Privacy Policy

Information about the controller of personal data:

"Za Dobroto" Foundation, a non-profit legal entity, duly established and existing in accordance with the legislation of the Republic of Bulgaria, entered in the Commercial Register and the register of non-profit legal entities with EIK 206320849, with headquarters and management address in the city of Sofia 1113 r -n Izgrev zh.k. East, 33 Charles Darwin Street, represented by Mrs. Svilena Siderova Georgieva, in her capacity as Executive Director

This Privacy Policy governs the relationship between the Administrator and the subjects
of data on the Site.

Contact data
phone: +359 896 712 591
Grounds and purposes for which we use your personal data

We process your personal data on the following grounds:

  • Donations made to campaigns organized by the Foundation;
  • Your express consent - the purpose is specified for each specific case;
  • Writing comments and messages;
  • If required by law;
  • In view of our legitimate interest

In this privacy policy you will find detailed information about the processing of your personal data depending on the basis on which we process it.


Purposes of processing:

  • establishing your identity;
  • managing and fulfilling the purpose of your donation;
  • maintaining correspondence in connection with reporting problems, inquiries made, etc.
  • notification of everything related to campaigns organized by us or our partners;
  • detect and/or prevent illegal acts or acts in conflict with
    our terms for the relevant services;
  • Category of data subjects

On this basis, data about our Donors is processed. A donor is any natural person,
has reached 18 (eighteen) years of age or a legal entity that makes donations for
support activities and fundraising campaigns conducted by the Foundation.

Services provided

On the Site, you can find information about charity campaigns organized by us or our partners in the field of children's health care.

Data we process on this basis:

On the basis of the donation contract concluded between us and you, we process information about the type and content of the contractual relationship, as well as any other information related to the contractual relationship, including:

  • names
  • email
  • Social security number, social security number or date of birth for a foreigner
  • ID data
  • gender
  • address
  • credit or debit card information, bank account number or other banking and payment information related to payments made
  • data on donations made

The processing of some of the specified personal data is mandatory for us in order to be able to conclude the contract with you and fulfill it. Without you providing us with the above data, we would not be able to fulfill our obligations under the contract. Such personal data is marked in a specific way with a “*” or other character. All other personal data is collected voluntarily.

Provision of personal data to third parties

We provide your personal data to third parties, and our main goal is to offer you quality, fast and comprehensive service. We do not provide your personal data to third parties before making sure that all technical and organizational measures are taken to protect this data and we strive to implement strict controls to fulfill this purpose. In this case, we remain responsible for the confidentiality and security of your data. With the persons to whom we transfer personal data, we have concluded a contract for the processing of personal data.

We provide personal data to the following categories of recipients (data controllers):

  • Postal operators and couriers
  • persons performing consulting services in various fields such as law, accounting, business
    counseling and the like.
  • Cloud service providers such as Google Drive, Microsoft OneDrive, Dropbox, etc.
  • Applications and add-ons to our site for filling out contact and other forms like Google
    forms, Typeform, Microsoft forms, Contact form 7 or similar.
  • Applications for preparing documents and notes such as Microsoft office, Google docs, sheets,
    slides, Evernote, Bear, OneNote and the like.

When we delete data collected on this basis

We delete the data collected on this basis 3 or 5 years after termination of the contract
relationship, whether due to expiry of the contract, cancellation or any other reason.
The term is determined by the limitation period applicable by law for possible claims from
the contract.

The data collected on the occasion of pre-contractual relations are deleted after 12 months.

Automated solutions

We do not use automated algorithms to process personal data.


It is possible that the law stipulates an obligation for us to process your personal data. In these
cases we are obliged to carry out the processing, such as:

  • Obligations under the Law on Anti-Money Laundering Measures;
  • Provision of information to the Commission for the Protection of Personal Data in connection with
    obligations provided for in the regulations for the protection of personal data;
  • Obligations provided for in the Law on Accounting and Tax-Insurance Procedure
    code and other related legal acts, in connection with the conduct of lawful
  • Provision of information to the court and third parties, within the framework of proceedings before a court, in accordance with the requirements of the normative acts applicable to the proceedings;

When we delete personal data collected on this basis

We delete the data collected in accordance with the obligation provided for in the law after the obligation for
collection and storage be fulfilled or abandoned. For example:

  • under the Accounting Act for storage and processing of accounting data (11 years)
  • obligations to provide information to the court, competent state authorities, etc.
    grounds provided for in the current legislation (5 years).

Provision of data to 3rd parties

When we are required by law, we may provide your personal data
of the competent state authority, natural or legal person.


We process your personal data on this basis only after explicit, unambiguous and
voluntary consent on your part. We will not anticipate any adverse
consequences for you if you refuse the processing of personal data.
Consent is a separate basis for processing your personal data and the purpose of the processing is
stated therein, and is not covered by the purposes listed in this policy. If you give us the appropriate
consent and until its withdrawal or termination of any contractual relationship with you
we prepare suitable service proposals for you.

Data we process on this basis:

On this basis, we only process the data for which you have given us your express consent.
Specific data is determined on a case-by-case basis. Usually this data is email
and name. In case we transfer data to third parties, we notify you in advance before giving
your consent.

Withdrawal of consent

Consents may be withdrawn at any time. Withdrawal of consent
has no impact on the performance of contractual obligations. If you withdraw your consent to
process personal data for any or all of the ways described above, we will not
we use your personal data and information for the purposes specified above. Withdrawal of
consent does not affect the lawfulness of processing based on prior consent
his withdrawal.

You can withdraw the given consent by contacting us on the contact details provided.

When we delete data collected on this basis

We delete the data collected on this basis at your request or store it for
the term specified in the consent. If no such deadline is specified, we delete the data by the 12th
months from their initial collection.

Email marketing

If you sign up to receive emails from us, you will receive messages with up-to-date information
information about our campaigns, campaigns of our partners or other useful information.
You can unsubscribe from the email newsletter by pressing the button in the email labeled "unsubscribe",
"unsubscribe" or similar text. You can also unsubscribe using our details for
contact provided in this Policy.


We process and analyze data based on legitimate interest. This data is collected for a purpose
improving our overall service. On this basis, we analyze the consumer
behavior and perform data analyses. Such data are: anonymized IP address which
shows only general location, behavior of the Site; non-anonymized IP address, profile data
on Facebook, exact location.

In the event that the collection of the above data goes beyond the legitimate interest of
the administrator of the personal data, he will collect them only after express consent.
Your data can also be anonymized. Anonymization is an alternative to
data deletion. Upon anonymization, all personally identifiable elements/items,
enabling your identification are irreversibly deleted. No for anonymized data
legally obliged to delete, as they do not constitute personal data.

How we protect your personal data

To ensure adequate data protection of the company and its donors, we apply
all the necessary organizational and technical measures provided for in the Law on the Protection of
personal data.
The company has established policies to prevent abuse and security breaches and is
adopted measures to preserve the security of personal data.
For the purpose of maximum security in the processing, transfer and storage of your data, it may
we use additional security mechanisms such as encryption, pseudonymization, etc.