Privacy Policy
Protect your data in accordance with GDPR and comprehensive international standards
Privacy Policy and Personal Data Protection
Company establishment date: June 29, 2026 | Version: 3.0 The 4Relief Humanitarian Foundation holds protecting your privacy of the utmost importance. This policy comprehensively explains how we collect, process, hold and share your personal data, and the full rights you have. We comply with the following legal frameworks: • European General Data Protection Regulation GDPR (2016/679/EU) • UK GDPR / Data Protection Act 2018 • Turkish Personal Data Protection Law KVKK (No. 6698 of 2016) • UAE Personal Data Protection Law PDPL (Decree No. 45 of 2021) • Saudi Personal Data Protection System (PDPL) (1443 AH) • Egyptian Personal Data Protection Law (No. 151 of 2020) • Moroccan Law 09-08 relating to the protection of private persons • APEC Framework Principles for Privacy of Personal Information (for Asian countries) • Pakistan Privacy Protection Act (PECA 2016 and related regulations)
Who we are — Identity of the data controller
Data Controller data: Name: 4Relief Humanitarian Foundation Website: [website link] Privacy email: info@forrelief.org Data Protection Officer (DPO): info@forrelief.org Data of the main data processors: • Stripe Inc. (Card payment processing) — Contact information: stripe.com/privacy • PayPal Holdings Inc. (PayPal payment processing) — Contact information: paypal.com/privacy • Google LLC (site analytics via Google Analytics) — Contact details: policies.google.com/privacy Data is processed by these processors under binding data processing agreements that ensure compliance with the GDPR and applicable laws.
What data we collect and why we collect it
We collect the following types of personal data: First - Identity and contact data: ┌──────────────────────────────── ────────────────────────────────┐ │ Data type │ Legal basis │ Source │ ├───────────────────────┼──────── ────────────┼───────────────────┤ │ Full name │ Contract execution │ User-entered │ │ Email │ Contract execution │ User-entered │ │ Phone number (optional) │ Legitimate interest │ User-entered │ │ Country and region │ Legal obligation │ User-entered │ └──────────────────────────────── ────────────────────────────────┘ Second - Financial Transaction Data: ┌──────────────────────────────── ────────────────────────────────┐ │ Data type │ Legal basis │ Source │ ├───────────────────────────┼──── ────────────────┼────────────────┤ │ Donation amount and currency │ Contract execution │ Payment system │ │ Type and periodicity of donation │ Execution of the contract │ Entered by the user│ │ Receipt number │ Contract execution │ Our internal system │ │ Last 4 digits of card │ Transaction security │ Stripe/PayPal │ │ Transaction status │ Contract execution │ Payment system │ │ Date and time of donation │ Legal obligation │ Our internal regulations │ └──────────────────────────────── ────────────────────────────────┘ IMPORTANT NOTE: We never retain your full card number or CVV. This data is processed directly by Stripe or PayPal and does not pass through our servers. Third - Technical data (collected automatically): • IP address (stored anonymously for security and analysis purposes) • Browser type, version and operating system • The pages you visited, the order in which they were visited, and the duration of each visit • Visit source (search engine, link, social media platform) • Device data: screen resolution, browser language, time zone • Cookies — See our cookie policy for details Fourth - Contact information: • Text of contact form messages • Log email correspondence • The subject of the inquiry or complaint and its date • Data on your complaints and refund requests Fifth - Optional data: • Your personal message attached to the donation • Preference for anonymous donation • Subscribe to the newsletter
The legal basis for each type of processing
In accordance with Article 6 of the GDPR, we process your data based on the following legal bases: 1. Implementation of a contract or agreement (Article 6/1/B): Processing: Completing the donation, issuing the receipt, managing monthly donation subscriptions. Explanation: This processing is necessary to provide the service you have requested. 2. Legal obligation (Article 6/1/c): Processors: Maintain records of financial transactions, comply with AML/CFT requirements, respond to regulatory requests. Explanation: We are required by law to keep these records for specific periods. 3. Legitimate interest (Article 6/1/f): Treatments: improving the site and user experience, fraud prevention, information security. Balancing: We carefully balance our legitimate interests with your fundamental rights. Right to object: You can object to this processing at any time. 4. Approval (Article 6/1/A): Treatments: newsletter, non-essential cookies, optional marketing messages. Right to withdraw: You may withdraw your consent at any time without retroactive effect. For users outside the European Union: These legal foundations are equivalent to the requirements set forth in the Turkish KVKK, the UAE PDPL, the Saudi PDPL, and the Egyptian Data Protection Law, and we apply them all.
How we use your data in detail
First purpose — providing basic service (mandatory): • Process your donation and transfer it to the selected campaign • Issuing and sending the electronic receipt immediately • Manage and update monthly donation subscriptions • Respond to your inquiries and complaints • Send updates to the campaign you donated to • Providing periodic impact reports Purpose 2 — Legal Compliance and Security (Mandatory): • Compliance with anti-money laundering and terrorist financing laws • Fraud detection and investigation • Protect the integrity of our platform from unlawful exploitation • Responding to requests from approved judicial and regulatory authorities • Auditing transactions and documenting their records Third purpose - improvement and development (legitimate interest): • Analyze site statistics to improve performance and experience • Develop new features based on usage patterns • Fix technical errors Purpose 4 — Marketing communication (with your consent only): • Sending a newsletter with news about the organization and new campaigns • Notifications of donation campaigns that may match your interests • Messages celebrating humanitarian achievements You can unsubscribe from any message with one click or by emailing us at info@forrelief.org
Sharing data with third parties
Our basic policy: We do not sell, rent, or share your data for commercial purposes. We only share your data in the following limited circumstances: 1. Payment service providers: • Stripe Inc.: Receives payment data to process transactions according to PCI-DSS Level 1 • PayPal Holdings: Receives order data to complete PayPal transactions • Both are signatories to binding data processing agreements in accordance with the GDPR 2. Analysis tools: • Google Analytics: anonymized usage data (with IP masking enabled) • Does not contain your name or email 3. Email service: • Authorized provider for sending receipts and newsletter • Operates under a binding data processing agreement 4. Field partners: • They receive aggregate data (total donations) only — without any donor identification data 5. Legal and regulatory bodies: • We respond to approved judicial orders and requests from competent regulatory authorities • We report suspicious transactions to the relevant authorities in accordance with AML/CFT requirements 6. International data transfer (for European and UK users): If your data is transferred outside the European Economic Area (EEA) or the United Kingdom: • We apply the European Commission's Standard Contractual Clauses (SCCs). • Or we make sure that the recipient is in a recognized country with an adequate level of protection • You can request a copy of the applicable guarantees via info@forrelief.org
Extended data retention
We retain your data for the following periods of time based on legal and operational requirements: ┌──────────────────────────────── ─────────────────────────────────┐ │ Data type │ Retention duration │ Reason │ ├───────────────────────────────┼ ─────────────────┼───────────────┤ │ Financial transaction data │ 7 years │ Tax liability │ │ KYC and AML records │ 5 years │ FATF requirements │ │ Contact and correspondence data │ 3 years │ Legal rights │ │ Technical data and access logs│ 90 days │ Information security │ │ Newsletter data │ Until cancellation +30 days │ Your wish │ │ Analytical cookies │ 26 months │ Google max│ │ KYC │ 5 years │ FATF/AML │ └──────────────────────────────── ─────────────────────────────────┘ After the expiry of the retention periods: • Identifiable data: permanently deleted from all systems • Non-sensitive data: made anonymous and can be retained for statistical analysis
Your comprehensive legal rights
You have the following full rights regarding your personal data: ┌──────────────────────────────── ────────────────────────────────┐ │ Right │ Description │ Duration to respond │ ├───────────────────┼─────────── ─────────────────┼──────────────┤ │ Access and review │ A copy of your saved data │ 30 days │ │ Correction │ Correction of inaccurate data │ 30 days │ │ Deletion (forgetting) │ Deletion of your data (with legal restrictions) │ 30 days │ │ Restriction │ Temporarily stopping the processing of your data │ 30 days │ │ Portability │ Your data in JSON/CSV format │ 30 days │ │ Objection │ Objection to certain processing │ Immediate │ │ Withdrawal of consent │ Withdrawal of any previous consent │ Immediate │ │ Not subject to an automated decision │ Human review of any automated decision │ 15 days │ └──────────────────────────────── ────────────────────────────────┘ How do you exercise your rights? • Send your request via email: info@forrelief.org • Explain the right you want to exercise and the data involved • We may need to verify your identity to protect your data from unauthorized access • We respond within 30 days (extendable by 60 days in complex cases with your notice) • If we deny your request, we explain the reasons and your rights to appeal The right to appeal to the regulatory authorities: • European Union: the local data protection supervisory authority • United Kingdom: Information Commissioner’s Office ICO — ico.org.uk — Number: 0303 123 1113 • Türkiye: Personal Data Protection Authority KVKK — kvkk.gov.tr • UAE: Telecommunications and Digital Government Regulatory Authority (TDRA) — tdra.gov.ae • Saudi Arabia: Personal Data Protection Authority — sdaia.gov.sa • Egypt: National Council for Telecommunications Regulation
Data security — technical and organizational measures
Technical Security Measures: Data encryption: • SSL/TLS 1.3: Encrypts all data transferred between your device and our servers • AES-256: Encrypts sensitive data stored in the database • bcrypt: Encrypt passwords using a strong hashing algorithm with random Salt Infrastructure security: • Multi-layer firewalls (WAF + Network Firewall) • Intrusion detection and prevention system (IDS/IPS) • Regular vulnerability scanning • Periodic penetration tests (Penetration Testing) Access control: • Multi-factor authentication (MFA) is mandatory for administrative access • Principle of Least Privilege. • Periodic review of access permissions and withdrawal of unsolicited ones • Record and track all access to sensitive data Organizational Security Measures: • A clear and documented information security policy • Mandatory training for all employees on data protection • Specific procedures for responding to data breach incidents • Non-disclosure agreements with all employees and contractors In the event of a data breach: • We notify regulatory authorities within 72 hours (according to GDPR/UK GDPR) • We will notify you personally if the breach poses a high risk to your rights • We are taking immediate action to contain the breach and minimize the damage • We publish a comprehensive report on the incident and the measures taken
Provisions specific to each jurisdiction
European users (EU GDPR): • Our practices meet all GDPR requirements • You have the right to file a complaint with the local supervisory authority without prejudice to your other rights • Our representative in the European Union: [to be appointed upon future enlargement] • Data Protection Officer: info@forrelief.org British users (UK GDPR): • We comply with the UK GDPR and the UK Data Protection Act 2018 • You can complain to the ICO: ico.org.uk • Our UK representative: [to be appointed upon expansion] Turkish Users (KVKK): • According to KVKK No. 6698, we commit to full disclosure and rights of access, deletion and correction • You can submit a complaint to the KVKK Authority via kvkk.gov.tr • Controller data: 4Relief Foundation — info@forrelief.org Emirati users: • We comply with the UAE PDPL Law (Decree No. 45 of 2021) • You can contact the TDRA Complaints Authority: tdra.gov.ae Saudi users: • We comply with the Saudi Personal Data Protection System (PDPL). • Saudi Data and Artificial Intelligence Authority: sdaia.gov.sa Egyptian users: • We comply with Personal Data Protection Law No. 151 of 2020 Moroccan users: • We comply with Law 09-08 on the protection of private persons • For complaints: cndp.ma Asian users: • We comply with the APEC Framework Principles for Privacy • We respect the provisions of each country's national privacy laws
Questions about your privacy?
Our Data Protection Officer is ready to answer — we respond within 72 hours