Privacy Policy

This Privacy Policy explains how Helpster collects, uses, shares and protects personal information when you visit our websites, use the Helpster mobile application (the “App”), donate, receive assistance or communicate with us. Our websites, App and related online tools are referred to as the “Services.” The Cookie Policy below forms part of this Privacy Policy.

Who is responsible for your information?

Helpster operates through separately incorporated charitable organizations. The organization responsible for an activity acts as the controller of the personal information it uses for that activity, meaning that it determines why and how that information is processed. • Helpster Charity US, Inc., a Delaware non-profit corporation, postal address at PO Box 610226 Newton Highlands, MA 02461, United States, is responsible for the App and US website services and for administering new donations received through the App and the US website. • Helpster Charity, an Estonian non-profit association (MTÜ), registry code 80622371, registered at Juhkentali tn 8, Kesklinna linnaosa, Tallinn 10132, Estonia, is responsible for European website donations at https://helpstercharity.org/eu and for existing recurring subscriptions whose authorized recipient remains the Estonian association. All new one-time donations and newly established recurring donations through the App are received by Helpster Charity US, Inc., not by the Estonian association. European website donations are collected through web payments to the Estonian association. Existing Estonian subscriptions remain with their original recipient; viewing an Estonian donation in the App does not change that recipient. The Helpster organization responsible for a beneficiary’s case is responsible for the information it processes for that charitable activity. Hospitals and other partners may have their own responsibilities for treatment records and other information they process independently. We identify the relevant organization when collecting beneficiary information or providing the applicable case-specific privacy notice. Helpster organizations may share information where needed to provide a requested service, administer donations, support a case or meet legal obligations. Where one organization processes information solely on another’s instructions, it acts as a processor under appropriate arrangements. Where organizations jointly determine a processing activity, we make information about their respective responsibilities available to the people concerned. You may contact team@helpstercharity.org about any activity covered by this Policy; we will direct your request to the responsible organization.

Scope and your choices

This Policy covers donors, website visitors, App users, people who contact us and, where relevant, beneficiaries and their representatives. A specific notice provided for a particular activity supplements this Policy. This Policy is a privacy notice, not a request for blanket consent. Using the Services, accepting our Terms of Use or making a donation does not by itself mean that you consent to optional cookies, advertising, marketing or any other activity that requires separate consent. Refusing optional tracking does not prevent you from making a donation.

Information we collect

Information you provide

• Account and contact information: your name, email address, account profile information and other contact details you provide. If you sign in through Apple, Google, Facebook or another supported service, we receive the information you authorize that provider to share, such as your name, profile picture, email address and account identifier. • Donation information: the amount, currency and date, the recipient charity, transaction reference, payment status, receipt details and recurring-payment authorization and cancellation records. We may also collect information necessary for tax reporting, verifying a donation or meeting legal obligations. • Communications: the content of emails, forms, messages and support requests, together with relevant contact information and communication metadata. If a call is recorded or transcribed, we provide any notice and obtain any consent required before doing so. • Gift donations and submitted content: the information you provide about a person on whose behalf you donate, and any text, images, audiovisual material or other content you choose to submit through available features. Please provide another person’s information only if you are entitled to do so and give them appropriate privacy information. We identify information that is needed to provide a requested service or comply with law when we ask for it. Without necessary contact, payment or verification details, we may be unable to create an account, process a donation, issue a receipt or answer a request. Optional information and optional tracking are not conditions for donating.

Beneficiary information

To assess requests for assistance, arrange support and explain the impact of donations, the responsible Helpster organization may receive information from beneficiaries, parents or guardians, hospitals and partner organizations. This may include a beneficiary’s identity and contact details, age, circumstances, medical condition, proposed treatment, hospital estimates, invoices and treatment updates. We limit collection and disclosure to what is necessary and lawful. Public case information may include a first name, photograph, a limited description of the condition and treatment, the funding needed and progress updates. More detailed records require additional safeguards; the fact that information supports a charitable appeal does not make unrestricted disclosure appropriate. Where the EU or UK General Data Protection Regulation applies, health information requires both a lawful basis for processing and an applicable condition for special-category data. For public disclosure relying on consent, we obtain valid explicit consent from the beneficiary or a person legally authorized to act for them. An agreement with a hospital or partner does not, by itself, replace the necessary lawful basis or consent. We provide additional information about the processing of a beneficiary’s case when collecting or arranging that information. We do not send beneficiaries’ identifying or medical information to Google Analytics or Meta advertising tools, or use that information to build advertising audiences.

Information collected through your device

The Services may collect technical information such as your IP address, browser, device model, operating system, language, time zone, access times, diagnostic information and security logs. Usage information may include pages or features visited, navigation, referral information and interactions. Cookie identifiers, advertising identifiers and optional analytics or advertising events are processed subject to the choices described below and applicable device permissions. Necessary security and service logs are separate from optional advertising tracking. We do not treat a device permission or a website cookie choice as consent to every form of tracking.

Cookie Policy

What cookies and similar technologies do

We use cookies and similar technologies, including pixels, to operate our website and, if you choose, to understand its use and measure or improve our advertising. Cookies are small files stored on your device. Pixels and similar tools can send information about a page visit or interaction to a provider. Cookies may be set by Helpster or by a provider whose service we use. Session cookies normally end when your browser session ends; persistent cookies remain until their expiry or deletion. Similar information may also be stored through other browser storage technologies. This section applies to these technologies, not only to files called cookies.

Necessary technologies

Necessary technologies support functions such as security, donation checkout and remembering your privacy choices. They are used only as needed to provide those functions. Google Analytics and Meta advertising technologies are optional, not necessary for making a donation.

Analytics: Google Analytics

With your consent, we use Google Analytics to understand visits, navigation and use of our website, and to improve its performance and content. Depending on our configuration, information may include cookie or device identifiers, browser and device details, referral information, page views, interactions, approximate location and technical information about the connection. Google receives information through this tool. We do not send names, email addresses, payment-card details or beneficiaries’ identifying or medical information to Google Analytics. We do not enable Google Analytics advertising features under an analytics-only consent.

Advertising: Meta

With your separate consent, we use Meta advertising technologies, including the Meta Pixel, to measure campaign effectiveness and help show relevant Helpster advertisements on Facebook and Instagram. Meta may receive browser or cookie identifiers, IP address, device information, referral information and permitted website interaction events. Meta may match that information with information it already holds, including a Facebook or Instagram account, and use it for advertising and measurement under its own privacy policy. We do not send beneficiaries’ identifying or medical information, payment-card details or other sensitive information through these tools.

Accepting, rejecting and withdrawing consent

Optional analytics and advertising technologies are disabled unless you enable the relevant category. Our cookie controls let you accept all optional technologies, reject all optional technologies or choose analytics and advertising separately. Optional choices are not preselected. Continuing to browse, closing a banner or making a donation is not consent. You can change your choice or withdraw consent at any time through “Cookie settings” in the website footer. Rejecting or withdrawing consent does not prevent you from browsing the website or donating. Withdrawal stops future optional tracking for the category concerned; we also take the steps required by applicable law regarding information already collected, including deletion where there is no lawful reason to retain it. Withdrawal does not make processing carried out lawfully before withdrawal unlawful. Your preferences normally apply to the browser or device you use. You may need to make your selection again after deleting cookies, changing browsers or using another device. Browser controls can also delete or block cookies, although blocking necessary cookies may affect essential functions. Browser controls are additional choices, not a substitute for our consent controls. If you have difficulty using the controls, contact team@helpstercharity.org. We retain proportionate records of your choices to respect them and demonstrate compliance.

Cookie information and retention

Our cookie-settings panel identifies the cookies and similar technologies actually in use, their providers, purposes and expiry periods. It distinguishes necessary technologies from optional analytics and advertising technologies. Cookie expiry is different from the period for which Helpster or a provider retains information already collected. Deleting a cookie does not automatically delete that information. Our retention criteria appear in “How long we retain information” below; providers’ own processing is also explained in their privacy information.

Provider information

• Google’s use of information from partner sites: https://policies.google.com/technologies/partner-sites. • Meta Privacy Policy: https://www.facebook.com/privacy/policy/. • Meta Cookies Policy: https://www.facebook.com/privacy/policies/cookies/.

App permissions and similar technologies

The App may use software development kits and similar technologies for service delivery, diagnostics, analytics or attribution. Where consent or operating-system permission is required for an optional activity, we request it separately. Website cookie consent does not automatically authorize App tracking. You can manage available App permissions and notification choices in the App or your device settings; refusing an optional permission does not authorize us to use another method to bypass that choice.

Information from other sources and service providers

We may receive information from sign-in services, payment providers, hospitals, beneficiary representatives and other charitable partners, as described above. Communications providers may supply delivery information and technical metadata needed to respond to or deliver a message. In addition to the Google Analytics and Meta tools described in the Cookie Policy, the Services may use Google Firebase for App infrastructure, diagnostics and analytics; AppsFlyer for mobile attribution and analytics; and Google Ads, Apple Search Ads and TikTok Ads for advertising and campaign measurement. The particular service and information involved depend on the feature, campaign and permissions concerned. Optional tracking is subject to the applicable consent choices and device permissions; listing a provider here does not authorize tracking without those choices. Advertising and analytics providers may receive permitted device identifiers, technical information and interaction or attribution events. Infrastructure and communications providers receive only the information needed for the functions they perform. Providers acting on our instructions are subject to appropriate data-processing arrangements. Providers acting as independent controllers are responsible for their own processing under their notices and applicable law. For the collection and transmission of event data through Meta tools covered by Meta’s EU Controller Addendum, the responsible Helpster organization and Meta Platforms Ireland Limited are joint controllers. Helpster is responsible for the required notice, consent and lawful implementation of collection and transmission. Under that arrangement, Meta is responsible for enabling relevant access, correction, erasure, restriction and portability rights concerning information it holds after transmission. You can contact either party to exercise applicable rights. Meta’s subsequent processing is separate from this joint collection and transmission. The arrangement and allocation of responsibilities are available at https://www.facebook.com/legal/controller_addendum. Meta’s contact details, legal bases, further processing and rights information are available in its Privacy Policy at https://www.facebook.com/privacy/policy/. Where corresponding UK arrangements apply, the relevant allocation is described at https://www.facebook.com/legal/terms/uk_controller_addendum.

How and why we use information

Where applicable law requires a lawful basis, we use the basis appropriate to the activity. Consent to optional tracking is separate from any other basis used to provide the Services. • Accounts and requested services: we use account and contact information to create and manage your account and provide features you request. Where processing is necessary for our agreement with you, the basis is performance of that agreement. We do not treat every item of technical or advertising data as necessary for the agreement. • Donations and recurring payments: we use contact, transaction and authorization records to administer donations, issue confirmations, handle cancellations and refunds, and answer payment questions. The bases are performance of the relevant agreement where applicable, our legitimate interests in properly administering voluntary gifts, and legal obligations for accounting, tax reporting and other required records. • Security and essential technical operations: we use proportionate technical, diagnostic and security information to keep the Services working, detect misuse and prevent fraud. The bases are our legitimate interests in safe and reliable Services, performance of a requested service where necessary, and legal obligations where applicable. This does not cover optional analytics or advertising tracking. • Support and communications: we use the information you provide to respond, resolve issues and send necessary service notices. The basis is performance of a requested service or our legitimate interests in responding to enquiries and administering our relationship with you. • Beneficiary assistance and reporting: we use case information to assess and arrange support and provide appropriate updates. The responsible organization identifies the applicable basis in the relevant case notice. Public disclosure and health information are subject to the additional safeguards and consent requirements described above. • Optional analytics: we use permitted technical and usage information to understand and improve website use through Google Analytics, based on your analytics consent. • Optional advertising: we use permitted technical and interaction information for advertising measurement and relevant advertisements through Meta and other enabled advertising tools, based on the applicable separate consent. • Marketing messages: we use your contact details to send optional news or fundraising communications with your consent where required, or on another basis expressly permitted by applicable law. You may unsubscribe at any time. Email-marketing consent is separate from cookie consent. • Legal compliance and claims: we use information necessary to comply with binding obligations, respond to lawful requests, and establish, exercise or defend legal claims. The bases are legal obligations and our legitimate interests in protecting legal rights, as applicable. When relying on legitimate interests, we consider whether your rights and interests override ours. Where EU or UK GDPR applies, the principal bases described above correspond to Article 6(1)(a), (b), (c) and (f); special-category data additionally require an applicable Article 9 condition.

Who receives information?

We share information only where needed for the purposes described in this Policy and with an appropriate legal basis. Recipients may include: • Payment processors and payment-service providers, for payments, verification, fraud prevention, disputes and receipts. • Hosting, infrastructure, security, communications and support providers, to operate and maintain the Services. • Analytics and advertising providers, subject to the choices and limitations described above. • The relevant Helpster organization, hospitals and charitable partners, for necessary donation administration, case support and reporting. A donation does not automatically authorize sharing the donor’s identity with a beneficiary or publishing it. • Professional advisers, auditors, tax authorities, regulators, courts and other public authorities, where required or lawfully necessary. Public information you choose to submit through a public feature may be visible to others. Beneficiary information is disclosed only as described above and subject to the required permissions and safeguards. We do not treat publicly accessible information as exempt from privacy obligations.

Donations and payment information

Payments are processed through the providers and methods shown at checkout, which may include Braintree, PayPal or Stripe and supported wallets such as Apple Pay or Google Pay. The applicable provider may process payment information as an independent controller for its own payment, security and legal obligations, and as a processor for other functions. Helpster does not store full payment-card details. We do receive and retain donation and transaction records needed for administration, receipts, accounting, fraud prevention and legal obligations. The donation recipient and corresponding controller are identified at the beginning of this Policy and in the relevant donation confirmation.

How long we retain information

We retain personal information only for as long as needed for the relevant purposes, including applicable legal obligations. We determine retention by reference to the type of information, our relationship with you, the purpose of collection, the sensitivity and risks, applicable statutory retention requirements and the time needed to resolve disputes or defend claims. • Account information is retained while needed to provide the account, then deleted or anonymized unless particular records must be retained for a lawful reason. • Donation, payment-authorization, accounting and tax records are retained for the periods required by the laws applicable to the recipient charity and, where necessary, to resolve payment disputes or legal claims. • Support correspondence, technical and security logs are retained for the period reasonably needed to resolve the issue, protect the Services and investigate incidents, with longer retention only where justified. • Beneficiary records are retained for case administration, safeguarding, reporting and applicable legal requirements. Publicly displayed identifying or medical information is reviewed against the continuing purpose and the scope of the relevant permission. • Consent and preference records are retained as needed to respect your choices and demonstrate compliance. We may keep a limited suppression record to avoid sending marketing after you unsubscribe. • Analytics information is retained for the period needed to evaluate website performance and the relevant reporting cycle, subject to configured deletion controls and applicable law. The period for user-level and event-level records is distinct from cookie expiry and from genuinely anonymized aggregate statistics. Information held independently by Google or Meta is subject to the provider’s own disclosed retention rules. You can contact team@helpstercharity.org for information about the retention period applicable to particular records. At the end of the applicable period, information is deleted or genuinely anonymized. Withdrawing consent or closing an account does not require us to delete records we must lawfully retain, but we do not retain them for unrelated optional marketing or tracking.

Automated processing and profiling

Optional advertising tools may use browsing and interaction information to infer interests and select relevant advertisements. This may constitute profiling. You can reject or disable this activity through the relevant privacy choices. We do not use this website advertising activity to make decisions about you that produce legal or similarly significant effects. If a separate service involves such automated decision-making, we provide the information and safeguards required by applicable law before using it.

Your privacy rights

EU, EEA and UK rights

Where the EU or UK GDPR applies, you may, subject to its conditions: • Ask for access to your personal information and a copy. • Ask us to correct inaccurate or incomplete information. • Ask us to erase information where there is no lawful reason to retain it. • Ask us to restrict processing in the circumstances provided by law. • Receive information you provided in a structured, commonly used and machine-readable format, and request transfer to another controller, where processing is automated and based on consent or a contract. • Object to processing based on legitimate interests for reasons relating to your situation. We will stop unless we have legally sufficient overriding grounds or need the information for legal claims. • Object at any time to direct marketing, including related profiling. We will stop using your information for that purpose. • Withdraw consent at any time, without affecting the lawfulness of earlier processing. To exercise your rights, email team@helpstercharity.org. You can withdraw website tracking consent directly through “Cookie settings.” We may ask for proportionate information to verify an access, correction or deletion request where needed, but you do not have to verify your identity or create an account to reject optional cookies. We respond to GDPR requests without undue delay and normally within one month. Where permitted because of complexity or the number of requests, we may extend that period by up to two further months; we will explain the extension within the first month. If we cannot fulfill a request, we will explain why and tell you about available complaint rights. Requests are normally free, subject to the exceptions allowed by law. You may complain to a competent data-protection authority, including the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) for relevant Estonian processing, or the authority in the country of your habitual residence, work or alleged infringement. You do not have to contact us before making a complaint.

US privacy choices

Depending on the law applicable to your information and our activities, you may have rights to access, correct, delete or obtain a copy of personal information, limit certain uses of sensitive information, or opt out of sale, sharing or targeted advertising. Some laws provide an appeal process for a refused request. These rights are subject to the relevant law’s scope and exceptions; this Policy does not assume every state privacy law applies to every charitable activity. We do not exchange personal information for money. Disclosures through advertising tools may nevertheless be treated as a “sale,” “sharing” or targeted advertising under applicable US privacy laws. You can disable optional advertising through “Cookie settings.” We honor recognized opt-out preference signals, including Global Privacy Control, where required by applicable law. You may email team@helpstercharity.org to make a rights request or ask how to appeal a decision. We respond within the period required by the applicable law. Where California’s statutory request rules apply, this is generally 45 days for access, correction or deletion requests, with an extension where permitted and notified. Opt-outs are handled under their applicable, shorter deadlines and do not require identity verification. Other requests may require proportionate verification, and authorized agents may act where permitted by law. We do not discriminate against you for exercising applicable privacy rights. Privacy choices are separate from cancelling a recurring donation.

Marketing, account controls and submitted content

You can unsubscribe from marketing emails using the link in the message or by contacting us. You can manage push notifications through available App or device settings. Opting out of marketing does not stop necessary donation confirmations, security notices or other service communications. You may review or change available profile information in your account, or request correction, deletion or closure by email. If information is necessary to provide an account or feature, deleting it may make that feature unavailable. We explain any lawful retention that remains necessary. Where required, we notify recipients of valid correction, erasure or restriction requests and take the steps required of us. Content you submit is governed by the applicable user-content provisions in our Terms of Use. Those provisions do not replace privacy protections, create blanket consent to use personal information or make consent irrevocable.

Children

Donor accounts and donation features are intended for adults aged 18 or over. Children receiving charitable assistance are beneficiaries, not intended users of those features. Their information is subject to the safeguards described in this Policy and any case-specific notice. If you believe a child has created a donor account or provided information to us without the necessary authority, or you have concerns about information displayed about a child, contact team@helpstercharity.org. We will investigate promptly and remove or restrict information where required. Necessary lawful case, safeguarding or legal records may still need to be retained.

Security

We use appropriate technical and organizational measures to protect personal information against unauthorized access, loss, misuse and disclosure, and review these measures as our Services develop. No internet transmission or storage system can be guaranteed completely secure. Please do not send full payment-card details or unnecessary sensitive information through ordinary email or public features.

International transfers and storage

The Services involve processing in the United States, Estonia and other countries where the responsible Helpster organization, hospitals, partners or providers operate. Google, Meta and other providers may process information internationally. The destination may have different data-protection laws from those in your country. Where applicable law restricts international transfers, we use a lawful transfer mechanism, such as an applicable adequacy decision or approved standard contractual clauses, together with additional assessments and safeguards where required. Reliance on a certification framework is limited to a recipient whose current certification covers the relevant transfer; we do not assume that every US recipient is certified. Corresponding UK or Swiss safeguards are used where applicable. You may request information about the safeguards for your data, including a copy of relevant contractual safeguards subject to lawful redactions, by emailing team@helpstercharity.org. Using the Services, making a donation or accepting cookies is not treated as blanket consent to unrestricted international transfers.

Social media, external links and independent providers

The Services may let you share content or follow links to social networks and other external sites. If you choose to use those features, the relevant provider’s privacy policy applies to its independent processing. Optional embedded tracking remains subject to the consent rules described above. We do not control independent sites, but their separate policies do not remove our responsibility for our own collection and disclosure, for processors acting on our instructions, or for joint-controller obligations. Please review the notice of any external service you choose to use.

Changes to this Policy

We may update this Policy to reflect changes in our Services, practices or legal obligations. We will publish the updated version and date and provide appropriate notice of material changes. Where a new purpose, provider or tracking activity requires consent, we obtain it before that activity starts. A policy update does not turn a previous refusal into consent or automatically change a donation recipient.

Contact us

For questions, privacy requests, cookie-control difficulties or concerns about a beneficiary’s information, contact team@helpstercharity.org. You can also write to the responsible Helpster organization at its address given at the beginning of this Policy.

Last update: 29 September 2026