Privacy Policy

The policy regulates the basic principles of privacy protection and personal data of users, as well as the method and rules for using cookies on the website https://app.topcharity.eu/ (hereinafter: the Website), including within the TOP CHARITY platform made available on the Website, which enables the registration and maintenance of a user account and participation in charity events and auctions organised by the Controller (hereinafter: the Platform). The rules for using the Platform are set out in the TOP CHARITY Platform Terms and Conditions, and the rules for participation in individual events and auctions – in the relevant event regulations.

The introduction of the privacy policy results from the requirements of direct analytical service providers and information requirements arising from legal provisions regarding the implementation of the principles of using cookies. The privacy policy summarizes (separates) the processes and information obligations carried out by the personal data controller.

The privacy policy implements the method of fulfilling requirements resulting from:

• Google Analytics Terms of Service (https://www.google.com/analytics/terms/us.html);
• Provisions of the Act of July 12, 2024, on Electronic Communications (Journal of Laws 2024.1221);
• Provisions of the Act of July 18, 2002, on the Provision of Services by Electronic Means – with regard to services provided within the Platform;
• Provisions of the Act of March 1, 2018, on Counteracting Money Laundering and Terrorist Financing (hereinafter: the AML Act) – to the extent that the Controller performs the obligations of an obligated institution;
• Provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: GDPR).

The Administrator of your personal data is the Omenaa Art Foundation, with its registered office in Warsaw, at ul. Fryderyka Joliot-Curie 28, unit U2, 02-646 Warsaw, entered into the Register of Associations, Other Social and Professional Organisations, Foundations and Independent Public Healthcare Institutions of the National Court Register, maintained by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, KRS No.: 0001008016, REGON: 523988736, NIP: 5213998083 (hereinafter: the Controller).

Contact with the Controller is possible by sending an e-mail to [email protected] or by mail to the correspondence address indicated above.

Your personal data will be processed for purposes related to your use of the functionalities available on the Website, in particular:

• in order to handle and respond to inquiries sent via the contact form available on the Website;
• in order to register and maintain a user account on the Platform, including verifying the registration application against the list of invited persons maintained by the Controller and authenticating logins with a one-time code sent via SMS;
• in order to handle participation in charity events and auctions, including providing auction catalogues, receiving and handling declarations (offers), handling telephone bidding (including recording calls, where provided for in the relevant auction regulations), receiving statements submitted on the Platform, and settling auction results and donations;
• in order to fulfil legal obligations incumbent on the Controller, including accounting and tax obligations and the obligations of an obligated institution under the AML Act;
• in order to invite users to participate in future events and to inform them about the Controller's statutory activities;
• in order to send, to the provided e-mail address, information about the Controller's activities, the events it organises, charity auctions and fundraising campaigns – solely on the basis of separate, voluntary consent;
• in order to collect analytical and statistical data related to measuring traffic on the Website and user behavior, which serves to improve the quality of services and optimize the Website.

Your personal data will be processed on the following legal bases:

• Art. 6(1)(b) GDPR (Necessity for the performance of a contract): regarding the registration and maintenance of an account on the Platform and the handling of participation in events and auctions in accordance with the TOP CHARITY Platform Terms and Conditions and the relevant event regulations;
• Art. 6(1)(c) GDPR (Legal obligation): regarding the fulfilment of accounting and tax obligations and obligations under the AML Act;
• Art. 6(1)(f) GDPR (Legitimate interest of the Controller): regarding the handling of inquiries sent via the contact form. The legitimate interest of the Controller is the ability to respond to an inquiry directed by an interested person and to maintain communication with potential partners, donors, and other interested parties.
• Art. 6(1)(f) GDPR (Legitimate interest of the Controller): regarding inviting previous participants and donors to take part in future events and informing them about statutory activities; the legitimate interest of the Controller is maintaining relationships with participants and donors and pursuing its statutory objectives;
• Art. 6(1)(a) GDPR (Consent): regarding sending, to the provided e-mail address, information about the Controller's activities, events, charity auctions and fundraising campaigns; consent is voluntary and may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal;
• Art. 6(1)(a) GDPR (Consent): regarding the collection of analytical data via cookies, based on the consent expressed by the User through the consent management mechanism (cookie banner).
• Art. 6(1)(f) GDPR (Legitimate interest of the Controller): regarding ensuring the security and proper functioning of the Website, as well as pursuing and defending against potential claims.

The Controller processes the following categories of personal data:

a) Data provided in the contact form:

• name and surname,
• e-mail address,
• message content,
• other data provided voluntarily by the User in the content of the inquiry.

b) Data provided during account registration and use of the Platform:

• name and surname (and in the case of legal persons or organisational units – the name and the details of the person authorised to represent them),
• e-mail address,
• mobile phone number (used for logging in with a one-time SMS code),
• data concerning participation in events and auctions, including submitted declarations (offers), auction results, and data concerning settlements and donations made,
• the content of statements submitted on the Platform (including statements of having read the regulations), together with a record of the date and time of submission, the document version and the IP address,
• recordings of telephone calls – only in the case of participation in telephone bidding, where provided for in the relevant auction regulations,
• data and documents provided as part of the verification required under the AML Act.

c) Data collected automatically (cookies and analytical data):

• IP addresses,
• browser and device data,
• analytical and statistical data related to measuring traffic on the Website and User behaviour (including visited subpages, visit time, traffic source).

Providing personal data in the contact form is voluntary but necessary to handle the inquiry. The consequence of not providing data will be the inability to respond to the message. Providing data during account registration is voluntary but necessary to create an account and use the Platform. Providing data required under the AML Act is a statutory obligation with regard to transactions covered by that Act; refusal to provide it may result in refusal to register an account, admit to an auction or complete a transaction.

Personal data is stored only for the period necessary to achieve the specific purpose for which it was collected:

• contact form data: for the period of conducting correspondence and handling the inquiry, and then for the period necessary to secure or pursue potential claims (as a rule, 3 years from the date of the last contact);
• data related to maintaining an account on the Platform: for the duration of the account agreement and for 6 years after its termination (limitation period for claims);
• data related to participation in auctions and settlements (including donations): for 6 years from the end of the year in which the transaction took place, and for the periods resulting from tax and accounting regulations;
• data processed in fulfilment of the obligations under the AML Act: for the period indicated in Article 49 of that Act;
• data processed for the purpose of inviting to future events and informing about statutory activities: until an effective objection is raised, but no longer than 5 years from the last participation in an event;
• data processed on the basis of consent to e-mail communication: until the consent is withdrawn;
• analytical data (cookies): in accordance with the validity period of individual cookies, specified in the section regarding cookies.

Recipients of personal data may be entities providing auxiliary services to the Controller, which include:

• hosting and Website maintenance providers;
• the entity managing the Platform (Platform operator) – where this function is performed by an entity other than the Controller;
• analytical service providers (Google LLC – as part of Google Analytics);
• IT service and technical support providers;
• e-mail service providers;
• telecommunications service providers for sending SMS messages (login codes);
• payment operators handling donations made via online payments – indicated separately for individual events;
• entities providing accounting and legal services;
• owners (sellers) of auction items – to the extent necessary to complete the transaction, in accordance with the relevant auction regulations;
• authorities entitled to receive data under the law, including the General Inspector of Financial Information, tax authorities and judicial authorities.

Data processed in connection with maintaining an account on the Platform and participation in events and auctions is, as a rule, not transferred outside the European Economic Area. In connection with the use of the Google Analytics service, personal data may be transferred to third countries (including the United States). The transfer of data takes place on the basis of appropriate safeguards provided for in the GDPR, including the European Commission's decision stating an adequate level of data protection (EU-US Data Privacy Framework) or standard contractual clauses (Articles 45 and 46(2)(c) GDPR).

Every data subject has the right to:

• request access to their personal data from the Controller;
• rectification of personal data;
• erasure of personal data;
• restriction of personal data processing;
• object to the processing of personal data (in particular, to processing based on the legitimate interest of the Controller);
• data portability;
• withdrawal of consent to the processing of personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal (applies to data processed on the basis of consent);
• file a complaint with the supervisory authority – the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

The data Controller does not engage in automated decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

Profiling may take place only through analytical services, in accordance with the consents expressed by the User. The Controller does not carry out profiling for marketing purposes.