Privacy policy

Who we are

The data controller is [[PLACEHOLDER: full registered organisation name]], a non-governmental association based in Tivat, [[PLACEHOLDER: registered address, Tivat]]. For anything data-related, write to [[PLACEHOLDER: contact email]].

Our data protection contact is [[PLACEHOLDER: data protection contact name]].

What we collect

We collect only what we need for a specific job:

• When you donate: your name, email address, the amount, and your choice of whether your name is shown publicly. If you pay by card, the bank's verification may also require a phone number and address — those go directly to the payment processor, not to us.
• When you register for an event: name, email, phone, distance, shirt size, the signed participation waiver and, for minors, guardian consent.
• When you open a fundraiser page: your sign-in email, plus the photo, story and target you choose to publish.
• At events: photos and video, under the rules described below.
• Technical data: server logs (IP address, request time) for security and debugging.

Why we collect it, and on what legal basis

Every processing activity rests on one of these bases:

• Performance of a contract: processing your donation, registering you for an event, running your fundraiser page.
• Legal obligation: accounting and tax records of money in and money out.
• Legitimate interest: site security, abuse prevention, and the public ledger of payments — where you choose whether your name appears or you stay anonymous.
• Consent: publishing photos in which you are identifiable, analytics, and optional email updates. You can withdraw consent at any time.

Who we entrust data to (processors)

We sell data to no one. We use a small number of processors without which the site would not run:

• Supabase — database, sign-in and file storage. Hosting region: EU [[PLACEHOLDER: confirm Supabase project region]].
• Vercel — website hosting.
• Resend — email delivery (confirmations, transfer instructions).
• Monri — card payment processing, Croatia (once card payments go live). Your card number never passes through our servers.

The public ledger and your name

We publish every payment in and out in a public ledger — that is the heart of what we do. The ledger shows either the display name you chose or the label "Anonymous", the amount, and the date. Your email, phone and address are never published. Beneficiaries appear only in generalised form (e.g. "family in Tivat — medical costs"), never by name without explicit consent.

Photos

We photograph and film at events for the gallery and our posts. When you register for an event you choose whether you consent to being identifiable in published photos; you can change that choice. If you recognise yourself in a published photo and want it removed, write to [[PLACEHOLDER: contact email]] and we will take it down. Stricter rules apply to children under our child safeguarding policy.

How long we keep data

We keep records of payments in and out for as long as Montenegro's accounting and tax regulations require. Your account and fundraiser page are kept until you delete them or ask us to. Photos are kept while consent stands. Server logs are kept briefly, for security. The exact statutory periods will be confirmed by a lawyer before this policy is published.

Your rights

Under Montenegrin law and the GDPR you can ask for: access to your data, correction, erasure, restriction of processing, data portability, and you can object to processing or withdraw consent. Send requests to [[PLACEHOLDER: contact email]] — we respond without delay, and at the latest within the period the regulations set.

If you believe we have violated your rights, you can complain to Montenegro's Agency for Personal Data Protection and Free Access to Information; EU donors can also complain to the supervisory authority in their own country.

Changes to this policy

If we change this policy, we publish the new version on this page with the date of the change. For substantial changes we will notify registered users by email.