Website Privacy Notice

1. About this notice

This Privacy Notice explains how MTÜ RescueHero processes personal data in connection with the RescueHero public Website and direct organizational donations made through Help Us Go Global.

Help Us Go Global donations are made directly to MTÜ RescueHero. They are separate from donations or other support directed through the RescueHero app to individual rescuers or organizations.

This notice does not describe the separate personal-data processing carried out through the RescueHero app.

2. Who is responsible for your data?

The controller is:

MTÜ RescueHero
Registry code: 80642646
Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 67/1-13b, 10115, Estonia
Email: info@rescuehero.app

You can use this email address for questions about this notice or to exercise your data-protection rights.

3. How the Help Us Go Global donation flow works

The RescueHero Help Us Go Global page does not ask you to enter payment details on the RescueHero Website.

If you choose to donate, you are redirected to a checkout page hosted by Stripe, our payment service provider. Payment and related information is entered and processed in Stripe's environment.

You are not required to make a donation. If you choose to donate, information required by Stripe or your selected payment method must be provided for the payment to be processed. If required information is not provided, the donation may not be completed.

4. Personal data involved in a donation

Depending on the payment method and checkout circumstances, Stripe may process information such as:

• the donation amount, currency, date and transaction status;
• your name, email address, billing or other contact information where required;
• payment-method or financial-account information supplied to Stripe or the relevant payment provider;
• device, browser, network and security information;
• information used to detect and prevent fraud;
• refund, reversal, chargeback or dispute information.

Stripe may also process information entered into its checkout even if the transaction is not ultimately completed.

RescueHero receives or can access the transaction information that Stripe makes available to us for administering the donation. Depending on the transaction, this may include the donation amount and currency, transaction identifiers and status, transaction dates, contact or billing details made available by Stripe, limited payment-method information, and information relating to refunds, disputes, chargebacks, fraud risk, fees and settlement.

Payment credentials entered into Stripe-hosted checkout are supplied to Stripe and the relevant payment providers rather than being entered on the RescueHero Website.

5. Why we process donation data

Administering your donation.
We process information necessary to receive, record and administer the donation and to handle transaction-related requests. The legal basis is Article 6(1)(b) GDPR, because the processing is necessary to perform the donation transaction.

Accounting and legal recordkeeping.
We retain and process information where necessary to meet accounting, reporting or other statutory obligations. The legal basis is Article 6(1)(c) GDPR.

Fraud prevention, security and payment disputes.
We may process relevant information to protect donors, RescueHero and the integrity of payment processing, and to investigate fraud, unauthorized payments, refunds, reversals, chargebacks or disputes. The legal basis is Article 6(1)(f) GDPR, based on our legitimate interests in preventing fraud, protecting our systems and funds, and resolving payment disputes. Where a specific legal obligation applies, Article 6(1)(c) GDPR may also apply.

Legal claims.
We may retain and use relevant information where necessary to establish, exercise or defend legal claims. The legal basis is Article 6(1)(f) GDPR or, where a legal obligation requires the processing, Article 6(1)(c) GDPR.

6. Stripe and other payment recipients

We use Stripe as our payment service provider.

For processing that Stripe performs on RescueHero's instructions to provide payment services to us, Stripe acts as a processor on our behalf.

Stripe also processes certain personal data for purposes that Stripe determines itself, including activities relating to security, fraud prevention, compliance and the operation of its payment services. For those activities, the relevant Stripe entity acts as an independent controller. Stripe provides further information about this processing in its own Stripe Privacy Policy and Privacy Center.

Payment information may also be processed by banks, card networks, digital-wallet providers and other payment-method providers where necessary to complete or administer the transaction.

We may disclose relevant donation information to competent authorities where required by law and, where necessary, to professional advisers for accounting, audit or legal-claims purposes.

7. International transfers

Stripe operates internationally and may process personal data outside the European Economic Area, including in the United States.

Where a transfer subject to GDPR requires an international-transfer mechanism, Stripe states that its Data Transfers Addendum provides applicable safeguards, including the EU-U.S. Data Privacy Framework where applicable and the European Commission's Standard Contractual Clauses.

You may contact RescueHero at info@rescuehero.app for further information about safeguards relevant to your personal data.

8. How long we keep donation data

Donation transaction and accounting records that must be preserved under applicable Estonian accounting law are retained for the legally required period, generally seven years from the end of the financial year in which the relevant transaction was recorded.

Information required for refunds, fraud investigations, disputes, chargebacks or legal claims is retained only for as long as necessary for the relevant purpose and any applicable legal preservation requirement.

When no continuing purpose or legal requirement applies, personal data should no longer be retained merely because it was once connected with a donation.

Stripe may retain personal data separately where Stripe processes that information under its own legal obligations or controller responsibilities.

9. Your data-protection rights

Subject to the conditions and exceptions provided by applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request erasure of your data;
• request restriction of processing;
• receive or transfer personal data where the right to data portability applies;
• object to processing based on legitimate interests; and
• withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact info@rescuehero.app.

You also have the right to lodge a complaint with the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) or, where applicable, another competent supervisory authority, including the supervisory authority in the EU or EEA Member State of your habitual residence, place of work or the place of the alleged infringement.

10. Public donor recognition and badges

The current Help Us Go Global donation flow does not require public donor recognition and does not make a donation conditional on agreeing to public recognition.

If RescueHero later offers an optional public donor-name or public badge feature, public display will require a separate voluntary choice. Refusing or withdrawing that choice will not affect the ability to donate.

A choice not to display a donor publicly would concern public recognition only. It would not make the payment anonymous to RescueHero, Stripe or other payment providers where identifying information is required to process or administer the transaction.

11. Stripe-hosted checkout and cookies

The Help Us Go Global donation action redirects you to Stripe's hosted checkout rather than embedding the payment form on the RescueHero Website.

Stripe may use cookies and similar technologies in its own hosted services in accordance with Stripe's privacy and cookie information.

If RescueHero introduces additional Website analytics, advertising or other non-essential tracking technologies, we will provide any additional information or consent controls required by applicable law before using them.

12. Changes to this notice

We may update this Privacy Notice if the Website, donation flow, service providers or applicable legal requirements change.

Material changes that affect how personal data is processed will be reflected in the notice before the affected processing is introduced where required.