Personal Data Protection Policy
PROCESSING OF PERSONAL DATA
1. Introduction
Člověk v tísni o.p.s. / People in Need (hereinafter referred to as "PIN" or the "Controller") processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation – GDPR), Act No. 110/2019 Coll., on the Processing of Personal Data, and other applicable legal regulations.
On this page, you will find information about the personal data we process, why we need it, the legal basis on which we process it, with whom we may share it, and your rights in relation to the processing of your personal data.
PIN operates both in the Czech Republic and abroad and implements a wide range of social, educational, humanitarian and development programmes. Therefore, the way in which we process personal data may vary depending on how you interact with us or which of our services you use.
This page provides general information on the processing of personal data. If you apply for a specific programme, request assistance, enter into a contract with us, or use any of our services, we will, where necessary, provide you with more detailed information relating to the specific processing of your personal data.
When processing personal data, we ensure that personal data are processed only to the extent necessary for the specified purpose, are protected by appropriate security measures, and are retained only for as long as necessary or for the period required by applicable legal regulations.
2. Who Processes Your Personal Data
The Controller of your personal data is:
Člověk v tísni, o.p.s.
Šafaříkova 635/24, 120 00 Praha 2, Id No. 25755277
If you have any questions concerning the processing of your personal data or wish to exercise your rights under the GDPR, please contact us using the e-mail addresses below.
Our internal contact person for data protection matters is:
Martina Zikmundová
e-mail: gdpr@clovekvtisni.cz
Our Data Protection Officer (DPO) is:
Eva Lipovská, společnost Equica, a.s.
e-mail: dpo@clovekvtisni.cz
3. What Personal Data We Process
The scope of the personal data we process depends on how you interact with us and which of our services or activities you use.
Depending on the specific circumstances, we may process, in particular:
- identification data (e.g. first name, surname, date of birth);
- contact details (e.g. address, e-mail address, telephone number);
- payment and billing information;
- data relating to donations made, the use of our services, or participation in our programmes;
- data provided in applications, registration forms or other forms;
- data contained in our mutual communications;
- technical data collected when you use our website, such as your IP address, information about your device and browser, records of website usage, and data collected through cookies or similar technologies. More detailed information about the use of cookies, including their current settings and the possibility to change or withdraw your consent, is available in the cookie settings on our website;
- other data necessary for the provision of a specific service, the implementation of a project, or compliance with our legal obligations.
In exceptional cases, we may also process special categories of personal data, such as data concerning health, religious beliefs, or other data referred to in Article 9 of the GDPR, where this is necessary for the provision of social, humanitarian or other assistance, where required by law, or where another condition set out in the GDPR is fulfilled. In certain situations, we may also process information relating to your social circumstances or other sensitive circumstances, although such information may not always constitute special categories of personal data.
We obtain personal data primarily directly from you. In justified cases, we may also obtain personal data from our partners, funding providers, public authorities, or publicly available sources, where permitted by applicable law or where necessary for the provision of our services. In such cases, we will, of course, inform you of the processing of your personal data in due time.
The provision of personal data is voluntary in most cases. However, where personal data are necessary for the conclusion of a contract, the provision of a service, the processing of an application, or compliance with a legal obligation, we may not be able to provide the relevant service or carry out the relevant activity without such data.
4. When We Process Your Personal Data
The scope of the processing of personal data depends on how you interact with us. Below, you can select the situation that applies to you to view more detailed information about the processing of your personal data. If you have any questions, please contact us using the e-mail addresses provided above.
► I Want to Support PIN
Donors
What data we process
Identification and contact details, payment information, data relating to donations made, and data relating to our mutual communications.
Why we need the data
To receive and record donations, issue donation receipts, comply with our legal obligations, communicate with donors, and develop donor relationships.
Legal basis
Performance of a contract, compliance with legal obligations, legitimate interests, and, where appropriate, consent.
How long we retain the data
For as long as necessary to fulfil the purpose of the processing, but at least for the period required by applicable legal regulations. Data used for communication with donors are generally retained for three years from the date of the last contact.
Identification and contact details, payment information, data relating to donations made, and data relating to our mutual communications.
Why we need the data
To receive and record donations, issue donation receipts, comply with our legal obligations, communicate with donors, and develop donor relationships.
Legal basis
Performance of a contract, compliance with legal obligations, legitimate interests, and, where appropriate, consent.
How long we retain the data
For as long as necessary to fulfil the purpose of the processing, but at least for the period required by applicable legal regulations. Data used for communication with donors are generally retained for three years from the date of the last contact.
► I Need Humanitarian Assistance
Beneficiaries of Assistance
What data we process
Identification and contact details, as well as other data necessary to assess eligibility for assistance and to implement humanitarian programmes. Where necessary, we may also process special categories of personal data.
Why we need the data
To assess applications, provide humanitarian assistance, protect vital interests, comply with our obligations towards donors and supervisory authorities, and monitor and evaluate projects.
Legal basis
Performance of a contract, compliance with legal obligations, protection of vital interests, performance of a task carried out in the public interest, where an appropriate legal basis exists for the specific processing, or the processing of special categories of personal data pursuant to Article 9 of the GDPR.
How long we retain the data
For as long as necessary to fulfil the purpose of the processing and, subsequently, for the period required by the applicable legal regulations or the funding conditions of the relevant programme.
► I Use Social Services
Social Service Clients
What data we process
Identification and contact details, as well as other data necessary for the provision of social services, including special categories of personal data where their processing is necessary.
Why we need the data
To provide social services, maintain records, comply with legal obligations, and protect the rights of both clients and the service provider.
Legal basis
Performance of a contract, compliance with legal obligations, legitimate interests, and the processing of special categories of personal data in accordance with the GDPR.
How long we retain the data
For as long as necessary to fulfil the purpose of the processing and, subsequently, for the period required by the applicable legal regulations or the funding conditions of the relevant programme.
► I Participate in a Programme, Training Course or Other Event
What data we process
Identification and contact details, data provided in the registration form, and other data necessary for the organisation of the relevant event.
Why we need the data
To organise, administer, deliver and evaluate educational programmes, training courses, seminars and other events.
Legal basis
Performance of a contract, legitimate interests, or consent.
How long we retain the data
For the duration of the programme and, subsequently, for as long as necessary to comply with our legal or contractual obligations.
Identification and contact details, data provided in the registration form, and other data necessary for the organisation of the relevant event.
Why we need the data
To organise, administer, deliver and evaluate educational programmes, training courses, seminars and other events.
Legal basis
Performance of a contract, legitimate interests, or consent.
How long we retain the data
For the duration of the programme and, subsequently, for as long as necessary to comply with our legal or contractual obligations.
► I Want to Become a Volunteer
What data we process
Identification and contact details, as well as other data necessary for the selection, organisation and performance of volunteer activities.
Why we need the data
To conclude a volunteer agreement, organise volunteer activities, communicate with volunteers, and comply with related legal obligations.
Legal basis
Performance of a contract, compliance with legal obligations, and legitimate interests.
How long we retain the data
For the duration of the volunteer engagement and, subsequently, for the period required by applicable legal regulations.
Identification and contact details, as well as other data necessary for the selection, organisation and performance of volunteer activities.
Why we need the data
To conclude a volunteer agreement, organise volunteer activities, communicate with volunteers, and comply with related legal obligations.
Legal basis
Performance of a contract, compliance with legal obligations, and legitimate interests.
How long we retain the data
For the duration of the volunteer engagement and, subsequently, for the period required by applicable legal regulations.
► I Am Submitting My CV
What data we process
Data contained in your CV, cover letter, and any other data provided during the recruitment process.
Why we need the data
To assess the suitability of applicants, conduct the recruitment process, and, where applicable, enter into an employment relationship
Legal basis
Steps taken at the request of the data subject prior to entering into a contract, legitimate interests, and, where applicable, consent.
How long we retain the data
For the duration of the recruitment process or, where applicable, for the period for which the applicant has given consent to be included in our applicant database.
Data contained in your CV, cover letter, and any other data provided during the recruitment process.
Why we need the data
To assess the suitability of applicants, conduct the recruitment process, and, where applicable, enter into an employment relationship
Legal basis
Steps taken at the request of the data subject prior to entering into a contract, legitimate interests, and, where applicable, consent.
How long we retain the data
For the duration of the recruitment process or, where applicable, for the period for which the applicant has given consent to be included in our applicant database.
► I Am a Supplier or Business Partner
What data we process
Identification, contact and billing information, as well as other data relating to the contractual relationship.
Why we need the data
To enter into and perform contracts, communicate with you, and comply with our legal obligations.
Legal basis
Performance of a contract, compliance with legal obligations, and legitimate interests.¨
How long we retain the data
For the duration of the contractual relationship and, subsequently, for the period required by applicable legal regulations.
Identification, contact and billing information, as well as other data relating to the contractual relationship.
Why we need the data
To enter into and perform contracts, communicate with you, and comply with our legal obligations.
Legal basis
Performance of a contract, compliance with legal obligations, and legitimate interests.¨
How long we retain the data
For the duration of the contractual relationship and, subsequently, for the period required by applicable legal regulations.
► I Visit the Website
Protection of Web Forms Against Misuse
We use the reCAPTCHA service provided by Google on selected web forms to protect them against automated misuse, spam and security attacks. When reCAPTCHA is used, technical data relating to your device, browser, IP address and your interaction with the form may be processed for the purpose of determining whether the form is being used by a human user or by an automated tool.
The legal basis for this processing is our legitimate interest in ensuring the security of our website and protecting our forms against misuse.
The service is provided by Google, which acts as our processor in relation to this processing of personal data.
What data we process
When you visit our website, we may process technical data relating to your device, browser and use of the website, such as your IP address, cookie identifiers, information about the pages you have visited, your cookie consent preferences, and data provided through web or contact forms.
Why we need the data
We use this data primarily to ensure the operation and security of our website, remember your preferences, respond to your enquiries and requests, and, where you have given your consent, to measure website traffic, analyse the use of our website, personalise content, or display relevant communications and advertising.
Legal basis
We use technical cookies that are necessary for the operation of the website without your consent where they are strictly necessary for the provision of the service you request as a user of the website. Other cookies and similar technologies, in particular analytical and marketing cookies, are used on the basis of your consent provided through the cookie banner. If you complete a form on our website or send us an enquiry, we process your personal data according to the nature of your request, in particular for the purpose of responding to your request, performing a contract, complying with a legal obligation, or on the basis of our legitimate interests.
How long we retain the data
We retain cookies and the data collected through them for the periods specified in the current cookie settings on our website. Data collected through contact forms or other web forms are retained for as long as necessary to deal with your request and, where applicable, for the period required by applicable legal regulations or necessary for the establishment, exercise or defence of legal claims.
We use the reCAPTCHA service provided by Google on selected web forms to protect them against automated misuse, spam and security attacks. When reCAPTCHA is used, technical data relating to your device, browser, IP address and your interaction with the form may be processed for the purpose of determining whether the form is being used by a human user or by an automated tool.
The legal basis for this processing is our legitimate interest in ensuring the security of our website and protecting our forms against misuse.
The service is provided by Google, which acts as our processor in relation to this processing of personal data.
What data we process
When you visit our website, we may process technical data relating to your device, browser and use of the website, such as your IP address, cookie identifiers, information about the pages you have visited, your cookie consent preferences, and data provided through web or contact forms.
Why we need the data
We use this data primarily to ensure the operation and security of our website, remember your preferences, respond to your enquiries and requests, and, where you have given your consent, to measure website traffic, analyse the use of our website, personalise content, or display relevant communications and advertising.
Legal basis
We use technical cookies that are necessary for the operation of the website without your consent where they are strictly necessary for the provision of the service you request as a user of the website. Other cookies and similar technologies, in particular analytical and marketing cookies, are used on the basis of your consent provided through the cookie banner. If you complete a form on our website or send us an enquiry, we process your personal data according to the nature of your request, in particular for the purpose of responding to your request, performing a contract, complying with a legal obligation, or on the basis of our legitimate interests.
How long we retain the data
We retain cookies and the data collected through them for the periods specified in the current cookie settings on our website. Data collected through contact forms or other web forms are retained for as long as necessary to deal with your request and, where applicable, for the period required by applicable legal regulations or necessary for the establishment, exercise or defence of legal claims.
► I Subscribe to the Newsletter
What data we process
Your name, e-mail address and, where applicable, your subscription preferences.
Why we need the data
To send you information about the activities of PIN, invitations to events, and other communications.
Legal basis
Consent or legitimate interests, where permitted by applicable law.
How long we retain the data
Until you withdraw your consent, object to the processing, or unsubscribe from the newsletter.
► I Contacted People in NeedYour name, e-mail address and, where applicable, your subscription preferences.
Why we need the data
To send you information about the activities of PIN, invitations to events, and other communications.
Legal basis
Consent or legitimate interests, where permitted by applicable law.
How long we retain the data
Until you withdraw your consent, object to the processing, or unsubscribe from the newsletter.
What data we process
Identification and contact details, and the content of our mutual communications.
Why we need the data
To respond to your enquiry, request or other submission, and for any subsequent communication.
Legal basis
Steps taken at the request of the data subject prior to entering into a contract, legitimate interests, or compliance with a legal obligation.
How long we retain the data
For as long as necessary to deal with your request and, where applicable, for the establishment, exercise or defence of legal claims.
Identification and contact details, and the content of our mutual communications.
Why we need the data
To respond to your enquiry, request or other submission, and for any subsequent communication.
Legal basis
Steps taken at the request of the data subject prior to entering into a contract, legitimate interests, or compliance with a legal obligation.
How long we retain the data
For as long as necessary to deal with your request and, where applicable, for the establishment, exercise or defence of legal claims.
► I Participate in a Public Event
If photographs or video recordings are taken during the event, participants will be informed of this in an appropriate manner in advance.
What data we process
Identification and contact details (where registration is required), data provided in the application or registration form, data relating to your participation in the event, and, where applicable, photographs, audio recordings or video recordings taken during the event.
Why we need the data
To organise and administer the event, communicate with participants, ensure the safe conduct of the event, document the event, provide information about the activities of PIN, and demonstrate that the event took place to funding providers.
Legal basis
Performance of a contract or steps taken prior to entering into a contract, legitimate interests of the Controller, and, where appropriate, consent.
How long we retain the data
For as long as necessary to organise and evaluate the event and, subsequently, for the period required by applicable legal regulations or for as long as necessary for the establishment, exercise or defence of legal claims.
What data we process
Identification and contact details (where registration is required), data provided in the application or registration form, data relating to your participation in the event, and, where applicable, photographs, audio recordings or video recordings taken during the event.
Why we need the data
To organise and administer the event, communicate with participants, ensure the safe conduct of the event, document the event, provide information about the activities of PIN, and demonstrate that the event took place to funding providers.
Legal basis
Performance of a contract or steps taken prior to entering into a contract, legitimate interests of the Controller, and, where appropriate, consent.
How long we retain the data
For as long as necessary to organise and evaluate the event and, subsequently, for the period required by applicable legal regulations or for as long as necessary for the establishment, exercise or defence of legal claims.
► Photographs and Video Recordings
We take photographs and video recordings primarily during public events, educational activities, and other events organised by PIN.
What data we process
Photographs, video recordings, audio recordings, and other visual or audiovisual recordings in which you may appear.
Why we need the data
To document our activities, inform the public about the work of PIN, present our programmes, projects and events, and produce annual reports, publications, promotional materials, and content for our website and social media channels.
Legal basis
The legitimate interests of the Controller in documenting and presenting its activities or, where required by applicable law, your consent.
How long we retain the data
For as long as the photographs or recordings are used for the purposes described above or, where the processing is based on consent, until you withdraw your consent.
What data we process
Photographs, video recordings, audio recordings, and other visual or audiovisual recordings in which you may appear.
Why we need the data
To document our activities, inform the public about the work of PIN, present our programmes, projects and events, and produce annual reports, publications, promotional materials, and content for our website and social media channels.
Legal basis
The legitimate interests of the Controller in documenting and presenting its activities or, where required by applicable law, your consent.
How long we retain the data
For as long as the photographs or recordings are used for the purposes described above or, where the processing is based on consent, until you withdraw your consent.
► I Follow PIN on Social Media
When you use social media, your personal data are also processed by the operators of the respective social media platforms in accordance with their own privacy policies.
What data we process
Data that you make available when communicating with us through social media, data relating to your interactions with our social media profiles (such as comments, messages or reactions), and other data made available in accordance with your account settings on the relevant social media platform.
Why we need the data
To communicate with the public, respond to enquiries and feedback, provide information about the activities of PIN, and manage and develop our social media profiles.
Legal basis
The legitimate interests of the Controller in communicating with the public and presenting its activities or, where required in a particular case, your consent.
How long we retain the data
For as long as the data remain available on the relevant social media platform or for as long as necessary to respond to your enquiry or communication. The processing of personal data by the operators of social media platforms is governed by their respective privacy policies.
What data we process
Data that you make available when communicating with us through social media, data relating to your interactions with our social media profiles (such as comments, messages or reactions), and other data made available in accordance with your account settings on the relevant social media platform.
Why we need the data
To communicate with the public, respond to enquiries and feedback, provide information about the activities of PIN, and manage and develop our social media profiles.
Legal basis
The legitimate interests of the Controller in communicating with the public and presenting its activities or, where required in a particular case, your consent.
How long we retain the data
For as long as the data remain available on the relevant social media platform or for as long as necessary to respond to your enquiry or communication. The processing of personal data by the operators of social media platforms is governed by their respective privacy policies.
5. General Information on the Processing of Personal Data
Legal Basis for Processing Personal Data
We process personal data only where we have an appropriate legal basis under the GDPR. Depending on the specific circumstances, this legal basis may include the performance of a contract, compliance with a legal obligation, the protection of vital interests, the performance of a task carried out in the public interest, where an appropriate legal basis exists for the specific processing, our legitimate interests, or your consent. The specific legal basis for each processing activity is always indicated in the relevant section of the previous chapter.
Who May Receive Personal Data
We disclose personal data only to the extent necessary for the purpose for which they were collected. Access to personal data is limited to our employees and associates who require it for the performance of their duties. Where justified, personal data may also be disclosed to our contractual partners and service providers (such as providers of IT, accounting, legal or audit services), project partners, or funding providers, where this is necessary for the implementation of a specific project or for compliance with our contractual or legal obligations. We may also disclose personal data to public authorities where required to do so by applicable law.
Transfers of Personal Data Abroad
PIN implements humanitarian, development and other programmes both in the Czech Republic and abroad. In connection with these activities, it also processes personal data in the countries where its programmes are implemented. As a general rule, we do not transfer the personal data of individuals who interact with us in the Czech Republic, such as donors, event participants or job applicants, outside the European Union (EU) or the European Economic Area (EEA), unless such transfer results from a specific service, supplier, tool or programme, about which you will be informed in the relevant detailed privacy information. Where the operation of our website, the use of IT services, analytical or communication tools, social media platforms, or a specific programme involves transfers of personal data outside the EU/EEA, such transfers will always be carried out in accordance with the GDPR and with appropriate safeguards to ensure an adequate level of protection for personal data.
How Long We Retain Personal Data
We retain personal data only for as long as necessary to fulfil the purpose for which they were collected. The retention period depends in particular on the nature of the specific activity, our legal obligations, the requirements of funding providers, or the period necessary for the establishment, exercise or defence of legal claims and the protection of our legitimate interests. After the relevant retention period has expired, we securely delete or anonymise the personal data, unless applicable law requires their further retention.
6. How We Protect Your Personal Data
We consider the protection of personal data to be an important part of our activities. We implement technical, organisational and personnel measures to help ensure the confidentiality, integrity and availability of personal data and to protect them against unauthorised access, loss, misuse or other unauthorised processing.
Access to personal data is restricted to employees and associates who require it for the performance of their duties. All persons who process personal data are bound by confidentiality obligations and are regularly made aware of the rules governing the protection of personal data and the importance of maintaining their security. We apply the same requirements to our contractual partners and service providers who process personal data on our behalf. Where we engage external processors, we select them carefully and enter into data processing agreements with them in accordance with the GDPR. We regularly review our security measures and adapt them to technological developments, the nature of our activities, and evolving risks.
7. Your Rights and How to Exercise Them
The GDPR grants you a number of rights in relation to the processing of your personal data. If you wish to exercise any of these rights or have any questions concerning the processing of your personal data, you may contact us at any time.
Your Rights
Depending on the specific circumstances, you may, in particular:
- request information about the personal data we process concerning you;
- request the rectification of inaccurate or incomplete personal data;
- request the erasure of your personal data, where the conditions set out in the GDPR are met;
- request the restriction of the processing of your personal data;
- object to processing based on our legitimate interests;
- request the transfer of your personal data in cases where the GDPR grants you the right to data portability;
- withdraw your consent at any time where the processing of your personal data is based on your consent.
How to Exercise Your Rights
You may submit your request by e-mail to gdpr@clovekvtisni.cz or contact our Data Protection Officer directly at dpo@clovekvtisni.cz.
We will respond to your request without undue delay and, in any event, within one month of receiving it, unless applicable law provides otherwise.
Verification of Identity
As we are committed to protecting your personal data against unauthorised disclosure, we may ask you to verify your identity before processing your request. The method of verification will always be appropriate to the nature of your request and the manner in which it was submitted.
Automated Decision-Making
PIN does not carry out decision-making based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects the data subject within the meaning of Article 22 of the GDPR.
Changes to This Document
We may update this Privacy Notice from time to time, in particular where there are changes to applicable legislation, our activities, or the way in which we process personal data.
The current version of this document is always available on the PIN website.
Last updated: July 1, 2026