the blog post is deleted; if you delete your account, they are anonymised
  • Reactions: for as long as the blog post exists
  • Technical logs: a few days

Statutory retention obligations remain reserved.

Data security

The connection to our website is encrypted (HTTPS). Only members of our team who need personal data for their tasks have access to it. Two-factor sign-in is mandatory for the administration area.

Your rights

You have the right at any time to

  • request information about which personal data we process about you,
  • have incorrect data corrected,
  • request the deletion of your data,
  • object to processing or have it restricted,
  • receive your data in a common electronic format (data disclosure and portability), and
  • withdraw any consent you have given, with effect for the future.

To do so, please write to us at crp.spenden@gmail.com. To make sure that your data does not fall into the wrong hands, we may ask you to prove your identity.

If you believe that we are not processing your data correctly, you can lodge a complaint with the supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. If you live in the EU, you can also contact the data protection authority in your country. However, we would much prefer you to get in touch with us directly first.

Changes

We update this privacy policy when our website or the legal requirements change. The current version on this page always applies.

Last updated: 3 October 2026