This document is provided in English. Translated versions may follow; in case of any discrepancy, the English text prevails.
The controller for the processing of personal data through this website is AquaVesto Foundation. Identification and contact details are set out in the Legal Notice.
a) Contact form / e-mail
Data: name, e-mail address, the content of your message.
Purpose: answering your enquiry.
Legal basis: Art. 6(1)(b) GDPR where your message concerns a pre-contractual step, otherwise Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries).
Retention: TO BE COMPLETED
b) Donations
Data: handled by the external payment provider; the Foundation receives the information necessary to acknowledge and account for the donation.
Purpose: processing and documenting the donation.
Legal basis: Art. 6(1)(b) and Art. 6(1)(c) GDPR (contract and legal accounting obligations).
Retention: as required by applicable accounting law, TO BE COMPLETED
c) Server log files
Data: IP address, date and time of request, requested resource, referrer, browser and operating system information.
Purpose: delivering the site, security, and troubleshooting.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website).
Retention: TO BE COMPLETED
d) Web fonts and embedded media
This site loads fonts and images from external sources. When a page is opened, your browser connects to those providers and transmits your IP address to them.
Legal basis: Art. 6(1)(f) GDPR.
Providers: Google Fonts, Cloudinary, and the media sources credited on the page.
This site does not set cookies for advertising or cross-site tracking. Technically necessary storage may be used to remember your language selection. If analytics or any non-essential technology is introduced, it will only be activated after your consent (Art. 6(1)(a) GDPR), and this policy will be updated accordingly. TO BE COMPLETED
Personal data may be made accessible to service providers acting on our instructions, in particular the hosting provider, the payment service provider and, where applicable, e-mail and analytics providers. These providers are bound by data processing agreements under Art. 28 GDPR. Current list: TO BE COMPLETED
Where a provider processes data outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission or on Standard Contractual Clauses together with any additional measures required. Details: TO BE COMPLETED
Links to our profiles on Instagram, Threads and Pinterest are plain hyperlinks. No data is transmitted to those platforms until you click a link and open the platform. Once there, the platform’s own privacy policy applies.
Under the GDPR you have the right to request access to your personal data, rectification, erasure, restriction of processing, and data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time with effect for the future.
To exercise these rights, contact us at TO BE COMPLETED
You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or of the alleged infringement. Competent authorities include the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) and, for activity in Spain, the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
You are not obliged to provide personal data. If you do not provide the data requested in the contact form, we may be unable to answer your enquiry.
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place on this website.
This policy may be updated to reflect changes in the site or in legal requirements. The version published here applies.