We follow the principle of data minimisation: we collect only the data needed for the stated purpose. 
 

6. Protection of Children's Data 

SFLUA works in the interests of children, so protecting their data is a priority. We adhere to the international Keeping Children Safe (KCS) standards and the Law of Ukraine "On the Protection of Childhood". 

• Children's data within our programmes is processed only with the consent of a parent or legal guardian. 

• Photographs, videos, and stories of children are published only with documented consent and after review for dignity, privacy, and safety. 

• We do not publish identifying information (full name combined with school, address, etc.) without explicit consent. 

• Website functions involving the submission of personal data (donations, subscriptions, applications) are intended for adults. 

• Parents and legal guardians may withdraw consent regarding their child's data at any time by contacting privacy@sflua.org. 
   

7. Cookies 

The Website uses cookies and similar technologies. We classify them as: 

• Essential — enable basic Website operation (no consent required); 

• Analytics — help us understand how the Website is used; 

• Marketing / third-party — for example, embedded social media content. 

Before placing non-essential cookies, we ask for your consent through a cookie banner. You can change your settings at any time through the banner or your browser settings. See our Cookie Notice for more detail. 
 

8. With Whom We Share Data 

We do not sell your personal data. We may share data with a limited set of recipients, including: 

• Service providers (processors): payment services, Website hosting, email tools, CRM system — solely to perform their functions on our behalf; 

• Donors and institutional partners — in anonymised or aggregated form for impact reporting (children's personal data only with consent); 

• Public authorities — where required by law; 

• Star for Life International — within our participation in the international network, subject to this Policy. 

All processors are required to ensure an adequate level of data protection and to process data only on our instructions. 
 

9. International Data Transfers 

Some of our service providers (for example, cloud services, payment systems) may store or process data outside Ukraine, including in the EU or the USA. 

In such cases, we take measures to ensure an adequate level of protection, including transferring data to countries recognised as providing a sufficient level of protection (such as the EEA states and the USA under Resolution of the Cabinet of Ministers of Ukraine No. 910 dated 16 August 2022), or applying other safeguards provided by law. 
 

10. How Long We Keep Data 

We keep personal data only for as long as there is a legal basis for processing it: 

• Donor data (for financial and tax reporting) — for the periods required by Ukrainian law (usually at least 3 years, and longer for certain accounting documents); 

• Subscriber data — until consent is withdrawn (unsubscribe); 

• Applicant data — for the duration of the application review and a reasonable period afterwards; 

• Children's data within programmes — for the duration of participation and the period needed for donor reporting, after which it is deleted or anonymised; 

• Cookie data — for the lifetime of the relevant cookie. 

After the retention period ends, data is deleted or anonymised. 
 

11. Your Rights 

Under Article 8 of the Law of Ukraine "On the Protection of Personal Data" (and, for residents of the EEA/UK/Switzerland, also under the GDPR), you have the right to: 

• know the sources of collection, the location of your personal data, and the purpose of processing; 

• access your personal data; 

• request correction of inaccurate or outdated data; 

• request deletion (destruction) of your data where there is no legal basis for continued storage; 

• object to processing and withdraw consent previously given; 

• request restriction of processing; 

• data portability (for cases covered by the GDPR); 

• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or with a court. 

To exercise any of these rights, email us at privacy@sflua.org. We will respond within the time limits set by law (generally within 30 days). 
 

12. How We Protect Data 

We apply organisational and technical measures to protect personal data against unauthorised access, loss, or misuse, including: 

• access management on a least-privilege basis; 

• multi-factor authentication for work accounts; 

• encryption of data in transit (HTTPS); 

• internal policies on data storage and processing; 

• heightened care for data relating to children. 

Given that we operate in conditions of armed conflict, we pay particular attention to cybersecurity and to protecting data against threats associated with martial law. 
 

13. Changes to This Policy 

We may update this Policy. For material changes, we will update the effective date at the top of the document and publish a notice on the Website. We recommend reviewing this Policy periodically. 
 

14. Contact 

If you have questions about this Policy or wish to exercise your rights, please contact us: 

Organisation: Charitable Organisation "Charitable Foundation Star for Life Ukraine" 

EDRPOU: 44977372 

Address: 18 Otakara Yarosha Street, Kharkiv, 61045, Ukraine 

Privacy matters: privacy@sflua.org 

General enquiries: team@starforlife.org.ua 

Website: www.sflua.org