BO “BF “KOLO UKRAINE” PRIVACY POLICY

Effective Date: April 5th, 2022 04.04.2022

MTÜ KOLO EU, limited liability company incorporated under the laws of Estonia with registration number 80609643 (“MTÜ KOLO EU”) and BO “BF “KOLO UKRAINE”, limited liability company incorporated under the laws of Ukraine with registration number 44732233 (“BO “BF “KOLO UKRAINE””) operate a donation based fundraising platform available at https://koloua.com/donate/ (“Website”) providing customers with a possibility to help Companies in support of humanitarian and military response of Ukraine to aggressive military invasion (together MTÜ KOLO EU and BO “BF “KOLO UKRAINE” are referred to as “Companies”, each separately – “Company”). MTÜ KOLO EU is responsible for collecting and processing information of customers located outside Ukraine. https://koloua.com/donate («Website»).

When you visit the Website, respective Company will receive information about you. This policy (“Privacy Policy”) applies to you when:

• You are visiting our website;
• You register on our website to receive information about our services;
• You make a donation;
• You provided your personal details to us in another way for communication purposes;
• You purchase any item on the website;

This Privacy Policy provides detail about how each Company processes personal information and how each Company supports your rights to your data. Companies are joint controllers of the personal data that is being processed via this website: MTÜ KOLO EU is a controller of personal data of customers located outside Ukraine and BO “BF “KOLO UKRAINE” is a controller of personal data of customers located inside Ukraine. Use of the Website is further governed by the Website terms of use available here: TERMS AND CONDITIONS

1. PROCESSING OF DATA

How Company processes your personal information depends upon how you use and interact with the Website. Some information is provided directly by you, while other information is processed through automated technologies.

Legal Basis for Processing: When accessing the Website, Company processes personal information from you where 1) Company has your consent, 2) where your personal information is necessary for Company to provide a service or 3) where Company has a legitimate interest to process your information and that legitimate interest is not overridden by your data protection interests or fundamental rights and freedoms. In some cases, Company may have a legal obligation to process your personal information, or to process your personal information in order to exercise, establish or defend legal claims.

Types of Data Company Processes: Company processes the following types of information from you:

• Contact details (Name, email address, phone number);
• Technical details (IP address, browser type and version, operating system, location information) and;
• Website use details (pages visited, how long you stayed, how you entered, time of visit).

Website Access:Company processes information when you provide it directly to Company through the Website when you make a donation, order an item or visit a website.

Collected from Third Parties:Company may receive information about you from other sources, including publicly available databases or third parties from whom Company has purchased data, and combine this data with information Company already has about you. This helps Company to update, expand and analyze records, identify new customers, and provide information about products and services that may be of interest to you. If you provide Company personal information about others, or if others give Company your information, Company will only use that information for the specific purpose for which it was provided to Company.

Automated Processing Mechanisms:Company and Company’s service providers also use automated processing technologies to process information within some areas of the Website. Company uses cookies to store content and preferences which enables Company to process standard information your browser sends to certain websites you visit such as your IP address, browser type and language, and the site you came from as well as pages you visit and links you click on within the Website. Having technical information like this helps Company to improve the Website. For additional information on the automated information processing technologies Company uses, please review the cookie policy available here: Cookie policy.

2. HOW COMPANY USES PERSONAL INFORMATION

Company uses personal information processed from the Website to process donations, orders of goods or provide information and reports.

Requests on the Website: Company uses information processed from the Website to respond to visitors` requests. Company does not sell, rent, lease, trade or share Website visitors` personal information other than as outlined in this Privacy Policy. When you provide Company with your personal information or otherwise choose to sign up to receive email communications from Company, Company will use that information to send those communications to you. Individuals may “opt-out” of receiving e-mail communications through links available on e-mails received.

Data Retention: Where Company serves as the controller of the data, such as where Company uses personal information for Company’s own independent business purpose, Company will retain your information for the necessary period of time that it serves the purpose for which it was originally processed or subsequently authorised and in accordance with applicable law.

3. YOUR INQUIRES REGARDING DATA PROCESSING

Company acknowledges that you may have the right to access your personal information and works to manage your inquiries as applicable. Your rights are as follows:

• You may request to access, correct, update or request deletion of your personal information based on information collected from accessing the Website.
• You may request additional information related to the purposes for which Company processes your personal information, the categories of personal information Company processes, where Company originally collected the information, who Company shares it with, and how long Company will retain it.
• You may object to the processing of your personal information, request that Company restrict the processing of your personal information or request portability.
• You have the right to opt-out of marketing communications Company sends you at any time. You can do so by clicking the “unsubscribe” or “opt-out” link in the marketing emails Company sends to you, including Company’s newsletter. Where Company has collected and processed your personal information with your consent, you can withdraw your consent at any time. However, withdrawing your consent will not affect the lawfulness of any processing Company conducted prior to your withdrawal nor will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• Upon your request, and where it is technically feasible, Company will provide you with a copy of your personal data or transmit it directly to another controller. You have the right to submit a complaint to a data protection authority about the collection and use of your personal information. To make a request please email Companies at info@koloua.com with “Personal Data Request” in the subject line and indication “Inside Ukraine” or “Outside Ukraine” respectively, and provide Company with full details in relation to your request, including your contact information and any other detail you feel is relevant. Company will provide a response to an access request within 30 days of receiving such request with respect to the personal information Company holds or if Company cannot, Company will notify you and provide you with the reason for the delay.

You may have other rights as may be provided by the applicable legislation.

Identity Verification Requirement: Company is required by law to verify that any request submitted was made by someone with the legal right to access the data. Therefore, prior to providing any information pursuant to a data subject access request, Company may request that you provide Company with additional information in order for Company to verify your identity and legal authority.

4. LEGAL DISCLOSURES

In certain situations, Company may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Company reserves the right to disclose your personal information as required by law and when Company believes in good faith that disclosure is necessary to protect Company’s rights and/or comply with a judicial proceeding, court order, or legal process served on to Company.

5. REPORTING ISSUES

You have a right to report grievances related to privacy with your local data privacy supervisory authority. In Estonia this is AKI and they can be reached at www.aki.ee which can also be contacted by email at hotline@ombudsman.gov.ua. In Ukraine this is Ukrainian Parliament's Commissioner for Human Rights (Ombudsman), who can be reached at https://www.ombudsman.gov.ua/en/ and also cantacted by email hotline@ombudsman.gov.ua. If you have questions about this Privacy Policy or if you receive any unwanted, unsolicited e-mail sent by Company or purporting to be sent via Company, please contact Company directly at info@koloua.com.

6. CHANGES TO THE PRIVACY POLICY

Companies keeps the Privacy Policy under regular review. Any material updates will be communicated to you in writing. This Privacy Policy was last updated on July 9th, 2022