Privacy Policy

Effective from 2026-04-20 · Last revision 2026-04-20

1. Data Controller

The controller of your personal data is Charitable Foundation "International Movement for Victims' Rights of Russian Aggression" (IMVRRA or the Foundation).

• Ukrainian Tax ID (EDRPOU): 39283884
• Registered address: Ukraine, 02094, Kyiv, Dmytra Bahaliia Street, 1/53
• Phone: +380 95 418 8050
• Privacy contact: info@imvrra.fund

2. What Personal Data We Collect

We collect only the data you voluntarily provide through contact forms on imvrra.fund:

• Contact details: name, organization/community name, email, phone number
• Inquiry content: topic, message, area of interest
• Technical data: IP address, browser type, form submission timestamp (for spam protection and logging)

We do not collect special categories of personal data (health, religious beliefs, racial origin) without your explicit consent.

3. Purpose of Processing

Your data is used exclusively for:

• Responding to your inquiries through site forms
• Coordinating participation in Foundation projects (Legal Forces of Ukraine, Fort 24)
• Providing legal and methodological support to territorial communities
• Informing you about the Foundation's activities (with your consent)
• Complying with Ukrainian legal requirements (reporting, anti-terror compliance)

4. Legal Basis for Processing

Your data is processed based on:

• Your consent (Art. 11 of Ukrainian Law № 2297-VI; Art. 6(1)(a) GDPR) — provided via checkbox when submitting a form
• Legitimate interests of the Foundation (Art. 6(1)(f) GDPR) — for spam protection and site security
• Legal obligation compliance (Art. 6(1)(c) GDPR) — for Ukrainian and European legal requirements

5. Retention Period

Personal data is retained no longer than necessary to fulfill the purpose of processing:

• General inquiries — up to 12 months after the last contact
• Project participant data (communities, partners) — for the duration of cooperation + 3 years after its conclusion (for archival and reporting purposes)
• Technical logs — up to 30 days

After expiration, data is destroyed or anonymized.

6. Data Transfers to Third Parties

The Foundation does not sell or transfer your personal data to third parties for commercial purposes.

Transfers are possible only in the following cases:

• With your explicit written consent
• To Ukrainian government authorities based on lawful request
• To partner organizations of the Foundation only to the extent necessary to coordinate a specific project (with your consent)

7. Data Processors

Technical services used by the Foundation for site operation:

• Hosting provider — site storage and delivery
• Google Analytics — anonymous aggregated analytics (with your consent via cookies)
• Google Fonts, jsDelivr CDN — font and icon delivery
• Form processing service — Formspree or equivalent, GDPR-compliant

8. Your Rights

Under Ukrainian Law № 2297-VI and GDPR, you have the right to:

• Information about the processing of your data
• Access to your data
• Rectification of inaccurate or outdated data
• Erasure ("right to be forgotten")
• Restriction of processing
• Data portability (receive your data in machine-readable format)
• Withdraw consent at any time
• Lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or a supervisory authority in your EU country

9. Cookies

The site uses technical cookies necessary for its operation and Google Analytics cookies (with your consent). You can manage cookies in your browser settings.

10. Data Security

The Foundation takes reasonable technical and organizational measures to protect your data:

• Traffic encryption (HTTPS/TLS)
• Restricted access (only authorized Foundation personnel)
• Regular updates of technical systems
• Backups with protection against unauthorized access

11. Changes to the Policy

The Foundation may periodically update this Policy. The current version is always available at imvrra.fund/en/privacy. We will notify you of significant changes via the site.