Privacy Policy

Last updated: March 4, 2026

1. Introduction

avesta nature, registered at Erbil kurdistan with registration number 6536, and reachable at info@avestanature.org, acts as the data controller for personal data processed through this website. We operate in Slovakia (EU) and Erbil (Kurdistan Region of Iraq). We apply GDPR (EU 2016/679), the EU ePrivacy framework, Slovak Act No. 18/2018 Coll., and recognized international privacy best practices. Where standards differ, GDPR-level protection applies.

2. Data We Collect

We collect personal data directly from you and automatically through website technologies. Collection methods include contact forms, partnership and volunteer enquiries, donation flows, newsletter sign-up, analytics tools, and cookies.

  • Identity and contact data you provide (such as name, email, phone, organization, message content, and donation-related details where relevant).
  • Technical and usage data (IP address, browser/device type, operating system, language, pages viewed, timestamps, referring URLs, and security logs).
  • Cookie identifiers and consent records; strictly necessary cookies by default, and analytics/preference/optional marketing cookies only after consent. We do not knowingly collect personal data from children under 16 without verifiable parent or guardian consent.

3. How We Use Your Data

We process personal data only where a legal basis under GDPR Article 6 applies: consent (Art. 6(1)(a)), performance of a contract or steps before contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)), and where applicable vital interests (Art. 6(1)(d)).

  • To respond to enquiries, manage partnerships/volunteering/donations, and provide requested services.
  • To operate, secure, troubleshoot, and improve website quality, accessibility, and resilience.
  • To send updates, newsletters, and policy notices where you subscribed or where otherwise permitted by law.
  • To generate aggregated insights for service improvement and program planning, with data minimization and safeguards.

4. Data Sharing

We do not sell personal data. We may share data with trusted processors under GDPR-compliant contracts (Art. 28), including hosting/cloud providers, analytics services, email/newsletter tools, payment providers, and IT/security support. Data may be processed in the EU and, where operationally necessary, transferred between the EU and non-EU locations (including Iraq). For restricted transfers, we apply appropriate safeguards such as Standard Contractual Clauses, transfer assessments, and supplementary technical and organizational controls.

5. Data Security

We implement technical and organizational measures including access controls, least-privilege access, encryption in transit, secure backups, logging, and incident response. Retention is purpose-based: enquiry records are generally kept up to 24 months after last interaction, cookie-consent logs up to 5 years for compliance, donation/accounting records for the period required by applicable tax/nonprofit law, and analytics data per configured retention limits. Data is deleted, anonymized, or securely archived when no longer necessary.

6. Your Rights

Under GDPR and Slovak Act No. 18/2018 Coll., you may exercise your rights by contacting info@avestanature.org. You also have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR) or your local supervisory authority.

  • Right of access: obtain confirmation of processing and a copy of your personal data.
  • Right to rectification and erasure: correct inaccurate data and request deletion where legal conditions are met.
  • Right to restriction and portability: request restriction in specific cases and receive data in a structured, machine-readable format.
  • Right to object and withdraw consent: object to legitimate-interest processing, withdraw consent at any time, and file a complaint with a supervisory authority.

7. Changes to This Policy

We may update this policy to reflect legal, technical, or operational changes. The updated version will be published on this page with a revised "Last updated" date. Where required, we will provide additional notice and request renewed consent before material changes take effect.

8. Contact Us

Data Controller: avesta nature, Erbil kurdistan, Email: info@avestanature.org. For any privacy, data-protection, or rights request, please contact info@avestanature.org.