Privacy Policy

01What we process and why

• Presenting a case and applications (the “Present a case” and “Apply for a case” forms): name, phone, email, relationship to the person, age and a description of the situation, which may include health data. We use them to assess the case and contact you. Basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
• Donations, partnerships and volunteering (the “Get involved” form): name, email, phone, organization and message. Basis: our legitimate interest in answering requests (Art. 6(1)(f) GDPR).
• Company sponsorship requests: company name and tax ID, contact person, email, phone, estimated amount. Basis: steps before concluding the sponsorship contract (Art. 6(1)(b) GDPR).
• Form 230: name, father's initial, personal numeric code (CNP), address, email, phone, signature and the two-year option. We use them to prepare the form and file it with ANAF on your behalf. Basis: your request and the legal obligations around tax redirection (Art. 6(1)(b) and (c) GDPR).
• Card donations: payments are processed by Stripe. We receive your name, email, amount and payment status; we never see or store card details. Basis: carrying out the donation and accounting obligations (Art. 6(1)(b) and (c) GDPR).
• Technical data: the hosting provider automatically logs IP address, date and page visited, for security and operation of the site. Basis: legitimate interest (Art. 6(1)(f) GDPR).

02How long we keep data

• Cases and applications: for the assessment and, if you join a programme, for its duration; if a case isn't taken on, we delete the data within 12 months at most.
• Messages and sponsorship requests: up to 2 years after the last correspondence, then deleted if no contract followed.
• Form 230: as long as needed to file it with ANAF and keep the records tax law requires. Forms are stored encrypted.
• Donations, contracts and accounting documents: for the periods set by accounting law.

03Who we share data with

We never sell or rent your data. We share it only as needed:

• ANAF, for Form 230 and tax obligations.
• Stripe Payments Europe Ltd. (Ireland), for card payments. Stripe may transfer data outside the European Economic Area under the safeguards GDPR provides (standard contractual clauses).
• Our hosting and email providers, who process data only on our behalf.
• Partner doctors and clinics involved in assessing and treating a case, only with your consent.
• Public authorities, when the law requires it.

04Children

Many of our cases concern children. A minor's data is sent to us by a parent or legal guardian, who consents on the child's behalf. Children's stories and images appear on the site only with their parents' written consent.

05Security

The site uses an encrypted connection (HTTPS). Form 230 submissions are stored encrypted, and access to data is limited to the people at the Foundation who need it.

06Your rights

You have the right of access, rectification, erasure, restriction, portability, objection and to withdraw consent at any time. The GDPR page explains each right and how to exercise it.

07Changes

We may update this policy. The date of the last update is shown at the top of the page.