Privacy policy

1. Introduction

This Privacy Policy explains how Fundacja Wspierania Więźniów Politycznych “Dissidentby” (“we”, “our”, “the Foundation”) collects, uses and protects personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

Our work focuses on supporting political prisoners, former detainees and their families, documenting repression and advocating for human rights. Because of the nature of our activities, we process sensitive personal data and apply enhanced security and confidentiality measures.

2. Data controller

The data controller is Fundacja Wspierania Więźniów Politycznych “Dissidentby”, Święty Marcin 29/8, 61-806 Poznań, Poland.

3. Scope of activities

We process personal data in connection with:

  • support for political prisoners and former detainees
  • assistance to families of detained individuals
  • documentation of repression and human rights violations
  • research and reporting
  • advocacy and international cooperation

4. Types of data we process

4.1 Basic data

We may process:

  • name and surname
  • contact details via secure messaging channels

4.2 Sensitive data

Due to the nature of our work, we may process special categories of personal data, including:

  • information about criminal charges and grounds for prosecution
  • data related to detention, trial and imprisonment
  • information about health condition
  • information about torture, violence or inhuman treatment

Such data is processed only when necessary and with particular care.

4.3 Anonymous data

In some cases, data is processed in anonymised form at the request of individuals or their relatives.

5. Sources of data

We collect data from:

  • website contact forms
  • secure messaging applications (with additional safety precautions)
  • partner organisations
  • publicly available sources

For individuals located in Belarus, we apply additional communication safety measures, including message auto-deletion and minimised data exchange.

6. Purpose and legal basis

We process personal data to:

  • provide humanitarian and informational support
  • document human rights violations
  • conduct advocacy and reporting
  • maintain internal databases of cases
  • manage donations and communication

Legal bases include:

  • consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR)
  • legitimate interest in human rights protection (Art. 6(1)(f) GDPR)
  • substantial public interest (Art. 9(2)(g) GDPR)

7. Data sharing

We do not share personal contact details of individuals with third parties. Where necessary:

  • we give individuals the contacts of partner organisations, so they can decide independently whether to engage
  • we may share aggregated or anonymised data with international partners
  • we cooperate with lawyers and experts without transferring sensitive personal data, unless explicitly agreed

8. Donations and payments

We accept donations via external payment systems, such as Stripe, PayPal, BLIK and bank transfers. We do not store payment data. It is processed and stored by the third-party providers in accordance with their own privacy policies.

9. Data storage and security

Personal data is stored in a secure internal system (CRM). We implement enhanced security measures, including:

  • restricted access for authorised team members only
  • two-factor authentication (2FA)
  • role-based access control
  • minimisation of stored data

Given the risks associated with political repression, we apply heightened confidentiality standards.

10. High-risk context and confidentiality

Our activities involve individuals at risk of political persecution. Therefore:

  • we apply strict confidentiality practices
  • we limit data processing to the minimum necessary
  • we do not disclose non-public data under any circumstances without consent
  • in some cases, full disclosure of data may not be possible even on request, if it could endanger individuals

11. International data transfers

Due to the global nature of our work, data may be processed outside the European Economic Area (EEA). Appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR, or transfers to countries recognised as providing an adequate level of protection under Article 45 GDPR.

12. Data Protection Officer

The Foundation has assessed that appointing a Data Protection Officer is not mandatory under Article 37 GDPR, as our data processing does not meet the thresholds set out in Article 37(1)(b) or (c). Data protection queries are handled by the Foundation’s management and can be sent to [email protected].

13. Data retention

We retain data only for as long as necessary to fulfil our mission, including documentation, support and reporting purposes.

14. Your rights

Under the GDPR, you have the right to:

  • access your data
  • correct inaccurate data
  • request deletion where applicable. This right may be limited where processing is necessary for documenting human rights violations, serving the public interest or exercising the right to freedom of expression, in accordance with Article 17(3) GDPR. In such cases, data may be kept in anonymised or partially anonymised form
  • restrict processing
  • object to processing, unless there are compelling legitimate grounds for continuing it, including human rights documentation and public interest activities
  • data portability, where processing is based on consent or contract and carried out by automated means (Art. 20 GDPR). This right does not apply where processing is based on legitimate interest or public interest

To exercise your rights, write to [email protected].

15. Cookies and analytics

Our website uses cookies and similar technologies. With your consent, we use Google Analytics to collect aggregated statistics about visits to the website. You may withdraw your consent at any time; this does not affect the lawfulness of processing before withdrawal. Our Cookie Policy describes which cookies we use, what they are for and how to manage them.

We also operate communication channels, including newsletters. These are not directed at individuals located in high-risk jurisdictions, where such communication may pose a safety threat.

16. Changes to this policy

We may update this Privacy Policy when necessary. The latest version will always be available on this page. Where changes are material, we will notify data subjects by email or with a prominent notice on our website at least 14 days before the changes take effect.

17. Contact

For any questions regarding data protection, write to [email protected].