Privacy Policy

MCF World Portal — Last updated: May 2026

1. Data Controller

The MCF World Portal is operated by the Moravian Church Foundation (MCF World). MCF World is the data controller responsible for the personal data processed through this portal. For privacy-related questions, contact: info@mcfworld.com.

2. What Data We Collect

Account data: name, email address, role, province affiliation
Authentication data: hashed password, two-factor authentication settings
Submission data: annual funding requests, statistical data, financial information, uploaded documents
Bank details: bank name, account name, SWIFT/IBAN (used solely for MCF disbursements)
Technical data: IP address (login events, audit log), browser session tokens
Usage data: login history, actions performed in the portal (audit log)

3. Purpose and Legal Basis

Performance of a contract (Art. 6(1)(b) GDPR): Processing your annual funding request, managing disbursements, and maintaining your account.

Legitimate interests (Art. 6(1)(f) GDPR): Security logging, fraud prevention, and system integrity.

Legal obligation (Art. 6(1)(c) GDPR): Retaining financial records as required by applicable law (minimum 7 years).

4. Data Retention

Account data: retained for the duration of your relationship with MCF World, plus 2 years
Financial and submission data: retained for 10 years in accordance with financial record-keeping requirements
Audit logs: retained for 5 years
Deleted accounts: personal data anonymised within 30 days of approved deletion request, unless legal retention applies

5. Your Rights (GDPR)

Right of access (Art. 15): Request a copy of your personal data via Settings → Export my data
Right to rectification (Art. 16): Correct inaccurate data via your account settings or by contacting MCF
Right to erasure (Art. 17): Request deletion of your account via Settings → Request account deletion. Note: financial data may be retained as required by law
Right to data portability (Art. 20): Download your data in machine-readable format via Settings → Export my data
Right to object (Art. 21): Object to processing based on legitimate interests by contacting MCF World

6. Cookies

This portal uses only strictly necessary cookies for session management and authentication. No analytics, advertising, or tracking cookies are used. No consent is required for these cookies under the ePrivacy Directive.

7. Data Security

Data is stored on servers located in the European Union. Access is protected by strong passwords, two-factor authentication (required for all staff), role-based access control, encrypted connections (HTTPS/TLS), and comprehensive audit logging. Uploaded documents are stored outside the public web root and are only accessible to authorised users.

8. Contact & Complaints

For privacy questions or to exercise your rights, contact MCF World at info@mcfworld.com. If you believe your rights have not been respected, you have the right to lodge a complaint with your national data protection authority.