Personal Data Protection Policy

PERSONAL DATA PROTECTION POLICY

Centrum pre filantropiu, n.o., registered office Baštová 5, 811 03 Bratislava, company ID number: 31 821 871, listed in the non-profit registry supervised by the Interior Ministry of the Slovak Republic, registration office: Bratislava District Office, registration No. OVVS-530/49/2002 – NO (hereinafter the “Operator֨”) is the operator of the DARUJME.sk donation system, which serves for the purposes of the support and development of public-benefit goals and activities, especially donorship, and which may be used in accordance with the Terms of Use of the DARUJME.sk donation system (which are published at https://darujme.sk/pravidla-a-podmienky/ – hereinafter the “Terms” – and which contain the definitions of Parties, Contracts, Rights and Obligations etc.). The Operator has issued this Personal Data Protection Policy (“Personal Data Protection Policy”) to which it adheres when processing the following personal data of the following data subjects, for the purposes of ensuring the operation of the donation system, entering into of contracts, and provision of services in accordance with the Terms:

1. What data we process and how we collect it

Donor – natural person:

• First name and last name – mandatory data for the purpose of entering into a contract,
• e-mail address – mandatory data for the purpose of entering into a contract,
• donation amount – mandatory data for the purpose of entering into a contract,
• whether the donation is one-time or regular – mandatory data for the purpose of entering into a contract,
• the donation payment method – mandatory data for the purpose of performing a contract
• other payment details, mainly the date and number of the transaction, number of the bank account from which the transaction was made – the Operator obtains these data in the course of processing the transaction, from banks or other institutions processing card payments and bank transfers,
• whether the donor has familiarised themselves with the Terms of Use of DARUJME.sk and the Personal Data Protection Policy – mandatory data for the purpose of entering into a contract,
• other data provided in the donation form – unless stated otherwise in the form, this data is not mandatory and is processed by the Operator for the Beneficiary of the donation (the “Beneficiary”).

If the data subject does not provide the relevant data marked as mandatory, a contract between the Donor and Beneficiary shall not be entered into.

Natural person acting on behalf of the Beneficiary

• First name and last name – mandatory data for the purpose of entering into a contract,
• e-mail address – mandatory data for the purpose of entering into a contract,
• telephone number – mandatory data for the purpose of entering into a contract,
• position held in working for the Beneficiary – mandatory data for the purpose of entering into a contract,
• Beneficiary’s identification and other details about the Beneficiary and their activities – mandatory data for the purpose of entering into a contract.

If the data subject does not provide the above mentioned data marked as mandatory, a contract between the Operator and Beneficiary shall not be entered into.

Peer-to-Peer Campaign Author/Ambassador – natural person:

• First name and last name – mandatory data for the purpose of creating a P2P Campaign,
• e-mail address – mandatory data for the purpose of creating a P2P Campaign,
• profile photograph of the P2P Campaign Author – data is not mandatory for the purpose of creating a P2P Campaign,
• name, text and other (for example picture) information for the P2P Campaign –mandatory data for the purpose of creating a P2P Campaign, but the content is specified by the P2P Campaign Author,
• user account and password of the P2P Campaign Author for access to administration of the P2P Campaign, or user account and data necessary for P2P Campaign for P2P Campaign Author authorisation, if they selected the option to sign in through Facebook or a Google account – mandatory data for the purpose of creating a P2P Campaign if the P2P Campaign Author does not yet have an account set up,
• voluntary moral commitment of the P2P Campaign Author – the P2P Campaign Author is not obliged to make a commitment for the purpose of creating a P2P Campaign, doing so is voluntary,
• information about the financial goal of the P2P Campaign – mandatory data for the purpose of creating a P2P Campaign,
• information about the Beneficiary or the Beneficiary’s potential project which the P2P Campaign Author wants to support with the P2P Campaign,
• information on the duration of the P2P Campaign – mandatory data for the purpose of creating a P2P Campaign, 25 days by default, with an option to change this after the Campaign has been created,
• information on contributions sent via the P2P Campaign, including for instance information on the amount of individual donations, the date of donation, donor, and whether the P2P Campaign’s financial goal was reached etc.,
• information on whether the P2P Campaign Author has familiarised themselves with the Terms of Use of DARUJME.sk and the Personal Data Protection Policy – mandatory data for the purpose of creating a P2P Campaign.

If the data subject does not provide the above mentioned data marked as mandatory, a P2P Campaign shall not be created.

Visitor to the Operator’s www.darujme.sk website (any natural person who uses the www.darujme.sk web domain, including any subpage/subdomain, or who, in doing so, provides the Operator any personal data, for example e-mail, name etc.):

• Apart in this document, information on the protection of privacy of visitors to the Operator’s website (information on the use of cookies) is also available HERE.
• Data necessary for access and use of the www.darujme.sk website as a user of the web domain, as well as data to which the visitor voluntarily provides based on his or her own consent for the purpose of providing services or information, and information to which he or she has agreed within the extent of the website or its subpages or the DARUJME.sk donation system (for example receiving a Newsletter etc.)

In processing personal data the Operator complies with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR) (“General Regulation”), the Act No. 18/2018 on the protection of personal data and amending and supplementing some other acts (“PPD Act”), the Act No. 351/2011 on electronic communications as later amended (“Electronic Communications Act“) and the Act No. 22/2004 on electronic trade and amending and supplementing the Act No. 128/2002 on state regulation of the internal market in matters of consumer protection and amending and supplementing some other acts as amended by the Act No. 284/2002 as later amended (“Law on Electronic Trade“).

2. Why we process your personal data – the purpose and lawful basis for processing personal data

The Operator processes the personal data of the:

Donor – natural person, for the purpose of:

• entering into and performing a contract between the Donor and Beneficiary and entering into and performing a contract between the Donor and Operator (Article 1 (4) of the Terms) in accordance with Article 6(1)(b) of the General Regulation,
• fulfilling legal obligations in accordance with Article 6(1)(c) of the General Regulation, performing all legal obligations of the Operator as set forth by specific regulation (for instance on accounting, meeting tax obligations and tax declarations in accordance with relevant legislation etc.),
• legitimate interests of the Operator in accordance with Article 6(1)(f) of the General Regulation – the Operator’s legitimate interest is the exercise of potential claims against the Beneficiary or defence against claims brought against the Operator,
• legitimate interests of the Beneficiary in accordance with Article 6(1)(f) of the General Regulation – the Beneficiary’s legitimate interests are maintaining records of donations, managing donations, administering the donor base, writing reports of donations received and drawing up analyses of the effectiveness of marketing etc. Legitimate interests of the Beneficiary are also exercising potential claims against the Donor and defence against claims brought against the Beneficiary; to this extent the Operator holds the position of a processor in accordance with the General Regulation and the PPD Act, which means that the Operator processes personal data for this purpose on behalf of the Beneficiary,
• for another purpose for which the data subject has given his or her consent to in accordance with Article 6(1)(a) of the General Regulation

Natural person acting on behalf of the Beneficiary, for the purpose of:

• entering into and performing a contract between the Operator and the Beneficiary in accordance with Article 6 (1)(b) of the General Regulation,
• complying with legal obligations in accordance with Article 6(1)(c) of the General Regulation,
• legitimate interests of the Operator in accordance with Article 6(1)(f) of the General Regulation – legitimate interests of the Operator are exercising potential claims against the Beneficiary and potential defence against claims brought against the Operator; to this extent the Operator has the status of an independent operator, which means that the Operator processes personal data for this purpose in its own name,
• for another purpose for which the data subject has given consent to in accordance with Article 6(1)(a) of the General Regulation, mainly for direct marketing of the services of the www.darujme.sk website (sending a newsletter or news emails with the permission of the data subjects etc.); information about providing consent is set included at the end in the section „PERMISSION TO SEND NEWSLETTER – Natural person acting on behalf of the Beneficiary“;.

P2P Campaign Author – natural person, for the purpose of:

• creating, publishing and administering the P2P Campaign Author’s campaign to send contributions to a specific Beneficiary via the DARUJME.sk donation system and the website of the Beneficiary; with the creation of the P2P Campaign a contractual relationship is created between the P2P Campaign Author and the Beneficiary and between the P2P Campaign Author and the Operator (Article 1(4)(c) of the Terms) and personal data are processed in accordance with Article 6(1)(b) of the General Regulation, for the purposes of performing the main contract,
• fulfilling legal obligations under Article 6(1)(c) of the General Regulation, in accordance with specific regulations,
• legitimate interests of the Operator in accordance with Article 6(1)(f) of the General Regulation – legitimate interests of the Operator are the exercising of potential claims against the Beneficiary and defence against claims exercised against the Operator,
• legitimate interests of the Beneficiary in accordance with Article 6(1)(f) of the General Regulation – legitimate interests of the Beneficiary are maintaining records of received donations, managing the donations, maintaining records of and managing P2P Campaigns of the individual P2P Campaign Authors concerning the Beneficiary, such as approval of the P2P Campaigns, administration of the donation base and base of supporters, writing reports of provided donations, analyses of the effectiveness of marketing etc. Legitimate interests of the Beneficiary are also the exercising of potential claims against a donor and defence against claims exercised against the Beneficiary,
• for the purpose to which the data subject has given consent in accordance with Article 6(1)(a) of the General Regulation i.e. especially the creation and administration of the user account through which the P2P Campaign Author creates and administers P2P Campaigns. The P2P Campaign Author may withdraw their consent by cancelling their account. Cancellation of their user account does not remove the P2P Campaigns created before the cancellation, as long as the Beneficiary needs the data about the P2P Campaigns in accordance with the previous point hereof. Information on giving consent is set out at the end in the section „CONSENT TO SET UP AN ACCOUNT“.

Visitor to the www.darujme.sk website:

for the purpose to which the data subject has given consent under Article 6(1)(a) of the General Regulation i.e. mainly use of the www.darujme.sk website, storage of search data (use of cookies), marketing services of the www.darujme.sk website (sending of newsletter or news emails with the consent of data subjects etc.);

3. To whom the personal data is sent (categories of recipients)

The Operator does not publish nor provide to third parties personal data of data subjects, unless stated otherwise below; however, to fulfil the processing purposes outlined above the Operator may, to a necessary extent, transfer to service providers data necessary for the ensuring the smooth functioning of the Operator and its DARUJME.sk Donation system. The personal data is provided only to the necessary extent and always with the same level of confidentiality on the side of the recipient of the data, i.e for example an authorised employee, an individual who has been nominated to carry out accounting or other similar professional consultancy, an auditor, technical specialist or other supplier of specific services (for example IT service provider etc.), and always in accordance with relevant regulations (i.e. especially the General Regulation under which we enter into specific contracts with these providers).

The essence of creating a P2P Campaign by the P2P Campaign Author is the creation of a web page for the P2P Campaign and a unique URL which is sent to the P2P Campaign Author. The URL is accessible only to the P2P Campaign Author, Beneficiary, and Operator. The URL is further accessible to all persons to whom it is sent, or to whom access is given, by the P2P Campaign Author.  For this purpose the Operator processes the personal data of the P2P Campaign Author also for the purposes of the Beneficiary, i.e. the entering into a contract between the Beneficiary and P2P Campaign Author.

Under certain circumstances, and in accordance with relevant provisions of the Terms, especially for the purpose of entering into donation contracts between Beneficiaries and Donors, but equally for the purposes of the creation of P2P Campaigns under the previous paragraph, we process personal data under the direction of the Beneficiary, i.e. in the position of a processor for the Beneficiary, which the Operator sends the Beneficiary on whose behalf it is processing the data. The processing of this personal data on behalf of the Beneficiary is governed by the Terms for processing personal data on behalf of the Beneficiary, which are available HERE.

The Operator may, for the purpose of protecting its legitimate interests, provide the personal data of data subjects to a third party, who is bound by an obligation of confidentiality, for example the Operator’s legal representative.

The Operator obtains the personal data of data subjects directly from data subjects, in specific cases from the Beneficiary or other persons, but always in accordance with this Personal Data Protection Policy, General Regulation, and applicable legislation.

Transfer of your personal data to third countries: We do not intend to transfer your personal data to third countries i.e. states outside the European Economic Community. Your personal data may only be transferred to third countries if such a transfer is in accordance with the conditions for transfer set out in Chapter V of GDPR.

4. How long we keep your personal data

All personal data on a data subject which we obtain are processed only temporarily for the period necessary for the fulfilment of our contractual, legal, and other obligations, for the achievement of the purpose for which the data was provided or the purpose of the implemented activity or project, or in order to meet obligations under the current legislation (for example storing data for accounting or tax/customs purposes – always for the period required by the applicable legislation).

The Operator processes the personal data of the data subjects as follows:

• until there is no purpose any more for which they were processed,
• for a maximum period of 10 years in the case that the data was given freely based on the data subject’s consent, unless the data subject withdraws his or her consent prior to the end of that period,
• for no longer than the statutory limitation period if the personal data are processed in connection with the entering into and fulfilling of a contract (in some cases the statutory limitation period is as many as 10 years from the date when a claim could be brought for the first time, for instance the right to compensation for intentional damage),
• in the case of published data about a P2P Campaign Author’s P2P Campaign – until the period of the P2P Campaign has ended and thereafter while the Beneficiary maintains a legitimate interest in publishing the data of the P2P Campaign regarding its project; the Beneficiary will re-evaluate their legitimate interest at least once every 5 years,
• for the period set forth in relevant legislation for personal data processed on the basis of a legal obligation (for example accounting records are kept for at least ten (10) years),
• if records of the processed personal data must be retained, for the time set out in the 395/2002 Act on the Archives and Registries, usually for no longer than ten (10) years from the fulfilment of the contract.

5. What are your rights

Data subjects have the following rights with regard to the processed personal data:

• request from the Operator access to their personal data which the Operator processes and request confirmation that the Operator processes their personal data in accordance with Article 15 of the General Regulation

The data subject can contact the Operator by post at: Centrum pre filantropiu n.o., Baštová 5, 811 03 Bratislava, and by e-mail at cpf@cpf.sk,

• request from the Operator rectification of inaccurate personal data concerning him or her or have the incomplete personal data completed, in accordance with Article 16 of the General Regulation;

• request the Operator to delete their data information.
  A data subject who has an account with the Operator’s website and all connected applications may also delete their personal data after they have signed into their account.  The data subject can contact the Operator by post at: Centrum pre filantropiu n.o., Baštová 5, 811 03 Bratislava, and by e-mail at cpf@cpf.sk, and data will be erased within 10 days.

• request to obtain from the Operator restriction of processing of their personal data in accordance with Article 18 of the General Regulation i.e especially where one of the following applies:

• the accuracy of the personal data is contested by the data subject, for a period enabling the Operator to verify the accuracy of the personal data
• the processing is unlawful but the data subject opposes the erasure of personal data,
• the Operator no longer needs the personal data but they are required by the data subject for the exercise of legal claims,

• request from the Operator transmission of the personal data which he or she has provided to the Operator and which are processed by automated means, in accordance with Article 20 of the General Regulation,
• right to object to processing of personal data for the purpose of the legitimate interests pursued by the Operator, on grounds related to his or her particular situation or where the data are processed for direct marketing purposes, in accordance with Article 21 of the General Regulation.

Until the Operator demonstrates that its compelling legitimate interests override the interests of the data subject, it shall restrict the processing of personal data.

If it is demonstrated that the legitimate interests of the data subject override those of the Operator, the Operator shall erase those personal data, unless they are processed for another legal purpose.

The Operator processes the personal data of data subjects solely on the basis of their prior consent; therefore, all that is needed to end the processing of the personal data and erase them (unless they are being processed simultaneously on another legal basis) is for consent to be withdrawn.

• withdraw his or her consent at any time, where processing is based on consent. Should you decide to withdraw your consent please send your withdrawal to the address of our registered office or email contact as set out above.

The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

• lodge a complaint (proceedings in accordance with § 100 under PPD Act) with the Slovak Republic Office for Personal Data Protection, registered office: Hraničná 12, 820 07 Bratislava, if the data subject considers that the processing of personal information relating to him or her infringes the General Regulation.

The Operator shall provide information on action taken on a request or complaint to the data subject within one (1) month of receipt of the request. Taking into account the complexity of the request, the period may be, repeatedly, extended by two further months. The Operator shall inform the data subject of any such extension.

The Operator shall provide the information in writing or by electronic form, unless otherwise requested by the data subject.

Where the Operator processes the personal data in the position of a processor on behalf of the Beneficiary, the data subject may exercise the above rights also directly against the Beneficiary.

Details about the rights of the data subject and the exercise of those rights are set out in Articles 12-23 of the General Regulation.

In order to ensure the proper functioning of the www.darujme.sk website the Operator may store on the website user’s equipment small data files, cookies, through which the web page may for a definite period of time store data about activities and settings (for instance log-in name, language, size of writing etc.). Details about the use of cookies and protection of privacy of visitors to the Operator’s website can be found HERE.

PERMISSION TO RECEIVE A NEWSLETTER – Natural person acting on behalf of the Beneficiary

By creating user access to the donation system, the data subject gives the Operator his or her consent to process personal data as follows:

„In accordance with Article 6(1)(a) of the General Regulation, having read the information on protection of personal data, I give the Operator my consent, in accordance with Article 7 of the General Regulation, to the processing of my personal data for the purpose of sending a newsletter or news emails etc. I understand that I may withdraw my consent at any time, and the withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal. I understand that if I am below the age of 16, my consent shall be lawful only with consent of the holder of parental responsibility over me. If I am below the age of 16, I confirm that I have received the consent of a holder of parental responsibility over me.“

CONSENT TO SET UP AN ACCOUNT

By clicking a checkbox stating consent to set up an account, the data subject gives the Operator his or her permission to process personal data as follows:

„In accordance with Article 6 (1)(a) of the General Regulation, having read the information on protection of personal data, I give the Operator my consent, in accordance with Article 7 of the General Regulation, to the processing of my personal data for the purpose of setting up and administering a user account for the purpose of creating and administering P2P Campaigns. I understand that I may withdraw my consent at any time, and that the withdrawal of my consent shall not affect the lawfulness of processing based on consent before its withdrawal. I understand that if I am below the age of 16, my consent shall be lawful only with consent of the holder of parental responsibility over me. If I am below the age of 16, I confirm that I have been given the consent of a holder of parental responsibility over me.“

6. Changes in the Protection of Personal Data Policy

This Personal Data Protection Policy is effective as of 3 of August 2020. The information which we are obliged to provide to you with regard to our processing of personal data may change or cease to be valid. For this reason we reserve the right to, at any time, alter these conditions to any extent.  In the case that any changes are made to this Personal Data Protection Policy, we shall publish them in their new form on our DARUJME.sk website, or shall notify you in some other form (for example, in a special email notification). The changes shall take effect immediately after their publication or the delivery of notification in any other form (whichever occurs first).

7. How to contact us

We welcome your opinions about our website and this Personal Data Protection Policy. You may contact us with your proposals or requests for clarification of any right or obligation relating to processing of personal data, or with any other requests, using the contact details below:

Contact details:

Centrum pre filantropiu n.o.

E-mail:  cpf@cpf.sk

Website: www.darujme.sk