Legal information

Privacy and personal data
protection policy

DRAFT FOR REVIEW. Complete highlighted fields and verify this text against the website and service settings before publication.

Effective date: [INSERT PUBLICATION DATE]

This Policy describes how the charitable foundation processes personal data belonging to website visitors, donors and people who contact the Foundation.

1. Who is responsible for processing data

The controller of personal data collected through the website the Foundation’s website is Charitable Organization “Oltera Foundation”, EDRPOU code [INSERT VERIFIED EDRPOU CODE], registered address: [INSERT REGISTERED ADDRESS FROM THE STATE REGISTER] (the “Foundation”). Privacy enquiries: info@oltera.foundation.

This Policy explains what personal data the Foundation may receive through the website, why it uses the data, who may receive it, and how a person can exercise their rights. It applies to website visitors, donors, applicants and people who contact the Foundation.

2. What data may be processed

Depending on how a person interacts with the Foundation, the data processed may include their first and last name; email address; phone number; payment amount, date, currency and technical transaction identifier; the contents of an enquiry; and technical information about website visits, such as IP address, browser type, request time and cookies set by the website platform or connected services.

Do not send full payment card details, a CVV/CVC code, passwords, copies of identity documents or information about a child’s health through the website or ordinary email. If sensitive information or documents are needed to consider a request for charitable assistance, the Foundation should provide a separate secure transfer method and the information required about processing those data.

Payment card data entered on a bank or payment service page are processed by that payment service provider under its own rules. The Foundation should not receive or store a full card number or security code.

3. Current status of the donation form

As of [INSERT PUBLICATION DATE], the donation form on the website is a demo: information entered into it is not sent to the Foundation and is not used to accept payments. LiqPay is not connected. Monobank, Patreon, PayPal and cryptocurrency buttons may be activated after the Foundation adds verified links and configures the relevant services.

Before online payments are launched, the Foundation must update this Policy to identify each connected service, the data it receives, the purpose and legal basis for processing, any recipients, and where to find the service’s privacy policy.

4. Purposes and legal grounds for processing

The Foundation processes data only for specific purposes: responding to enquiries; communicating with donors; recording and confirming donations; complying with legal and accounting requirements; operating and securing the website; and handling personal data requests.

Depending on the circumstances, processing is based on the person’s consent, the need to perform a transaction or take steps at their request, compliance with legal requirements, or another ground provided by Ukrainian law. If the Foundation asks for consent, a person may withdraw it for future processing by contacting the Foundation using the details in this Policy. Withdrawal does not undo processing already lawfully completed and does not affect processing based on another lawful ground.

5. Who may receive data

The Foundation may provide the minimum data necessary to people and organisations that help it operate: the website hosting and platform provider [INSERT PROVIDER NAME AND COUNTRY OF PROCESSING]; payment services actually connected by the Foundation [PAYMENT SERVICES ARE NOT CURRENTLY CONNECTED]; email provider; auditors, banks, public authorities or other people where required to comply with the law or protect rights.

The Foundation does not sell personal data or provide them for third-party marketing mailings. If analytics or advertising services are used, their names, purposes, data categories and consent settings must be stated here before launch: [CONFIRM WHETHER ANALYTICS OR ADVERTISING SERVICES ARE USED].

Some providers may process data outside Ukraine. Before launching those services, the Foundation must verify the country and terms of transfer and disclose this where required by law.

6. Cookies and technical data

The website or the platform on which it runs may use technically necessary cookies for security, navigation and saving settings. Analytics or advertising cookies may be used only after they are actually connected and, where required, after consent is obtained through a cookie management tool.

Website platform name, cookie list, storage periods and how to change a choice: [INSERT THE PLATFORM’S ACTUAL SETTINGS OR A LINK TO THE COOKIE NOTICE].

7. Retention and security

The Foundation retains data only as long as needed for the purpose for which they were collected, handling an enquiry, accounting for a donation, meeting legal requirements and protecting rights. Specific periods depend on the document category and statutory requirements. When they expire, data are deleted or anonymised unless further retention is required by law.

The Foundation applies organisational and technical measures to protect data from accidental loss, unauthorised access, alteration or disclosure. Access is limited to people who need it to perform defined duties.

8. Your rights

To the extent provided by law, a person may ask whether their data are being processed; receive information about the purposes and conditions of processing; access their data; request correction of inaccurate data or deletion of data processed unlawfully; object to processing in cases provided by law; withdraw consent; and complain to the Ukrainian Parliament Commissioner for Human Rights or a court.

To make a request, email info@oltera.foundation and state which right you wish to exercise. The Foundation may request enough information to verify identity where reasonably necessary to prevent disclosure to another person.

9. Links to third-party websites

The website may contain links to banks, payment services, Patreon, PayPal, Monobank or other external resources. After following a link, the owner of that resource independently determines how it processes data. Read the relevant service’s privacy policy before providing information.

10. Changes to this Policy

The Foundation may update this Policy if the law, website or data processing practices change. The new version will be published on this page with its update date. The version in force at the relevant time applies, subject to applicable law.