Privacy Policy

1. Who is responsible

Suryoyo Sat is run by two associations:

• Bahrosuryoyo Mediaförening: an association, Klockarvägen 104, 151 61 Södertälje, Sweden.
• AMD Suryoyo Sat: an association, Georgstraße 6, 33330 Gütersloh, Germany.

Bahrosuryoyo Mediaförening is responsible (the “controller”) for the website, its forms, the live chat, email updates and payments made in Sweden (Swish, Bankgiro, Autogiro and transfers to the Swedish account).

AMD Suryoyo Sat is responsible for membership sign-ups made through the SEPA membership form on the website and for payments to the German account.

You can reach both associations at info@suryoyosat.com.

2. What we collect and why

We only receive the data you type in yourself, plus the small amount of technical data every website needs. This is what each part of the site collects.

Membership form (/donate)

• Your full name, date of birth, email address, how often you want to pay (monthly or yearly), the amount in euros and your full IBAN.
• That you accept the direct debit and, if you tick the box, your consent to receive updates by email.

The form is saved in our database. Our staff receive an email notification about it, in which the IBAN is masked. We then send you a SEPA mandate to sign. The website itself never takes money from your account.

Visitors in Sweden are offered Autogiro instead. That sign-up happens on Bankgirot’s own website (mvh.bgonline.se) and is not handled by this website.

Contact form (/contact)

Your first name, last name, email address, subject and message. Saved in our database and sent by email to info@suryoyosat.com so that we can answer you.

Programme proposal form (/propose)

Your name and email address, the programme name and any details you choose to add (theme, language, audience, format, duration, frequency, experience, an example link or text, technical needs and location). Saved in our database and sent by email to our staff.

Event form (/events)

Your name and email address, plus the event title, description, location, date and time, and link. Saved in our database and sent by email to our staff.

Death notice form (/obituary)

Details about the person who has died (name, dates, places, the family members and relatives you name, and funeral details), up to three photos, and your own contact details.

This form is not saved in the website’s database. It is sent by email, with the photos attached, to Suryoyo Sat. We may broadcast or publish the notice on the channel. Please only send a notice if you have the family’s permission.

Email updates (homepage and footer)

Your email address is saved in our list of subscribers, and our staff receive an email about each new sign-up. We do not send updates automatically yet. You can unsubscribe at any time by writing to info@suryoyosat.com.

Live chat (/live)

The name you choose and the messages you write are saved in our database and shown publicly to everyone watching. Your browser remembers the name you chose (in local storage, as “chat_name”), so you do not have to type it again. Do not write anything in the chat that you do not want others to see.

Push notifications (bell icon)

If you allow notifications, we store your browser’s push subscription: a web address and encryption keys provided by your browser’s push service (for example Google, Apple or Mozilla). We use it only to send you alerts from the channel. You can turn notifications off in your browser at any time.

Staff login

The admin area is only for Suryoyo Sat staff. Logging in uses login cookies from Supabase Auth.

Technical data

• Our hosting provider processes IP addresses and request logs in order to deliver the website to you.
• On your first visit, the country of your IP address is used once to choose the website language.
• To stop spam, IP addresses are kept briefly in server memory to limit how often a form can be sent.

3. Legal basis

Under the EU General Data Protection Regulation (GDPR) we rely on these legal bases:

• Contract: membership sign-ups, because we need the data for your membership and for the steps before it starts (Art. 6(1)(b) GDPR).
• Legitimate interest: answering contact messages, programme proposals and event submissions, running the live chat, protecting the forms against spam, and hosting logs (Art. 6(1)(f) GDPR).
• Consent: email updates (including the optional box in the membership form) and push notifications (Art. 6(1)(a) GDPR). You can withdraw your consent at any time.
• Death notices: your request to have the notice announced, and our legitimate interest in announcing it to the community.

4. Cookies and browser storage

We use very little browser storage, and only for things the site needs:

• The “lang” cookie remembers your language for one year. It is set automatically from your country on your first visit, or when you choose a language. The site needs it to work, so we do not ask for consent.
• Local storage “lang” and “chat_name” remembers your language and your chat name in your browser.
• Supabase Auth cookies are only set for staff who log in to the admin area.

We use no analytics, no advertising or tracking cookies, and no tracking pixels.

Embedded players work differently. YouTube videos (some through youtube-nocookie.com, some through youtube.com) and the Castr live player may set their own cookies or collect data when you play them. Their own privacy policies apply. The YouTube video lists on our site are fetched by our server, so no visitor data is sent to YouTube for them.

5. Service providers

We share data only with these providers, and only as far as needed:

• Supabase: database, file storage and staff login. Our project is hosted in the EU (Ireland).
• Resend: sends the website’s emails (from noreply@beta.suryoyosat.com). We use its EU sending region; Resend is a US company.
• Vercel: hosts the website and detects your country from your IP address. Vercel is a US company with a global network.
• YouTube (Google): video players.
• Castr: live stream player.
• Browser push services (Google, Apple, Mozilla, Microsoft): deliver push notifications.
• Bankgirot: Autogiro mandates, on its own website.
• Handelsbanken and Stadtsparkasse Augsburg: our banks, for payments.

Some of these providers are US companies, so data may be transferred outside the EU. Such transfers rely on safeguards such as the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

We do not sell your personal data, and we do not share it for advertising.

6. How long we keep data

We keep personal data only as long as we need it for the purpose it was collected for:

• Membership: as long as your membership lasts, and after that as long as bookkeeping law requires.
• Contact messages, programme proposals and events: until we have handled them. We delete them when they are no longer needed.
• Email updates: until you unsubscribe.
• Live chat: messages may be removed by our staff.
• Death notices: our staff keep the email as long as it is needed for the broadcast.

7. Your rights

You have the right to:

• see the data we hold about you (access);
• have incorrect data corrected;
• have your data deleted;
• restrict how we use your data;
• object to our use of your data;
• receive your data in a format you can take elsewhere (data portability);
• withdraw your consent at any time. This does not affect what was done before you withdrew it.

To use any of these rights, write to info@suryoyosat.com.

You can also complain to a data protection authority:

• In Sweden: Integritetsskyddsmyndigheten (IMY), imy.se.
• For AMD Suryoyo Sat in Bavaria: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), lda.bayern.de.
• Or the data protection authority in the country where you live.

8. Children

The website is for a general audience. Children under 13 (in Sweden) or under 16 (for example in Germany) should not send forms or use the chat without a parent.

9. Changes to this policy

We may update this policy when the website changes. The date at the top shows when it was last updated.

10. Contact

Questions about privacy? Write to info@suryoyosat.com.