Privacy Policy
Last updated: 3 September 2026
The Carpathian Human Rights Agency “Vested” respects your privacy and is committed to protecting personal data.
This Policy explains what information we may receive through kaplvested.info and related digital services, why we use it, who it may be shared with, how long it is retained and what rights individuals have.
We apply Ukrainian personal data protection law. Where the European Union General Data Protection Regulation (GDPR) applies to specific processing, we also comply with its requirements.
1. Who processes personal data
The controller of personal data is:
Carpathian Human Rights Agency “Vested”.
For questions about personal data, contact:
2. What data we may receive
We collect only information needed for a specific purpose.
Messages sent through the website
If you send us a message through the contact form, we may receive:
- your name;
- phone number;
- email address;
- the subject and text of your message;
- other information you provide voluntarily.
Please do not send documents or sensitive personal information through the general contact form unless it is necessary for us to consider your request.
Digest subscription
To create and manage a subscription, we may receive your email address and information needed to confirm or end the subscription.
Volunteer application
If you complete a volunteer application, we may receive information you provide about:
- first and last name;
- age group;
- place of residence;
- contact details;
- interests, skills, languages and experience;
- availability and preferred participation format;
- motivation;
- adjustments or support, if you choose to provide this information.
If voluntarily provided information concerns health, disability or other special categories of personal data, it is used only to the extent necessary to provide appropriate participation conditions and on an appropriate legal basis.
Donations
Online payments are processed by LiqPay. The Organisation does not receive or store the full payment card number, expiry date, CVV code or PIN.
We may receive information about the amount, currency, payment status and other technical data needed for payment records and support.
Technical information
When the website operates, the server and hosting provider may technically process the IP address, browser or device type, date and time of the request and other information needed to operate and secure the website, diagnose errors and prevent misuse.
Push notifications
If you enable notifications in the VESTED mobile app, we process the information needed to deliver them, as well as your device language and time zone.
Notifications are used only to inform you about new announcements. We do not use this function for advertising or to determine your location.
You can disable notifications at any time in the VESTED mobile app or in your device settings.
3. AI assistant
Some routes to the website may use an AI assistant that helps people obtain basic information about the Organisation and find relevant material on the website.
To generate a response, the query text is processed temporarily by the server and may be sent to an external language model provider.
The Organisation does not create or retain a history of these conversations. After processing is completed, we do not retain the query text, dialogue text or a session identifier for later analytics or profiling.
Please do not submit passwords, payment details, documents, case numbers or other sensitive personal data through the AI assistant.
4. Why we use data
Depending on the situation, information may be used to:
- respond to enquiries;
- send the requested information digest;
- consider volunteer applications;
- organise volunteer activities;
- receive and record donations;
- operate and secure the website;
- prevent spam, fraud and automated misuse;
- send requested push notifications about new announcements;
- obtain website usage statistics where you have consented;
- comply with legal requirements;
- protect the rights and legitimate interests of the Organisation or other persons.
We do not use information for an incompatible purpose without an appropriate legal basis.
5. Legal bases for processing
Depending on the purpose, the legal basis may be:
- your consent;
- steps taken at your request;
- performance of an agreement or arrangement;
- compliance with a legal obligation;
- the legitimate interests of the Organisation, including website operation and security, protection against misuse and appropriate communication with people who contact us.
Website statistics tools are used only after you consent to statistics.
You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6. Cookies and website statistics
The website uses only necessary browser storage technologies for specific functions, including remembering accessibility settings and your choice about statistics.
They are not used for advertising profiling.
Separately, you can allow or reject website statistics.
If you reject statistics, optional statistics services are not loaded.
If you allow statistics, the website may use third-party web analytics services to obtain aggregated information about website use.
Your statistics choice is stored in your browser for 12 months. You can change it at any time through the website privacy settings.
To demonstrate that the choice was obtained properly, the Organisation may keep a minimal technical record of consent or refusal. This record does not contain your name, email address, browsing history or enquiry text.
7. External providers
For the website and related digital functions, we may use external providers, including:
- Google and Google Workspace - for work email, forms, file and document storage and collaboration, selected organisational workflows, maps, protection against automated misuse and, with your consent, web analytics;
- Metricool - for web analytics, only after your consent to statistics;
- push notification delivery services - if you have enabled this function;
- Microsoft Clarity - for web analytics and improving website usability, only after your consent to statistics;
- LiqPay - for online payment processing;
- the hosting provider;
- a language model provider when you use the AI assistant.
These providers process information only to the extent needed to provide the relevant services and carry out workflows defined by the Organisation.
We do not sell personal data or provide it to advertisers for advertising profiles.
If processing involves an international transfer of personal data and GDPR applies to that transfer, legally recognised safeguards are used where required.
Data may also be disclosed where required by law, a court decision or a lawful request from a competent authority.
8. How long we retain data
We do not retain personal data longer than needed for the relevant purpose.
In particular:
- enquiry data is retained for the time needed to consider the enquiry and any necessary follow-up communication;
- digest subscriber data - until the subscription is cancelled or the mailing is discontinued;
- a volunteer application that does not result in engagement may be retained for up to three years unless the applicant requests earlier deletion;
- after volunteer engagement begins, data is retained according to the nature of the activity and legal requirements;
- push subscription data - until you unsubscribe or the subscription expires;
- payment and accounting data - for periods required by law;
- technical security logs - only for the period needed to protect the website, investigate errors or respond to an incident;
- minimal records of the statistics choice - for the period needed to demonstrate appropriate consent management.
The Organisation does not retain AI assistant conversation text after processing is completed.
After the relevant period ends, information is deleted, destroyed or anonymised unless further retention is required by law.
9. Data concerning minors
A person aged 15-17 may submit an initial volunteer application with the knowledge of a parent or other legal representative.
If a suitable engagement opportunity arises, before volunteer activity begins we will agree the necessary conditions separately and, where required by law, obtain the consent of the legal representative.
10. Your rights
Depending on applicable law, you may have the right to:
- know what personal data we process and for what purpose;
- obtain access to it;
- request correction of inaccurate data;
- request deletion or restriction where there is no legal basis for further processing;
- object to processing where provided by law;
- withdraw consent previously given;
- exercise other rights provided by GDPR where it applies to the processing.
To exercise your rights, contact:
To protect information, we may reasonably verify the identity of the requester without asking for excessive data.
You may also contact the Ukrainian Parliament Commissioner for Human Rights, a court or, where GDPR applies, the competent data protection supervisory authority.
11. Information security
We use organisational and technical measures designed to protect information against unauthorised access, loss, alteration or disclosure.
Access to personal data is limited to people who need it for their tasks.
No method of transmitting or storing information can guarantee absolute security.
If you believe your personal data has been misused, lost or disclosed, contact:
12. Updates to this Policy
We may update this Policy when legislation, website functions, digital services or processing practices change.
The current version is published on this page with the date of the latest update.