Privacy Policy

Kiwanuka e.V., the operator of Kiwa-Projects, takes the protection of personal data seriously. This privacy policy explains which data we process, for what purposes, and which rights data subjects have.

1. Controller

2. What data we process

• Account data, such as name, email address, and optional profile details when creating an account.
• Usage data, such as information about how the website is used, visited pages, and technical log data.
• Donation-related data, such as amount, currency, project reference, name, email address, public-visibility choice, and an optional message.
• Communication data when users contact us by form or email.

3. Purposes and legal bases

• Providing and operating the website.
• Managing user accounts and authentication.
• Processing and documenting donations.
• Handling inquiries and communication.
• Complying with legal obligations, especially retention obligations under association, tax, and commercial law.

Depending on the context, processing is based on Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation), Art. 6(1)(f) GDPR (legitimate interests), or, where required, consent under Art. 6(1)(a) GDPR.

4. Payment processing

When online donations are enabled, we use Stripe as our payment service provider. In the course of payment processing, personal data such as name, email address, payment information, and transaction data may be transmitted to and processed by Stripe.

For donations made by bank transfer, we process the payment data necessary for booking and documentation.

5. Service providers we use

• Supabase: database, authentication, and storage functions.
• Netlify: website hosting and delivery, including technical logs.
• Resend: delivery of transactional email, such as donation confirmations.
• Stripe: payment processing once online donations are enabled.

Where a provider processes data outside the European Economic Area, we rely on an applicable adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses. The details depend on the service in use and its data-processing agreement.

6. Retention period

Account data is generally retained until the account is deleted. Messages and inquiries are deleted once handling is complete and no legal retention duty remains. Technical logs are deleted according to each provider’s security and operational retention periods. Donation and accounting records are retained in line with applicable tax and commercial obligations. Data with no remaining legal basis is deleted or anonymized.

7. Public community content

Project comments, questions, and optional donation messages are displayed on the relevant public project page. Online donors choose whether their name or “Anonymous” appears. Email addresses are never displayed in the public ledger. Do not include contact details, health data, or other sensitive information in messages. We may hide unsuitable messages without deleting the donation entry required for transparency and accounting.

8. Cookies and similar technologies

Where we use non-essential cookies or similar technologies, we do so only on the basis of valid consent. Technically necessary functions may be used without separate consent where legally permitted.

9. Rights of data subjects

Data subjects generally have the right to access, rectification, erasure, restriction of processing, data portability, and to object to certain processing activities. Consent may be withdrawn at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority.

10. Contact for privacy requests

Privacy-related requests can be sent to info@kiwa-projects.org.

11. Version and changes

Version: 31 July 2026. We update this privacy policy when our website, the services we use, or legal requirements change.