Privacy policy

1. Who is responsible for your data

The controller of the personal data processed through this website (grenzenlose-kinderhilfe.com) is:

• Határtalan Segítség Alapítvány (Grenzenlose Kinderhilfe)
• Registered office: 4405 Nyíregyháza, Molnár utca 26, Hungary
• Tax number: 19102186115
• Represented by: Kocsik Enikő, chair of the board of trustees
• Email: hatartalansegitsegalapitvany@gmail.com

We are not required to appoint a data protection officer and have not done so. Please send any question or request about your personal data to the email address above.

This policy follows the General Data Protection Regulation of the EU (Regulation (EU) 2016/679, “GDPR”) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information.

2. What data we process, and why

Visiting the website

When you open a page, your browser automatically sends technical data to the server of our hosting provider: your IP address, the date and time of the request, the page requested, the referring page, and your browser and operating system. This is necessary to deliver the pages to you and to protect the server against misuse and attacks.

• Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).
• Retention: the server logs are deleted automatically by the hosting provider’s log rotation, after a few weeks at the latest.

Visitor statistics (Google Analytics), only with your consent

If you accept statistics cookies in the cookie banner, we use Google Analytics 4 to understand how the website is used, so we can improve it. Google Analytics then records: the pages you view and how long you stay, the use of buttons and links (for example the donation buttons, email and phone links, starting a video, switching the language), the website you came from, your device type, browser, screen size and language, and your approximate location (country and city, derived from your IP address; Google Analytics 4 does not store IP addresses). For card donations, we also record the amount, currency and frequency you selected on our website. Analytics never receives your name, email address or card details.

Google Analytics is not loaded at all until you consent. Advertising features (Google signals, ad personalisation) are switched off.

• Legal basis: your consent (Art. 6(1)(a) GDPR; for storing and reading cookies, section 155(4) of Hungarian Act C of 2003 on electronic communications).
• Retention: event-level data is deleted automatically from Google Analytics after 2 months. The cookies themselves are described in the cookie policy.
• Withdrawing consent: at any time via “Cookie settings” at the bottom of every page. Withdrawal does not affect the lawfulness of the processing before it.

Card donations (Stripe)

Card donations are processed by Stripe on its own payment pages. Stripe processes the data you enter there (name, email address, card details, billing address) as an independent controller under its own privacy policy. From Stripe, we receive your name, email address, the amount and date of the donation, and for monthly donations the status of the subscription. We never receive your full card number.

• Purpose: processing the donation, sending a confirmation, managing monthly donations, bookkeeping.
• Legal basis: carrying out the donation you asked for (Art. 6(1)(b) GDPR) and our legal obligation to keep accounting records (Art. 6(1)(c) GDPR).
• Retention: 8 years, as required by section 169 of Hungarian Act C of 2000 on accounting.

Donations by bank transfer or TWINT

For bank transfers and TWINT payments, we receive the data your bank or TWINT passes on to us: your name, your account number or phone number, the amount, the date and the payment reference. The purpose, legal basis and retention are the same as for card donations.

Contacting us

If you write to us by email or call us, we process your name, your email address or phone number and the content of your message, in order to answer you.

• Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), or, if your enquiry is about a donation, Art. 6(1)(b) GDPR.
• Retention: until your enquiry is settled, then for at most one more year, unless the correspondence has to be kept as an accounting record.

Our email account is provided by Google (Gmail), so your emails are also processed by Google.

Content loaded from other services

To keep the website up to date, some content is loaded directly from other servers while you view a page. Your browser then connects to these servers, which receive your IP address and browser data:

• Articles, videos and the list of supported institutions: from a public Google Sheets spreadsheet (Google).
• Blog posts: from our own blog at blog.grenzenlose-kinderhilfe.com.
• Video previews: the preview images come from YouTube’s image server (Google). The YouTube player itself is only loaded when you press play, from YouTube’s privacy-enhanced domain (youtube-nocookie.com). From then on, Google’s privacy policy applies to the video.
• Map of our delivery locations: embedded from Google My Maps (Google).

Legal basis: our legitimate interest in showing current content (Art. 6(1)(f) GDPR). We do not receive or store these data ourselves.

Settings stored in your browser

Your choice of language and your cookie choice are stored in your browser, so you are not asked again on every page. They are never sent to us. Details are in the cookie policy.

3. Who receives your data

We use the following service providers. Where they process data on our behalf, they act as processors bound by a data processing agreement:

• Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA: hosting of the website (processor).
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: Google Analytics (only with your consent), Google Sheets, YouTube, Google My Maps and email (Gmail).
• Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland: card payments (independent controller).

We do not sell your data, we do not use it for advertising, and we do not make automated decisions or profiles about you.

4. Transfers outside the European Union

Our hosting provider Namecheap, Inc. is based in the United States, and the website is served from a data centre there. This transfer is based on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR), which are part of Namecheap’s data processing agreement.

Google and Stripe may also process data in the United States. Their US parent companies, Google LLC and Stripe, Inc., are certified under the EU–U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR).

5. Your rights

Under the GDPR, you have the right to:

• access your personal data and receive a copy of it (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17), unless we must keep it, for example as an accounting record;
• have the processing restricted (Art. 18);
• receive the data you provided in a machine-readable format (data portability, Art. 20);
• object to processing based on our legitimate interest (Art. 21);
• withdraw your consent at any time, without affecting the lawfulness of the processing before the withdrawal (Art. 7(3)).

Send your request to hatartalansegitsegalapitvany@gmail.com. We will answer within one month at the latest. We may ask you to confirm your identity first.

6. Complaints

If you think we are processing your data unlawfully, please contact us first, so we can put it right. You also have the right to lodge a complaint with the Hungarian data protection authority:

• Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
• Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary
• Postal address: 1363 Budapest, Pf. 9, Hungary
• Phone: +36 1 391 1400
• Email: ugyfelszolgalat@naih.hu
• Website: naih.hu

You can also lodge a complaint with the supervisory authority of the EU member state where you live or work, or take legal action in court. In Hungary, the regional courts (törvényszék) hear these cases, and you may bring the case before the court of your place of residence.

7. Security

The website is only served over an encrypted connection (HTTPS). Donor data is accessible only to the members of the foundation who need it for their work.

8. Changes to this policy

We update this policy when our website or our processing changes. The date of the latest version is shown at the top of this page.