Websites give many advantages to a religious community, making religious practices more accessible and enabling communication and community-building. At the same time, the user's privacy needs to be protected. This is particularly true for the data about their religious beliefs. The General Data Protection Regulation has strict requirements on the processing of special categories of personal data, including data revealing an individual's religious beliefs. This paper presents a case study of websites of the largest religious community in Finland, the Evangelical Lutheran Church. We study the prevalence of third parties and potential data leaks on 31 websites of this church. Our findings show that several measures have been taken to protect the user's privacy by the church and website maintainers, such as introducing a common platform for the vast majority of the websites and replacing Google Analytics with Matomo. However, there were still some privacy concerns such as leaking data to Meta and vague privacy policies. This case study serves both as an example of how many correct measures have been taken to prevent privacy violations and how web developers and data protection officers can further improve data protection.