Privacy Policy

1. General Information

1. This Privacy Policy defines the rules for processing personal data of users of the Ukrainian Action KIK website, available at https://ua.kik.waw.pl/ (hereinafter: the “Website”).
2. The personal data controller is Klub Inteligencji Katolickiej with its registered office in Warsaw, ul. Freta 20/24A, 00-227 Warsaw, entered into the National Court Register (KRS) under number 0000034785 (hereinafter: the “Controller” or “KIK”).
3. The Controller can be contacted via email at: [email protected] or by phone at: +48 22 827 39 39.

2. Scope and Purposes of Data Processing

The Controller may process users’ personal data for the following purposes:

1. Handling of the contact form / support form (if available on the Website):
   • data: first name, last name, email address, phone number, message content, and other data voluntarily provided by the user;
   • purpose: to respond to the submitted inquiry, conduct correspondence, and handle matters reported by users;
   • legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller – communication with users; in the case of newsletter subscription – Art. 6(1)(a) GDPR – consent).
2. Handling donations and supporting the activities of Ukrainian Action KIK (including contact data provided during transfers, via form, Patronite, etc.):
   • data: first name, last name, email address, bank account number, correspondence address (if provided), donation amount and date, other data required by tax law;
   • purpose: receiving and accounting for donations, maintaining financial documentation, fulfilling tax obligations;
   • legal basis: Art. 6(1)(c) GDPR (fulfillment of the Controller’s legal obligations) and Art. 6(1)(f) GDPR (legitimate interest – contact with donors).
3. Conducting email and telephone correspondence not directly related to forms on the Website:
   • data: data contained in correspondence (email address, first name and last name, phone number, and other data provided by the user);
   • purpose: handling matters reported by users, providing information about the activities of KIK and Ukrainian Action;
   • legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller).
4. Ensuring the security and proper functioning of the Website (server logs, technical data):
   • data: IP address, device data, browser data, connection date and time, error information;
   • purpose: ensuring Website security, detecting abuse, analyzing operational correctness and technical statistics;
   • legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller).

3. Data Recipients

1. Personal data may be transferred to entities cooperating with the Controller, in particular:
   • IT, hosting, and Website maintenance service providers,
   • payment system providers or payment operators (in the case of online donation handling),
   • accounting firms and entities providing accounting services,
   • entities authorized by law (e.g., tax authorities).
2. As a rule, data is not transferred to third countries (outside the European Economic Area) or international organizations, unless it directly results from the use of specific external tools (e.g., analytical tools or newsletters – in which case this must be clearly described in the updated version of the document).

4. Data Retention Period

1. Data related to correspondence and forms are stored for the period necessary to handle the inquiry and for the time required to secure any potential claims (as a rule, no longer than 3 years from the end of the correspondence).
2. Data related to donations and accounting settlements are stored for the period required by tax and accounting law (as a rule, 5 years from the end of the year to which the documents relate).
3. Technical data (system logs) may be stored until they lose their usefulness for ensuring Website security or for the period resulting from the Controller’s internal IT security policies.

5. Rights of Data Subjects

Data subjects have the following rights:

1. the right to access personal data, including obtaining a copy of the data;
2. the right to rectification (correction) of personal data;
3. the right to erasure of data (“right to be forgotten”) – in cases provided for in the GDPR;
4. the right to restriction of processing;
5. the right to data portability – to the extent resulting from Art. 20 GDPR;
6. the right to object to data processing based on the Controller’s legitimate interest;
7. the right to withdraw consent (if processing is based on consent) at any time, without affecting the lawfulness of processing before its withdrawal.

These rights can be exercised by contacting the Controller using the contact details provided in point 1 of this Policy.

Data subjects also have the right to lodge a complaint with the President of the Personal Data Protection Office if they consider that the processing of their data violates GDPR provisions.

6. Voluntariness of Data Provision

1. The provision of personal data in connection with the use of the Website (e.g., in the contact form, for donations) is voluntary, but may be necessary to use a specific function (e.g., receiving a response, processing a donation).
2. The consequence of not providing data may be the inability to handle an inquiry or perform a given action (e.g., inability to contact the user).

7. Cookies and Similar Technologies

1. The Website may use cookies (so-called “cookies”) for the purpose of:
   • ensuring the proper functioning and security of the Website,
   • remembering selected user settings (e.g., language, acceptance of the cookie message),
   • conducting anonymous visit statistics (if an analytical tool is implemented).
2. The following categories of cookies may be used:
   • necessary cookies – enabling the proper functioning of the Website,
   • functional cookies – improving the convenience of using the Website,
   • analytical/statistical cookies – allowing analysis of Website traffic (if used).
3. The user can independently manage cookie settings in their web browser, including blocking their installation or deleting saved cookies. Restricting the use of cookies may affect some functionalities of the Website.
4. If the Controller starts using external tools (e.g., Google Analytics, Facebook pixel), the updated version of the Policy will specify the particular tools, scope of data, purposes, and information about any data transfers outside the EEA.

8. Data Security

The Controller applies appropriate technical and organizational measures to ensure the protection of processed personal data, corresponding to the risk of infringement of the rights or freedoms of natural persons, in particular, securing the server, hosting solutions, and access to the systems where data is processed.

9. Changes to the Privacy Policy

1. The Privacy Policy may be periodically updated to adapt to changes in legal regulations, supervisory authority practices, or changes in the functioning of the Website.
2. The Controller may inform about significant changes to the Policy through an appropriate announcement placed on the Website.