Privacy policy
· in force from the date of publication
Other documentsPrivacy policy
1. Who is responsible for your information
The personal data controller is INTERNATIONAL CHARITABLE FOUNDATION «ACTION HORIZON», EDRPOU 46238820 (the Foundation).
Address: 10 Kropyvnytskoho Street, Pecherskyi district, Kyiv, 01024, Ukraine. Contact: horizontdiy.help@gmail.com, subject “Personal data”.
This policy explains processing when using horizontdiy.org, donating and communicating. Separate programmes or forms receive additional notices before collecting other information. This is a processing notice, not blanket consent to any use of information.
2. Information we receive
| Situation | Information and source |
|---|---|
| Browsing | IP address, time, request address / result and technical headers in server / security logs |
| Correspondence | Email, name and contacts if supplied, content and attachments |
| Bank donation | Amount, currency, date, purpose, reference and payer information supplied by the bank in its statement |
| Donation form | Chosen amount, campaign / area, frequency, email, optional name and choices; for online payment, also acceptance of the offer and, for recurring support, the separate authorisation of automatic charges (text, version, time). Information may reach the server for validation. When online payment is disabled, completion does not charge funds |
| Online payment through WayForPay, once enabled | From WayForPay: order number, amount, currency, transaction status and date, payment method, masked card number (we keep no more than the last four digits), refund information; for recurring support, the status of the recurring payment and charge dates. An email or phone number entered on the payment page may arrive with the transaction status |
| Recurring online support | Email, amount, frequency, support dates and status, cancellation history; for the personal management link, only a hash of the secret key, not the key itself |
| Cookie choice, when analytics is configured | Analytics permission / refusal, explicit-choice time and version in the browser cookie |
| Analytics, after configuration and permission | Public page views, permitted events, approximate region, device / browser type, time, referral source and pseudonymous identifiers |
You enter card details only on WayForPay’s payment page; the service processes them under its own rules. The Foundation does not receive or store full card numbers, CVV / CVC, PINs or banking passwords. Do not send them to the Foundation. Banks and external pages process payment details under their own rules.
An initial aid request needs a description and reply contact. Do not send passport copies, medical records, children’s information or sensitive military details without arrangement. Necessary processing of those categories requires a separate basis, scope and secure channel.
Required and optional fields
Amount is needed for selection and validation. Name is optional; if supplied, it is used to address you and communicate about the contribution or enquiry. It is not published without prior written consent.
Email is optional for a one-off contribution. To choose recurring support, the current form requires email: we use it for a setup confirmation with a personal management link, a cancellation confirmation and other service emails about that support method. The requirement also applies when online payment is disabled. Without it, that form option cannot proceed; one-off contributions and direct IBAN remain available. An address does not subscribe you to news or reports. Email is needed if you separately choose campaign updates; the subscription is voluntary.
A direct transfer to the published IBAN does not require giving email or name through the Foundation’s form. The bank sets payment information and provides confirmation; we receive a statement. Reconciliation requires date, amount, currency, purpose, safe evidence and a reply contact; without sufficient information, we may be unable to identify the transfer or reply.
Information from other sources
We receive some information from others rather than directly from you: bank statements from JSC PUMB and online transaction information from WayForPay. Article 12 of Ukraine’s personal data protection law requires notice of the Foundation, information, purposes, rights and recipients at direct collection, or within 30 working days of collecting a statement or other indirect-source information, except statutory cases. We use this policy, notices beside bank details and the form, service emails and an appropriate available channel. Publication does not prove individual notification; an absent contact does not automatically create an exception. A WayForPay receipt does not replace the Foundation’s notice.
Where the GDPR also applies, Article 14 notice is provided within a reasonable period, no later than one month after receipt, or earlier at first contact or disclosure to another recipient. It includes source, categories and other required information. Article 14(5) exceptions are assessed separately and do not replace Ukrainian requirements.
3. Purposes and lawful bases
| Purpose | Basis under Ukrainian law | GDPR basis, where it governs this processing |
|---|---|---|
| Receive a donation, clarify its purpose and answer enquiries about contract performance | Concluding and performing a donation agreement | Article 6(1)(b), only for information necessary for a contract with that individual or steps at their request before a contract |
| Process an online payment through WayForPay, operate recurring support under your authorisation, send service emails about it, review refunds | Concluding and performing the donation agreement and the payment mandate you authorised | Article 6(1)(b), only for necessary information; a payment mandate is not general consent under Article 6(1)(a) |
| Maintain accounts and mandatory records | Applicable Ukrainian accounting and tax duties | Article 6(1)(f): the Foundation’s legitimate interest in accurate donation accounting, checking their designated use and protecting rights; only necessary accounting information, following a documented necessity and rights-balancing assessment |
| Handle enquiries or partnership proposals | Requested steps before a contract, where relevant; an appropriately assessed legitimate interest in replying | Article 6(1)(b) for necessary pre-contractual steps at your request; for other enquiries, Article 6(1)(f) after assessing necessity and balancing rights |
| Operate and protect the website, investigate abuse | An appropriately assessed legitimate interest in service security | Article 6(1)(f) after assessing necessity, proportionality and impact on individuals' rights |
| Measure website visits after analytics is configured | Your separate, withdrawable consent | Article 6(1)(a), separate voluntary consent |
| Send voluntarily chosen updates; publish donor or aid-recipient information | Separate consent; public reporting requires prior written consent under the Statute | Article 6(1)(a); donating alone does not provide consent |
| Handle personal data requests | Applicable Ukrainian data-protection duties | Article 6(1)(c) for compliance with the relevant duties imposed by the GDPR itself |
| Disclose information to a competent authority | A verified applicable Ukrainian legal requirement | Article 6(1)(c), only where the duty has an applicable EU / Member State legal basis; in other specific cases, Article 6(1)(f) only after a separate assessment of necessity, the Foundation’s interest in lawful operations / protecting rights and the balance of rights. For requests from third-country authorities, Article 6(1)(f) may apply only in exceptional, justified cases; Article 48 and Chapter V where applicable |
| Defend a legal claim | An appropriately assessed legitimate interest in protecting rights | Article 6(1)(f) after assessing necessity and balancing rights |
Ukrainian legal duties apply separately. They do not by themselves establish a basis under GDPR Article 6(1)(c), which requires applicable EU or Member State law under Article 6(3). For each processing activity governed by the GDPR, we establish a separate basis before it starts; legitimate interests do not apply automatically. Consent is not a universal basis for accounting or mandatory records. Declining optional analytics does not prevent browsing, contacting us or donating.
A request from an authority alone does not justify disclosure. If our check does not establish an appropriate basis and applicable transfer conditions, we do not disclose information in response to that request. We do not collect additional information just in case authorities might request it.
4. Analytics and external content
Google Analytics and Google Tag Manager are currently not configured. Once analytics is configured, its banner and “Cookie settings” appear with it; GA4 through GTM will start only after permission. Refusing does not prevent browsing, contacting us, transferring a donation or paying online. The Cookie policy explains changing and withdrawing permission.
Permitted analytics is planned for public page views, technical information and pseudonymous identifiers, which are not necessarily anonymous. Names, emails, phones, enquiry text, card information, order and transaction numbers, secret management links and URL parameters must be excluded. Advertising profiling and our own event exports are outside the planned use. Management pages and internal / editorial previews are excluded from analytics.
The YouTube player loads after you click the video; its iframe is not connected beforehand. Once loaded, Google / YouTube receives technical connection information and may use storage under Google’s notices (opens in a new tab). Playing does not authorise GA or optional advertising tracking. Do not start the player if you do not wish to connect it.
5. Who may receive information
Responsible personnel and authorised contractors have access only as needed. The main services are:
| Recipient / service | Purpose and information | Location and role |
|---|---|---|
| DigitalOcean, LLC — hosting | Website operation, logs, files and managed backups | VPS in Frankfurt, Germany; US company. Processor for hosted information; its own account operations follow service terms |
| WayForPay — ТОВ ФК «ВЕЙ ФОР ПЕЙ», EDRPOU 39626179, only for online payment, once enabled | Processing online payments, recurring charges and refunds. The Foundation passes the amount, currency, order number, a description of the purpose without personal information and the page language; email and name only if you provided them. You enter card details and any other information requested by the payment page directly on WayForPay’s page. The Foundation receives the information listed in section 2 from the service | Ukraine; payment service provider licensed by the National Bank of Ukraine. Processes payer information on its own account for the payment service, financial monitoring and fraud prevention under its public agreement for payers (opens in a new tab) and the law; roles for information passed by the Foundation are set by the Foundation’s agreement with WayForPay |
| Brevo — Sendinblue SAS, France | Selected service-email provider, including emails about recurring support: address, name if supplied, subject / content, necessary links including the personal management link, and technical delivery information | Processor for sending; infrastructure / subprocessors follow service terms |
| Google — Gmail | Enquiries and replies at horizontdiy.help@gmail.com, contacts and attachments | Google’s international infrastructure; roles and its own operations follow service terms and policy |
| JSC First Ukrainian International Bank (FUIB / PUMB) | Transfers and payer / transaction information in statements, including payouts from WayForPay | Ukraine; independent controller for banking services and its own legal duties |
| Google — YouTube; GA4 / GTM only after configuration and consent | YouTube: technical information after playing; analytics: permitted events / identifiers | International infrastructure; roles depend on the relevant service and terms |
Service messages do not subscribe you to news. Brevo receives information for delivery; optional open / click measurement requires separate assessment and a basis, rather than following from delivery. Replies to service messages go to the Foundation’s contact Gmail. WayForPay sends receipts and notices about online payments and upcoming recurring charges in its own name under its own rules.
Accounting / legal advisers receive necessary access. Authorities receive information only after powers, basis and scope are checked, including the international requirements in sections 3 and 6. We do not sell information or provide it for third-party advertising.
Public reports may contain donor or aid-recipient information only with prior written consent under Statute section 8.4. We do not publish serving military personnel’s personal information, numbers and deployment locations of military units receiving aid, contacts, banking information or other dangerous information. Giving a name in a form or on the payment page does not authorise publication.
6. Processing in other countries
The server is in Germany. Brevo is a French provider; DigitalOcean is a US company; Google may use international infrastructure. WayForPay is a Ukrainian payment service provider; its terms determine processing locations and subprocessors. A storage region does not mean all access and operations occur only in the EU.
Article 29 of the Ukrainian law requires adequate protection in the recipient country under paragraph 3 or an applicable ground under paragraph 4. For transfers requiring separate guarantees, we provide for safeguards against interference with private and family life under paragraph 4(5): written processing terms, purpose / access limits, confidentiality and supplier-chain protection.
GDPR transfers additionally require Chapter V conditions: a valid applicable adequacy decision or appropriate safeguards, including standard contractual clauses and necessary supplementary measures. DigitalOcean’s public DPA (opens in a new tab) contains mechanisms for relevant transfers; its existence does not establish safeguards for every Foundation transfer. Brevo’s terms (opens in a new tab) and Google’s notices (opens in a new tab) apply to their respective services.
Request information about specific recipients, access countries and applicable safeguards, and copies of safeguards, using the Foundation’s email. Analytics permission does not replace international-transfer requirements.
7. Retention
The table distinguishes the statutory accounting minimum, cookie periods and policy requirements for cleanup. The 12-month ordinary-correspondence, 30-day log, 35-day managed-backup and 90-day unpaid-order limits are not universal statutory periods.
| Category | Period / criterion |
|---|---|
| Primary donation records, accounting registers and related reports, including records of online payments, recurring charges and refunds needed for accounting | At least 1,825 days from submission of the report for which they were used; if not submitted, from its submission deadline. Longer for categories with a longer statutory period, audits, appeals / court proceedings and statutory suspension of the limitation period, under Article 44 of the Ukrainian Tax Code |
| Incomplete, failed or expired online orders without payment | Policy requirement: 90 days from final closure of the order; a specific dispute or incident is handled separately where justified |
| Masked card number (no more than the last four digits) | Policy requirement: until reconciliation is complete and 90 days afterwards, but no longer than 12 months from the payment; longer only for a specific documented legal need |
| Recurring-support payment mandate, its parameters, changes and cancellation | While support is active; afterwards, only as evidence of payments made and of cancellation within the accounting period or the period of a specific legal claim |
| Hash of the personal management-link key | Policy requirement: deleted from the operational record within 30 days after cancellation or end of support; the management link then stops working. The fact of cancellation is kept separately |
| Completed ordinary correspondence and attachments | Policy requirement: 12 months after the enquiry is closed; longer only for a specific need, such as an unresolved issue or dispute |
| Ordinary technical logs | Policy requirement: 30 days; incident records may be retained separately as needed for investigation |
| User-level and event-level information in GA4, after launch | Configuration requirement: 2 months, with identifier retention reset on new activity disabled; Google automatically deletes information on a monthly cycle |
| Cookie choices in the browser, when analytics is present | 6 calendar months from the last explicit choice; visiting the website does not extend this period |
| Minimal evidence of separate consents / withdrawal, where collection is introduced | Policy requirement: while processing requiring that consent evidence continues; afterwards, only for a documented need, up to 12 months, with earlier deletion when that need ends. Refusal alone does not require a separate long-term evidence record |
| Ordinary backups managed by the Foundation / website team, including manual copies | Policy requirement: no more than 35 days from initial creation; copying or restoration does not renew the period. Restricted access, cleanup of all such copies and reapplication of deletions after restoration are required |
The policy requires deletion or appropriate anonymisation after the purpose and mandatory period end. Withdrawal stops processing based on consent but does not remove separate lawful recordkeeping duties. We do not impose one arbitrary period on all categories. WayForPay’s own retention of information is governed by its terms and payment-services law.
Mandatory accounting records are retained separately from the ordinary backup cycle. Where a particular record is needed for an unresolved dispute or another lawful requirement, we establish a separate basis, restricted access and a period / necessity review; this does not extend retention of all backups or all consent evidence.
The GA4 two-month setting does not apply to standard aggregated reports or determine cookie lifetime. We do not enable our own event exports / BigQuery; introducing them would require a separate purpose, retention periods and an updated notice. For our own statistical summaries, we use aggregate figures without visitor identifiers.
8. Your rights and the GDPR
You may learn sources, storage location, purposes and recipients; access and obtain a copy, request correction, justified deletion, object, withdraw consent and complain. GDPR restriction and portability are available in its specified cases. Rights and exceptions depend on law and processing basis.
The GDPR applies within its territorial scope, including relevant monitoring of people’s behaviour in the EU / EEA. Visiting from a country is not tracking consent. Once analytics is configured, the same cookie choices are available regardless of country.
Email horizontdiy.help@gmail.com with your request and reply contact. To prevent disclosure to another person, we may seek minimal identity confirmation; a passport copy is not routinely required. Requests about information that WayForPay processes as a payment service provider can also be sent directly to that service using the contacts in its public agreement.
Under Article 16 of the Ukrainian law, access requests are assessed within 10 working days of receipt, with the decision and reasons communicated in that period. Fulfilment is within 30 calendar days unless the law provides otherwise. Article 20 requires inaccurate information to be corrected without delay once identified; you may submit a reasoned written correction request. Statutory change, deletion or access-restriction notices follow Article 21.
GDPR requests are addressed without undue delay and within one month. A justified extension of two further months is explained in the first month. These periods do not replace Ukraine’s calendar / working-day periods.
Separately: your GDPR right to object
For legitimate interests under Article 6(1)(f), you may object at any time on grounds relating to your situation. We stop processing unless compelling legitimate grounds overriding your interests / rights are established, or processing is needed to establish, exercise or defend legal claims. You may object to direct marketing at any time; information is then no longer used for that purpose. The right is communicated clearly and separately no later than first contact under Article 21(4).
Complain to the Ukrainian Parliament Commissioner for Human Rights (opens in a new tab) or a court; under the GDPR, also a competent supervisory authority, including where you habitually live, work or believe an infringement occurred. Aid decisions are not made solely automatically with legal or similarly significant effects.
9. Security and policy updates
We use access restrictions, secure connections, system updates and backups, with measures appropriate to risks and information categories. No system eliminates every risk. We notify authorities and individuals of incidents where and within the periods required by applicable law.
New versions are published with their effective date. Updating the policy does not create new consent; a new optional purpose or material analytics change requires a new choice. Contact us using section 1 for policy questions.