Privacy Policy

This document covers the Fundacja HelpTana website at helptana.org and its subdomains. It is not a privacy policy or terms of sale for the separate online store.

1. Data controller and contact

The personal data controller is Fundacja HelpTana, based in Krakow, Poland, National Court Register (KRS) 0001186865, tax ID (NIP) 6783229494, statistical number (REGON) 542367850. For personal-data matters, contact help@helptana.org.

Confirmed registered office address: os. Oświecenia 9/82A, 31-635 Kraków, Polska. For correspondence, contact help@helptana.org.

2. Categories and sources of data

• Messages and contact information supplied by senders when they write to the Foundation or use an email link.
• Technical connection and security information, potentially including IP addresses, request dates and times, and device parameters in server and infrastructure logs.
• Cookie preferences: a pseudonymous decision identifier, event time, choice type, notice version, and consent to optional analytics.
• Bank-transfer donation information received by the Foundation through its bank account and bookkeeping. The Donation page prepares transfer details; it does not collect payment-card numbers or online-banking credentials.
• Photographs showing children involved in the Foundation’s activities. The Foundation confirms that it has parents’ or guardians’ permissions to use their images in informational materials.

3. Purposes of processing

• Responding to correspondence and working with donors and volunteers.
• Maintaining the operation, integrity and security of WordPress and Azure infrastructure.
• Remembering cookie preferences and recording choices relating to optional analytics.
• Accounting for donations and fulfilling legal and bookkeeping duties.
• Documenting and reporting on the Foundation’s activities using children’s photographs within the scope of the permissions granted.

Depending on the processing activity, relevant legal bases may include: Article 6(1)(a), (c) or (f) GDPR, as appropriate to the particular activity. Clicking an “Accept” button does not in itself make unrelated processing lawful.

4. Cookies and the decision register

HelpTana Cookie Consent sets the necessary ht_cookie_consent cookie for .helptana.org for no more than 180 days. A choice is also recorded in the central WordPress register: random UUID, choice type, analytics consent, notice version and UTC time. The planned retention period for register entries is 12 months, with deletion by a WP-Cron task that requires monitoring.

The dedicated consent register does not store IP addresses or User-Agent headers. Separate hosting-service logs may nevertheless contain technical data. Preferences can be changed or withdrawn using the footer link. For details, see the Cookie Policy.

5. Providers and data location

The Fundacja HelpTana website runs on Microsoft Azure. The WordPress App Service, MySQL Flexible Server and related application storage are located in West US 2 (United States). An additional Azure Storage account is configured in Poland Central (Poland). Azure Front Door and Azure Communication Services are global services; the label “global” does not establish where every data-processing operation occurs.

Microsoft publishes its Data Protection Addendum (DPA), November 2026 edition, and information about its U.S. entities covered by the EU–U.S. Data Privacy Framework. The European Commission adequacy decision applies to participating U.S. organisations. Details requiring case-specific confirmation for the Foundation: which DPA terms and transfer mechanism apply to the Foundation’s specific subscription, relevant subprocessors, retention of logs, and data processing in additional services.

Transfer mechanism used by the provider: according to Microsoft’s GDPR information, Microsoft uses Standard Contractual Clauses (SCCs) as a mechanism for transfers of personal data from the EEA to third countries in its enterprise online services. Microsoft is also certified under the EU–US Data Privacy Framework, but states that it does not rely on that framework as the basis for such transfers. This description of the provider’s practice does not replace verification of the terms applicable to the Foundation’s particular services and subscription.

Verified Azure resource configuration (as of 6 November 2026)

• WordPress and database: App Service Sklep and MySQL Flexible Server 46dcbd0c92-dbserver run in West US 2 (United States).
• Automated MySQL backups: the configured recovery retention is 7 days, and geo-redundant database backups are disabled (GeoBackup=Disabled). This does not describe the retention of all website data.
• Application storage: account wpstorage46dcbd0c92 is located in West US 2 with Standard_RAGRS replication to the paired West Central US region (United States).
• Additional storage: account helptanaweb is located in Poland Central and uses local Standard_LRS redundancy.
• Communication services: the Azure Communication Services and Email Services resources have dataLocation=europe, while their resource location is global. This does not establish the location of every item of metadata, log data or network operation.

The technical audit found no App Service diagnostic export configuration for Azure Monitor. This does not establish that Microsoft services or WordPress create no logs. Retention of other logs, email and backups was not established by that audit and depends on the services used.

6. Retention periods

• Preference cookie: up to 180 days after a choice is stored.
• Server-side consent register: planned retention of 12 months, with automatic WP-Cron cleanup.
• Correspondence, technical logs and accounting records: retention depends on the purposes of processing, data categories, the Foundation’s procedures and applicable legal obligations.

7. Rights of individuals

Where provided by the GDPR, individuals may exercise rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent when consent is the legal basis. Withdrawal does not affect earlier lawful processing. A complaint may be submitted to the President of Poland’s Personal Data Protection Office (UODO).

8. Changes to this document

The current policy should reflect the actual plugins, analytics tools, payment services and suppliers used by the website. Separate information on orders and payments will be published before the online store is launched.