Privacy Policy.

1. Who is the data controller

The data controller is Hate Fighters Network, Deligradska 2/3, 18000 Niš, Serbia, hatefightersprojects@gmail.com. This policy explains how Hate Fighters Network processes personal data through the website and in connection with messages, project applications, events, donations, public content and system security.

For questions, rights requests or privacy concerns, write to hatefightersprojects@gmail.com. Include enough information for us to identify the relevant processing, but do not send a copy of an identity document unless we specifically request it.

2. Processing principles and scope

We process data lawfully, fairly and transparently; collect only what is necessary for a specified purpose; seek to keep data accurate; limit retention and access; and apply reasonable organisational and technical safeguards.

This policy applies to data controlled by Hate Fighters Network. When you move to a partner website, social network, PayPal, Google Maps, YouTube, Vimeo or another platform, that provider may become a separate controller and applies its own policy.

3. Data we may collect

Contact data may include name, email, phone number, organisation, subject and message content. Activity data may, where necessary, include date of birth or age, place of residence, education or experience, motivation, accessibility requirements, travel data and documents used to verify eligibility.

Technical data may include IP address, request date and time, page address, browser and device type, referring page, language, security-check result and error logs. After consent, Google Analytics and Meta Pixel may collect identifiers, visit events and campaign information.

If you participate in a project or event, we may process photographs, audio or video recordings, statements and work outputs, but only with an appropriate legal basis and a notice for the specific activity. We do not collect payment-card data through this website.

4. Sources of data

Most data comes directly from you through a form, email, phone call, application or participation in an activity. We may also receive data from a parent or guardian, a partner organisation nominating you, a project-consortium member, a photographer or a publicly available professional source where there is a justified purpose.

If you provide another person’s data, you are responsible for having a lawful basis and, where required, informing that person about this policy.

5. Purposes and legal bases

We use data to respond to enquiries, process applications, organise and document activities, meet obligations to participants, partners and donors, safeguard participants, maintain financial and project records, publish agreed content, measure website performance and prevent abuse.

Depending on the processing, the legal basis may be: your consent; steps before entering into an arrangement or performance of a participation arrangement; a legal obligation; protection of vital interests in an emergency; or Hate Fighters Network’s legitimate interest in communication, project documentation, security and improvement, where that interest is not overridden by your rights.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of earlier processing and does not necessarily require deletion of data that must still be retained under another valid basis.

6. Forms, applications and communication

Messages submitted through the contact form are stored in the protected administration area and may be forwarded to the official email account for response. Contact messages are routinely deleted no later than 12 months after correspondence ends, unless they become part of a contractual, project or legal record.

Activity-application data is kept for up to 24 months after the activity ends. Selected records may be kept longer where required by donor rules, audit, accounting, insurance, participant safety or the defence of a legal claim.

7. Photographs, video and public content

Events and projects may use a separate photography and recording notice. Where consent is required, it will be requested in a way that allows a free choice. Additional safeguards and parental or guardian consent are used for minors where required.

If you wish to raise a concern about a published photograph, recording or personal detail, send the exact link and explanation. We will assess the request against the legal basis, public interest, project documentation and the rights of others.

8. Recipients and processors

Access is limited to authorised team members who need the data for a specific task. Processing may be supported by the hosting provider identified in the organisation’s service agreement, the email provider, technical support, project partners, donors or auditors, travel and accommodation services and backup providers, to the extent required for their role.

Google Analytics and Meta process data only if you accept the corresponding category in the consent panel. Google Maps is embedded on the contact page and may process the visitor’s IP address and browser technical data when that page opens. Personal data is not sold or shared for another party’s independent advertising.

Data may be disclosed to a competent authority where required by law, pursuant to a valid request or where necessary to protect life, safety or legal interests.

9. International data transfers

Hate Fighters Network projects often involve international partners. Where organising an activity requires a transfer outside Serbia, only necessary data is transferred, with participant information and appropriate contractual, organisational or other safeguards.

Google, Meta and other global providers may process data in countries outside Serbia or the European Economic Area. Their optional scripts are not activated before consent. Details of processing locations and transfer mechanisms are set out in those providers’ policies.

10. Retention periods

In addition to the periods for contact messages and applications, security logs are normally retained for up to 90 days. They may be retained longer where needed to investigate an incident, prevent repeated abuse or protect a legal claim.

Project, financial and accounting records are retained for periods required by law, contract and donor rules. A published archive may remain available to document the organisation’s work unless an individual right or another justified reason requires removal or restriction.

At the end of the retention period, data is deleted, anonymised or permanently restricted unless continued retention remains required or justified.

11. Your rights

Under applicable law, you may request information about processing, access and a copy, correction, deletion, restriction, portability where applicable, object to processing based on legitimate interest and withdraw consent.

To protect personal data, we may request reasonable proof of identity and additional information to locate the record. We will respond within the period required by law. Rights are not absolute; if we cannot fully comply, we will explain the applicable reason.

You have the right to lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection. You may first contact Hate Fighters Network so that we can try to resolve the issue directly.

12. Minors, security and policy updates

We collect minors’ data only where needed for an activity, safeguarding and legal or project obligations. Access is restricted, and particularly sensitive data is not requested through the general contact form. A parent or guardian may contact Hate Fighters Network for information about specific processing.

We use access controls, strong passwords, form protection, login rate limiting, secure sessions, backups and system updates. No internet system can guarantee absolute security; if you suspect an incident, notify us immediately.

We update this policy when processing, service providers or applicable rules change. Material changes will be clearly published and, where required, we will request fresh consent.