Privacy policy

Data protection information in accordance with Articles 13, 14 EU General Data Protection Regulation (GDPR)

The following data protection information is intended to explain to you in an understandable, transparent and clear manner how we, Charity and Support Foundation "Nuzhna pomosh Europe" (hereinafter: "NPE"), process your personal data in connection with your use of our website. However, if you have any questions of understanding or other queries about data protection at NPE, you are welcome to contact us at info@npe-kartu.eu

1. Controller The controller within the meaning of Art 4 no 7 GDPR for the processing of your personal data is: NPE Registration address: Konstitucijos prospektas 21A, Vilnius, Lithuania Email: info@npe-kartu.eu

2. Information we collect and our use We collect personal information in connection with your visits to and use of the website. This collection includes information that you provide in connection with the use of the website, and information that is collected automatically such as through the use of cookies and other technologies. Information That You Provide We collect personal information that you submit directly to us. The categories of information we collect may include: Payment information. When you donate, we collect transactional information provided in connection with your donation. Please note that we use third party payment processors, including Stripe, to process payments. As such, we do not retain any personally identifiable financial information such as credit card numbers. Rather, all such information is provided directly by you to our third-party processor. The payment processor’s use of your personal information is governed by their privacy notice. To view Stripe’s privacy notice, please visit: https://stripe.com/privacy. Communications. If you communicate with us through any paper or electronic form, we may collect your name, email address, mailing address, phone number, or any other personal information you choose to provide to us. We use this information to investigate and respond to your inquiries.

3. Rights of the data subject/your rights under data protection law You have the following rights under applicable data protection law with respect to personal data concerning you. Right of access: You can request information from us at any time about whether and which personal data we store about you. The provision of information is free of charge for you. The right to information does not exist or is subject to limitations if and to the extent that confidential information, such as information that is subject to professional secrecy, would be disclosed. Right to rectification: If your personal data stored by us is inaccurate or incomplete, you have the right to obtain rectification of this data from us at any time. Right to erasure: You have the right to request that we erase your personal data if and to the extent that the data is no longer needed for the purposes for which it was collected or, if the processing is based on your consent, you have withdrawn your consent. In this case, we must stop processing your personal data and remove it from our IT systems and databases. A right to erasure does not exist insofar as: • the data may not be deleted due to a legal obligation or must be processed due to a legal obligation; • the data processing is necessary for the assertion, exercise or defense of legal claims. Right to restrict processing: You have the right to request that we restrict the processing of your personal data. Right to data portability: You have the right to receive from us the data you have provided in a structured, common and machine-readable format, as well as the right to have this data transferred to another controller. This right only exists if: • you have provided us with the data on the basis of consent or on the basis of a contract concluded with you; • the processing is carried out by automated means. • Right to object to processing: If the processing of your data is based on Art 6 para 1 lit f) GDPR, you may object to the processing at any time. You may assert all of the data subject rights described above against g by addressing your specific request to the following contact details: By email info@npe-kartu.eu

4. Right to lodge a complaint with a supervisory authority In accordance with Art 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.

5. Provision of data Even if partial automatic transmission of data takes place when you call up our website, you are not legally or contractually obliged to provide data in connection with the use of our homepage.

6. Description of the data processing on the website and legal basis for the processing

6.1 Recipient of the data In order to fulfil the processing purposes listed below, data is also transferred to third parties. This may also include the transfer of personal data to European and non- European countries and the storage of data outside the EU or the European Economic Area (EEA). Recipients bound by instructions We may share your data with service providers bound by instructions, both within the NPE network and with other third parties, such as IT / storage / payment service providers, who support us in our activities, e.g. as part of the administration and maintenance of the websites and the related systems and/or for other internal or administrative purposes. If we pass on data to service providers bound by instructions, we do not require a separate legal basis for this. Independent recipients In addition, in individual cases, we also pass on your data to other third parties, such as public authorities, courts or other bodies, if we are required by law or by official or court order of an EU member state to disclose personal data to these bodies. These bodies also use the data on their own responsibility. Insofar as you have explicitly consented, Art 6 para 1 lit a) GDPR is the legal basis for the data transfer. If there is a legal obligation to disclose the data, the legal basis for the data transfer is Art 6 para 1 lit c) GDPR. If, on the other hand, the disclosure is necessary for the fulfilment of a contractual or pre-contractual measure with you as a natural person, Art 6 para 1 lit b) GDPR is the legal basis. Otherwise, the transfer is based on our legitimate interests and the legal basis is Art 6 para 1 lit f GDPR. We and the other companies in the NPE network have an interest in making our work processes efficient and in sharing processes within the NPE network for this purpose. Data transfer to recipients in third countries outside the EU/EEA Insofar as any of the above-mentioned data transfers are made to a recipient outside the EEA (to socalled “third countries”), an appropriate level of data protection for the foreign transfer is ensured by means of suitable security measures.

6.2 Processing of personal data when accessing the website When you visit our website, we collect the data that is technically necessary to display this website to you. This involves the following personal data which is automatically transmitted to our server by your browser: • IP address • Date and time of your request/call to the website (the app) • Time zone difference from Greenwich Mean Time (GMT) • Content of the request (information about which specific webpage you have visited) • Access status/http status code • Transferred data volume • Website requesting the access • Browser (information about the browser you use) • Operating system and its interface (operating system of the computer you use to access the website or app) • Language and version of the browser software The processing of this personal data is based on Art 6 para 1 lit f) GDPR. The website cannot be accessed and offered to users without using such data; there is a legitimate interest in making the call-up and use of the website technically possible. The aforementioned data will be stored for 7 days and then deleted. This website is hosted by a service provider Digital ocean, the data collected on our website is therefore stored on the service provider's servers. The server locations are also located in European and non-European countries. Data is transferred abroad, including to countries outside the European Union or the European Economic Area. An adequate level of data protection is ensured by the use of standard contractual clauses of the EU Commission within the meaning of Art 46 para 2 lit c) GDPR.

6.3 Contact by email You can contact us by email. When you contact us by email, the data you provide will be stored by us in order to process your enquiry and answer your questions. The data processing is justified according to Art 6 para 1 lit f) GDPR. We have an interest in contacting you via the website in response to your enquiry. If your request is aimed at the fulfilment of a contractual or pre-contractual measure with you as a natural person, Art 6 para 1 lit b) GDPR is the legal basis for the data processing. We will delete the data generated in the course of your enquiry/contact as soon as it is no longer required for processing your enquiry. Insofar as there is a legal obligation to retain data, the data will be stored for the duration of the legally required retention period. The use of the contact form is voluntary for you and is not a prerequisite for the use of the website.

7. Use of cookies In order to make visiting our website attractive and to enable the use of certain functions, we and certain third parties use cookies on our website. These are small text files that are stored on your terminal device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your terminal device and enable us or our partner companies to recognise your browser the next time you visit us (so-called persistent cookies). The following cookie categories are used:

7.1 Cookies strictly necessary for the operation of our website (hereinafter “required Cookie”): These cookies are required for the operation and functionality of the website. They make the website technically accessible, secure and usable and provide essential and basic functionalities, such as navigation on the website, correct display of the website in the internet browser or consent management. The legal basis for the use of required cookies is Sec 25 para 2 Nr 2 of the German Telecommunication-Telemedia-Act (“TTDSG”) or on the basis of Art 6 para 1 lit f) GDPR to protect our legitimate interests. In particular, our legitimate interests lie in being able to provide you with a technically optimised website that is user-friendly and tailored to your needs, and to ensure the security of our systems. The legal basis for consent with regard to the storage and reading of information is Section 25 (1) TTDSG and, with regard to the processing of personal data, Article 6 (1) lit. a GDPR.

8. Links to social media Our website may contain hyperlinks to websites/services of other providers. When activating these hyperlinks, you will be redirected from our website directly to the website of the other provider. You will recognise this by the change of URL, among other things. We cannot accept any responsibility for the confidential handling of your data on these third-party websites, as we have no influence on whether these companies comply with data protection regulations. Please inform yourself about the handling of your personal data by these companies directly on these websites.