General principles
Categories of personal data, purposes of and legal bases for processing, and the retention of personal data
I am a visitor to ecom.ngo
Visitors to our webpage are generally in control of the personal data they share with us (e.g. by signing up for our newsletter – see subsection 1.2 – or registering an account on our website – see subsection 1.3). We may collect some personal data automatically via cookies on our website. For more information about which cookies we use and how we use the data gathered via cookies, see our
Cookie Policy.
I am a recipient of the newsletter
In the meaning of this Privacy Notice, ‘recipient of the newsletter’ is someone who regularly receives our e-mails that give an overview of our activities, our events and other topics that we consider important.
We only send you our newsletter, if you yourself have provided us with your email address for the purpose of receiving the newsletter. Your email address is the only piece of personal information we collect in order to send you the newsletter. The legal basisfor such processing is your respective consent that you give when you register your email address on our website ecom.ngo for receiving the newsletter.
Please note that you can unsubscribe from our newsletters any time by clicking the ‘unsubscribe’ button in the bottom of any of the newsletters. In such a case, we will delete your email address from the newsletter list immediately and you will not receive any of our future newsletters.
I am a person who has registered an account on ecom.ngo (registered user)
We process the following personal datarelated to the registered users, which we have received from yourself:
- personal details (name, surname, nickname);
- contact details (email);
- other information that you have decided to communicate us.
- preferred language
- website
- google+
- twitter
- facebook
We process your personal data for the following purposes:
- enabling you the use of the functions available to ecom.ngo registered users;
- enabling you to download information and apply requests and forms;
- enabling you to send reports;
- leave comments and rate the materials.
The legal basis for such processing is your respective consent that you give by registering to our website ecom.ngo.
We retain your personal data until it is necessary depending on the purposes for which we collected the data. We may retain your personal data longer, if it is necessary for the protection of our interests or the fulfilment of our obligations deriving from the law. We usually retain the personal data of registered users for analysis of statistics of visits and user interests. We delete all the personal data of a registered user immediately after they have deleted their account on our website.
I am a member of an initiative group or an organization that applies for funding from ECOM or receives funding from ECOM (sub-recipient)
In the meaning of this Privacy Notice ‘sub-recipient’ includes the people who are members of initiative group or of an organization that applies for funding from ECOM or receives funding from ECOM
We process the following personal data related to the sub-recipients, which we have received from yourself or from the initiative group or organization that you are a member of, you work for or with which you participate in the funding process:
- personal details (name, position, job responsibilities);
- contact details (address, email, telephone number);
- other information that you have decided to communicate us.
- data related to qualification (e.g. information about the acquired education and/or professional qualifications);
- data about employment history (e.g. previous employers, previous positions, the number of years of previous professional experience);
- other data which you have decided to communicate to us;
- grants story or other programs’ implementation information.
We process your personal data for the following purposes:
- contact the sub-recipient;
- to assess the competence and the eligibility of the sub-recipient in order to decide to whom we should give funding to;
- to conclude a contract with the sub-recipient;
- to exercise the rights and fulfil obligations arising from the contract with the sub-recipient.
The legal basis for processing your data for the above mentioned purposes is our legitimate interest to administer the relationship with the sub-recipient. We believe that as you are a sub-recipient, in such circumstances our business interest overrides your interests and fundamental rights and freedoms. If you are a natural person that applies for funding in your own name, the legal basis for such processing is your consent that you give by submitting the funding application and if you are a natural person that receives funding, the legal basis for processing your personal data is the funding contract concluded between us.
We retain your personal data until it is necessary depending on the purposes for which we collected the data. We may retain your personal data longer, if it is necessary for the protection of our interests or the fulfilment of our obligations deriving from the law. For instance, we store personal data necessary for the fulfilment of our accounting obligations for at least 7 years from the end of the relevant financial year, and the data necessary for filing claims or defending ourselves against claims for 10 years after the end of the contract.
I provide funding to ECOM or represent a legal person who provides funding to ECOM (donors and representatives of donors)
In the meaning of this Privacy Notice ‘donor’ means a physical or legal person who provides funding to ECOM. ‘Representatives of donors’ includes the people who are the legal representatives of the donors and people who are the contact persons of the donors.
We process the following personal data of the donors, the representatives of donors and other natural persons associated with donors, which we have received from yourself or from the donor:
- personal details (name, date of birth);
- contact details (email, telephone number);
- the relationship with the donor and position (if relevant).
We process your personal data for the following purposes:
- to contact you or the donor you are associated with;
- to conclude a contract with you or the donor you are associated with;
- to exercise the rights and fulfil obligation arising from the contract concluded with you or the donor you are associated with.
If you are a donor that is a natural person, the legal basis for processing your personal data is the necessity to take steps prior to entering into a contract and performing the contract.
If you are associated with a donor (e.g. representative of a donor), the legal basis for processing your personal data is our legitimate interest to receive funding from the donor and administer the relationship with the donor. We believe that, as you are the representative of the donor, our business interests override your interests and fundamental rights and freedoms.
We retain your personal data until it is necessary depending on the purposes for which we collected the data. We may retain your personal data longer, if it is necessary for the protection of our interests or the fulfilment of our obligations deriving from the law. For instance, we store personal data necessary for the fulfilment of our accounting obligations for at least 7 years from the end of the relevant financial year, and the data necessary for filing claims or defending ourselves against claims for 10 years after the end of the contract.
I am a participant of a survey conducted by ECOM
In the meaning of this Privacy Notice, ‘participant of a survey’ includes all people who have decided to participate in any survey conducted by ECOM.
We process the following personal data related to survey participants, which we have received from yourself (the categories of personal data may vary in different surveys):
- age;
- place of residence (town and/or country);
- medical information;
- sexual orientation;
- gender;
- IP-address (if the survey is conducted online);
- Facebook profile (optional);
- Email address (optional).
We process your personal data for the following purposes:
- to acquire practical knowledge and use it in developing new programs, projects and coordinating our activities directed at achieving the goals and purposes set forth in our articles of association;
- to create reports of the results of the surveys to publish them on our website and to raise awareness.
We process your data for these purposes only if you have given your explicit consent for that.
We may also collect your name, nickname, information about your Facebook profile and/or your email address, if you have decided to communicate such data to us. Please note, that providing such data is optional and it is not considered as a prerequisite for participating in the survey. We process such data only with the purpose to send you similar surveys in the future, only if you have consented to such processing and have provided your contact details for that purpose.
Please note that the results of the survey will be published in a generalized form only, without the possibility to identify any of our participants. Overall, we do not identify any of our survey participants even if you decide to provide us your name, nickname, information about your Facebook profile and/or your email address.
Where we process your personal data based on your consent, you have the right to withdraw your consent at any time by contacting us at contact@ecom.ngo. The withdrawal of the consent does not affect the lawfulness of the processing based on consent before its withdrawal.
We retain your personal data (your name, nickname, information about your Facebook profile and/or your email address) until publication of the final survey report. Since we collect the answers to our surveys in unidentifiable form, we are able to retain this data for an indefinite period.
I am a participant of an event organized by ECOM or our sub-recipient (event participants)
In the meaning of this Privacy Notice, ‘event participants’ includes all persons who participate in any of the events (including seminars, webinars, meetings and conferences) organized by ECOM or its sub-recipients.
We process the following personal data related to event participants, which we have received from yourself, our sub-recipients (to whom you have given your personal data yourself or who have collected data themselves during the events), your representative(s) or which we have collected at the events (e.g. photos):
- personal details (name, date of birth, passport number or personal ID code);
- contact details (address, email, telephone number);
- copy of a passport;
- medical information (e.g. data about food allergies, disability);
- photos taken at the events.
We process the personal data for the following purposes:
- to enable you to participate in our event;
- to organize the event;
- to promote our events and activities;
- to fulfil our reporting obligation to our donors.
If you have participated in one of the events organised by our sub-recipient, we may receive following personal data about you from our sub-recipient (to whom you have given your personal data yourself or who have collected data themselves during the events):
- personal details (name, date of birth, passport number or personal ID code);
- contact details (address, email, telephone number);
- photos taken at events.
We process the personal data received from our sub-recipients for the following purposes:
- to have control over the use of funding we have given to our sub-recipients;
- to fulfil our reporting obligation to our donors.
The legal basis for such processing is either your consent that you give when you sign up to an event or performance of contract between us or between you and our sub-recipient. Since we have reporting obligation in front of our donors, we may share your data with our donors on the basis of our legitimate interest. Additionally, we may receive your personal data from our sub-recipients who we provide funding to organize events. In such a case, we may process your data on the basis of our legitimate interest.
We also take photos of the events and publish these to share information about our organisation and our events. In such cases, the legal basis for processing depends on the objectives and characteristics of the specific event, but is either your consent or our legitimate interest. Before deciding, whether our legitimate interest would be a proper legal basis for processing your image, we conduct proper analysis of your and our interests. If we believe that our legitimate interest can be considered as a proper legal basis for processing your image, we always inform you of the fact that the event is being photographed. If you do not want be photographed, you shall always have the right to object to that. In addition, if the legal basis for processing is our legitimate interest, you shall always have the right to object to the processing of your image.
Where we process your personal data based on your
consent, you have the right to withdraw your consent at any time by contacting us at
contact@ecom.ngo. The withdrawal of the consent does not affect the lawfulness of the processing based on consent before its withdrawal.
We retain your personal data for no more than 10 years.
I am a contractor that offers or provides services to ECOM or a representative of a contractor that offers or provides services to ECOM (service providers and representatives of service providers)
In the meaning of this Privacy Notice, ‘service providers’ refers to physical or legal persons who have made an offer to provide services to ECOM and/or provide services to ECOM. ‘Representatives of service providers’ are the legal representatives, the contact persons and employees of the service provider, who are involved in the provision of the services or are otherwise related to the service agreement.
We process the following personal data related to service providers and representatives of service providers, which we have received from yourself or from the service provider:
- personal details (name, date of birth or personal ID code or passport number);
- copy of a passport or other ID;
- contact details (address, email, telephone number);
- data related to qualifications (e.g. information about the acquired education and/or professional qualifications);
- data about employment history (e.g. previous employers, previous positions, the number of years of previous professional experience);
- payment details (e.g. bank account number, tax details);
- other data which you have decided to communicate to us in your CV, recommendation letter or otherwise.
We process your personal data for the following purposes:
- to verify you and the personal data you have submitted to us (on the basis of your passport or other ID);
- to contact the service provider;
- to assess the competence of the service provider in order to decide with whom we should conclude service agreements with;
- to conclude contracts;
- to exercise the rights and fulfil obligations arising from the contract with the service provider.
The legal basis for such processing is the necessity to takes steps prior to entering into a contract and/or to perform the contract. If you are a representative of a service provider, the legal basis for processing your personal data is our legitimate interest to receive services from the service provider and to administer the relationship. We believe that as you are professionally connected to the service provider, in such circumstances our business interest overrides your interests and fundamental rights and freedoms.
We retain your personal data until it is necessary depending on the purposes for which we collected the data. We may retain your personal data longer, if it is necessary for the protection of our interests or the fulfilment of our obligations deriving from the law. For instance, we store personal data necessary for the fulfilment of our accounting obligations for at least 7 years from the end of the relevant financial year, and the data necessary for filing claims or defending ourselves against claims for 10 years after the end of the contract.
I am a job applicant
In the meaning of this Privacy Notice, ‘job applicants’ include all people who have expressed their wish to be employed by ECOM and made their personal data available for ECOM to assess their suitability for working for ECOM.
We process the following personal data related to job applicants, which we have received from yourself:
- personal details (name, date of birth, nationality/citizenship);
- contact details (address, email address, telephone number);
- data related to qualifications (e.g. information about the acquired education and/or professional qualifications);
- data about employment history (e.g. previous employers, previous positions, the number of years of previous professional experience);
- data collected through qualification and knowledge tests;
- other data which you have decided to communicate to us in your CV, motivation letter, at the interview or otherwise.
We may also collect your personal data from your recommenders (e.g. your previous employers), if you have consented to that. By giving us the name and the contact details of your recommender, we assume that you have given your consent to contact them.
We process your personal data for the following purposes and on the following legal bases:
- to find the most suitable candidates for us and to decide with whom to conclude employment contract with;
- if necessary, for filing claims and for defending ourselves against claims.
The legal basis for such processing is either your consent that you give us by applying to a respective position or our legitimate interest to find the best candidate for a vacant position or to protect our rights. Where the legal basis for processing is our legitimate interest, we have concluded that our legitimate interest overrides your interests and fundamental rights and freedoms in a given situation.
If we choose someone other than you to fill the vacant job position, we retain your personal data up to 1 year from making the recruitment decision. We may retain your personal data longer, if it is necessary for the protection of our interests or the fulfilment of our legal obligations. If we conclude an employment contract with you, subsequent processing of your personal data by us will be carried out in accordance with separate processing rules that will be presented to you before signing of the contract.
I am applying to be a member of ECOM (membership applicants)
In the meaning of this Privacy Notice, ‘membership applicants’ include all natural persons who themselves have applied for membership to ECOM or are representatives of such applicants.
We process the following personal data, which we have received from yourself or from the applicant that is a legal entity:
- personal details (name, surname, date of birth);
- contact details (address, email address, telephone number);
- data retrievable from the CV (e.g. information about the acquired education and/or professional qualifications, previous employers, previous positions, the number of years of previous professional experience);
- description of previous activities relating to ECOM’s activities;
- motivation letter;
- copy of an ID document.
As one of the preconditions to join ECOM is to submit a recommendation letter from a current ECOM member, we also collect your personal data from your recommender(s).
We process your personal data for the following purposes and on the following legal bases:
- to find the most suitable candidates for us and to decide with whom to conclude employment contract with;
- if necessary, for filing claims and for defending ourselves against claims.
The legal basis for such processing is either your consent that you give us by applying to a respective position or our legitimate interest to find the best candidate for a vacant position or to protect our rights. Where the legal basis for processing is our legitimate interest, we have concluded that our legitimate interest overrides your interests and fundamental rights and freedoms in a given situation.
If we choose someone other than you to fill the vacant job position, we retain your personal data up to 1 year from making the recruitment decision. We may retain your personal data longer, if it is necessary for the protection of our interests or the fulfilment of our legal obligations. If we conclude an employment contract with you, subsequent processing of your personal data by us will be carried out in accordance with separate processing rules that will be presented to you before signing of the contract.
I am a member of ECOM
‘Members of ECOM’ are the natural persons who are themselves members or related to the legal entities that are members of our non-profit association within the meaning of our articles of association.
We process the following personal data, which we have received from yourself or from the applicant that is a legal entity:
- all the personal data that you have submitted to us during the membership application process (see above – clause 1.10);
- information on your activities as a member of ECOM (e.g. your candidacy and activities in our organs, participation in events etc.);
- your participation, statements and voting during general assembly;
- other relevant data about your membership that you yourself have submitted to us or we have gathered ourselves.
We process your personal data for the following purposes and on the following legal bases:
- for administrative and archiving purposes;
- to exercise our obligations under our articles of association;
- to fulfil our legal obligations;
- to identify you or the organisation you are related to.
The legal basis for such processing is usually performance of the contract, our legitimate interest or our legal obligation. Within the meaning of GDPR the we perceive our articles of association to be a contract between you and ECOM.
We retain your personal data until it is necessary depending on the purposes for which we collected the data. We will retain your data for as long as you are a member of ECOM.
If you leave our organisation or you cease to represent your organisation in ECOM, we will delete your data after three months of the decision or immediately upon your request, except the data that we need in order to fulfil our legal obligations (e.g. bookkeeping obligations) or if we have overwhelming legitimate interest to do so (e.g. for archiving purposes).
