Фондация Капка Живот

Privacy Policy

Last updated: 28 August 2026

Kapka Zhivot Foundation (the "Foundation", "we") processes personal data in connection with the fundraising platform at kapkajivot.bg (the "Platform"). This Privacy Policy explains what data we collect, why, on what legal basis, with whom we share it, how long we keep it and what rights you have.

This Policy is an information notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act. Using the Platform is not in itself consent to processing that requires consent.

1. Who we are

Controller: Kapka Zhivot Foundation (Фондация „Капка Живот“), UIC/EIK 208627658 Registered office: Republic of Bulgaria, Haskovo 6300, 16 Osmi Mart Street Represented by Kristina Ivanova Kancheva, Chair of the Management Board Email: info@kapkajivot.bg Website: https://kapkajivot.bg

The Foundation is entered in the Central Register of non-profit legal entities carrying out activities in the public interest.

We have not appointed a data protection officer. Requests under this Policy are sent to the email above.

The Foundation is the controller of data processed to operate the Platform (accounts, donations, payouts, campaign review, security). The organiser is responsible for the lawfulness of data they publish in a campaign, including beneficiary data. Stripe processes card data as an independent controller under its own policy.

2. Data we collect

2.1. Account data Name, email address, password (stored hashed), optional phone number, language preference, profile photo if you add one. If you sign in with Google, we receive basic profile information (name, email and profile photo) from Google.

2.2. Campaign data Title, story, goal, country and city, beneficiary name, relationship to the organiser, images, updates and supporting verification documents (including medical documents, invoices and identity documents).

2.3. Donation data Amount, currency, campaign or Fund, payment method, status, email, name, optional message, chosen visibility (public, partial or anonymous for public display). For a guest donor, name and email are required to complete the donation. Card data are processed by Stripe. We do not store full card numbers.

2.4. Fund Allocation applications (amount and justification), decisions on applications and allocated amounts.

2.5. Payouts Account holder name, IBAN, SWIFT/BIC, bank country and documents related to the payout.

2.6. Follows and notices Which campaigns you follow, so we can send operational notices about updates.

2.7. Reports and support The content of a report or message and the contact details provided.

2.8. Technical data IP address, browser type, device, pages visited, session identifiers and records needed for security and abuse prevention. See the Cookie Policy.

3. Special categories of data and children

For medical campaigns we process health data — documents, descriptions of a condition, photographs. These are special categories of data under Article 9 GDPR.

We process them on the basis of the data subject's explicit consent (Article 9(2)(a) GDPR), given through the organiser. For children, consent is given by a parent or guardian.

Verification documents are not published on the campaign page. Public content must not include more health data than needed to understand the cause. We may refuse or take down a campaign if valid consent is missing or disclosure is excessive.

Do not use the Platform to publish a personal identification number, a full medical file or third-party data without a basis.

4. How we use data

  • creating and managing accounts, including activation and password reset;
  • reviewing, publishing and moderating campaigns;
  • accepting donations to the Foundation, issuing receipts and donation certificates, accounting;
  • considering Fund applications and payouts;
  • operational messages about the account, donation, campaign and security;
  • notices about updates to followed campaigns;
  • preventing fraud, abuse and security incidents;
  • complying with legal obligations.

We do not use personal data for behavioural advertising. We do not sell personal data.

5. Legal bases

  • Contract (Article 6(1)(b) GDPR) — registration, campaign, donation, payout, following a campaign for operational notices.
  • Legal obligation (Article 6(1)(c)) — accounting and tax, including donation certificates; anti-money-laundering measures where required.
  • Legitimate interest (Article 6(1)(f)) — Platform security, handling reports, preventing fraud, limiting abuse. You may object to processing on this basis unless overriding legitimate grounds apply.
  • Consent (Article 6(1)(a) and Article 9(2)(a)) — publishing health data and photographs of the beneficiary; non-essential cookies if they are introduced in the future.
  • Consent may be withdrawn. Withdrawal does not affect the lawfulness of processing before withdrawal. Withdrawing consent for public health information may require the campaign to be taken down or edited. Accounting records of the donation are retained.

6. Sharing

We share data only when needed:

  • Stripe — card payments; Stripe is an independent controller for card data;
  • the Foundation's bank — bank transfers and payouts;
  • hosting, file-storage and email providers acting as processors on our instructions;
  • professional advisers (legal, accounting) under a duty of confidentiality;
  • competent authorities where the law requires it.

Campaign pages and aggregated Fund information are public. Do not publish data you do not want to be visible.

7. International transfers

Some providers may process data outside the European Economic Area. For such transfers we use appropriate safeguards, including standard contractual clauses or an adequacy decision, as required by the GDPR.

8. Retention

  • Account data — until the account is closed and up to 12 months thereafter for security, unless the law requires longer.
  • Donations, payouts, accounting and tax records, including data needed for a donation certificate — 10 years, under the Accountancy Act.
  • Medical and other verification documents — until the campaign and related payouts are completed, and then for the period needed for audit, disputes and accounting, with restricted access.
  • Support reports — up to 2 years after closure, unless a dispute continues.
  • Technical logs and IP addresses — up to 12 months, except in a security incident.
  • The record that you have seen the cookie notice — until you delete it or change device.

When data are no longer needed, we delete or anonymise them.

9. Your rights

You have the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, within the GDPR and the Personal Data Protection Act. You may lodge a complaint with the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, kzld@cpdp.bg, www.cpdp.bg.

To exercise your rights, write to info@kapkajivot.bg. We respond within one month, which may be extended under the GDPR. We may need to confirm your identity.

You can change some account data in Dashboard → Settings. From there, a user with a password may request account deletion. Deletion anonymises the profile. Campaign and donation records are kept for accounting, audit and transparency. If you signed in only with Google, request deletion by email.

We do not take decisions based solely on automated processing that produce legal or similarly significant effects for you (Article 22 GDPR).

10. Children's privacy

The Platform is not directed at persons under 18 as organisers. A campaign may benefit a child. In that case the organiser obtains the consent of a parent or guardian. Donors under 18 donate only with the involvement of a parent or guardian. We do not knowingly collect children's data for accounts.

11. Security

We use HTTPS, hashed passwords, access control and payout review. No online service is completely secure. Keep your login details confidential.

12. Changes

We may update this Policy. The "Last updated" date reflects the current version. Material changes will be communicated through the Platform or by email where appropriate.

13. Contact

Kapka Zhivot Foundation UIC/EIK 208627658 Haskovo 6300, 16 Osmi Mart Street, Bulgaria Email: info@kapkajivot.bg Website: https://kapkajivot.bg