Privacy Policy

1. Controller

The controller of personal data is the Dream come true civic association. Its identification and contact details appear above. DCT has not designated a data protection officer (DPO); please contact info@dctracers.com about data protection.

2. Data, sources and provision

For correspondence, we process information you provide, particularly your name, email address, other contact details and the contents of messages and attachments. For contractual or partnership relationships, we also process identification and contact information needed for that relationship, including details of the partner’s contact persons.

For donations, we obtain information from the donor and from bank statements or notifications from the bank. To the extent made available by the bank, this may include the payer’s name, account number or IBAN, amount, currency, date and payment reference or another payment identifier. Relevant information forms part of donation records, contracts and accounting documentation.

Technical data arises when the website is used and is processed through Websupport hosting. It may include the IP address, request time, requested address, browser information and error logs.

General correspondence and making a donation are voluntary. Without the necessary contact details or message content, however, we may be unable to answer a particular request. We process information needed to prepare or perform a contractual or donation relationship for those purposes; without the necessary information, we may be unable to prepare or properly perform that relationship. DCT is legally required to retain information that forms part of accounting documentation.

3. Purposes and legal bases

General correspondence and handling enquiries: Article 6(1)(f) GDPR. Our legitimate interest is to respond to requests and manage relationships with donors and partners. We also use this basis for necessary correspondence with representatives of legal entities who are not themselves parties to the contract.

Pre-contractual communication at the individual’s request and performance of a donation or other contractual relationship: Article 6(1)(b) GDPR, where that individual is a party to the contract or requests pre-contractual steps.

Accounting records and related legal obligations: Article 6(1)(c) GDPR, particularly under Slovak Act No. 431/2002 Coll. on Accounting.

Website security and technical operation, including server logs: Article 6(1)(f) GDPR. Our legitimate interest is to keep the website functional and secure and to detect and resolve errors, misuse and security incidents. For the protection of related legal claims, our legitimate interest is to establish, exercise or defend those claims.

We do not use donor information or contact details for marketing or newsletters.

4. Recipients and data transfers

To the extent necessary, data may be accessible to Websupport, which provides website hosting and the info@dctracers.com email service, an external accounting firm, the bank and the competent authorities where required by law. Websupport and the external accounting firm process information when providing their services; the bank also processes payment information under its own legal obligations and privacy rules.

PAYME is an external payment link operated by the Slovak Banking Association. You authorise the payment itself in your bank and the donation goes directly to DCT’s account. Section 9 explains the technical data involved when PAYME is opened.

DCT does not itself carry out planned transfers of personal data outside the European Economic Area (EEA). Under its terms, Websupport may use additional processors, including in third countries. Its terms provide for an adequacy decision or appropriate GDPR safeguards for such transfers. The links below provide current information about recipients, transfer conditions and safeguards; you can also ask DCT at info@dctracers.com for information or a copy of the applicable safeguards.

Websupport — privacy and recipients

Websupport — contractual data processing terms

5. Retention

We retain general email correspondence for no more than 3 years after the last communication. We retain it longer only if it forms part of a contractual, accounting or legal matter; the relevant period described below then applies.

We retain accounting records and donation information that forms part of accounting documentation under the Accounting Act, generally for 10 years following the year to which they relate. Specific statutory rules may require longer retention, for example during unresolved proceedings.

We retain contractual and partnership information for the duration of the relationship and then for the applicable statutory or limitation period. The period depends on the type of relationship and claim, the applicable law and any ongoing proceedings.

For technical records, retention is determined by the need to ensure website functionality and security, detect and resolve technical errors or security incidents and protect related legal claims, taking the provider’s rules into account. Websupport states that backups of access and error logs are available for the last 14 days. This describes the availability of those backups; it does not mean that all technical records are automatically deleted after 14 days.

Websupport — server logs

6. Your rights

Subject to the GDPR, you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent where processing is based on consent.

You have the right to object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. In that case, we will no longer process the data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims.

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In Slovakia, this is the Office for Personal Data Protection of the Slovak Republic. Information on initiating data protection proceedings is available on its website.

Slovak supervisory authority — data protection proceedings

7. Automated decision-making

Dream come true does not use this website for automated individual decision-making or profiling producing legal or similarly significant effects.

8. Contact

Privacy requests may be sent to info@dctracers.com.

9. Cookies and how the website works

During ordinary browsing, the current public DCT website does not set its own cookies or store user identifiers in localStorage or sessionStorage. It does not use analytics or marketing cookies or tracking pixels. The /sk/ or /en/ address determines the page language. Fonts, images and scripts are loaded from the DCT domain.

Websupport hosting processes technical request records when delivering a page, such as the IP address, time, requested address and browser information. They support website security and technical operation. These server records are not cookies; sections 3 and 5 describe their purposes and retention.

Entering an amount and generating the QR image take place in your browser; these actions alone do not send the amount to DCT or PAYME. You initiate saving the image, copying the details or sharing them with an application of your choice.

The optional PAYME link may open a supported banking app or the external PAYME website. The PAYME website is operated by the Slovak Banking Association. The link contains DCT’s recipient name and IBAN, the selected amount, currency and payment reference. If the PAYME website opens, its operator also receives technical information needed to load the page, such as the IP address. Its cookies and data processing are governed by that operator’s information and rules. The same applies when you use your bank.

About PAYME