Privacy Policy
for srp-ua.ch
This Privacy Policy explains how SRP collects and processes personal data when you visit srp-ua.ch, register an account, list items, submit requests or contact us. The rules for using the Platform are set out separately in the Terms of Use.
1. Controller
1.1 Controller within the meaning of the Swiss Federal Act on Data Protection (FADP): Support and Recovery Platform (SRP), Basel, Switzerland, an association under Art. 60 ff. of the Swiss Civil Code. Contact: info@srp-ua.ch.
1.2 Data protection related questions and requests can also be sent to info@srp-ua.ch.
2. Applicable law
2.1 SRP processes personal data in accordance with the FADP and its Ordinance (DPO). Where the GDPR applies in an individual case, for example to donors or partners in Germany or Austria, SRP takes its requirements into account. Recipients in Ukraine may additionally be subject to Ukrainian data protection law.
3. Which data we process
| Category | Examples | Source |
|---|---|---|
| Website and technical data | IP address, date and time, pages visited, browser, device, operating system, referrer, server logs | Automatically when you visit |
| Account and login data | E-mail address, first and last name, password (stored in protected form), role (Donor/Recipient), verification codes and links, login and verification logs | You |
| Organisation and contact data | Organisation name and type, individual/organisation declaration, address, mobile number, warehouse addresses, contact person, correspondence | You, or your organisation |
| Item data | Descriptions, images, quantities, condition, packaging, availability, search tags, translations | Donors |
| Request and donation data | Request cart, requests and their status, request ID, reports and documentation on donations and handover, delivery coordination | Recipients, Donors, SRP |
| Review and compliance data | Results and sign-off of account approval, plausibility, dual-use and sanctions checks, notes from verification calls | SRP, public sources, partners |
| Search data | User ID, time, search keywords and page for searches without results | Automatically when you search |
| Preferences and consents | Language, communication preferences, consents given or withdrawn | You |
| Cookies and local storage | Session, language and persistent request-cart information (see section 10) | Your browser |
3.1 We do not ask for particularly sensitive data. Compliance checks (section 4) may involve information about sanctions or administrative or criminal proceedings, which the FADP treats as sensitive. We process such information only where needed for those checks and permitted by law. Please do not send us other sensitive data unless we ask for it.
3.2 We collect data mainly from you or from the organisation you represent. In individual cases it also comes from partner organisations, authorities, municipalities, companies or publicly accessible sources, where necessary and lawful.
4. Purposes
- Operating, securing, maintaining and improving the website and Platform.
- Creating and managing accounts, verifying e-mail addresses and identities, and approving or refusing registrations.
- Reviewing, structuring, matching and coordinating offers, needs and requests between Swiss and Ukrainian actors, including automatic notifications of newly listed items that may fit a Recipient's needs.
- Complying with export-control, sanctions and other legal obligations, including plausibility and dual-use checks.
- Handling enquiries and communicating with users, members, partners, authorities and funders.
- Analysing searches without results to close gaps in the range of available items.
- Documenting SRP's work and accounting to funders, auditors and authorities, using aggregated or anonymised data wherever possible.
- Fulfilling legal, accounting and association-law duties, and protecting SRP's legitimate interests (security, misuse prevention, enforcement of claims).
5. Justification of processing
5.1 SRP processes personal data on the basis of your consent, the performance or preparation of an agreement with you (such as your Platform account), legal obligations, or overriding private or public interests. Overriding interests include running a non-profit coordination platform safely, preventing misuse and meeting sanctions and export-control requirements.
5.2 SRP processes only the data needed for these purposes and in line with the principles of lawfulness, good faith, proportionality, purpose limitation, transparency, accuracy and security.
6. Who receives your data
6.1 Within SRP, data is accessible to the Board, management and Administrators as needed for their tasks.
6.2 Other users see only what is needed for a specific listing or request.
6.3 Further recipients may include: IT, hosting, e-mail and translation service providers; logistics, customs and implementation partners in Switzerland and Ukraine; municipalities and partner organisations; funders and auditors; legal, tax and fiduciary advisers; and authorities (for example the State Secretariat for Economic Affairs or customs), where required or permitted by law.
6.4 Personal data is never sold.
6.5 Service providers act on our instructions under agreements that require appropriate technical and organisational safeguards.
7. Disclosure abroad
7.1 The Platform is hosted in Switzerland.
7.2 Because SRP coordinates with partners in Ukraine, your data may be disclosed there, for example to a Recipient or Donor counterpart, a municipality or an implementation partner, but only where needed for the request concerned.
7.3 Ukraine is not on the Federal Council's list of states with an adequate level of data protection. For such disclosures SRP relies on suitable safeguards (in particular standard contractual clauses recognised by the Swiss authority) or on the statutory exceptions, for example your consent or the need to perform an agreement with you or in your interest. Disclosures within the EU/EEA rely on the adequacy of their data protection.
7.4 Do not submit personal data that is not needed for coordination.
8. Retention
8.1 We keep personal data only as long as needed for the purposes above, as long as legal retention or documentation duties apply, and as long as claims may be asserted or defended. After that it is deleted or anonymised.
| Data | Retention |
|---|---|
| Server logs | max. 12 months |
| Enquiries and correspondence | 2 years after the matter is closed |
| Account and organisation data | While the account is active and 3 years after last activity or closure; inactive accounts are removed periodically |
| Items, requests and donation records | 10 years after completion, to evidence donations, export-control checks and reporting to funders (legal retention periods may apply, such as up to ten years for accounting records) |
| Zero-result search logs | 12 months, then aggregated or deleted |
| Backups | Encrypted backups, periodically overwritten |
9. Security and data breaches
9.1 SRP applies appropriate technical and organisational measures, such as access restrictions and role concepts, password protection, encrypted transmission, time-limited verification codes, logging of verification attempts, backups, and instructions to staff and providers. Absolute security cannot be guaranteed on the internet or by e-mail.
9.2 If a breach of data security is likely to result in a high risk to your personality or fundamental rights, SRP notifies the Federal Data Protection and Information Commissioner (FDPIC) and, where required, the persons concerned.
10. Cookies, local storage and similar technologies
10.1 The Platform uses technically necessary cookies and local storage for login sessions, language choice, security and the persistent request cart. These do not require separate consent.
10.2 You can block or delete cookies in your browser settings. Some functions may then no longer work.
11. Your rights
11.1 Under Swiss data protection law you have the right to: request information about the data we process about you; have inaccurate data corrected; request deletion of your data or object to certain processing; receive or transfer your data in a common electronic format where the legal conditions are met; withdraw consent at any time with effect for the future (processing before withdrawal remains lawful); and request human review of an automated individual decision.
11.2 To exercise your rights, write to info@srp-ua.ch. We may ask you to verify your identity. We answer within 30 days; if this is not possible we tell you why and when to expect a response. Requests are normally free of charge.
11.3 Rights may be limited where the law or overriding interests require, for example legal retention duties, export-control obligations or the rights of third parties. Deleting data may mean we can no longer provide certain functions.
12. Automated decisions
12.1 SRP does not make decisions with legal effect or similarly significant effect solely by automated means. Automatic notifications of possible matches only alert Recipients; approval of accounts, items and requests is carried out by Administrators.
13. Complaints
13.1 You may contact SRP first so that we can resolve your concern. You may also lodge a complaint with the Swiss supervisory authority: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern, www.edoeb.admin.ch. Users in other countries may also contact their local data protection authority.
14. Minors
14.1 The Platform is intended for persons aged 18 or over and for organisations. It is not directed at children.
15. Changes
15.1 SRP may amend this Privacy Policy, for example when processing changes or the law changes. The version published on srp-ua.ch applies. Registered users are informed of material changes.
16. Contact
16.1 Support and Recovery Platform (SRP), Basel, Switzerland. E-mail: info@srp-ua.ch.