Transparency is one of the most important principles for us, which is why we want to inform you about the purposes for which we collect your personal data, how we process it and what rights you have in this regard.
The technical and organizational solutions we have implemented ensure a high standard of personal data protection. This privacy policy explains our approach and practices to protecting your privacy. As part of our business, we undertake to comply with this policy, as well as the requirements of applicable law regarding the processing of personal data.
I. Basic principles of data processing
1. We process the personal data of Donors, Beneficiaries, Volunteers and Users in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("GDPR") and the Personal Data Protection Act of 10 May 2018.
2. The administrator of personal data is the Rakiety Oncological Foundation, ul. Stryjeńskich 19 lok. U21/21A, 02-791 Warsaw, identified by the following numbers: NIP 5213628570, REGON 146040727, KRS 0000414091.
3. The Data Protection Officer at the Foundation is Katarzyna Kąkol. You can contact the Data Protection Officer at the following email address: [email protected] or by mail to the address of the Foundation's registered office with the note "Data Protection Inspector".
II. Collection of personal data
1. We collect personal data through the following forms: newsletter subscription, Volunteer registration, petition signature, contact and payment, and application for admission to the Foundation's Beneficiaries, on the following websites: www.fundacjarakiety.pl, panel.fundacjarakiety.pl, www.fundacjarakiety.biz and www.gwiazdozbior.pl.
2. We also collect personal data on the basis of data from bank transfers and data from the Ministry of Finance (in the case of taxpayers transferring 1.5% to us and providing their personal data to our organization).
3. In the case of direct debits and declarations of transfer of employee contributions (payroll), we process data obtained on the basis of completed forms or data provided with the consent of donors by their employers.
III. Types of data processed
1. We process data such as: names, surnames, gender, e-mail, address (street, postal code, city, country), telephone number, bank account number and place of work (in the case of transferring an employee contribution), date of birth, PESEL , data of legal guardians (in relation to the Charges).
2. In the case of the Mentees, we also process data concerning their health and image, to the extent necessary to provide assistance and implement the concluded Agreement.
3. We analyze the openness and effectiveness of electronic and paper correspondence sent to Donors and other Recipients in order to best match subsequent shipments to their preferences.
IV. Purposes and principles of personal data processing
1. Personal data is processed by us in order to:
- process financial donations from Donors made via the website www.fundacjarakiety.pl, traditional bank transfers, employee contributions, payment orders, as well as 1.5% tax deductions;
- handle donated goods and services;
- thank donors for their support;
- report activities to donors and newsletter recipients;
- respond to messages sent via contact forms on websites www.fundacjarakiety.pl, www.fundacjarakiety.biz and www.gwiazdozbior.pl.
- cooperate with Volunteers;
- implement the provisions of the Agreement signed with the Clients;
- inform about the current needs of the beneficiaries and encourage them to join this assistance through material, service and activist support;
- be able to keep a history of donations and assistance provided;
- contact all Recipients in their preferred manner;
- create correspondence tailored to the interests and preferences of recipients;
- invite you to events we organize;
- organize and conduct training;
- fulfill legal obligations, including accounting and tax obligations.
2. Personal data are processed by us on the basis of Article 6 paragraph 1 letter a of the GDPR, i.e. your consent to their processing, Article 6 paragraph 1 letter b of the GDPR as necessary for the performance of the donation agreement, the agreement with the Mentee and the Volunteer, the training service, and in accordance with Article 6 paragraph 1 letter f of the GDPR as necessary for the purposes of the legitimate interests pursued by the Controller, in particular responding to correspondence, including e-mail correspondence, conducting correspondence, e-mail and telephone contact, providing information, building business relationships, and improving cooperation in the field of product marketing.
We process data for the purpose of sending the newsletter and other marketing information via electronic means of communication based on the recipient's consent, in accordance with Article 6 paragraph 1 letter a of the GDPR and Article 398 of the Act of 12 July 2024 - Electronic Communications Law. We process data necessary to comply with legal obligations, in particular accounting and tax obligations, on the basis of Article 6 paragraph 1 letter c of the GDPR. In the case of processing data concerning the health of Patients, the basis for processing is also Article 9 paragraph 2 letter a of the GDPR, i.e. the express consent of the data subject or their legal representative.
3. In the case of Donors who have not consented to us sending them correspondence, we process their personal data for the period necessary to fulfil our obligations under generally applicable law, including tax ordinance.
4. If processing is based on consent, we process data until it is withdrawn, unless the purpose for processing ceases earlier. If the processing is based on the Foundation's legitimate interest, we process data until that interest ceases or until an effective objection is filed, taking into account cases in which the Foundation can demonstrate overriding grounds for processing.
5. Donations can be made on the fundacjarakiety.pl website thanks to cooperation with payment operators:
Przelewy24, PayPro Spółka Akcyjna based in Poznań at ul. Kanclerska 15, 60-327 Poznań, entered into the Register of Entrepreneurs under KRS number 0000347935, NIP number 7792369887, REGON number: 301345068
and
PayU Spółka Akcyjna based in Poznań at ul. Grunwaldzka 186, 60-166 Poznań, entered into the Register of Entrepreneurs under KRS number 0000274399, NIP number 779-23-08-495, REGON: 300523444.
Thanks to this, donors can donate to us in a quick, easy and safe way. In order to process donations through these operators, our Foundation transfers personal data to their websites. Personal data is used only for activities necessary for the electronic payment process.
6. Advertising agencies help us prepare printed correspondence. In the case of cooperation with these service providers, data is entrusted on the basis of a concluded agreement and personal data is not used for any other purposes than sending correspondence to recipients. The entrusted data are: names, surnames, postal address, gender.
7. The company helps us prepare electronic correspondence MailerLite Limited with its registered office in Ireland at 38 Mount Street Upper, Dublin 2, D02 PR89 Ireland, identifying itself with VAT number: IE3748416JH.
MailerLite Limited provides us with a professional tool for creating and sending newsletters, as well as analyzing the open rate of messages. It also allows for personalization, as well as for scheduling automatic cyclical messages. In the case of cooperation with this service provider, data is entrusted on the basis of a concluded agreement, and the recipients' data is used exclusively for our correspondence with recipients and analysis of whether the content is interesting for them. Entrusted data MailerLite Limited are: names, surnames, e-mail, telephone number.
8. Due to the fact that the Administrator uses external suppliers of various services, e.g. Google, Microsoft, Zoom, Youtube, your data may be transferred outside the European Union, to third countries, e.g. to the United States of America (USA). Personal data will be transferred only to recipients who guarantee the highest protection and security of data, e.g. by using security mechanisms provided for by the GDPR or using standard contractual clauses.
V. Cookies and analytical tools
1. The Foundation's websites use cookies and similar technologies. Essential cookies ensure the proper and secure operation of the website and do not require user consent. Other cookies, particularly functional, analytical, and marketing cookies, are used only after obtaining appropriate consent.
2. Users may consent to all or selected categories of cookies, refuse to consent, and change or withdraw consent at any time using the cookie settings panel available on the website. A detailed list of cookies used, their purposes, providers, and operating periods is available in this panel.
3. The Foundation uses Google Analytics, provided by Google Ireland Limited, to generate statistics and analyze website usage. The tool was implemented via Google Tag Manager.
4. The Foundation uses Google Consent Mode v2. If consent is not provided, analytical cookies are not saved or read. However, limited technical signals may be sent to Google, without using the identifiers stored in analytical cookies, including information about consent status, the page visited, the time of the visit, the browser, and the device. These signals may be used to create aggregated or modeled statistics.
5. The basis for data processing using optional cookies is the User's consent, in accordance with Article 6 paragraph 1 letter a of the GDPR and Article 399 of the Electronic Communications Law.
6. In connection with the use of Google services, data may be transferred outside the European Economic Area, subject to the safeguards required by the GDPR. Detailed information on data processing by Google is available in the Google Privacy Policy: https://policies.google.com/privacy?hl=pl.”
List of cookies
VI. Rights regarding personal data
1. The right to access data - everyone has the right to obtain information from us whether we are processing their personal data, to obtain access to them and information about the purposes of their processing, pursuant to Art. 15 GDPR.
2. The right to request rectification of data - everyone has the right to request us to immediately rectify their personal data if they are incorrect or incomplete, pursuant to Art. 16 GDPR.
3. The right to delete data ("right to be forgotten") - everyone has the right to request us to immediately delete their personal data, and we are obliged to delete it without undue delay, unless the law requires us to further process it, pursuant to Art. . 17 GDPR.
4. The right to limit data processing - everyone has the right to request that we not process their data in any other way than storing them for the duration of our consideration of another request regarding personal data, pursuant to Art. 18 GDPR.
5. The right to transfer and inspect data - everyone has the right to receive from us all personal data processed by us in a structured, commonly used format, as well as the right to transfer it to another administrator, pursuant to Art. 20 GDPR.
6. The right to object - everyone has the right to object to our processing of their data, pursuant to Art. 21 GDPR.
7. The right to withdraw consent - everyone has the right to withdraw the consent based on which we process their data at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal, pursuant to Art. 7 section 3 GDPR.
VII. Contact regarding personal data protection
1. In order to exercise the above rights, to submit any objections or to obtain additional information on data processing, please contact us at [email protected], by calling 22 299 29 28 or by sending correspondence to the following address: Fundacja Onkologiczna Rakiety, ul. Stryjeńskich 19 lok. U21/21A, 02-791 Warsaw
2. At the same time, we would like to inform you that everyone has the right to lodge a complaint with the supervisory authority responsible for the protection of personal data, i.e. the President of the Personal Data Protection Office, pursuant to Article 77 of the GDPR.
