Privacy Policy
Last updated: 14.08.2025
1. Who We Are
NGO “Youth Organization SPARK” (ГО «Молодіжна Організація СПАРК»), EDRPOU 46152156 (“SPARK,” “we,” “us,” “our”) acts as the data controller for personal data processed under this Policy.
Address: 88000 Ukraine, Zakarpatska oblast, Uzhhorod, vul. Stantsiina, bud. 36, kv.16
Email: manager@spark.org.ua
2. What Personal Data We Collect
- Identification data: first & last name, organisation, job title.
- Contact data: email address, telephone number, postal address.
- Technical data: IP address, browser type, access date/time, cookies.
- Programme / project data: survey responses, training attendance, service-usage statistics.
- Financial data: bank details and taxpayer ID (only for grant payments or reimbursements).
We do not intentionally collect special-category (sensitive) data unless required by law and supported by your explicit consent.
3. Legal Bases & Purposes of Processing
| Legal basis (Art. 6 GDPR / Art. 11 Ukrainian PDP Law) | Purpose |
|---|---|
| Consent | Newsletters, invitations, updates; publication of testimonials or photos. |
| Contract performance / grant agreement | Administering project participation; processing payments or reimbursements. |
| Legitimate interest of SPARK | Cyber-security, statistical reporting, defending legal claims. |
| Legal obligation | Accounting, tax, and statutory reporting. |
4. Cookies
We use session and persistent cookies to:
- ensure correct website functionality;
- analyse traffic (Google Analytics with IP anonymisation);
- remember language preferences.
You can manage cookies in your browser; disabling them may affect site performance.
5. Data Retention
We store personal data only as long as necessary for the stated purposes or to meet legal requirements:
- Online application records: 3 years.
- Financial documents: 5 years (tax compliance).
After these periods we securely delete or anonymise the data.
6. Disclosure to Third Parties
We share data only with:
- IT service providers (hosting, email delivery) under Data Processing Agreements;
- donors/partners for grant reporting (anonymised where possible);
- government authorities when required by law.
We never sell data or share it for marketing lists.
7. International Transfers
Our servers are located in Ukraine and/or the EU (ISO 27001-certified data centres). If data is transferred outside the EEA, we implement:
- an EU adequacy decision,
- Standard Contractual Clauses (SCCs), or
- another mechanism permitted by Art. 46 GDPR.
8. Your Rights
You may exercise the following rights (Art. 8 Ukrainian PDP Law / Arts. 15-22 GDPR):
- access your data;
- rectify inaccurate data;
- request erasure (“right to be forgotten”);
- restrict processing;
- object to processing;
- receive data in a portable format;
- withdraw consent at any time;
- lodge a complaint with the Ukrainian Ombudsman or an EU supervisory authority.
Send requests to manager@spark.org.ua. We will respond within 30 days.
9. Data Security
We apply:
- TLS 1.2+ encryption in transit;
- AES-256 encryption for backups;
- role-based access controls;
- regular audits and staff training.
If a personal-data breach occurs, we will notify you (and regulators) within 72 hours as required by Art. 33 GDPR and Ukrainian law.
10. Changes to This Policy
We may update this Policy periodically. The new version will be posted on our website with the revised date. Please review it occasionally.
11. Contact
Questions about this Policy or your data rights?
NGO “Youth Organization SPARK” (ГО «Молодіжна Організація СПАРК»), EDRPOU 46152156
Email: manager@spark.org.ua
Address: 88000 Ukraine, Zakarpatska oblast, Uzhhorod, vul. Stantsiina, bud. 36, kv.16