1. Data Controller
The controller of your personal data is Charitable Foundation "International Movement for Victims' Rights of Russian Aggression" (IMVRRA or the Foundation).
- Ukrainian Tax ID (EDRPOU): 39283884
- Registered address: Ukraine, 02094, Kyiv, Dmytra Bahaliia Street, 1/53
- Phone: +380 95 418 8050
- Privacy contact: info@imvrra.fund
2. What Personal Data We Collect
We collect only the data you voluntarily provide through contact forms on imvrra.fund:
- Contact details: name, organization/community name, email, phone number
- Inquiry content: topic, message, area of interest
- Technical data: IP address, browser type, form submission timestamp (for spam protection and logging)
- De-identified visit data: which pages were viewed, where you came from, the start and completion of a form and the name of the field where filling stopped — no field contents, no IP address and no identifiers on your device (see section 9)
We do not collect special categories of personal data (health, religious beliefs, racial origin) without your explicit consent.
3. Purpose of Processing
Your data is used exclusively for:
- Responding to your inquiries through site forms
- Coordinating participation in Foundation projects (Legal Forces of Ukraine, Fort 24)
- Providing legal and methodological support to territorial communities
- Informing you about the Foundation's activities (with your consent)
- Improving the site using de-identified visit statistics
- Complying with Ukrainian legal requirements (reporting, anti-terror compliance)
4. Legal Basis for Processing
Your data is processed based on:
- Your consent (Art. 11 of Ukrainian Law № 2297-VI; Art. 6(1)(a) GDPR) — provided via checkbox when submitting a form
- Legitimate interests of the Foundation (Art. 11(1)(6) of Law of Ukraine No. 2297-VI; Art. 6(1)(f) GDPR) — for spam protection, site security and de-identified visit analytics
- Legal obligation compliance (Art. 6(1)(c) GDPR) — for Ukrainian and European legal requirements
5. Retention Period
Personal data is retained no longer than necessary to fulfill the purpose of processing:
- General inquiries — up to 12 months after the last contact
- Project participant data (communities, partners) — for the duration of cooperation + 3 years after its conclusion (for archival and reporting purposes)
- Technical logs — up to 30 days
- De-identified visit analytics — up to 12 months
After expiration, data is destroyed or anonymized.
6. Data Transfers to Third Parties
The Foundation does not sell or transfer your personal data to third parties for commercial purposes.
Transfers are possible only in the following cases:
- With your explicit written consent
- To Ukrainian government authorities based on lawful request
- To partner organizations of the Foundation only to the extent necessary to coordinate a specific project (with your consent)
7. Data Processors
Technical services used by the Foundation for site operation:
- Hosting provider — site storage and delivery
- PostHog (PostHog Inc.; data stored in the European Union, Frankfurt) — de-identified visit analytics without cookies
- Google Fonts, jsDelivr CDN — font and icon delivery
- Form handler — our own, on the Foundation's hosting, with no third-party form services
8. Your Rights
Under Ukrainian Law № 2297-VI and GDPR, you have the right to:
- Information about the processing of your data
- Access to your data
- Rectification of inaccurate or outdated data
- Erasure ("right to be forgotten")
- Restriction of processing
- Data portability (receive your data in machine-readable format)
- Withdraw consent at any time
- Lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or a supervisory authority in your EU country
9. Cookies and visit analytics
The site does not use advertising or analytics cookies. To understand which pages are useful and where visitors find it hard to complete a form, we use PostHog in cookieless mode: nothing is stored on your device, the IP address is not stored, sessions are not recorded and form field contents are not collected. We only see de-identified aggregate data: number of visits, moves between pages, the start and completion of a form and the name of the field where filling stopped.
If your browser sends a Global Privacy Control or Do Not Track signal, analytics is switched off automatically. You can also switch it off manually — your choice is stored only in your browser:
10. Data Security
The Foundation takes reasonable technical and organizational measures to protect your data:
- Traffic encryption (HTTPS/TLS)
- Restricted access (only authorized Foundation personnel)
- Regular updates of technical systems
- Backups with protection against unauthorized access
11. Changes to the Policy
The Foundation may periodically update this Policy. The current version is always available at imvrra.fund/en/privacy. We will notify you of significant changes via the site.
How to Contact Us About Your Data
To exercise any of your rights or ask a question, contact us:
Email: info@imvrra.fund
Postal address: Ukraine, 02094, Kyiv, Dmytra Bahaliia Street, 1/53
Response: within 30 days per Law № 2297-VI and GDPR requirements