Who is responsible for your data?
The data controller is the Foundation identified below. You can contact us regarding privacy or the exercise of your data-protection rights using the email address listed here.
What services does this policy cover?
This policy applies to our public website and the connected digital services operated by or for the Foundation, including:
- the voicesfromukraine.org website and multilingual pages;
- Voices from Ukraine Radio including the web player, Now Playing / recently played information, stream status and listener-related widgets;
- event registration, ticketing, invitations, QR check-in and ticket Wallet passes;
- volunteer accounts, verification, digital volunteer credentials and Wallet passes;
- donation, contact and other forms made available through our services.
What data may we process?
Technical data
IP address, browser and device information, timestamps, requested URLs, security logs and similar server data necessary to operate and protect the services.
Information you provide
For example name, surname, email address, phone number, message content, event registration details, volunteer data or other information submitted in a form.
Transaction and ticket data
Order identifiers, payment status or reference, ticket/invitation identifiers, QR tokens, entry/check-in status and related operational records. Full payment-card details are handled by the payment provider rather than stored by us where the payment provider hosts the payment process.
Account and credential data
For volunteer services this can include account identifiers, photograph, date of birth, volunteer ID, role, affiliation, validity period, verification status and secure access or Wallet-related tokens.
Why do we process data?
Depending on the service and context, processing may be necessary to provide a requested service or perform an agreement, comply with legal obligations, pursue our legitimate interests in operating and securing the Foundation’s services, or be based on your consent where consent is required. You may withdraw consent at any time without affecting processing carried out before withdrawal.
Privacy when listening to our radio
The radio is part of our digital services. When you press Play, your browser connects to the audio-stream infrastructure used by Voices from Ukraine Radio. The streaming provider can technically receive information needed to deliver the stream, such as your IP address, user agent/device information, connection time and stream requests.
- Now Playing, recently played tracks, stream status and listener counts may be retrieved from our radio/streaming infrastructure and displayed on the website.
- If a listener map or other embedded radio widget is displayed, the third-party service providing that embed may receive ordinary web-request data from your browser.
- We use radio listening information to operate the station, show current metadata, understand aggregate service usage and maintain availability and security. We do not sell radio-listener personal data to advertisers.
Mobile app, APIs and push notifications
The Voices from Ukraine mobile application may connect to our website and radio infrastructure through APIs to load radio metadata, current programme information, news, events or other app content. These requests may include standard technical information such as IP address, device and operating-system information, app version, request time and diagnostic data needed to operate, secure and troubleshoot the service.
If you enable push notifications, the app or our Radio Bridge service may register an Apple Push Notification service (APNs) device token or equivalent notification token. We use that token only to address notifications to the relevant device, maintain notification delivery and remove invalid registrations. A push token is a technical device identifier and may be stored on our server while notifications are enabled or until the token becomes invalid or is deleted.
The app may store your language choice, notification preferences and other basic settings locally on the device or, where necessary, on our server so the service can remember your preferences. We do not use these settings to build an advertising profile. We do not sell personal data and we do not use push tokens for cross-app advertising tracking.
You can disable notifications at any time in your device settings. You may also contact us to request access to, correction of or deletion of personal data associated with the app where we can reasonably identify that data. Deletion requests may include removal of server-side notification registrations and other app records, subject to legal retention duties and records that must be retained for security, accounting, fraud prevention or legal claims.
Events, tickets, invitations and donations
When you register for an event, obtain or purchase a ticket, receive an invitation or make a donation, we process the information needed to administer the transaction or participation. Depending on the event, tickets may be personalised or non-personalised. Where a payment is required, a payment provider may process payment details under its own privacy terms. QR codes and secure access links are credentials: do not share them unless you intend to transfer access.
Volunteer portal, verification and digital Wallets
Volunteer credentials may include a photograph, name, volunteer number, role, affiliation, validity information and other data necessary to verify the credential. Public QR verification is designed to disclose only the information needed to confirm that a credential is genuine and currently valid; the full date of birth should not be exposed on the public verification page.
If you add a credential or ticket to Apple Wallet or Google Wallet, the relevant platform receives the data required to create, store and update that pass. For Apple Wallet updates, our system may store device/pass registration identifiers and push tokens needed to deliver pass updates. Apple and Google process platform data under their own privacy terms.
Who may receive data?
We may use carefully selected providers to host and deliver the website and radio stream, send email, process donations or payments, provide digital Wallet functionality, maintain security, or supply embedded website resources. Depending on the feature you use, this may include hosting/streaming providers, Goodstack, Viva.com, Apple, Google and providers of embedded content or technical infrastructure. These providers process data only to the extent required for the relevant service and subject to their contractual or independent legal obligations.
Some providers may process data outside the European Economic Area. Where GDPR requires it, transfers should rely on an applicable adequacy decision, standard contractual clauses or another lawful transfer mechanism.
How long do we keep data?
We keep personal data only for as long as necessary for the purpose for which it was collected, to maintain required operational or security records, to handle claims, and to meet accounting, tax or other legal retention duties. Different categories therefore have different retention periods. When data is no longer required, it is deleted, anonymised or otherwise securely disposed of where reasonably possible.
Security and secure links
We use technical and organisational measures intended to protect personal data and access credentials. Ticket links, volunteer credential links, QR codes and Wallet links may grant access to an individual record. Treat them like a digital key. If you believe a secure link or credential has been exposed, contact us so it can be revoked or replaced where the service supports revocation.
Your data-protection rights
Subject to the conditions of applicable law, you may have the right to request access to your personal data, rectification, erasure, restriction of processing, portability, and to object to certain processing. Where processing is based on consent, you may withdraw that consent. You also have the right to lodge a complaint with the competent supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
Privacy request[email protected]Changes to this policy
We may update this policy when our services, technologies or legal requirements change. The current version and update date will be published on this page.