Privacy policy

1. Who we are and scope

This Policy explains how CHARITABLE ORGANIZATION “SERGEY TOKAREV FOUNDATION”, Ukrainian registration code 44349847 (the “Foundation”), processes personal data in connection with https://www.tokarevfoundation.org, email, social media, partnerships, events, research, grantmaking and other statutory activities.

Under Ukrainian law, the Foundation is the personal data owner where it determines the purpose of processing, the categories of data and the processing procedures. Where the GDPR, UK GDPR or another law applies, the Foundation may also act as a controller, joint controller or processor, depending on its actual role. Roles in joint projects are defined by contract or another appropriate arrangement.

This Policy does not replace specific notices for employees, candidates, participants in particular programmes, grant recipients or other groups where the nature of the processing requires more specific information.

2. Legal framework and international activities

The Foundation’s primary legal framework is the Constitution of Ukraine, the Law of Ukraine “On Personal Data Protection” No. 2297-VI as amended, Council of Europe Convention 108 and the Additional Protocol ratified by Ukraine, together with other applicable Ukrainian rules.

The GDPR applies only where its territorial scope is met, including where processing takes place in the context of an EU/EEA establishment or where the Foundation, without an EU establishment, offers goods or services to individuals in the EU or monitors their behaviour in the EU. Likewise, the UK GDPR and other foreign privacy laws apply only where their respective applicability criteria are met.

If mandatory law in a relevant jurisdiction grants broader rights or imposes stricter requirements, those rules apply in addition to this Policy. The Foundation may issue local or programme-specific privacy notices where necessary. Nothing in this Policy is intended to state that the privacy law of every country in the world automatically applies to the Foundation.

3. Current digital touchpoints

As of the last review date, the website is primarily informational and includes pages about the Foundation, its team, areas of work, impact, reports and contacts, together with links to external social networks and resources. Collaboration enquiries are directed to hey@tokarevfoundation.org. The Contact Us page states that grantmaking is currently invitation-only and that there is no open call for applications.

If the website later introduces forms, subscriptions, online donations, user accounts, open calls, new trackers or other functionality, the Foundation will review this Policy, consent/cookie settings and, where required, provide a separate just-in-time notice before launching the relevant feature.

4. Personal data we process and where it comes from

4.1. Website visits

• IP address, date and time of the request, URL, referrer, browser and device type, language, operating system, error logs and security logs;
• cookie and similar-technology preferences, if such technologies are used;
• aggregated page-view and content-interaction metrics, if analytics is enabled.

4.2. Email and other enquiries

• first and last name, role, organisation, country, email address, telephone number and other contact details;
• message content, attachments and proposals concerning partnerships, support, ideas or new projects;
• internal notes, communication history, screening results and decisions regarding further engagement.

4.3. Partners, donors, grant recipients, applicants and contractors

• identity and registration information about individuals and organisations, authority of representatives and professional experience;
• due-diligence data, such as ownership structure, ultimate beneficial owners, conflicts of interest, sanctions and reputational risks, financial and programme capacity;
• banking, tax, contractual, procurement and reporting information to the extent necessary for lawful cooperation.

4.4. Programme participants and beneficiaries

• contact, demographic, educational, professional and social information needed for participation, assessment, safeguarding and impact measurement;
• health, disability, psychological status, displacement, war experience, experience of violence or other vulnerability data only where necessary for a particular programme and supported by appropriate legal grounds and safeguards;
• photographs, video, audio, quotations, biographical information and impact stories in accordance with section 9.

4.5. Team members, candidates, advisers and suppliers

This Policy provides external-level transparency for these categories. Detailed employment, contractual and internal processing should be governed by separate notices, contracts, policies and access rules.

4.6. Data from other sources

The Foundation may receive data from partners, donors, grant recipients, referees, public registers, sanctions lists, professional sources, media and other lawful public sources. Where data is not obtained directly from the individual, the Foundation provides appropriate processing information within the time required by applicable law unless a lawful exception applies. Under Ukrainian law, such notice is generally provided within 30 working days of collection; where the GDPR applies, Article 14 GDPR governs the relevant timing and content.

4.7. Email newsletter

If you subscribe to updates from Tokarev Foundation, we collect your email address and information relating to your subscription, such as the date and time of consent and your subscription status.

We use this information to send you news, stories, opportunities and other updates about the Foundation and its work.

Where required by applicable law, we process this information on the basis of your consent. You can withdraw your consent at any time by clicking the unsubscribe link included in every email or by contacting us at hey@tokarevfoundation.org.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

5. Purposes and lawful bases

6. Consent

The Foundation does not use consent as a universal lawful basis. Where processing relies on consent, consent must be freely given, specific, informed and unambiguous and, for special-category data, must satisfy any heightened requirements imposed by applicable law. The Foundation keeps appropriate evidence of consent.

Consent may be withdrawn for future processing. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and does not stop processing where a separate lawful basis continues to apply. Refusing media consent should not, by itself, deprive a person of charitable assistance or programme participation unless publicity is objectively necessary for the relevant activity.

7. Special categories and higher-risk processing

In carrying out its statutory activities, the Foundation may encounter data requiring enhanced protection, including information about health, disability, psychological status, violence, location, biometric or genetic data and other categories identified by Article 7 of the Ukrainian Law “On Personal Data Protection” or Article 9 GDPR.

• such data is collected only to the minimum extent necessary;
• before processing begins, the Foundation identifies a general lawful basis and, where required, a separate condition for processing the special category of data;
• access is restricted on a need-to-know basis and enhanced technical and organisational safeguards are applied;
• high-risk operations are subject to a documented risk assessment and, where the GDPR applies and Article 35 criteria are met, a DPIA is completed;
• where processing must be notified to the Ukrainian Parliament Commissioner for Human Rights as presenting a particular risk, the Foundation completes the applicable notification and organisational requirements under Ukrainian law.

Nothing in this Policy means that consent alone will always make the processing of special-category data lawful; all additional requirements of the applicable legal regime must also be satisfied.

8. Children and vulnerable people

• the Foundation applies the best interests of the child, data minimisation, understandable transparency and enhanced safeguarding;
• where required by law or by the nature of the programme, the authority of a parent, guardian or other legal representative is verified; where appropriate, the child’s own informed views are also taken into account in a manner consistent with age and maturity;
• consent to participate in a programme is not automatically consent to photography, publication of an impact story, marketing use or the transfer of identifiable data to a donor;
• public reporting and research should use aggregation, anonymisation or pseudonymisation where identification is not necessary;
• materials must not create an undue risk of stigma, re-traumatisation, discrimination, harassment or physical harm.

9. Photographs, video, biographies and impact stories

The website publishes photographs, biographical information about team members and advisers, partner information, programme information and impact materials. For each category, the Foundation documents an appropriate lawful basis for personal-data processing and separately verifies any copyright, licence or other content rights that are required.

• for identified beneficiaries, children and vulnerable people, separate, specific and understandable consent is used unless another basis is appropriate and sufficient;
• where appropriate, the relevant permission or other basis records the channels of use, territory, duration, permitted editing, withdrawal options and the effect of lawful publication already completed;
• content is reviewed for dignity, safety, safeguarding, accuracy and minimisation of disclosure;
• donor reporting should not automatically include identifiable beneficiary stories where the purpose can be achieved with aggregated or de-identified information.

10. Cookies, analytics and third-party technologies

Strictly necessary technologies may be used for page delivery, cybersecurity, load balancing, abuse prevention and the storage of preferences. Non-essential analytics, advertising or marketing pixels, social widgets and other non-essential technologies are activated only after an appropriate user choice where required by applicable law.

The actual list of cookies and trackers must be established through a technical scan of the production website. If non-essential cookies or technologies requiring consent are used, the Foundation implements an appropriate consent-management mechanism and Cookie Notice before or at the time such technologies are activated.

External links to social networks, partner websites and report-hosting resources may lead to independent third parties. After a user follows such a link, those parties process data under their own terms unless otherwise expressly agreed with the Foundation.

11. Recipients and use of processors

• hosting, domain, cybersecurity, email, cloud-storage, CRM, analytics and technical-support providers;
• banks, auditors, legal and accounting advisers, insurers, translators and other professional providers;
• donors, partners, researchers, grant recipients and contractors, only to the minimum extent necessary and supported by an appropriate lawful basis;
• public authorities, courts, law-enforcement bodies or other competent authorities where required by law or necessary for the establishment, exercise or defence of legal rights.

Where a provider processes personal data on behalf of the Foundation, the provider’s authority, purposes, scope, confidentiality, security measures, sub-processors, return/deletion obligations and other required terms are set out in a written agreement as required by applicable law. The Foundation does not sell personal data or disclose it to third parties for their independent marketing without a separate appropriate basis.

12. International transfers of personal data

The Foundation’s statutory activities include cooperation in Ukraine and abroad, so personal data may be transferred to international partners or processed by cloud providers in other countries.

Transfers from Ukraine are made in accordance with Article 29 of the Law of Ukraine “On Personal Data Protection”, including to countries recognised under Ukrainian law as ensuring an adequate level of protection or on another basis expressly permitted by law, such as unambiguous consent, necessity for a transaction, protection of vital or public interests/legal claims, or the provision of appropriate guarantees.

Where the GDPR applies, international transfers are made in accordance with Chapter V GDPR, including, where appropriate, adequacy decisions, Standard Contractual Clauses or another permitted mechanism, together with supplementary measures and a transfer assessment where required. Where the UK GDPR applies, the Foundation uses permitted UK transfer mechanisms and the applicable protection test/assessment. Other jurisdictions’ mandatory transfer rules are followed where they apply.

Before a transfer, the Foundation considers the recipient, destination, purpose, categories and sensitivity of data, duration, onward transfers, individual rights and contractual, organisational and technical safeguards. Identifiable data about children and vulnerable beneficiaries is not transferred internationally merely for convenience.

13. Security, accountability, incidents and risk assessment

• role-based access, least privilege, multi-factor authentication and periodic access reviews;
• encryption in transit and, where proportionate to risk, at rest; backups, logging and timely system updates;
• data classification, retention rules, confidentiality, staff training and documentation of access to high-risk data;
• vendor due diligence and written processing/confidentiality agreements;
• an incident-response plan, assessment of risk to individuals, decision logging and notification to competent authorities and/or affected people within the time required by applicable law.

The Foundation maintains proportionate records of processing activities and assesses privacy risk before introducing new technologies or programmes likely to materially affect individuals’ rights. Where Ukrainian law requires notification of particular-risk processing or the designation of a responsible person/unit for personal-data protection, the Foundation complies with those requirements. Where the GDPR applies, the relevant accountability, DPIA, DPO and breach-notification requirements are followed when applicable to the actual processing.

14. Retention

These periods are working guidelines and may be shortened or extended where required by a particular programme, contract, donor condition, accounting or tax law, litigation, investigation or another lawful reason. Final periods are set by the Foundation’s Records Retention Schedule. At the end of the applicable period, data is deleted, irreversibly anonymised or lawfully archived with restricted access.

15. Individual rights and requests

Depending on applicable law, an individual may have the right to:

• know the sources of collection, location of personal data, purposes and conditions of processing, categories of recipients and other information required by law;
• access personal data and obtain a copy where provided by law;
• request correction, updating, blocking, cessation of processing or deletion where the law permits;
• object to processing based on legitimate interests where the applicable legal regime provides that right;
• withdraw consent for future processing;
• request restriction of processing and data portability where these rights are provided by the GDPR, UK GDPR or other applicable law;
• not be subject to solely automated decisions producing legal or similarly significant effects where and to the extent provided by law;
• complain to the Ukrainian Parliament Commissioner for Human Rights and, where the GDPR, UK GDPR or another regime applies, to the competent supervisory authority;
• seek judicial or other remedies available under applicable law.

Requests may be sent to hey@tokarevfoundation.org with the subject “Privacy request / Запит щодо персональних даних”. The Foundation may request only additional information reasonably necessary to verify identity and protect personal data against unauthorised disclosure.

The Foundation responds within the time required by applicable law. Under Ukrainian law, the controller generally considers whether an access request can be satisfied within no more than 10 working days and satisfies the request within 30 calendar days unless otherwise provided by law. Where the GDPR applies, its response period generally is one month, subject to the extension rules in the GDPR.

16. Automated decisions, profiling and AI

The public website does not currently state that it uses automated applicant selection or personalised profiling. If the Foundation introduces AI or automation to triage enquiries, assess projects, evaluate risk or measure impact, the purpose, lawful basis, data categories, vendors, international transfers, need for a DPIA/risk assessment, retention rules and human-oversight mechanisms are determined before deployment.

Decisions producing legal or similarly significant effects for an individual should not be based solely on an opaque automated output unless permitted by applicable law and accompanied by appropriate safeguards. Enhanced caution applies to data about children, health and other high-risk categories.

17. Changes, language versions and contact details

The Foundation reviews this Policy when the website, programmes, providers, international operations or law change. Material changes are marked with a new date and, where appropriate or legally required, brought to individuals’ attention by an additional notice.

The Ukrainian and English versions of this Policy have the same structure and content. The English version is a translation of the Ukrainian version. If an unintended inconsistency arises, the Ukrainian version prevails for relationships governed by Ukrainian law; this does not limit any mandatory rights available under applicable foreign law.

Personal data owner / Controller: БО «ФОНД СЕРГІЯ ТОКАРЄВА» / CHARITABLE ORGANIZATION “SERGEY TOKAREV FOUNDATION”, Ukrainian registration code 44349847. Website: https://www.tokarevfoundation.org. Privacy contact email: hey@tokarevfoundation.org.