1 Data Controller

The data controller responsible for your personal data is:

• Organisation: Fundacja Warto Żyć Dla Kogoś
• Address: ul. Szkolna 7, 63-421 Przygodzice, Poland
• KRS (Registry No.): 0000844132
• NIP (Tax ID): 6222830320
• Email: fundacja.wzdk@gmail.com
• Phone: 503 592 869

2 What Data We Collect

We may collect the following categories of personal data:

• Contact information – your name, email address, and phone number when you contact us via our contact form or email.
• Donation data – information related to financial contributions you make, such as your name and transaction reference, as required for accounting and legal purposes.
• Communication data – the content of messages, enquiries, or correspondence you send to us.
• Technical data – your IP address, browser type, device type, and pages visited on our website, collected automatically via server logs and analytics tools.
• Cookie data – information stored in cookies placed on your device when you visit our website (see Section 8).

We do not collect sensitive personal data (such as health data, racial or ethnic origin, or financial account details) unless you voluntarily provide it in the context of a specific fundraiser or support request, and only to the extent necessary to assist you.

3 How We Use Your Data

We use the personal data we collect for the following purposes:

• To respond to your enquiries and communicate with you effectively.
• To process and acknowledge donations made to the Foundation.
• To fulfil our legal and accounting obligations as a registered charitable foundation.
• To operate and improve our website and online services.
• To send you updates about our activities, fundraisers, and events — only where you have given your consent.
• To protect the security and integrity of our website and prevent fraud.

We will never use your data for commercial marketing purposes or sell it to third parties for advertising.

4 Legal Basis for Processing

We process your personal data on the following legal grounds under the General Data Protection Regulation (GDPR) and applicable Polish law:

• Consent (Art. 6(1)(a) GDPR) – where you have explicitly agreed to receive communications from us.
• Contract performance (Art. 6(1)(b) GDPR) – where processing is necessary to fulfil a donation or service request.
• Legal obligation (Art. 6(1)(c) GDPR) – where we are required to process data to comply with Polish accounting, tax, or charity law.
• Legitimate interests (Art. 6(1)(f) GDPR) – where processing is necessary for our legitimate interests as a charitable foundation, such as website security and fraud prevention, provided these interests are not overridden by your rights.

5 Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We may share your data only in the following limited circumstances:

• Service providers – trusted third-party providers who assist us in operating our website or processing donations (e.g., hosting providers, email services), acting as data processors under appropriate data processing agreements.
• Legal authorities – where we are legally required to disclose information to Polish public authorities, courts, or law enforcement agencies.
• Partner organisations – with your explicit consent, where a specific fundraiser involves a partner organisation (e.g., a hospital or co-organising charity).

Any third party receiving your data is required to handle it in accordance with applicable data protection law and our instructions.

6 Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

• Contact form data – retained for up to 12 months after your enquiry is resolved, unless a longer period is required.
• Donation records – retained for a minimum of 5 years in accordance with Polish accounting and tax regulations.
• Technical/log data – typically retained for up to 90 days for security and diagnostic purposes.
• Marketing consent – retained until you withdraw your consent.

When data is no longer needed, it is securely deleted or anonymised.

7 Your Rights

Under the GDPR and applicable Polish data protection law, you have the following rights regarding your personal data:

• Right of access – you may request a copy of the personal data we hold about you.
• Right to rectification – you may ask us to correct inaccurate or incomplete data.
• Right to erasure – you may request that we delete your personal data, subject to legal retention requirements.
• Right to restriction – you may ask us to restrict the processing of your data in certain circumstances.
• Right to data portability – you may request your data in a structured, machine-readable format.
• Right to object – you may object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent – where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at fundacja.wzdk@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Polish data protection authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

8 Cookies and Tracking

Our website may use cookies — small text files stored on your device — to ensure the proper functioning of the site and to analyse visitor behaviour. We use the following types of cookies:

• Strictly necessary cookies – essential for the website to function correctly. These cannot be disabled.
• Analytical cookies – help us understand how visitors use our website (e.g., Google Analytics). These are only placed with your consent.

You can control or delete cookies through your browser settings at any time. Disabling cookies may affect the functionality of certain parts of our website. For more information about cookies, visit aboutcookies.org.

9 Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. These measures include:

• Use of HTTPS (SSL/TLS encryption) for all data transmitted via our website.
• Access controls limiting who within the Foundation can access personal data.
• Regular review of our data handling practices.

However, no method of transmission over the internet is 100% secure. If you have concerns about the security of your data, please contact us immediately.

10 Children's Privacy

Our website is not directed at children under the age of 16. We do not knowingly collect personal data from children without verifiable parental or guardian consent. Fundraisers conducted on behalf of children are managed through their parents or legal guardians, who are the data subjects for the purposes of this Policy.

If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete it.

11 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we provide. The date of the most recent revision is shown at the top of this page.

We encourage you to review this Policy periodically. Continued use of our website after any changes constitutes your acknowledgment of the updated Policy.

12 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please do not hesitate to contact us: