Privacy Notice

1. Who is responsible for your data

We use data to respond to enquiries, organise assistance, account for donations and operate the website. The data involved depend on your action: viewing a page, contacting us, offering assistance or making a transfer. Publishing a name or photograph requires a separate legal basis.

The personal data controller is БЛАГОДІЙНА ОРГАНІЗАЦІЯ "БЛАГОДІЙНИЙ ФОНД "СОЛОДКО ШКУРІДІН", Ukrainian registration code 45536811 (the Foundation). This Ukrainian name identifies the registered legal entity; Solodko Shkuridin Foundation is the English brand. Address: Office 14, 31 Oskolska Street, Kyiv, 03028, Ukraine. For data enquiries and rights requests: info@solodkoshkuridin.org; +380 67 187 87 87; +380 44 364 60 63.

This notice covers website visitors, donors, applicants, volunteers, representatives of organisations and people whose information is received in connection with the Foundation’s assistance.

2. Information we receive

Enquiries: your name, email address or telephone number, message and subsequent correspondence. Volunteer offers also include the selected task, skills, experience, city and availability. Offers of goods, transport or services include the type and description of assistance, quantity or scope and city; company offers also include the organisation’s name and its representative’s details. Fields marked as required are needed to handle that offer; either an email address or a telephone number is sufficient for contact.

The system records the submission type and receipt time, confirmation number, version of the privacy notice and operational processing and notification delivery status. Information comes from you, an authorised representative, participants in agreed cooperation, or the bank or payment service handling your transfer. We may use appropriate public registers to verify an organisation. When we receive information from another source, we notify you of that source and the processing no later than 30 working days after obtaining the data, subject to lawful exceptions. Where GDPR applies, notice is given no later than one month, the first communication or the first disclosure to another recipient, whichever comes first.

3. Purposes and legal bases

We use the information needed to answer an ordinary question and assess an offer of assistance on the basis of the Foundation’s legitimate interest in maintaining contact and organising charitable activities, taking account of your rights and reasonable expectations. When you ask us to prepare or carry out an arrangement for a donation, volunteering or the transfer of property, the basis is entering into or performing that transaction, or taking steps at your request before it. Business representatives’ contact details are processed on the parties’ legitimate interest in organising cooperation.

Accounting and tax records, legally required requests and records of data operations are based on the Foundation’s legal obligations. Website security and the prevention of abuse are based on the legitimate interest in protecting the service without excessive monitoring.

Where consent is needed, including optional use of a photograph or a named public acknowledgement, we request it separately for a specific purpose. A checkbox acknowledging this notice records that the information was provided; it is not consent to every possible use, mailing or publication. The principal bases are set out in Article 11 of Ukraine’s Law on Personal Data Protection.

Optional website analytics and separate advertising effectiveness measurement rely on your voluntary consent for the corresponding purpose under Article 11 of Ukraine’s Law on Personal Data Protection. Where GDPR applies, consent under Article 6(1)(a) is the basis for this processing. Neither permission is a condition of a donation, enquiry or company offer. The basis for processing the submission itself or bank accounting records is determined separately and is not changed by your measurement choices.

4. Data minimisation and safe contact

Send only information needed for your enquiry. General forms are not intended for files, identity document copies, medical records, payment card details, exact coordinates, routes or personnel lists. Do not provide passwords, PINs, CVVs or verification codes. Describe military needs in general terms first; send necessary supporting materials only through a method agreed with the Foundation and to the minimum extent needed.

If an enquiry genuinely requires health information or other data given special protection by law, we establish a separate lawful basis and a secure way to receive them. Sending excessive information does not authorise its use for other purposes. Before providing another person’s data, make sure you have authority or another lawful basis to do so.

5. Donations and payment information

For an IBAN transfer, the Foundation receives the bank information accompanying the payment: the payer details included in the banking document, date, amount, currency, reference and transaction identifier. For reconciliation or a refund, we may ask for a receipt with unnecessary information concealed.

When you choose a LiqPay or WayForPay payment page, the website sends the selected service the amount, currency, purpose, payment identifier and technical addresses for receiving the result. Payment credentials are entered with the selected service. The Foundation processes verified statuses, identifiers and transaction amounts for reconciliation and accounting; full card details, CVVs, PINs and banking passwords are not stored in the website database. For separately authorised recurring payments, the operator also processes the payment instruction’s parameters and the means of authorising repeated charges.

When you follow a link to Privat24, a charitable Envelope or mono, the selected banking service processes the data. Merely reading this notice does not send your data to all the payment services named here.

6. Who may receive information

Only authorised people within the Foundation have access for their assigned tasks: handling an enquiry, arranging assistance, accounting or technical support. Technical data go to the hosting and network protection services actually involved in operating the website; correspondence goes through the email service and to the recipients of the agreed communication. Processors acting on the Foundation’s instructions receive only the data needed and tasks defined in a written agreement.

Your selected bank or payment service independently fulfils its own banking, payment and statutory obligations. LiqPay is a PrivatBank payment solution; mono is a service of JSC Universal Bank. Their rules apply to actions on the relevant external pages. Naming a service here does not mean that it receives every visitor’s data.

Necessary information may be given to a counterparty for an agreed delivery of assistance, a professional adviser bound by confidentiality, or a competent authority on a lawful basis. We do not sell personal data. On request, we will identify the actual recipients of your data unless the law restricts that disclosure.

With the corresponding permission, measurement data are received by Google: the legal entity identified in the Google Analytics or Google Ads terms applicable to the Foundation, and its processing service providers. The Google group includes Google LLC (United States) and Google Ireland Limited (Ireland). Depending on the service and terms, Google processes data on instructions or for its own purposes specified in those terms; the recipient’s role is not identical for every service. We do not send these services submission contents, names, contact details, bank details, amounts or transaction identifiers. Google and its rules: https://policies.google.com/privacy; its subprocessors: https://business.safety.google/adssubprocessors/. On request, the Foundation will identify the actual recipient and terms applicable to the processing of your data.

7. Processing outside Ukraine

Internet communications, cloud services and an international payment you select may involve processing outside Ukraine. A transfer to a foreign recipient is permitted only on a basis allowed by Article 29 of Ukraine’s Law on Personal Data Protection: an adequate level of protection in the recipient country or another applicable statutory basis, including appropriate safeguards or the necessity of performing a transaction for the individual’s benefit. Acknowledging this notice does not replace separate transfer consent where that consent is required.

On request to info@solodkoshkuridin.org, we will explain the countries, recipients and grounds for actual transfers of your data and provide the available substance of the safeguards without disclosing other people’s data or protected information. If GDPR applies to the transfer, an appropriate basis under its Chapter V is also required; a service agreement alone is insufficient.

This also applies to Google Analytics and Google Ads: permitted measurement data may be processed outside Ukraine, including in the United States, Ireland and other countries where Google or its providers have infrastructure. Transfers must satisfy Article 29 of Ukraine’s Law on Personal Data Protection: an adequate level of protection or another applicable ground, including appropriate safeguards. Measurement consent does not replace verification of a lawful international transfer ground. Where GDPR applies, the Foundation also ensures an applicable ground under Chapter V; Google Consent Mode settings alone do not provide one. Information about actual recipients, countries and safeguards is available through the Foundation’s contacts in section 1.

8. Browser storage, cookies and technical requests

When you open a page, the browser sends network services your IP address and technical request information needed to deliver content and protect the connection. The website loads its own pages, images, fonts and program files and checks which actions are available. A payment service opens after you select the corresponding method.

Entered fields remain in the open page’s memory until submission or clearing. The website does not write enquiry text, names, email addresses or telephone numbers to localStorage or sessionStorage. Tab history may retain your selected purpose, amount, currency, donation method and technical selection context. A payment status page address may contain a unique access identifier: keep that link private. Your browser controls history, bookmarks, autofill and tab restoration.

After you save privacy settings, localStorage holds a fundPrivacyPreferences record: the version, separate analytics and advertising measurement choices, and save and expiry times. Your choice lasts up to 180 days from saving, or until cleared sooner; a new choice is required after expiry. Changing advertising permission alone does not reset the valid analytics permission period. Previous analytics permission does not become advertising permission. With analytics permission, _ga and _ga_* cookies may be used. Only with separate advertising measurement permission may related technical cookies, such as _gcl_* or _gac_*, be used if the Google tag actually sets them. Permitted browser cookies last no longer than 180 days; cookies with shorter lifetimes retain that shorter period, and no extension beyond the current permission period occurs without a new permission. sessionStorage may hold only fixed boolean markers of target actions already measured, without personal, advertising, bank or submission identifiers. They last until the tab session ends, analytics permission is withdrawn or expires, or all preferences are cleared. Withdrawing and regranting only advertising permission while analytics remains valid does not clear these markers, so the same action is not counted again. An external banking service determines its necessary security mechanisms and cookies when you visit it.

9. Optional technologies and your choice

With analytics permission, the site uses Google Analytics 4 for statistics about public pages and interactions. Google receives permitted events, browser information, analytics identifiers and your IP address during the connection. Events contain only defined technical fields and cleaned page addresses. We do not send measurement services form contents, names, contact details, arbitrary URL parameters or fragments, bank details, amounts, submission identifiers or payment identifiers.

With additional separate advertising effectiveness measurement permission, the site may send Google only validated advertising identifiers gclid, gbraid or wbraid and the corresponding permitted events to match results of the Foundation’s Google Ads campaigns and optimise their delivery. This exception covers only those identifiers, not other URL parameters. The events are a deliberate visit to the exact bank envelope for the minibus fundraiser or the ongoing OCHI fundraiser, and an offer of assistance from a company or an individual whose acceptance and notification sending are confirmed by our server. A bank visit does not confirm a donation; submitting an offer does not confirm funding or an agreement. A page view, QR display or copying bank details is not one of these target actions.

Both permissions are initially off. Without analytics permission, the Google tag and optional events are neither loaded nor sent. Analytics permission alone does not permit sharing advertising identifiers or using events for advertising matching. Advertising measurement in this system requires separately selecting both permissions. Personalised advertising, Google Signals, remarketing, enhanced conversions and offline conversion uploads remain disabled.

Refusal does not restrict donations, forms or access to the site. Privacy settings in the page footer let you change either choice, withdraw only advertising permission, withdraw all optional permissions or clear your choice. Withdrawing only advertising permission stops the corresponding future measurement and clears advertising identifiers and advertising cookies accessible to this site. While analytics permission remains valid, fixed boolean markers of target actions already measured, without identifiers, are retained under section 8; regranting advertising permission does not cause a past action to be counted or sent again. Withdrawing analytics, reaching its expiry or clearing all preferences also turns off advertising measurement, removes the corresponding cookies accessible to this site and clears these markers. The site cannot delete other domains’ cookies or automatically erase data already sent to Google. For access, erasure or other rights, contact the Foundation under section 12. Withdrawal does not affect the lawfulness of prior processing based on consent. If saving your choice is blocked or permission has expired, the corresponding optional measurement is off.

10. Retention periods

We retain ordinary initial messages and offers that have not become records of a separate legal relationship for no longer than 365 days from creation of the enquiry record. Unneeded data may be deleted sooner. For continuing cooperation, we retain only the necessary information in the relevant arrangement’s records; this does not automatically extend the life of the entire initial submission.

Donation, aid delivery, contract, accounting and tax documents have separate statutory periods. For primary documents, accounting registers and other documents covered by Tax Code paragraph 44.3.2, the minimum is 1,825 days from submission of the relevant return or, if none was filed, its statutory filing deadline. Specified categories have longer periods, extensions while limitation periods are suspended and preservation rules for audits or disputes. Annual financial statements and records of archival value follow their own mandatory schedule, rather than the ordinary enquiry period.

Formal citizens’ appeals and the records of their examination are retained for 5 years, counted from 1 January following closure of the case; for repeated appeals, the period follows the last examination, or longer where law requires. The substance of a message determines its category, whether it arrives through a form or by email.

Ordinary technical logs under the Foundation’s control are kept for up to 30 days. Request limiting uses a protected derived identifier with a one-day cleanup horizon; expired records are removed in bounded batches on subsequent activity. Minimal records of personal data operations have a separate period: one year after the end of the year of the operation, unless the law specifies otherwise. Technical records of unfinished payments are reviewed monthly and removed after reconciliation when no transaction, dispute or other lawful need requires preservation.

Optional measurement retention periods differ by storage location. In the browser, your choice and permitted cookies last up to 180 days, or a cookie’s shorter lifetime, as explained in section 8. This does not mean that Google deletes all received data after 180 days or immediately on withdrawal.

For user and event data, including key events, covered by GA4’s retention setting, the Foundation selects 2 months without automatically resetting identifier retention through new activity. Google deletes expired data in its monthly cycle. This setting does not determine the retention of standard aggregated reports and is not the Google Ads retention period. Aggregated reports, advertising reports, technical logs and other Google data follow the relevant service’s separate rules and legal obligations; we do not set one guaranteed 180-day or 2-month limit for all such data. Google’s rules: https://support.google.com/analytics/answer/7667196 and https://policies.google.com/technologies/retention. For data that can be linked to you, the Foundation handles requests under sections 11–13 using available service tools.

11. Deletion, exceptions and copies

Once its period ends, an ordinary record is excluded from routine processing, notifications and exports and deleted in the next cleanup cycle. A deletion request accepted for execution also stops routine use. Where specific information is needed for a legal obligation or dispute, access is restricted and the grounds and need for preservation are reviewed at least monthly. Waiting for an internal review is not, by itself, an indefinite basis for keeping a submission.

Foundation-managed backups and working exports of ordinary enquiries expire within 30 days of the copy’s creation. Restoration applies deletion markers so that old records do not return to use. Minimal protected markers and the journal are retained to meet recordkeeping duties and prevent restoration while relevant older copies may exist. They contain neither enquiry text nor contact details, but are protected as data-related records.

Working emails and attachments under the Foundation’s control follow their category’s retention period. Copies in your mailbox, bank records and independent providers’ archives also follow their own lawful rules. Deleting from the website database does not recall a delivered email or mean immediate physical erasure from every storage medium.

12. Your rights and how to contact us

You may learn the sources, location, purposes and grounds of processing, recipients and contents of your data; obtain access; make a reasoned objection; request correction of inaccurate data or deletion of unlawfully processed data; withdraw consent where processing relies on it; and complain to the Ukrainian Parliament Commissioner for Human Rights or a court. You also have the statutory rights concerning the mechanism of automated processing and protection against automated decisions with legal consequences. The Foundation does not make decisions on granting assistance solely by automated means.

Write to info@solodkoshkuridin.org or the Foundation’s postal address. Describe the data and action concerned; where available, include an enquiry number or payment reference without card secrets. For a formal request to access your own data, Ukrainian law requires surname, given name, patronymic, place of residence or stay and identity document details. Contact us to arrange a safe verification method; a complete passport copy is not a standard requirement for every email. We also verify a representative’s authority. Additional information is requested only to the extent needed for lawful verification and protection of your data.

Access to your own data and exercise of statutory rights are free, subject only to exceptions expressly permitted by law.

13. Response times

We assess a personal data access request within 10 working days of receipt, explain the outcome and grounds, and fulfil it within 30 calendar days unless law provides otherwise. Access to your own data cannot be deferred. A reasoned demand to prohibit processing or change the data’s composition or contents is examined within 10 days; an established inaccuracy is corrected without delay. We notify you and the appropriate recipients of changes, deletion, destruction or access restrictions within 10 working days in accordance with Article 21 of the Law.

Withdrawal of consent stops processing for which consent was the sole basis; it does not invalidate prior lawful processing or a separate duty to retain records. Requests governed by Ukraine’s Law on Citizens’ Appeals follow its periods: without additional examination, without delay and no later than 15 days; ordinarily, within one month; a justified extension with notice, no more than 45 days in total. These periods do not replace shorter special data protection deadlines. We give reasons for a refusal and explain how to challenge it.

14. Representatives, children and public materials

Forms are intended for adults acting for themselves or duly authorised representatives. Where assistance concerns a child, a parent or other legal representative provides the necessary information; excessive child data are not needed in general messages. Tell the Foundation if you discover that a child’s data have been provided unlawfully.

Contacting us or making a donation does not authorise publication of a name, donation amount, photograph or beneficiary’s story. For those materials, we separately agree the purpose, scope and means of publication or verify another statutory basis. A partner’s representative must confirm authority to provide the name, logo and materials. Public reports are checked for unnecessary personal information and risks to people, military units and aid delivery. You may contact the Foundation to end an agreed publication; copies independently distributed by third parties also require contact with those parties.

15. Information security

We restrict access according to operational need, separate public material from private records, validate incoming data, protect transmission and control backups and data operations. These measures reduce risk, but no system can guarantee absolute security.

Report an error or possible disclosure to info@solodkoshkuridin.org without forwarding unnecessary information about other people. The Foundation investigates, limits the effects and notifies affected people and competent authorities in the cases and within the periods required by applicable law.

16. When GDPR applies

Access to a Ukrainian website from another country does not by itself determine GDPR’s applicability. It applies to particular processing where its territorial conditions are met, including processing in the context of an establishment in the EU, deliberately offering services to people in the EU or monitoring their behaviour there.

Where GDPR applies, necessary steps at your request and performance of an arrangement rely on Article 6(1)(b), separate voluntary consent on Article 6(1)(a), and security, proper recordkeeping and protection of rights on Article 6(1)(f) after a balancing assessment. Article 6(1)(c) is used only for an obligation under applicable EU or Member State law; a Ukrainian accounting obligation does not by itself meet that requirement.

In that case, alongside applicable Ukrainian rights, you have rights of access and a copy, correction, erasure subject to the statutory conditions, restriction, objection to processing based on legitimate interests, and portability of data you provided where processing is automated and based on consent or contract. Consent can be withdrawn without affecting earlier lawful processing. You may complain to a competent EU data protection authority, including in the country of your habitual residence, work or the alleged infringement, and seek a judicial remedy.

We respond to a GDPR request without undue delay and within one month. Where complexity or the number of requests justifies an extension of up to two further months, we explain the reasons within the first month. This does not permit delay beyond a shorter mandatory deadline under another applicable law.

17. Version and changes

Version 1.1. Effective date: 26 October 2026. The Ukrainian and English versions convey the same rules. The current version is available on this page. A material change to purposes, data, recipients or rights is reflected in an updated notice and communicated appropriately; where fresh consent is required, we request it before the processing concerned. A new version does not itself authorise incompatible use of data already received.