Boryviter Centre of Excellence processes personal data in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) for visitors located in the European Economic Area, and with applicable Ukrainian data-protection legislation. This policy describes how that compliance works in practice.
Data Controller
Boryviter Center of Excellence, NGO
Legal address: 03151, Kyiv, vul. Ushynskoho, 40, office 302/1
Email: privacy@boryviter.center
What Data We Collect
We collect personal data only when you voluntarily provide it:
- contact forms and emails: name, email address, message content;
- event registration: name, email, professional affiliation;
- identity verification via Diia: full name and a pseudonymised identifier derived from the RNOKPP (see “Identity Verification via Diia”);
- newsletter subscription: email address.
Our servers automatically log technical data (IP address, browser type, pages visited) for security purposes.
Identity Verification via Diia
To confirm the identity of people who register for our events or access our restricted online services for registered participants, we may use the Ukrainian state electronic identification service Diia, specifically the qualified electronic signature Diia.Signature (Дія.Підпис).
Verification happens only at your own initiative, in the Diia app on your phone. When you sign, we receive from Diia the data contained in your qualified signature certificate: your full name and your taxpayer registration number (RNOKPP). The data is transferred in encrypted form.
We use this data solely to confirm your identity, to link your registration or access to a verified person, and to keep a record of who accessed what in the event of a security incident. We do not store your RNOKPP. We keep only a pseudonymised identifier, an irreversible keyed hash that cannot be turned back into the number and serves only to recognise the same person on repeat registrations or logins. The signed confirmation itself is retained for a limited period as evidence of the verification.
Diia processes your data under its own terms. Using Diia is a choice; where an alternative registration path is offered, you may use it instead.
Advertising Attribution (Google Ad Grants)
When you reach our website by clicking a Google Ad Grants advertisement and submit a discovery-phase form, we record campaign-attribution context alongside your submission: standard UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the Google Click Identifier (gclid), the referring hostname, and the landing-page path. We also retain a coarse approximation of your IP address (the /24 subnet, not the full address) for abuse prevention. This information is used solely to evaluate which campaigns reach the intended professional audience.
Discovery-phase form submissions are retained for 12 months from submission, after which they are deleted automatically by our database’s time-to-live policy. We will not initiate outbound contact based on a discovery-phase submission. Legal basis: legitimate interest in measuring publicly-funded advertising performance (Article 6(1)(f) GDPR).
Cookies and Analytics
We use cookies only with your consent. If you accept cookies, we use Google Analytics to understand how visitors use our website. You can change your cookie preferences at any time using the "Cookies" link in the footer.
How We Use Your Data
We use your data to:
- respond to your inquiries;
- process event registrations;
- send updates you have subscribed to;
- ensure website security and functionality.
Legal Basis
We process your data based on:
- your consent — for cookies and newsletter;
- contractual necessity — for event registration;
- contractual necessity and legitimate interest in security — for identity verification via Diia;
- legitimate interest — for website security.
Data Retention
We retain your personal data only as long as necessary for the purposes described above, or as required by law. Contact and event data is typically retained for up to 3 years after your last interaction with us.
Third Parties
We do not sell your data. We may share data with trusted service providers who help us operate (e.g., email services, analytics). For analytics, we use Google Analytics; data is processed according to Google's Privacy Policy.
Your Rights
Under applicable data protection laws, you have the right to access your personal data, correct inaccuracies, request deletion, withdraw consent at any time, and lodge a complaint with a supervisory authority.
To exercise your rights, contact us at privacy@boryviter.center.
Changes to This Policy
We may update this policy periodically. The date at the top indicates the latest revision.