Your data, minimally and lawfully.
We collect the least personal data we need, protect it — especially children’s — and never treat a family’s information carelessly. This is the full policy adopted by our Management Board.
The data controller is School Aid MTÜ.
School Aid MTÜ (“School Aid”, “we”, “us”) is an Estonian non-profit association — mittetulundusühing, registry code 80646408 — with its registered office at Harju maakond, Tallinn, Kesklinna linnaosa, Juhkentali tn 8-4, 10132, Estonia. For the personal data described here, School Aid is the data controller: we decide what data is collected and why.
Our guiding rule is simple: we collect the least personal data we need, protect it — especially children’s — and never treat a family’s information carelessly. As an EU charity we operate under the GDPR and Estonian data-protection law, overseen by the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). This policy is public, adopted by our Management Board, and reviewed at least annually.
Only what a purpose genuinely needs.
We practise data minimisation and purpose limitation: we collect only what a specific purpose genuinely needs, use it only for that purpose, and avoid sensitive data unless it is essential. What we hold depends entirely on how you interact with us.
Payment data. When you give, your card details are handled by our payment processors and never touch School Aid’s own servers. We receive the confirmation and the information needed to issue your receipt and keep proper accounts — not your full card number.
We identify a basis before we collect.
Depending on the situation we rely on consent (newsletter sign-up; non-essential analytics), the performance of, or steps toward, your gift (processing a donation you choose to make), legal obligation (retaining accounting and tax records), legitimate interests (answering enquiries, running and securing the charity, balanced against your rights and freedoms), and, in the field, vital interests (protecting someone in an emergency).
In humanitarian settings we treat consent with particular care, because in a crisis it may not be freely given — so we lean on vital or legitimate interests where consent would not be meaningful, and we never repurpose the data of people we help for fundraising without a proper, separate basis.
The highest protection we apply to anything.
This section should be read together with our Child Safeguarding & Protection Policy. We obtain informed consent from the child (age-appropriately) and from a parent or guardian before we photograph or record, obtained through the locally agreed method.
- We never publish information that could identify a child’s exact location or endanger them.
- We never pair a child’s image with sensitive personal data.
- We store images and case data securely and separately.
- A short Data Protection Impact Assessment is carried out before any new activity that would process significant or sensitive personal data — for example, a beneficiary database.
Any withdrawal of consent is honoured, and the same care applies with equal force to images of women.
Secured, restricted, and deleted when its purpose ends.
We store personal data securely, restrict access to those who need it, and encrypt or lock sensitive records. We keep data only as long as its purpose requires, then delete it — with set retention periods for donor, subscriber, volunteer, HR and beneficiary records, and with accounting and tax records kept for the period Estonian law requires.
If a personal-data breach occurs, we report it at once internally, contain and assess it, and — where the GDPR requires — notify the Estonian Data Protection Inspectorate and the people affected.
Everyone who acts for School Aid is bound by our Code of Conduct to protect personal data, especially children’s, and to share it only on a need-to-know basis.
What you can ask us to do.
Under the GDPR you have the right to access the personal data we hold about you; to have it corrected if it is wrong; to have it erased where we no longer need it; to object to or restrict certain processing; to withdraw consent at any time (which does not affect the lawfulness of what we did before); and to data portability for data you provided to us.
We respect these rights so far as our humanitarian and legal duties allow, we do not charge for a reasonable request, and we aim to respond within one month. To exercise any right, use the contact details below.
If you are unhappy with how we have handled your data, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at aki.ee — though we would always welcome the chance to put things right first.
We would rather hear from you than have you wonder.
| Data controller | School Aid MTÜ — mittetulundusühing |
|---|---|
| Register code | 80646408 |
| Registered office | Harju maakond, Tallinn, Kesklinna linnaosa, Juhkentali tn 8-4, 10132, Estonia |
| Privacy requests | admin@school-aid.eu |
| General enquiries | action@school-aid.eu |
| Supervisory authority | Andmekaitse Inspektsioon — aki.ee |
Adopted by the Management Board. This is a public policy, reviewed annually. It is written for clarity, not as legal advice.