Personal Data Processing Policy

Personal Data Processing Policy

1. General provisions

This Policy is prepared pursuant to Article 8 of the Law of Ukraine “On Personal Data Protection” and defines the procedure for processing personal data and the security measures applied by the Public Association “Children’s cancer support initiative”.

The Policy applies to all information that the Organization may receive about visitors to https://www.ccsi.org.ua (the “Website”). The Organization acts as the data controller and processes personal data in accordance with applicable law.

2. Terms

  • Personal data — any information relating to an identified or identifiable natural person.
  • Processing — any operation or set of operations performed on personal data (collection, storage, use, transfer, deletion, etc.).
  • Information system of personal data — a set of databases and technical means for their processing.
  • Provision / dissemination — actions that disclose data to a specific or an indefinite number of persons.
  • Anonymization / destruction — actions that make it impossible to identify a person / irreversibly delete data.
  • User — any visitor of the Website.
  • Processor — a service provider processing personal data on behalf of the Organization under a data-processing agreement.

3. What data we process

Contact form data: first and last name, email address, phone number, message text, and any other information you voluntarily include in your inquiry.

  • first and last name;
  • email address;
  • phone number;
  • message text (content of the inquiry);
  • any other information you voluntarily include in your inquiry.

Strictly necessary technical cookies for the Website to function:

  • a cookie that stores the selected interface language;
  • cookies required for proper operation of forms;
  • a cookie to show/hide the cookie-consent banner.

We do not use web analytics tools (e.g., Google Analytics), advertising pixels (e.g., Facebook Pixel), or any marketing/retargeting trackers.

4. Purposes of processing

  • To respond to your inquiries and maintain follow-up communication.
  • To ensure operation and security of the Website (language display, form stability, cookie-consent banner).
  • To comply with legal, reporting, and archiving obligations where applicable.

5. Legal bases

  • Consent — when you voluntarily submit data via forms.
  • Legitimate interests of the Organization — handling inquiries, maintaining Website operation and security, preventing abuse.
  • Performance of contractual obligations — where our interaction involves an agreement/offer.
  • Compliance with a legal obligation — where required by law.

6. Collection, storage, transfers

We implement legal, organizational, and technical measures to protect personal data against unauthorized access, alteration, loss, or destruction.

Personal data may be transferred to processors (strictly to the extent necessary to provide Website/communication services) under appropriate data-processing agreements. Categories include:

  • hosting/cloud and infrastructure services (e.g., hosting/CDN providers);
  • email delivery providers;
  • content management systems / databases (CMS).

We do not transfer data to third parties for their own purposes, except as expressly required by law.

Retention periods:

  • form submissions — up to 12 months from the last interaction (or longer if needed to protect rights/meet obligations);
  • cookie-consent cookie — up to 180 days;
  • language cookie — typically 6–12 months or until you delete it in your browser.

You can delete cookies in your browser settings. Disabling strictly necessary cookies may affect form functionality and saving your language choice.

7. Cross-border transfers

  • Data may be processed by processors located outside Ukraine/EU/EEA, which may involve cross-border transfers.
  • In such cases, we ensure appropriate safeguards (including EU Standard Contractual Clauses — SCCs) and transfer data only to providers that offer a sufficient level of security and confidentiality.

8. Your rights

  • to obtain confirmation of processing and access your personal data;
  • to request rectification of inaccurate or outdated data;
  • to request deletion of data in cases provided by law (the “right to be forgotten”);
  • to restrict processing;
  • to object to processing based on legitimate interests;
  • to withdraw consent (this does not affect the lawfulness of processing prior to withdrawal);
  • to lodge a complaint with the competent personal data protection authority.

To exercise your rights, contact: ccsi.organization@gmail.com.

9. Contacts

Organization: Public Association “Children’s cancer support initiative”

Email: ccsi.organization@gmail.com

Website: https://www.ccsi.org.ua

10. Policy updates

  • We may update this Policy from time to time. A new edition comes into force upon publication at: https://www.ccsi.org.ua/en/privacy-policy (and respective pages in other languages).
  • The current version is available at the above address at all times.

September 2025