Privacy Policy

1. Who is responsible for data processing

The data controller is the NGO ‘OSCE International Diplomatic Humanitarian Mission’, registration code 44056953, 22 Zolotysta Street, Uzhhorod, Zakarpattia Region, 88000, Ukraine. Processing follows Ukrainian data-protection law and, where applicable, the GDPR. Privacy requests may be sent to idhm.osce@gmail.com or +380 66 520 57 40.

2. Scope of this policy

This policy applies to website visitors, people requesting a phone consultation and organization representatives listed in the electronic credential registry. External websites linked from this site have their own privacy rules.

3. Data we process

For callback requests we process name, phone number, submission time and request status. Credential checks process the entered passport number and, when a match exists, display the representative’s name, card and passport numbers, issue and expiry dates and status. Hosting and analytics services may also process IP address, request time, page, browser, device, operating system, approximate location, referrer and aggregated usage and performance data. We also process information you provide by email or phone.

Only after your consent, Google Analytics 4 receives page views and site interactions, cookie identifiers, device and browser information, approximate location and referral source. Google processes the IP address when receiving a request; under GA4 policies it is not stored in Analytics. We do not send names, phone numbers, passport numbers or form contents to Google Analytics.

4. How we use data

We use data to respond to consultation requests, maintain and verify the representative registry, operate and secure the website, prevent abuse, investigate incidents, understand aggregate usage, improve performance, meet legal duties and protect legitimate rights.

5. Legal basis for processing

Callback data is processed with your consent. Registry data is processed for record-keeping, authority verification and fraud prevention based on consent, the relationship with the representative and/or another lawful basis. Technical data is processed for security and performance under legitimate interests or consent where required.

Google Analytics, Vercel Web Analytics and Vercel Speed Insights run only after voluntary consent to analytics. Declining or withdrawing consent does not restrict any site features.

6. Data recipients

Only authorized representatives who need the data for their duties have access. We do not sell personal data or share it for third-party advertising. Processors include Supabase for forms and registry storage, Telegram for applicant notifications, and Vercel for hosting, aggregate analytics and performance measurement. Data may also be disclosed where required by law or to protect legal rights.

Google (Google Analytics 4) — for visit and interaction statistics after your consent. We do not use this data for personalized advertising; Google advertising signals are disabled.

7. International data transfers

Supabase, Telegram and Vercel operate internationally, so data may be processed outside Ukraine, including in the EU and other jurisdictions. Available contractual, technical and organizational safeguards are used for such transfers.

If you consent to Google Analytics, Google and its providers may also process data outside Ukraine and the European Economic Area, including in the United States. See https://policies.google.com/privacy for Google's processing practices. International transfers are subject to the relevant service terms and available data-protection safeguards.

8. Data retention

Request data is kept until communication and related issues are completed, then deleted or anonymized unless law or legal claims require retention. Representative data is kept during participation or credential validity and afterward only as needed for records, fraud prevention and legal duties. Passport queries are not stored as a separate search history; technical data follows provider and organization retention settings.

Your analytics choice is stored in your browser for 180 days. Google analytics cookies are configured to last up to 180 days without automatic renewal. Data already sent to Google follows the GA4 property's retention settings; withdrawal stops future collection and does not automatically delete previously transmitted data.

9. Cookies and analytics

Analytics runs only on the production website and after you select ‘Accept analytics’. Before consent or after refusal, Google Analytics, Vercel Web Analytics and Vercel Speed Insights are not loaded. Google Analytics uses _ga and _ga_* cookies to distinguish visits and sessions. Vercel provides cookie-free aggregate statistics and performance measurements. Advertising cookies, personalized advertising and Google Signals are disabled.

You can accept or decline analytics in the banner. Change your choice or withdraw consent anytime through ‘Cookie settings’ in the footer. Withdrawal blocks analytics and removes _ga and _ga_* cookies accessible to this site. Your choice is stored as osce:analytics-consent:v1 in localStorage for 180 days; we ask again after expiry or if storage is cleared. If storage is unavailable, your choice applies only to the current page.

Essential local storage of your choice is not used for tracking. The protected admin area uses an essential HttpOnly authentication session cookie lasting eight hours. Analytics is disabled in the admin area and CMS.

10. Your rights

Subject to applicable law, you may request information and access, correction, deletion or restriction, object to processing, withdraw consent and complain to the Ukrainian Parliament Commissioner for Human Rights or a court. Withdrawal does not affect earlier lawful processing, and identity verification may be required.

11. Security and responsible use

We use encryption, access controls, input validation and rate protection, but no internet transmission or storage is absolutely secure. Do not submit document copies, banking details, passwords, medical information or other unrequested sensitive data through the callback form, and use credential verification only for lawful purposes.

12. Changes to this policy

We may update this policy when site features, providers or legal requirements change. The current version and update date will remain on this page, with additional notice for material changes where appropriate.