Privacy Policy

This Privacy Policy describes the collection and processing of information about you that can directly or indirectly identify you (the “Personal Data”) carried out by the mobile application (the “App”) provided by Helpster Charity MTU and the website https://www.helpster.charity (“we”, “us”, “our”). We are a non-profit organization registered in the Republic of Estonia (EU). We are committed to protecting your privacy in accordance with applicable laws, including the EU General Data Protection Regulation (GDPR), the Estonian Personal Data Protection Act, the Digital Services Act (DSA), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). We act as the controller of all personal data collected in accordance with this Privacy Policy, and can be contacted as set out below.

Contact details of data controller:

Name: Helpster Charity MTU Address: Tallinn, Juhkentali tn 8, 10132 E-mail: team@helpstercharity.org Please read this Privacy Policy carefully as it contains important information about the following: • How do we collect your Personal Data? • How do we process your Personal Data? • When can we share your Personal Data? • How long do we retain your Personal Data? • Do we use automated decision-making or refer to the automated profiling? • What rights do you have? We may update this Privacy Policy from time-to-time to keep it in conformity with the relevant legislation, including the Regulation of the European Parliament and of the Council (EU) 2016/679 (the “GDPR”) and California Consumer Privacy Act 2018 (the “CCPA”). We will keep you informed about the changes to our Privacy Policy. If we make any major changes to our Privacy Policy and will need your explicit consent for further processing of your Personal Data, we will request your consent or your renewed consent (in case it was obtained previously).

HOW DO WE COLLECT YOUR PERSONAL DATA?

We collect Personal Data if you provide it to us or automatically by electronic means.

HOW DO WE PROCESS YOUR PERSONAL DATA?

We respect your privacy and aim to limit the Personal Data that we collect from you to the amount which is strictly necessary to fulfil the purposes of processing. Categories of Personal Data that we process are specified below:

Purpose of the processing	Personal Data	Legal basis for the processing
to fill out an account in the App	• name; • gender; • date and time of birth; • birthplace; • E-mail; • phone number	Terms and Conditions (Performance of a contract (Art. 6(1)(b) GDPR)* * Without providing this data you will not be able to use the App
to ensure proper use of the App, including the ability to monitor and troubleshoot technical issued	• technical data such as IP address, device ID, IDFA, Device token, location data, device model, OS version, device screen resolution, timezone, date and time of access (the “Technical Data”); • usage experience, i.e. information about your use of the App (the “User Data”)	Terms and Conditions (Performance of a contract (Art. 6(1)(b) GDPR) * Without providing this data you will not be able to use the App
to communicate with you (including technical support)	• E-mail; • any other information that you have made public in the messengers or social networks you used to contact us at the time of contacting us (name, photo, etc.); • information that you provide us when you contact us	Our legitimate interest in receiving communication from you and reacting to it and your interest in getting our response
to manage and optimize users’ experience by improving our knowledge of our users	• Technical Data; • User Data	Our legitimate interest in evaluating and creating statistics on the use of the App and your interest in the App updates which will be tailored to your needs
to provide you with advertising, including that is relevant to your interests	• Technical Data; • User Data	Our legitimate interest based on the balance of interests while you have absolute right to object to direct marketing
To make a donation via the APP	• name; • gender; • date and time of birth; • bank information	Terms and Conditions (Performance of a contract (Art. 6(1)(b) GDPR) * Without providing this data you will not be able to use the App

WHEN CAN WE SHARE YOUR PERSONAL DATA?

We can share your Personal Data with third parties only in the cases listed below. When we are required by law: We may disclose your Personal Data to the extent that we are required to do so by law (which may include to government bodies and law enforcement agencies), in connection with any legal proceedings or prospective legal proceedings and in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention). Where Personal Data is transferred to the United States, we may also rely on the EU–U.S. Data Privacy Framework for certified recipients. With our partners who help us support the App: We may have partners that help us to make the App better, including analytics and advertising services which may process your Personal Data for purposes specified in section “HOW DO WE PROCESS YOUR PERSONAL DATA?” above respectively. A list of third-party services used by App is below. Analytics services. We may use third-party service providers to monitor and analyze the use of our App, as follows: • Google Analytics. Google Analytics is a web analytics service provided by Google, Inc. Address: Google, Google Data Protection Office, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA. Privacy Help Center, Privacy Policy of Google Inc. • Google Firebase. Google Firebase is a mobile and web app development platform that offers several integrated features such as a mobile app server, analytics tools, app promotion and monetization tools provided by Google, Inc. Address: Google, Google Data Protection Office, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA. Privacy Help Center, Privacy Policy of Firebase. • AppsFlyer. AppsFlyer is a mobile marketing analytics and attribution platform provided by AppsFlyer. Address: to the attention of Legal Team/Data Protection Officer, 14 Maskit St., Herzliya, Israel, 4673314. privacy@appsflyer.com, Privacy Policy of AppsFlyer. Ads systems. We may use third-party service providers advertising purposes respectively, as follows: • Facebook Ads. Facebook Ads Manager is a Facebook tool that allows to create and manage ads provided by Meta Platforms, Inc. Address: 1601 Willow Road, Menlo Park, CA 94025, USA. Privacy Policy of Meta. • Google Ads. Google Ads is a contextual advertising service from Google, Inc. Address: Google, Google Data Protection Office, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA. Privacy Help Center, Privacy Policy of Google, Inc. • Apple Search Ads. Apple Search Ads makes us easy to manage our ads campaigns. Service is provided by Apple, Inc. Address: Apple Park Way, Cupertino, CA 95014, United States. Privacy Enquiries, Privacy Policy of Apple, Inc. • TIK TOK Ads. TIK TOK Ads is an advertising service. Transfer to the USA, the Russian Federation, the UAE, Indonesia, India based on the Jurisdiction Specific Terms and Controller to Controller Data Terms, Request privacy information. PLEASE NOTE THAT SOME OF THESE COMPANIES MAY BE LOCATED OUTSIDE THE EU (INTERNATIONAL DATA TRANSFERS) INCLUDING IN THE COUNTRIES WHICH DO NOT ENSURE AN ADEQUATE LEVEL OF PROTECTION OF YOUR PERSONAL DATA. Where this is the case, we meet the strict conditions of Personal Data transfers from the member states of European Union to other countries by using the Standard Contractual Clauses (SCC) adopted by the European Commission to ensure that Personal Data are properly protected or relying on other derogations compliant with GDPR.

HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

We retain your Personal Data for no longer than it is necessary to fulfill the purposes specified in the section “How do we process your Personal Data”. For example: • Account data: retained until you delete your account, then securely erased within 90 days. • Donation/payment data: retained for up to 7 years to comply with financial and AML obligations. • Technical/analytics data: retained for up to 24 months. Except for any legal obligation that sets a longer data retention period, at the end of these periods, the Personal Data processed will be deleted or anonymized.

DO WE USE AUTOMATED DECISION-MAKING OR REFER TO THE AUTOMATED PROFILING?

We do not make decisions with legal or similarly significant effects based solely on automated processing. We may use limited profiling (e.g., tailoring advertising or recommendations) but you can opt out of such profiling at any time via your account settings.

WHAT RIGHTS DO YOU HAVE?

Rights of EU residents:

(1) The right of access to your Personal Data meaning that you can receive a copy of the Personal Data that we hold about you, as well as other supplementary information. (2) The right to rectification of your Personal Data which is incomplete or inaccurate. (3) The right to erasure of your Personal Data meaning that you can ask us to delete or remove your Personal Data in certain circumstances. Note, that we can retain your Personal Data as necessary to comply with our legal obligations or resolve disputes. If we have no grounds to continue processing your Personal Data, we will delete or remove it and notify you about such deletion or removal. (4) The right to restrict processing of your Personal Data if (a) the accuracy of the Personal Data is contested by you, (b) the processing is unlawful and you oppose the erasure of the Personal Data, (c) we no longer need the Personal Data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, and (d) you have objected to processing pending the verification whether the legitimate grounds override this. (5) The right to data portability. The right to portability of your Personal Data, which applies only to information we have processed based on your consent or Terms and Conditions. (6) The right to object to the processing of your Personal Data where we are relying on a legitimate interest and there is something about your particular situation that makes you want to object to the processing on this ground. We will no longer process the Personal Data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. (7) Right to withdraw consent at any time where we are relying on the consent to process your Personal Data. If we have no other grounds for processing your Personal Data, after you send us a request to withdraw consent, we will stop processing your Personal Data that we were processing under your consent. We will address your request as early as possible and no longer that within 1 month. Please note that this period may be extended by 2 further months where necessary, taking into account the complexity and number of the requests. In this case, we will inform you of the extension within 1 month of receipt of your request and will explain you the reasons for the delay.

Rights of California residents:

(1) The right to opt out. Under the CCPA each California resident can request business stops selling Personal Data to third parties. Do we actually “sell” Personal Data? We do not, and will not, provide your Personal Data in direct exchange for money. Therefore, in the literal sense, we do not sell your Personal Data. (2) Other rights. You also have a right to be informed about what categories of Personal Data we are collecting: you can request us to disclose what Personal Data we have collected in the past 12 months and right to get a free copy of your Personal Data disclosed in a readily usable and readable format. You can also request us to delete the Personal Data we have collected in the past 12 months. We will not discriminate against you for exercising any of your rights granted under CCPA. Mandatory Verification: As required by CCPA we will need to verify your identity before processing your request. In order to verify your identity, you will be asked to log in to your account or (if you do not have an account) we will try to match the information you provided with the information we handle about you. In certain circumstances, we may decline the request, mainly where we are unable to verify your identity, for example, if you have requested us to delete your Personal Data. As required by CCPA we endeavor to respond to a verifiable request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. We will deliver our written response by e-mail. As of January 1, 2023, California residents also have the right to: • Correct inaccurate personal information; • Limit the use and disclosure of “sensitive personal information”; • Know if we “share” personal data for cross-context behavioural advertising (we do not). How to exercise any of your rights? You may exercise your rights by sending a relevant request to the e-mail indicated in the contact details. If you have any comments about how we process your Personal Data, please let us know and we will consider your claim. If you are not satisfied with our response to the complaint, you have the right to file a complaint with the competent authority. Digital Services Act (DSA). If you are located in the EU, please note that moderation of user-generated content on our Services may involve processing of your data. We provide a Notice and Action mechanism for reporting illegal content, explain the reasons for content removals, and offer an appeal process in line with the EU Digital Services Act.

Social Media Platforms

From within the App, users are able to share content on SNS such as Facebook, Twitter, Instagram and WhatsApp.

Donations via the App

When you make donations to us, we may process these through third-party payment processors such as Braintree, PayPal, Apple pay, Google Pay, Stripe and others.

This Policy Doesn't Cover Third Parties

This Privacy Policy addresses only our use and disclosure of information we collect from and/or about you. If you disclose information to others, or authorize us to do the same under this Privacy Policy, the use and disclosure restrictions contained in this Privacy Policy will not apply to any third party. We do not control the privacy policies of third parties, and you are subject to the privacy policies of those third parties where applicable. The interfaces of the App that you see may contain content or links to other websites that are not owned or controlled by us. We have no control over, do not review and are not responsible for the privacy policies of or content displayed on such other websites. When you click on such a link, you will leave our App and go to another site. During this process, another entity may collect Personal Information or Anonymous Information from you. The App may also contain links to other websites controlled by us but which operates under different privacy policies. Please review the privacy policy of any new site you visit.

Children

The App is not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If a parent or guardian becomes aware that his or her child has provided us with information or may be receiving communications from us without consent of a parent or guardian, we ask that this be brought to our immediate attention. We will make it our priority to address this situation and delete information relating to a child as soon as practicable. In such an event, please contact us.

Security

To protect your personal data from unauthorized access and abuse we have implemented technical and organizational security measures. We check these security measures regularly and adapt them, as necessary, to the state of technological progress. All payment data is processed by our payment processing partners. We do not collect your financial information. Your financial information is managed securely by our payment processors which are globally trusted payments companies.

Contact Us

If you have any questions or concerns about this privacy policy, please contact us at: Address: Tallinn, Juhkentali tn 8, 10132 E-mail: team@helpstercharity.org

Last update: 15 September 2025