Privacy and Personal Data Processing Policy

Privacy and Personal Data Processing Policy
Association of Ukrainian Organisations in Estonia

Effective date: 1 January 2026
Last updated: 16 August 2026
Version: 2.0

1. General provisions
Ukraina Organisatsioonide Assotsiatsioon Eestis MTÜ, hereinafter referred to as “AUOE”, the “Association”, “we”, “us” or “our”, respects individuals’ privacy and takes the protection of personal data seriously.

We process personal data in accordance with:

the European Union General Data Protection Regulation (EU) 2016/679 (“GDPR”);
the Personal Data Protection Act of the Republic of Estonia;
other applicable legislation of the European Union and the Republic of Estonia.
This Policy explains:

what personal data we process;
where we obtain such data;
the purposes and legal bases for which we use the data;
to whom the data may be disclosed;
how long the data are retained;
what rights individuals have regarding their personal data.
This Policy applies to the ukraine.ee website and to AUOE’s activities, events, projects, programmes, newsletters, fundraising, and cooperation with member organisations, partners, volunteers and other individuals.

AUOE member organisations may act as independent data controllers and are separately responsible for the personal data they collect and process as part of their own activities.

2. Data controller
Ukraina Organisatsioonide Assotsiatsioon Eestis MTÜ

Registry code: 80127690
Address: Harju maakond, Tallinn, Kesklinna linnaosa, Nafta tn 6-2, 10120, Estonia
Email: info@ukraine.ee
Telephone: +372 5350 0609
Website: https://ukraine.ee

For questions concerning the processing of personal data or the exercise of your rights, please contact us at:

info@ukraine.ee

AUOE has not appointed a separate Data Protection Officer unless the obligation to make such an appointment arises under Article 37 of the GDPR.

3. Personal data we process
Depending on an individual’s relationship with AUOE, we may process the following categories of personal data.

3.1. Contact and identification data
first name and surname;
organisation and position;
email address;
telephone number;
postal address;
preferred language of communication;
signature;
other contact details voluntarily provided by the individual.
3.2. Data concerning member organisations and their representatives
the organisation’s official name and registry details;
the name and contact details of a board member or authorised representative;
membership applications, decisions, minutes and powers of attorney;
information relating to membership;
information required to organise general meetings, voting and the work of the Management Board;
correspondence relating to AUOE’s activities.
3.3. Data concerning participants in events, programmes and projects
name and contact details;
age or age group;
the organisation or group represented by the participant;
registration and participation details;
information concerning transport, catering or other organisational requirements;
photographs, video recordings and audio recordings made during events;
information required for reporting to funding bodies.
3.4. Children’s data
When organising activities for children and delivering educational, cultural and youth programmes, we may process:

the child’s first name and surname;
age or date of birth, where necessary;
contact details of the parent or legal guardian;
information about participation in an event, school, group or trip;
photographs and video recordings;
information required to ensure the child’s safety.
We collect only the children’s data necessary for the relevant activity. Where required by law or by the nature of the processing, we obtain the consent of the child’s parent or legal guardian.

3.5. Donor and donation data
donor’s first name and surname;
contact details;
amount, date, purpose and method of the donation;
bank or payment information contained in account statements;
information required for accounting and taxation purposes;
correspondence concerning the donation.
AUOE does not receive or store complete payment card details where a payment is made through a bank or an external payment service provider.

Where a donation is made through Meta, a bank or another external service, the relevant service provider may also process personal data under its own privacy policy.

3.6. Correspondence and enquiries
We may retain:

emails;
messages submitted through contact forms;
enquiries submitted through social media;
complaints, requests and accompanying documents;
information voluntarily provided during telephone or in-person conversations.
Please do not send confidential or special-category personal data unless they are necessary for dealing with a specific matter.

3.7. Data concerning employees, volunteers, service providers and candidates
contact and identification details;
curricula vitae, education and professional experience;
information concerning assigned duties;
contracts, payment records and accounting documents;
information necessary for organising employment or voluntary activities.
3.8. Technical data
When the website is visited, the following information may be processed:

IP address;
date and time of the visit;
browser, operating system and device type;
pages visited;
technical security logs;
language preferences;
cookies and similar technologies.

4. Special categories of personal data
As a general rule, AUOE does not request information concerning health, disability, religious or political beliefs, ethnic origin or other special categories of personal data.

Such data may be processed only when genuinely necessary, for example to ensure an individual’s safe participation in an event, arrange special meals, ensure the accessibility of premises or provide assistance.

In such cases, processing is based on the individual’s explicit consent, the protection of the vital interests of the individual or another person, or another legal basis provided for in Article 9 of the GDPR.

5. Sources of personal data
We may obtain personal data:

directly from the individual;
from a parent or legal guardian;
from a member organisation or its authorised representative;
from the organiser or partner of a joint event;
from a bank, payment provider or donation platform;
from official public sources and public registers;
from social media where an individual contacts or interacts with AUOE;
from a public authority or funding body where provided for by law or the conditions of a project.
Where personal data have not been obtained directly from the individual, we provide the information required under Article 14 of the GDPR unless a statutory exception applies.

6. Purposes and legal bases for processing
We process personal data only for a specified purpose and where an appropriate legal basis exists.

6.1. Consent
On the basis of consent, we may:

send newsletters and other communications;
publish individual photographs and videos where consent is required;
process certain data concerning children;
use non-essential analytical or marketing cookies;
process special categories of personal data where necessary.
Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

6.2. Performance of a contract or steps taken at the individual’s request
On this basis, we process data required for:

registration for and participation in events or programmes;
arranging cooperation;
entering into and performing contracts;
working with employees, service providers and volunteers;
dealing with an individual’s request before entering into a contract.
6.3. Compliance with a legal obligation
On this basis, we process data for:

accounting and taxation;
compliance with employment legislation;
submission of mandatory reports;
compliance with lawful requests from public authorities;
retention of documents for statutory periods.
6.4. Legitimate interests of AUOE or a third party
On the basis of legitimate interests, we may:

respond to enquiries and conduct professional correspondence;
manage the Association and communicate with member organisations;
maintain relationships with partners, donors and volunteers;
ensure the security of the website, information systems, premises and events;
prevent fraud and misuse;
establish, exercise or defend AUOE’s legal rights and interests;
document and communicate the Association’s public activities;
take general photographs and video recordings at public events;
analyse and improve the Association’s activities.
Before relying on legitimate interests, we assess whether the processing is necessary and evaluate its potential effect on individuals’ rights and freedoms. Particular attention is paid to the protection of children’s rights.

7. Photography and video and audio recording
AUOE may take general photographs and make video or audio recordings at public events for the purposes of documenting its activities, reporting and informing the public.

Information about recording will be provided:

in the event description or registration form;
in the invitation;
by a notice displayed at the event venue;
by another clear and understandable method.
Individuals may inform the organisers if they do not wish to appear in recordings. We will take such objections into account to the extent reasonably practicable.

For staged photographs, individual interviews, close-up images or the use of an individual’s image in separate promotional or informational materials, we obtain consent unless another lawful basis applies.

Consent from a parent or legal guardian will be obtained for the individual photography of children and publication of their images where such consent is required. Refusal to be photographed should not, without proper justification, prevent a child from participating in an event.

8. Provision of data and consequences of failure to provide data
Providing personal data is generally voluntary.

However, certain information may be required for:

formalising membership;
registration for and safe participation in an event;
entering into or performing a contract;
making or recording a donation;
fulfilling accounting, taxation or other legal obligations.
If the required information is not provided, AUOE may be unable to accept a registration, enter into a contract, respond to an enquiry or arrange participation in the relevant activity.

Consent to receive newsletters or to optional photography is not a condition for receiving other AUOE services unless otherwise justified by the nature of a particular event.

9. Recipients of personal data
We do not sell personal data.

For lawful purposes, data may be disclosed to:

website hosting, technical support and information system providers;
email, cloud storage and newsletter service providers;
banks, payment service providers and donation platforms;
accountants, auditors, insurers and legal advisers;
organisers and partners of joint events;
transport, travel and other service providers where necessary to organise an event or trip;
funding bodies and project auditors within the scope of reporting requirements;
state and local authorities where required by law;
law enforcement authorities or courts where an appropriate legal basis exists;
member organisations where necessary for joint activities.
Service providers processing data on behalf of AUOE receive access only to the data required to perform their assigned tasks and must ensure appropriate protection of the data.

In certain cases, a recipient such as a bank, social media platform or public authority acts as an independent data controller and processes the data under its own legal obligations and privacy policy.

10. Social media and external links
AUOE uses social media and other online platforms to inform and communicate with the public.

When an individual visits our page on Facebook, Instagram, YouTube or another platform, the platform operator may also process personal data under its own privacy policy.

The AUOE website may contain links to external websites or embedded content from external services. AUOE does not control processing carried out on external websites and recommends reviewing their respective privacy policies.

11. Transfers outside the European Economic Area
Some digital service providers may store or process data outside the European Union and the European Economic Area.

In such cases, we use safeguards provided for under the GDPR, including:

an adequacy decision adopted by the European Commission;
Standard Contractual Clauses adopted by the European Commission;
other lawful safeguards provided for in Chapter V of the GDPR.
Information about the safeguards applied may be requested by emailing info@ukraine.ee.

12. Data retention periods
We retain personal data only for as long as necessary to fulfil the purpose of processing, comply with legal obligations or protect AUOE’s rights.

Our general retention periods are:

event registration and participation data — for up to 2 years following the event;
project data — for the duration of the project and the period prescribed by the funding agreement, audit requirements or applicable law;
accounting, payment and donation documents — for 7 years following the end of the financial year in which the relevant transaction was recorded;
membership data — for the duration of membership and up to 3 years after membership ends, unless a longer period is required by law or necessary to protect AUOE’s rights;
minutes, decisions and documents of permanent organisational or historical value — for the duration of AUOE’s activities or in accordance with its internal archiving rules;
enquiries, complaints and professional correspondence — generally for up to 3 years after the matter has been resolved;
newsletter subscription data — until consent is withdrawn or the individual unsubscribes;
candidate data — for up to 1 year after completion of the recruitment process unless the individual has consented to a longer period;
contracts and related correspondence — for the duration of the contract and until the expiry of the applicable limitation period;
technical security logs — generally for up to 12 months;
non-essential web analytics data — for the period specified in the cookie settings.
After the relevant retention period expires, the data are deleted, destroyed or anonymised unless continued retention is required by law.

13. Protection of personal data
AUOE applies appropriate technical and organisational measures to protect personal data against:

unauthorised access;
accidental or unlawful destruction;
loss;
alteration;
unauthorised disclosure;
other unlawful use.
Access to personal data is limited to Management Board members, employees, volunteers, service providers and partners who require the relevant information to perform their duties.

Security measures may include access restrictions, passwords and multi-factor authentication, backups, software updates, confidentiality obligations and training for individuals who work with personal data.

14. Cookies
The ukraine.ee website may use cookies and similar technologies.

Cookies may include:

strictly necessary cookies, which ensure the website’s basic operation and security;
functional cookies, which remember selected preferences;
analytical cookies, which help us understand how visitors use the website;
marketing cookies, which may be used to measure communications campaigns or display content from external platforms.
Strictly necessary cookies may be used without separate consent. Analytical, marketing and other non-essential cookies are used only after the user has provided consent.

Users may:

accept all non-essential cookies;
reject them;
select individual cookie categories;
change or withdraw consent at any time.
Rejecting non-essential cookies must not prevent users from accessing the website’s basic functions.

Detailed information about individual cookies, their providers, purposes and retention periods must be available through the website’s cookie settings.

15. Rights of the data subject
Under the GDPR, individuals have the right to:

obtain confirmation as to whether AUOE processes their personal data;
access their data and receive a copy;
request the correction of inaccurate data or completion of incomplete data;
request erasure where there is no longer a lawful basis for retaining the data;
request restriction of processing;
object to processing based on legitimate interests;
object to direct marketing at any time;
withdraw previously provided consent;
receive data they have provided in a structured, commonly used and machine-readable format and transmit those data to another controller where the right to data portability applies;
obtain information about the source of data where the data were not obtained directly from them;
lodge a complaint with a supervisory authority.
The right to erasure is not absolute. We may continue to retain data where necessary to comply with a legal obligation, establish, exercise or defend AUOE’s legal rights, exercise freedom of expression and information, or on another basis provided for by law.

16. Submitting a personal data request
To exercise your rights, please send a request to:

info@ukraine.ee

The request should clearly state:

the requester’s name;
the nature of the request;
the data or activity concerned;
the preferred method of receiving a response.
Where we have reasonable doubts concerning the requester’s identity, we may request additional information to verify their identity. We will not collect more information than is necessary for this purpose.

We respond without undue delay and generally within one month. For complex requests, this period may be extended in accordance with the GDPR. The requester will be informed of any extension.

Requests are generally processed free of charge. Where a request is manifestly unfounded, excessive or repetitive, we may charge a reasonable fee or refuse to act on the request in accordance with Article 12 of the GDPR.

17. Automated decision-making
AUOE does not make decisions concerning individuals based solely on automated processing or profiling that produce legal or similarly significant effects.

If such processing is introduced in the future, this Policy will be updated and individuals will receive the information required under the GDPR.

18. Right to lodge a complaint
If an individual believes that AUOE has infringed their personal data protection rights, we recommend contacting us first:

info@ukraine.ee

Individuals also have the right to lodge a complaint with the Estonian Data Protection Inspectorate:

Andmekaitse Inspektsioon
Tatari 39
10134 Tallinn
Estonia

Email: info@aki.ee
Telephone: +372 627 4135
Website: https://www.aki.ee

Lodging a complaint with the Data Protection Inspectorate does not restrict an individual’s right to seek a judicial remedy.

19. Changes to this Policy
AUOE may update this Policy in response to changes in legislation, the Association’s activities, its information systems or its methods of processing personal data.

The current version will always be published on ukraine.ee together with the date of the latest update.

Where material changes are made, we will provide notice through the website or another appropriate communication channel.

Ukraina Organisatsioonide Assotsiatsioon Eestis MTÜ
Registry code: 80127690
Email: info@ukraine.ee