Privacy Policy

We are Sahem International Relief and Development Organization MTÜ — an independent humanitarian and development organization striving to make the world a better and fairer place.

We are committed to keeping your personal data safe and confidential. We do not share personal data with another organization for their own marketing purposes, and we do not sell personal data.

We have written this Privacy Statement to inform you:

• Why we collect and use your personal data.
• Under what circumstances we may share your personal data with another organization.
• Your individual rights regarding your personal data.

We are committed to being completely open and honest with you about why we collect and use your personal data. This is the right thing to do, and it will also help you understand and exercise your rights over your personal data.

Organization Details:

• Organization Name: Sahem International Relief and Development Organization MTÜ
• Legal Form: Non-profit organization (Mittetulundusühing - MTÜ) registered in Estonia
• Registration Number: 80677432
• Registered Office: Tallinn, Republic of Estonia
• Address: Juhkentali 8, Tallinn, 10132, Estonia
• Email: [email protected]
• Phone: +32472843416
• WhatsApp: +32472843416

We act as the “Data Controller” for your personal data, meaning we determine the purposes and means of processing your data.

Data Protection Officer (DPO): Email: [email protected]  |  Phone: +32472843416  |  Address: Sahem International Relief and Development Organization MTÜ, Juhkentali 8, Tallinn, 10132, Estonia

You have the following rights regarding your personal data, which you can exercise free of charge:

2.1 Right to Withdraw Consent:

Where we have asked for your consent to use your personal data, you always have the right to withdraw your consent at any time.

You can expect that any direct marketing materials you receive from us will include clear and easy instructions on how to withdraw your consent. For example, any marketing emails we send you will include an “unsubscribe” link at the bottom.

If you wish to stop the processing of your personal data for any marketing purpose (including postal mail), please contact our Supporter Relations team:

• Email: [email protected]
• Phone: +32472843416

2.2 Right of Access (Subject Access):

You have the right to ask what personal data we hold about you and to request a copy of that information. We will respond to your request within one month of receipt.

2.3 Right to Object and/or Restrict Processing:

You have the right to know why we collect and use your personal data, and to request that we restrict or stop such processing.

2.4 Right to Data Portability:

You have the right to request that a copy of the personal data we hold about you be transferred directly to another organization in a machine-readable format (e.g., JSON or CSV).

2.5 Right to Erasure (Right to be Forgotten):

You have the right to request the deletion of the personal data we hold about you, subject to legal obligations (such as tax obligations).

2.6 Right to Rectification:

If you believe the personal data we hold about you is inaccurate, you have the right to request that it be corrected or updated.

To exercise any of these rights: Email: [email protected]  |  Phone: +32472843416  |  Post: Sahem International Relief and Development Organization MTÜ, Juhkentali 8, Tallinn, 10132, Estonia

Identity Verification: We may ask you to prove your identity before fulfilling your request to ensure the security of your data.

Response Time: We will respond to your request within one month. If the request is complex, we may extend this period by a further two months, informing you of the reasons for the extension.

You have the right to expect confidential and professional service and to receive a full response.

If you are a volunteer, please refer to Section 4 “Privacy Statement for Our Volunteers and Staff.”

3.1 When do we collect your personal data?

We collect your personal data in the following circumstances:

• When you donate to us.
• When you register for a campaign with us.
• When you register for or attend one of our events, or participate in one of our prize draws.
• When you contact us via email, phone, messaging, or through our website.
• When you visit and use our website (see Section 6 “Use of Cookies”).
• When you interact with us on our social media platforms.

3.2 Why do we collect and use your personal data?

We use your personal data for the following purposes:

• Processing your donations and issuing receipts — Performance of a contract (Art. 6(1)(b)).
• Sending confirmation of your donation and event registration — Performance of a contract (Art. 6(1)(b)).
• Keeping you informed about our activities and ways to support us (marketing) — Consent (Art. 6(1)(a)).
• Handling your inquiries, requests, and feedback — Legitimate interest (Art. 6(1)(f)).
• Personalizing our services (e.g., predicting your interests) — Consent (Art. 6(1)(a)) or Legitimate interest (Art. 6(1)(f)).
• Improving our services (e.g., sending surveys) — Legitimate interest (Art. 6(1)(f)).
• Compliance with anti-money laundering and counter-terrorism financing laws — Legal obligation (Art. 6(1)(c)).
• Preparing financial reports for regulatory bodies — Legal obligation (Art. 6(1)(c)).

Important Marketing Notes: We will only send you marketing materials via email, phone, SMS, or WhatsApp if you have given your explicit consent. You can withdraw your consent at any time (see Section 2). We will not send you marketing materials via postal mail if you have asked us to stop (see Section 2).

3.3 When do we collect personal data from other sources?

We may collect your personal data from other sources in the following cases:

• Third-party fundraising platforms (e.g., GoFundMe, Facebook Giving) — when you agree to support us through these platforms, to process your donation and issue receipts.
• Public sources (databases, press, company registries) — when conducting high-value fundraising research, to verify the accuracy and currency of your information.
• Screening and due diligence services (e.g., Thomson Reuters) — when receiving significant donations or support, for background screening to protect our charitable interests and prevent fraud and money laundering.

We conduct background screening in accordance with our due diligence policies and procedures to protect our charitable interests.

3.4 What is the lawful basis for collecting and using personal data?

We will only rely on “legitimate interest” if your fundamental rights and interests do not override ours.

This section covers our privacy statement for employees, volunteers, interns, trainees, and contractors (including prospective staff).

4.1 When do we collect your personal data?

We collect your personal data in the following circumstances:

• You apply for a job with us or contact us regarding volunteering with us, or fundraising on our behalf.
• As part of the day-to-day management and administration of your contract with us. For example: you inform us of a change in your personal data; you apply for or notify us of leave; you complete your appraisal; you lodge a formal complaint or raise a concern about your work with us.
• As part of the day-to-day management of work-related activities. For example: you use an approved ICT system or technology; you are present (CCTV) at one of our sites or sign in at one of our buildings; you register to participate in work-related activities such as first aid, fire warden, reserve staff, or registered driver; you attend or complete one of our training courses.

4.2 Why do we collect and use your personal data?

We use your personal data for the following purposes:

• Recruitment and selection of staff and volunteers — Contract (Art. 6(1)(b)) or Legitimate interest (Art. 6(1)(f)).
• Enabling payment of salaries, taxes, contributions, and expenses — Contract (Art. 6(1)(b)) and Legal obligation (Art. 6(1)(c)).
• Managing your contract with us (e.g., processing leave requests) — Contract (Art. 6(1)(b)).
• Fulfilling legal obligations (e.g., health and safety) — Legal obligation (Art. 6(1)(c)).
• Taking appropriate action in the event of a formal complaint or concern — Legal obligation (Art. 6(1)(c)) and Legitimate interest (Art. 6(1)(f)).
• Conducting background checks — Legal obligation (Art. 6(1)(c)) and Legitimate interest (Art. 6(1)(f)).
• Planning staffing levels and coverage — Legitimate interest (Art. 6(1)(f)).
• Keeping you informed and improving our strategy and services — Legitimate interest (Art. 6(1)(f)).

Sensitive Data (Special Categories): We may process sensitive data (such as physical or mental health) in the following cases: to protect your health and safety (Art. 9(2)(b)); to fulfill our equal opportunities obligations (Art. 9(2)(b)); only with your explicit and separate consent (Art. 9(2)(a)).

4.3 When do we collect personal data from other sources?

We conduct background screening for all staff and volunteers using a third-party screening and due diligence service, and publicly available sources such as search engines and official databases, to protect our charitable interests against risks such as fraud, corruption, bribery, terrorism, and money laundering.

4.4 When do we share personal data with other organizations?

We may share your personal data with the Estonian Tax and Customs Board (Maksu- ja Tolliamet), law enforcement agencies, payroll and pension providers, insurance companies, recruitment agencies and previous employers, and screening and due diligence services. In all cases, we ensure there is a written contract (or valid legal instruction) that includes data protection clauses.

4.5 Access by Other Staff to Your Personal Data

Other staff may access your personal data when required for business purposes, in accordance with their obligations under our Data Protection Policy.

This section is under review.

We are committed to protecting the data of beneficiaries of our relief services. A detailed privacy statement for beneficiaries will be published soon.

In principle:

• We collect beneficiary data (e.g., name, contact information, needs) to provide humanitarian assistance.
• Lawful basis: Performance of a task in the public interest (Art. 6(1)(e)) or protection of your vital interests (Art. 6(1)(d)).
• We share data with field relief partners only to deliver assistance.

Like most websites, we use cookies. Cookies are small text files stored on your device when you visit certain websites. Internet browsers typically accept cookies by default.

We use cookies to provide you with a smooth and efficient experience while using our services. For example: to enable the donation process; to statistically analyze website usage; to personalize our website content, design, and services.

On your first visit to our website, a cookie consent banner will appear allowing you to choose which types of cookies you consent to.

Types of cookies we use:

• Session Cookies — Track your online donations in the shopping cart. We do not store credit card details in the cookies we create. Legitimate interest (necessary for website functionality).
• Google Analytics — Collect anonymous information about how you use our website to improve your experience and identify and resolve errors. Explicit consent.
• YouTube — Collect anonymous information about how you use videos on our website. Explicit consent.
• Advertising Cookies — Sometimes used when we advertise on external sites to see which ads you interact with. Explicit consent.
• AddThis — Social sharing tool owned and operated by Clearspring Technologies. Explicit consent.

Controlling Cookies: You can set your internet browser to refuse cookies (this may affect your ability to use our website). You can withdraw your consent to non-essential cookies at any time by clicking the “Cookie Settings” link at the bottom of the website. You can opt out using the Network Advertising Initiative.

Note: Essential cookies must be enabled to make donations to us via our website.

We are committed to not selling your personal data to any third party. We may share your data only in the following cases, ensuring appropriate Data Processing Agreements (DPAs) are in place with all processors:

• Wise (Wise Payments Ltd / Wise Europe SA) — Processing donations and international money transfers. United Kingdom and/or Belgium (EU). Safeguards: Adequacy Decision for the UK or processing within the EU, FCA and NBB regulated, SSL/TLS encryption, PCI DSS compliant, DPA.
• Stripe — Processing card payments. United States / EU. Safeguards: SCCs, PCI DSS compliant, DPA.
• PayPal — Processing electronic payments. United States / EU. Safeguards: SCCs, PCI DSS compliant, DPA.
• Email Service Providers — Sending receipts, updates, and marketing messages. EU / United States. Safeguards: SCCs, DPA.
• Cloud Hosting and Storage Providers — Website hosting and data storage. Within the EU. Safeguards: DPA, encryption.
• Analytics Providers (Google Analytics) — Analyzing website usage. United States. Safeguards: SCCs, IP anonymization, DPA.
• Government and Regulatory Bodies — Compliance with legal obligations. Estonia / EU. Under binding law or court order.
• Field Relief Partners — Coordinating and delivering aid. May be outside the EU. Strict confidentiality agreements, SCCs or specific derogations.
• Screening and Due Diligence Services — Background checks for volunteers or large donations. EU / UK. Safeguards: DPA, compliance with AML laws.
• Estonian Tax and Customs Board — Compliance with tax obligations. Estonia. Under Estonian law.
• Law Enforcement Agencies — Compliance with legal instructions. Estonia / EU. Under valid legal instruction.
• Marketing Companies (e.g., mailing house) — Preparing and sending postal marketing materials. EU. DPA.
• Data Cleaning Companies — Ensuring data accuracy and currency. EU. DPA.

In all cases above, we ensure there is a written contract (or valid legal instruction) with the organization that includes data protection clauses to ensure: personal data is not used for their own marketing purposes; and security requirements are in place to protect your personal data.

Your personal data may be transferred to countries outside the European Economic Area (EEA) in the following cases:

8.1 Payment Processing via Wise

When you donate to us via Wise, your payment data may be processed by: Wise Europe SA, based in Brussels, Belgium (within the EU), or Wise Payments Ltd, based in London, United Kingdom (outside the EU).

Safeguards: Adequacy Decision (the European Commission adopted an adequacy decision for the UK on June 28, 2021); Regulatory Authorization (Wise is regulated by the UK FCA and the National Bank of Belgium); Data Processing Agreement (a signed DPA with Wise ensuring your data is processed in accordance with our instructions and in compliance with the GDPR).

8.2 Payment Processing via Other Gateways (Stripe, PayPal)

Your data may be processed by other payment service providers whose servers may be in the United States or other countries outside the EU.

Safeguards: Standard Contractual Clauses (SCCs) approved by the European Commission; and PCI DSS compliance.

8.3 Field Partners

If you are a volunteer or beneficiary in an area outside the EU, we may share your data with our local partners in those areas.

Safeguards: Standard Contractual Clauses (SCCs) where possible; and specific derogations in urgent humanitarian situations, such as protecting your vital interests (Art. 49(1)(f)) or performing a task in the public interest (Art. 49(1)(g)).

8.4 Summary of Safeguards

Adequacy Decision (e.g., United Kingdom - Wise Payments Ltd), Standard Contractual Clauses (e.g., United States - Stripe, PayPal, Google), Processing within the EU (e.g., Belgium - Wise Europe SA), Specific Derogations (e.g., field partners in conflict zones).

Obtaining a copy of the safeguards: You can request a copy of the specific safeguards we rely on to transfer your data outside the EEA by contacting us: Email: [email protected]

We maintain personal data in accordance with our Data Retention Policy. The retention period for each category of personal data depends on the reason for its collection and our legal and contractual requirements.

• Donation data and financial records — 7 years — Compliance with Estonian and EU tax laws (e.g., Estonian Accounting Act).
• Account data — While account is active + 3 years after last activity — To manage our relationship with you.
• Usage data (analytics) — 14 months (maximum) — To analyze and improve our service.
• Security and anti-fraud records — 6 months — For anti-fraud purposes.
• Rights requests and legal correspondence — 5 years — To demonstrate compliance.
• Employee and volunteer data — While active + 7 years after end of relationship — To comply with tax and employment laws.

After the retention period expires: data is securely deleted (Secure Deletion), or anonymized so that it can no longer be linked to you.

For more information: For more information about our Data Retention Policy, including how long we retain your personal data, please contact our Data Protection Officer: Email: [email protected]  |  Phone: +32472843416

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR.

• SSL/TLS Encryption — All data is encrypted during transmission between your browser and our servers.
• Encryption at Rest — Databases and backups are encrypted.
• PCI DSS — Compliant with Payment Card Industry Data Security Standards.
• Tokenization — We do not store full card data on our servers.
• Access Control — Limited access to authorized personnel only, on a “need to know” basis.
• Regular Security Audits — Regular security reviews and system updates.
• Staff Training — Mandatory data protection and privacy training for all staff and volunteers.

Data Breach Notification: In the event of a data breach that poses a risk to your rights and freedoms: we will notify the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) within 72 hours; and we will notify you directly without undue delay if the breach poses a high risk to you.

Our website and services are designed for individuals aged 18 years or older. We do not knowingly collect personal data from children under the age of 18.

If we become aware that we have collected personal data from a child under the age of 18 without parental or legal guardian consent, we will delete that data immediately.

If you believe your child has provided us with personal data, please contact us immediately: Email: [email protected]  |  Phone: +32472843416

We keep our Privacy Statement under regular review and will place any updates on this web page.

In the event of material changes: we will notify you via email (if we have your email address), and/or we will place a prominent notice on our website.

We encourage you to review this page periodically to stay informed about our latest privacy practices.

Last Updated: September 3, 2026

If you are unhappy with how we have handled your personal data or have a privacy concern, we want to know about it.

To make a complaint or raise a concern, please contact our Data Protection Officer:

• Email: [email protected]
• Phone: +32472843416
• Post: Sahem International Relief and Development Organization MTÜ, Juhkentali 8, Tallinn, 10132, Estonia

If you have any questions about this Privacy Statement or the information we hold about you, please contact us:

• General Email: [email protected]
• Data Protection Officer (DPO): [email protected]
• Phone: +32472843416
• WhatsApp: +32472843416
• Address: Sahem International Relief and Development Organization MTÜ, Juhkentali 8, Tallinn, 10132, Estonia
• International Transfers Inquiries: [email protected]