Privacy Policy
Last updated: 19 October 2026
Contents
- 1. Who is responsible for your data
- 2. What we collect and why
- 3. Panka’s story and health information
- 4. Donations through WhyDonate
- 5. Who else can access your data
- 6. Transfers outside the EU
- 7. Children
- 8. How we protect your data
- 9. Your rights
- 10. Complaints
- 11. Changes to this policy
We take the privacy of everyone who supports Panka seriously. This policy explains, in plain language, what personal data we handle in connection with caringart.eu and our fundraiser, why, how long we keep it, and what your rights are under the EU General Data Protection Regulation (GDPR).
Donations themselves are handled by WhyDonate, not by us. When you click a donation button on our site, our fundraiser page opens on WhyDonate in a new tab, and you complete your gift there. Nothing from WhyDonate is loaded on caringart.eu itself. We never see or store your card or bank details.
1. Who is responsible for your data
For the data described in this policy, the data controller is Tölgyesi Poós Anna, Dózsa György út 19., 3179 Nógrádsipek, Hungary, a private individual acting on behalf of Panka’s family. For any privacy question or request, write to info@caringart.eu.
2. What we collect and why
| Purpose | Data | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Keeping track of donations, managing monthly donations and thanking our supporters | The information WhyDonate passes on to us as fundraiser organiser: the name you donate under (or “Anonymous”), your email address and phone number if you provided them, the amount and currency, the processing fees deducted, whether the donation is one-time or monthly, the date and the WhyDonate transaction ID. We never see your card or bank details. | Art. 6(1)(f) – managing the fundraiser, keeping a record of donations received and stopping a monthly donation at your request | 5 years after your last donation |
| Sending your thank-you gift | Your choice of gift, name, email, postal address, and a phone number if the courier requires it – provided by you when you write to us | Art. 6(1)(b) – sending the gift at your request | 1 year after the gift has been delivered |
| Answering your messages | Name, email, your message | Art. 6(1)(f) – legitimate interest in replying | 1 year after the conversation ends |
| Website security | IP address, browser type, time of visit (server logs) | Art. 6(1)(f) – keeping the site secure | 30 days |
We do not sell, rent or share your personal data for marketing purposes, and we do not use automated decision-making or profiling.
3. Panka’s story and health information
Our pages share Panka’s story, photographs and general information about her type 1 diabetes. Because health information is a special category of data, we publish it only with the explicit written consent of Panka and her parents (GDPR Art. 6(1)(a) and 9(2)(a)). In her story we use her first name only and do not name her school.
Please do not copy or republish this information elsewhere. If the family withdraws consent, we will remove the relevant content from this website without delay.
4. Donations through WhyDonate
Donations are collected through our fundraiser on WhyDonate, operated by WhyDonate B.V., Johan Huizingalaan 763A, 1066 VH Amsterdam, the Netherlands (Dutch Chamber of Commerce no. 58485317). Payments are processed by Stripe, WhyDonate’s licensed payment provider.
- When you donate, WhyDonate processes your data as an independent controller, under its own terms and privacy statement: whydonate.com/privacy-and-cookies. WhyDonate’s website uses its own analytics and marketing cookies, which you manage on whydonate.com.
- Card and other payments are handled by WhyDonate and Stripe. Your payment details never reach us.
- As organiser, Anna sees only the donation details listed in section 2. If you donate anonymously on WhyDonate, your name is not shown publicly on the fundraiser page.
5. Who else can access your data
We do not use website analytics or advertising tools of our own. We only share data with service providers that help us run the fundraiser and this website, and only as far as necessary:
- WhyDonate (WhyDonate B.V., Amsterdam, the Netherlands) and its payment provider Stripe – donation platform and payments, as independent controllers (see section 4).
- Tárhely.Eu Szolgáltató Kft. (Budapest, Hungary) – web hosting and email; our website and emails are stored on their servers in Hungary.
- The postal or courier service delivering your thank-you gift (for example Magyar Posta Zrt.) – only your name, address and, if required, phone number. For parcels outside the EU, customs authorities may also receive this information.
- Web-Made (Kernya János, sole trader, Baja, Hungary) – website development and maintenance, under a written data processing agreement.
6. Transfers outside the EU
The data we handle ourselves is stored in the EU. If your thank-you gift is sent to a country outside the EU, your delivery details necessarily travel with the parcel to that country. How WhyDonate handles your data, including any transfers outside the EU (for example through the analytics services it uses), is described in its privacy statement (whydonate.com/privacy-and-cookies).
7. Children
This website is meant for adult supporters. If you are under 18, please ask a parent or guardian before making a donation.
8. How we protect your data
The website uses an encrypted (HTTPS) connection. Payments are handled entirely by WhyDonate and its licensed payment provider Stripe, so no payment data passes through our servers. Admin access is limited to the people who need it and protected by strong passwords and two-factor authentication. Software is kept up to date and backed up regularly.
9. Your rights
You have the right to:
- ask what data we hold about you and receive a copy (access);
- have incorrect data corrected (rectification);
- have your data deleted, unless we must keep it by law (erasure);
- ask us to limit how we use your data (restriction);
- receive your data in a portable format (portability);
- object to processing based on our legitimate interest (objection);
- withdraw your consent at any time – this does not affect processing carried out before the withdrawal.
To use any of these rights, email info@caringart.eu. We will reply within one month. For data held by WhyDonate (for example your WhyDonate account or donation records), please contact WhyDonate at support@whydonate.com. To stop a monthly donation, see our Donation Terms.
10. Complaints
If you are unhappy with how we handle your data, please tell us first – we will do our best to put it right. You can also complain to the Hungarian data protection authority, or to the authority in the EU country where you live:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) – Falk Miksa utca 9–11, 1055 Budapest, Hungary · Postal address: 1363 Budapest, Pf. 9. · ugyfelszolgalat@naih.hu · +36 1 391 1400 · naih.hu
You may also take legal action before the competent court.
11. Changes to this policy
If we change this policy, we will publish the new version on this page with a new date. Significant changes will be highlighted on the website.