Article 1 — Who the controller is
The controller of your personal data is the Non-governmental association “Santamore”, Teuta 113, Porto Montenegro, 85320 Tivat, registration number [[PLACEHOLDER]], PIB [[PLACEHOLDER]] (hereinafter: we, the association). For any question about your data, write to [[PLACEHOLDER: data-protection email, e.g. privatnost@santamore.me]]. The person responsible for data protection is [[PLACEHOLDER: name and function]].
This policy applies to the association's website and platform, to our events, to our work with beneficiaries and to our communication with you. We write it in accordance with the Law on Personal Data Protection of Montenegro and, because we have donors and participants from the European Union, in accordance with the General Data Protection Regulation (GDPR).
Article 2 — What data we collect
We collect only what we need for a specific task:
- When you donate: first name and surname, email address, amount, payment method, campaign, payment reference, your choice of whether your name is shown publicly and the display name, the language for the receipt. For a card payment the processor may ask for a phone number and address for the bank's verification; that data goes to the processor, not to us. For a bank transfer we see the data on the statement (payer's name, IBAN, amount, payment reference). For a monthly donation the processor keeps the card in tokenised form, and we see the last four digits and the expiry date.
- When you register for an event: first name and surname, date of birth, email, phone, distance or activity, shirt size, emergency contact, health notes you give yourself, the signed Participation Waiver with date, time and version, your choice about photos and about showing your name in the results, the entry fee paid. For minor participants: the data of the parent or guardian who registers, the accompanying person and the person collecting the child.
- When you open an account or a fundraiser page: sign-in email, name, phone (optional), language, and what you publish yourself: photo, story, goal, team. The amounts raised on your page are data about you.
- When you submit an application for aid: the applicant's name and contact details, category of need, amount requested, description and attachments (medical documentation, invoices, certificates), statement on other sources, consents. These are often especially sensitive data (health, social status); they are processed under Article 4.
- When you volunteer or are part of the team: name, contact details, roles, attendance at training, hours, for certain roles declarations and certificates under the Child Safeguarding Policy, and a photo if you agree to appear on the team page.
- When you write to us: what you send us and your address.
- When you connect a Strava account (at your choice, for partner perks): account identifier, name, the activity data that Strava sends (type, date, distance, duration) and access tokens. We do not collect GPS tracks or location.
- At events: photos and recordings, under Article 7, and incident records when incidents occur.
- Technical data: server logs (IP address, time and path of the request, browser type) for security and troubleshooting; cookies under the Cookie Policy.
- If you are a sponsor, supplier or partner: business contact details and contracts.
We do not collect data about children from children: all data about a minor participant is given by the parent or guardian.
Article 3 — Why and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Processing a donation, receipt, public ledger | data under Art. 2(1) | performance of a contract; legal obligation (accounting); legitimate interest (transparency of our work) |
| Registration and participation in an event, safety, results | Art. 2(2) | performance of a contract; protection of life and health; legitimate interest (safety) |
| Account and fundraiser page | Art. 2(3) | performance of a contract |
| Decisions on aid, payment, publication in generalised form | Art. 2(4) | explicit consent for sensitive data; legitimate interest; legal obligation (record of payments) |
| Volunteers and team, child safeguarding | Art. 2(5) | volunteering agreement; legal obligation; legitimate interest; consent for the photo |
| Replying to messages | Art. 2(6) | legitimate interest |
| Partner perks through Strava | Art. 2(7) | consent (connecting the account) |
| Photos in which you are identifiable | Art. 2(8) | consent |
| Site security, abuse prevention | Art. 2(9) | legitimate interest |
| Visit analytics | cookies | consent |
| Email updates about the association's work | consent, withdrawable in every message | |
| Prevention of money laundering for larger donations | identity, source of funds | legal obligation |
You may withdraw consent at any time; withdrawal does not affect processing carried out before it. Where we base processing on legitimate interest, you may object under Article 9.
Article 4 — Especially sensitive data
We process data on health, social status, disability and the like only: when you give it to us yourself in an application for aid or as a health note for an event, with explicit consent; to the extent needed for the decision or for safety; with access limited to the Grants Committee and the persons preparing the file, or to the event manager and the medical service; and with the retention period from Part B. We never publish it or share it outside that circle, except where the law requires it or where the protection of life demands it.
Article 5 — Whom we entrust data to
We do not sell data to anyone and do not share it with advertisers. We use a small number of processors who process data on our instructions and under a data-processing agreement:
| Processor | What it does | Where |
|---|---|---|
| Supabase | database, sign-in, file storage | [[PLACEHOLDER: project region, EU expected]] |
| Vercel | hosting of the site and platform, server logs | [[PLACEHOLDER: region; USA with standard contractual clauses for transfers]] |
| Resend | email delivery (receipts, instructions, notifications) | [[PLACEHOLDER: region]] |
| Monri | card payment processing and storage of tokenised cards | Croatia (EU) |
| [[PLACEHOLDER: bank]] | receiving transfers, statements | Montenegro |
| Plausible | analytics without profiles, only with consent | EU |
| Strava | source of activity data, only if you connect your account | USA, under Strava's terms |
| Anthropic | translation of news texts written by the team; does not process data about you | USA |
| [[PLACEHOLDER: accountant]] | bookkeeping of payments in and out | Montenegro |
We also share data: with the competent authorities where the law requires it (tax authorities, anti-money-laundering authorities, the police, the centre for social work in the cases set out in the Child Safeguarding Policy); with the insurer and the medical service in the event of an incident at an event; with partner clubs, only the list of participants needed for the safety of an event we organise together, under a duty of confidentiality.
We transfer data outside Montenegro and the European Union only to processors with appropriate safeguards (standard contractual clauses or an adequacy decision). We update the list of processors on this page before introducing a new one.
Article 6 — The public ledger and your name
We publish every payment in and every payment out in the public ledger; that is the core of our work. The ledger shows the date, the amount, the campaign or the participant's page, the chapter, the payment method, and the display name you chose yourself or the label “Anonymous”. Your email, phone and address are never published. You may choose anonymity when you pay and request it later for any earlier payment.
Beneficiaries are published only in generalised form (for example “a family from Tivat, treatment costs”), never by name, address or diagnosis, except for a story published with separate, revocable consent.
Participant and team pages show the name, photo and story you published yourself and the total amount raised; the results list shows name, bib number, category and time, unless you chose to have your name hidden.
Article 7 — Photos and recordings
At events we take photos and recordings for the gallery, reports, posts and the event sponsors' materials. When registering you choose whether you agree to be identifiable in published materials; you may change your choice in your account or by message. Without consent we do not publish you identifiably, except in group and panoramic shots in which you are one of many. We remove any published photo in which you recognise yourself within three working days of a request.
Stricter rules from the Child Safeguarding Policy apply to children: publication only with the parent's consent, without a name or data by which the child could be found, and withdrawal at any time.
Article 8 — How long we keep data
We keep data only for as long as it is needed for the purpose or as long as the law requires:
- data on payments in, payments out and entry fees, including receipts and Participation Waivers: [[PLACEHOLDER: number, as required by the accounting and tax regulations of Montenegro, to be confirmed by the lawyer]] years from the end of the financial year;
- account and fundraiser page: until you delete them or request deletion; an account inactive for [[PLACEHOLDER: number]] years is deleted after prior notice;
- applications for aid and attachments: [[PLACEHOLDER: number]] years from the last payment or from refusal, then deletion, except data that forms part of the record of payments;
- event data (emergency contact, health notes, lists): [[PLACEHOLDER: number]] months after the event; incident records longer, under the Child Safeguarding Policy;
- photos: while consent stands;
- Strava data: while the account is connected; on disconnection we delete the tokens and the activity data at once;
- server logs: [[PLACEHOLDER: number]] days;
- messages and correspondence: [[PLACEHOLDER: number]] years from the last message;
- register of interests, child safeguarding records, records of breach reports: under the respective policies.
The exact schedule is in Part B. When the period expires, we delete or anonymise the data; anonymised amounts in the public ledger are kept permanently.
Article 9 — Your rights
You have the right to ask us for: access to your data and a copy; rectification of inaccurate data; erasure when the data is no longer needed or you have withdrawn consent, except data we must keep by law; restriction of processing; transfer of the data you gave us in a machine-readable form; objection to processing based on legitimate interest; withdrawal of consent; and not to be subject to decisions made solely by automated means, of which we make none.
You send a request to [[PLACEHOLDER: data-protection email]] or by post to the address in Article 1. We reply without delay and at the latest within [[PLACEHOLDER: number, e.g. 30]] days; for complex requests we may extend the period with notice. A request is free of charge. To protect your data, we may ask you to confirm your identity, for example by replying from the email address you used.
If you believe we have infringed your rights, you may complain to the Agency for Personal Data Protection and Free Access to Information of Montenegro [[PLACEHOLDER: address and email of the Agency]] and, if you are in the European Union, also to the supervisory authority in your own country.
Article 10 — Cookies and analytics
We use only strictly necessary cookies (sign-in session, your cookie choice, the processor's security cookies during card payment). Analytics (Plausible, without profiles and without tracking across other sites) is switched off until you switch it on in the cookie notice; rejecting is as simple as accepting. We have no advertising pixels or cross-site tracking and never will. Details are in the Cookie Policy.
Article 11 — Security
We protect data with technical and organisational measures: encryption in transit and on the processors' servers; role-based access to data, where public visitors see only the public views and sensitive fields (donor email, private notes on beneficiaries, processor data) are not accessible without signing in; the card number never reaches our servers; an administrator access log; verification of the signature of every processor message; team training; data-processing agreements with every processor. If a data breach occurs that may endanger your rights, we will notify you and the competent authority within the statutory period.
Article 12 — Children
Our platform is not intended for children under 18 to open an account or donate on their own. Data about minor participants is given exclusively by the parent or guardian, under the Event Terms and the Child Safeguarding Policy. If we learn that we have collected a child's data without the parent's knowledge, we delete it.
Article 13 — Changes
If we change the policy, we publish the new version on this page with the date and a version number. We notify registered users and monthly donors of substantial changes by email at least 15 days before they take effect.