Privacy Policy

1.1. This Policy defines the procedure for processing and protecting personal data by the Public Organization "Veterans Union 'SAPSAN'" (EDRPOU code 46275725, hereinafter — the Organization).

1.2. The Organization is the owner of personal data in accordance with the Law of Ukraine "On Personal Data Protection" No. 2297-VI dated 01.06.2010.

1.3. The Policy is developed taking into account the requirements of the Law of Ukraine "On Personal Data Protection", the Law of Ukraine "On Public Associations", and other regulatory legal acts.

1.4. Personal data processing is carried out on the principles of lawfulness, transparency, minimization, purpose limitation, accuracy, storage limitation, and integrity and confidentiality.

Full name: Public Organization "Veterans Union 'SAPSAN'"

EDRPOU code: 46275725

Legal address: 08130, Kyiv region, Bucha district, Petropavlivska Borshchahivka village, Zhyvopysna St., 35

Email: vynetaym@gmail.com

Phone: +38 (098) 671-41-40

3.1. The Organization processes the following categories of personal data provided voluntarily by the subject through public forms on the website:

3.2. Processing of special categories of personal data is carried out exclusively on the basis of separate written consent of the personal data subject in accordance with Art. 7 of the Law of Ukraine "On Personal Data Protection" and is regulated by a separate internal document of the Organization.

3.3. Public forms on the website are intended solely for collecting contact data necessary for reviewing the application and providing feedback. Extended information required for the Organization's statutory activities is provided by the subject personally in a secure manner after membership is established.

4.1. Personal data is processed exclusively for achieving the Organization's statutory goals, in particular:

• reviewing applications for joining the Organization;
• providing feedback on requests via the contact form;
• communication with members, volunteers, and partners of the Organization;
• providing legal, informational, and social assistance to veterans and their families;
• ensuring the functioning of the Organization's digital platform;
• compliance with the requirements of Ukrainian legislation.

5.1. Personal data processing is carried out on the following legal bases:

• consent of the personal data subject (for feedback forms and membership applications);
• performance of the Organization's statutory activities (for member records);
• compliance with the requirements of Ukrainian legislation.

5.2. For processing special categories of data, the Organization obtains separate, explicit, written consent from the personal data subject.

6.1. Personal data is stored on the server equipment of the hosting provider, which ensures a level of protection adequate to the requirements of current legislation.

6.2. The Organization does not transfer personal data to third parties, except in cases provided by law or with separate consent of the subject.

6.3. The hosting provider acts as a processor of personal data and acts exclusively on behalf of the Organization.

7.1. The Organization performs automatic logging of all operations that change the state of data (creation, update, deletion), as well as access to confidential categories of data.

7.2. Logs contain: user identifier, action type, object, IP address, User-Agent, date and time.

7.3. The purpose of logging is to ensure security, audit actions, prevent unauthorized access, and recover data.

7.4. Log storage period — 12 months from the date of creation.

• Membership application data — 3 years from the date of submission;
• Feedback data — 1 year;
• Technical logs — 12 months;
• Member data — during the membership term and 3 years after its termination, according to a separate policy.

9.1. Every subject has the right to:

• know about the sources of collection, location of their data, purpose of processing;
• obtain access to their personal data;
• demand correction of inaccurate or incomplete data;
• demand deletion of data or termination of its processing;
• withdraw consent to processing at any time;
• file a complaint with the Commissioner of the Verkhovna Rada of Ukraine for Human Rights.

9.2. To exercise their rights, the subject may contact at vynetaym@gmail.com.

10.1. The Organization takes the following technical and organizational measures:

• encryption of data transmission channels (HTTPS/TLS);
• password hashing (bcrypt);
• access rights differentiation by role model;
• automatic logging of actions;
• regular backup;
• restriction of access to server equipment;
• gradual implementation of two-factor authentication for administrators.