Purple Rose Orphans logo Purple RoseOrphans · Mityana
Legal & Privacy

Privacy Policy and Personal Data Protection Notice

Last updated: 13 October 2026

Read the Policy Contact Us
1

Who is responsible for your data

The controller of the personal data collected through the website purpleroseorphans.org is the Greek support association:

Legal name: ΣΥΛΛΟΓΟΣ ΥΠΟΣΤΗΡΙΞΗΣ ΠΑΙΔΙΩΝ ΤΗΣ ΜΙΤΙΑΝΑ ΟΥΓΚΑΝΤΑ «ΠΟΡΦΥΡΟ ΡΟΔΟ» - “PURPLE ROSE” (in English: Association for the Support of Children of Mityana, Uganda “Porfyro Rodo” - “Purple Rose”)
Registered seat: Xanthi, Greece
Contact for privacy matters: Contact Us about privacy

In this policy, “the Association” (publicly known as Purple Rose Greece) refers to the entity named above. The Association processes your personal data in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and applicable Greek law.

2

What data we collect and why

We process only limited personal data, and only for specific purposes:

  • Contact requests: your name, email address, reason for contacting us and your message, so that we can handle and reply to your request. The legal basis is the Association's legitimate interest in handling and replying to the messages it receives (Article 6(1)(f) GDPR) and, where applicable, taking steps at your request (Article 6(1)(b) GDPR).
  • Newsletter: your email address, your subscription status and, where recorded, the date and time of your subscription as proof of your consent, so that we can send you the updates you have chosen to receive. The legal basis is your consent (Article 6(1)(a) GDPR).
  • Donations: the usual transaction data made available by a payment provider or bank, such as amount, date, description or reference, and identification details where provided, so that we can manage donations and meet our accounting, tax and legal obligations. The legal basis is the Association's legal obligations (Article 6(1)(c) GDPR) and its legitimate interest in managing the donations it receives (Article 6(1)(f) GDPR).
  • Website operation and security: limited technical data, such as IP addresses and server or security logs, where necessary to operate and protect the website. The legal basis is the Association's legitimate interest in keeping the website secure and functional (Article 6(1)(f) GDPR).

Providing data through the contact form is optional, but without it we cannot reply to your request. Subscribing to the newsletter is voluntary.

We do not sell or rent personal data, and we do not use it for advertising profiling or automated decision-making.

3

Contact form and messages

Messages submitted through the “Contact Us” form are delivered to the Association's email address and handled exclusively by the Association. They are not stored in a website database. They are used only to the extent necessary to manage and reply to your request.

If a request needs to be referred to a third party or service provider, your personal data will be shared only where this is necessary for that specific request and permitted by data protection law.

If you choose to contact us through an external messaging service linked from the website, that service may also process data in accordance with its own privacy terms.

Please do not include health information or other sensitive personal data in the form. If you nevertheless include it, we will handle it with particular care and only to reply to your request.
4

Newsletter

Newsletter subscriptions are managed through Sender.net, our email and newsletter service provider. Only the data necessary to manage your subscription and send the Association's updates is used.

You can unsubscribe at any time using the unsubscribe link included in each newsletter, without sending an email or completing the contact form. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

Subscriber data is not sold and is not used for unrelated advertising.

5

Donations and payments

Online card donations: card payments are made through a payment page (Checkout) hosted by Stripe. Card numbers, security codes and other card details are entered directly into Stripe's secure environment and are not collected or stored by the Association or this website.

Bank transfers: transfers are completed through the banking system. The Association does not receive your online banking password, confirmation codes or similar access credentials.

Payment providers and banks process data in accordance with their own privacy terms. The Association receives the usual transaction data needed to manage a donation and to meet its legal obligations.

6

Service providers, cookies and international transfers

The Association uses trusted service providers where necessary for website hosting (Hetzner), sending emails and newsletters (Sender.net), site security, optional visit statistics (Google Analytics 4 with consent), and payment processing (Stripe and banks). These providers receive only the data that is necessary to provide their service.

We do not transfer the data collected through the website to the Purple Rose Orphans organization in Uganda.

Some providers may process data outside the European Economic Area. In that case, the transfer takes place only with the safeguards required by the GDPR, namely on the basis of an adequacy decision of the European Commission (for example, the EU-US Data Privacy Framework for certified providers) or standard contractual clauses. For information about obtaining copies of applicable safeguards, see Your rights and contact.

The website uses necessary technical storage for basic functionality and to remember your cookie choice. With your consent, Google Analytics 4 may use analytics cookies to provide general visit statistics. Analytics is not activated before your consent. We do not use advertising or profiling cookies. You may accept, reject or change your choice at any time via “Cookie settings” in the footer.

7

Data retention and child protection

Personal data is kept only for as long as it is necessary for its purpose or as required by law:

  • Contact messages: for as long as necessary to handle the request and any necessary follow-up, or longer where required by law or for a specific legitimate reason.
  • Newsletter: until you unsubscribe, apart from the minimal record needed to respect your choice (for example, so that you do not receive further messages).
  • Donations and transactions: for the period required by tax and accounting law.
  • Technical and security logs: only as long as necessary for the operation and security of the website, usually about 3 days.

The website is intended for adults and does not provide forms intended for children. We do not knowingly ask children for personal data through the website.

To present the work of Purple Rose, selected photographs and limited information about children supported in Uganda are published on this website, with respect for their privacy, dignity and safety, in accordance with the Child Protection Policy and applicable law.

Read Child Protection Policy
8

Your rights, contact and complaints

You have the right of access to your personal data, rectification, erasure, restriction of processing, objection and data portability, to the extent provided by the GDPR. Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal.

To exercise a right or ask a question about your personal data, use our privacy contact form. Requests are handled by the Association and answered within one month of receipt. This period may be extended by two further months if the request is complex or if there are many requests, and you will be informed accordingly. Exercising your rights is, as a rule, free of charge.

If you believe your personal data has not been handled properly, you may lodge a complaint with the competent supervisory authority. In Greece, this is the Hellenic Data Protection Authority.