1. Controller and contact
The controller of personal data is Fundacja EUROPEJSKI INSTYTUT PRAW CZŁOWIEKA WHITE‑RED, ul. Celulozy 107M/1, 04‑986 Warsaw, Poland, KRS 0000778251, NIP 9522194947, REGON 382896144. Contact: whiteredfoundation@gmail.com.
If the Foundation appoints a Data Protection Officer, the contact details will be published on this page. Until then, privacy requests may be sent to the Foundation's general email address.
2. What data we process
Depending on how you use the website, we may process identification and contact data, correspondence, information needed for project participation, donations, browser and device data, IP addresses, server logs and cookie-related identifiers. If you consent to optional statistics, Google Analytics 4 may process page views, traffic sources, device information, approximate location and cookie identifiers.
We do not ask for special-category data through ordinary website forms. If a specific Foundation activity requires such data, a separate information notice and an appropriate legal basis will be provided.
3. Purposes and legal bases
We process data to answer enquiries, arrange and carry out cooperation and projects, process donations, comply with applicable legal obligations, defend legal claims and protect website security. Subject to your prior consent, we also use Google Analytics 4 to understand aggregate website usage. Refusing statistics has no effect on your ability to access the website.
The legal bases are, as applicable, Article 6(1)(a), (b), (c) and (f) GDPR. Where processing relies on legitimate interests, those interests include responding to correspondence, maintaining institutional relationships, securing IT systems, documenting activities and protecting legal claims.
4. Donations and payment data
When online donations are enabled, payment data will be processed through a secure payment provider. The Foundation intends to use Stripe-hosted checkout. The payment provider may process data under its own privacy terms and legal obligations. The Foundation does not need to receive full payment-card data in order to record the donation.
5. Recipients and processors
Data may be made available, where necessary, to hosting providers, email providers, payment operators, professional advisers, partner organisations and public authorities where lawful. If analytics consent is given, data may also be processed by Google as the provider of Google Analytics 4. Processing may involve transfers outside the EEA subject to applicable safeguards. Google's privacy information: https://policies.google.com/privacy.
The website is built with Webflow. Depending on the service configuration, Webflow and other technology providers may process technical data in connection with hosting and site operation.
6. International transfers
Some technology providers may process data outside the European Economic Area. Where such transfers occur, the Foundation relies on mechanisms permitted by the GDPR, such as an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism applicable to the provider and service.
7. Retention
Correspondence is retained for the period necessary to handle the matter and, where justified, for the period needed to protect against claims. Donation, accounting and tax records are retained for the periods required by applicable law, generally for at least the statutory accounting and tax retention period. Project documentation is retained for the period required by the relevant funding rules, agreements and law.
8. Your rights
Depending on the legal basis and circumstances, you may have rights of access, rectification, erasure, restriction, portability and objection. Consent may be withdrawn at any time without affecting prior lawful processing. To change your analytics choice, use the website’s “Cookie settings” control. You may contact the Foundation at whiteredfoundation@gmail.com.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
9. Voluntary provision of data
Providing data is generally voluntary, but it may be necessary to answer a request, register participation, enter into cooperation or process a donation. If information is legally required, the relevant notice will indicate that fact.
10. Automated decisions
The Foundation does not use website data to make decisions producing legal or similarly significant effects solely by automated means. Payment providers may use automated fraud-prevention measures under their own rules.
11. Changes to this policy
This policy may be updated when the website, legal requirements or the Foundation's processing activities change. The current version and update date will be published here.