PERSONAL DATA PROTECTION POLICY

Last updated: August 2026

1.1 Data Controller

• Organization: Venezuela Te Necesita

• Legal form: Association under the French Law of 1901 (SIREN 829816370)

• Registered address: 208 rue Saint-Maur, 75010 Paris, France

• Email: venezuelatenecesita.fr@gmail.com

This Data Protection Policy describes how we collect, use, protect, and share your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés, Law No. 78-17 of 6 January 1978, as amended).

1.2 Data Protection Officer (DPO)

Given the size of the organization and the non-sensitive nature of the data processed, Venezuela Te Necesita has determined that it is not required under the GDPR to appoint a Data Protection Officer (Art. 37). Any inquiries regarding data protection may nonetheless be sent to: venezuelatenecesita.fr@gmail.com

1.3 Data We Collect

We collect personal data when:

• You make a donation: first name, last name, email address, postal address, phone number, IBAN/banking details (processed by HelloAsso or GoFundMe, not by us).

• You subscribe to our newsletter: name, email address.

• You contact us: name, email address, message content.

• You apply to volunteer: first name, last name, date of birth, address, phone number, professional information.

• You visit our website: cookies, browsing data.

1.4 Purposes of Processing

We use your data to:

• process and manage donations (invoicing, issuing tax receipts);

• maintain communication with donors and supporters;

• improve our services and programs;

• comply with legal obligations (tax filings, audits);

• send information about our activities (only if you have given your consent);

• respond to information requests.

1.5 Legal Basis for Processing

The processing of your data is based on:

• Performance of a contract: processing donations, managing subscriptions.

• Consent: sending newsletters and marketing communications.

• Legal obligation: compliance with French tax rules (Art. 200 of the French General Tax Code).

• Legitimate interest: improving our services, impact analysis.

1.6 Data Retention

Data Type Retention Period Justification Donor data (name, email, address) 3 years from the last donation Tax obligation and relationship management Tax receipts and donation records 5 years Legal obligation (Art. 200 CGI) Volunteer data 1 year after the end of the collaboration Administrative and work-related matters Newsletter records (email) Until consent is withdrawn Subscription management Web contact data (forms) 6 months after response Handling of requests

1.7 International Data Transfers

To process donations, we use third-party platforms located outside the European Union:

• GoFundMe (USA): donation processing. Transfer based on an adequacy decision or Standard Contractual Clauses (SCCs).

• HelloAsso (France): payment processing; company located within the EU.

These transfers comply with Articles 44–49 of the GDPR. Providers are contractually required to guarantee a level of data protection equivalent to that of the EU.

1.8 Data Security

We implement technical and organizational measures to protect your data:

• TLS 1.3 encryption: all connections to the website are encrypted.

• Secure storage: data hosted on Hostinger servers (Cyprus), with daily encrypted backups.

• Restricted access: only authorized staff may access personal data, subject to confidentiality obligations.

• Strong authentication: robust passwords and two-factor authentication, where applicable.

• Risk assessment: we regularly conduct data security audits.

1.9 Your GDPR Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15): you may request a copy of your data.

• Right to rectification (Art. 16): you may correct inaccurate data.

• Right to erasure (Art. 17): you may request the deletion of your data, subject to legal exceptions.

• Right to restriction (Art. 18): you may restrict the processing of your data.

• Right to data portability (Art. 20): you may receive your data in a structured format (XML, CSV).

• Right to object (Art. 21): you may object to specific processing activities (e.g., marketing communications).

Response time: we will respond to any request within 30 calendar days (Art. 12 GDPR). If the request is complex, this period may be extended up to 90 days.

How to exercise your rights: send your request by email to venezuelatenecesita.fr@gmail.com, or by post to: Venezuela Te Necesita, 208 rue Saint-Maur, 75010 Paris, France. Please include your name, contact email, and a clear description of your request.

1.10 Complaints to the Supervisory Authority

If you believe your data protection rights have been violated, you may lodge a complaint with the competent authority:

CNIL (Commission Nationale de l'Informatique et des Libertés) 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France Website: www.cnil.fr

1.11 Contact

• Email: venezuelatenecesita.fr@gmail.com

• Postal address: Venezuela Te Necesita, 208 rue Saint-Maur, 75010 Paris, France