Privacy

Controller

Friends for Nepal – Himalayan Development Aid, Passauerstrasse 3, A-5163 Mattsee, is the controller for personal data on this website.

Enquiries: info@himalaya-development.org.

What this site does today

The public site is static. There is no analytics script, no ad network and no cookie banner, because no non-essential cookies are set.

The contact and sponsorship forms open the mail app on your device. Name, sender address and text reach us only when you send the message. The legal basis is Art. 6(1)(b) or (f) GDPR, depending on whether you start a sponsorship or send a general question.

Donations through Stripe

Online payments are intended to run through Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe will be a processor for cards, wallets and SEPA direct debit. The association creates Payment Links in the Stripe dashboard; secret keys do not sit on this website.

For Austrian tax relief Stripe may collect first name, last name and date of birth as required payment fields. Without a date of birth the report to FinanzOnline is not possible. The legal basis is Art. 6(1)(b) and (c) GDPR.

Stripe transfers data to the United States under the EU-US Data Privacy Framework and standard contractual clauses. Retention follows tax and association law, usually seven years.

Members’ area through Supabase

The closed area for sponsors and the board is planned on Supabase (project region eu-central-1, Frankfurt). Supabase Inc. will then be a processor for accounts, roles, child reports, payment records and private files.

Sign-in is planned as a magic link by email, without a password. A sponsor sees only their own child. That split lives in the database access rules, not on the public page.

Supabase’s processor terms speak of processing primarily in the EU, not exclusively. We therefore do not promise an EEA-only guarantee.

Hosting

The files of this website are stored with Mittwald CM Service GmbH & Co. KG, Espelkamp, Deutschland. The host keeps server logs (IP address, time, requested file) for operational security. The legal basis is Art. 6(1)(f) GDPR. Logs are deleted according to the host’s retention period.

The association sometimes writes to people who have asked to be informed. Sending is handled by a newsletter processor; the domain’s mail record points to The Rocket Science Group LLC (Mailchimp, United States). The written contract must be in place before launch.

Subscription needs consent under Art. 6(1)(a) GDPR. Every mail contains an unsubscribe link. Mailchimp relies on the Data Privacy Framework and standard contractual clauses for transfers to the United States.

Nepal as a third country

Nepal has no adequacy decision from the European Commission. As soon as people in Nepal — for example Suresh or Manish — can see photos, reports or sponsor contact data, the processing leaves the EEA.

That requires standard contractual clauses and a record of the risks. A server in Frankfurt does not replace that. Until the contract exists, private child data must not flow to Nepal.

Children on the public site

In public we show at most a first name, an age range and a photo, and only when a documented consent of the holders of parental responsibility exists. Last names, dates of birth and sponsorship status do not belong on this website.

Consent must be withdrawable. A withdrawal means photo and text come off the public site.

Your rights

You can ask for access, rectification, erasure, restriction and portability, and you can object where processing rests on legitimate interest. You can withdraw consent at any time.

Complaints go to the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at.