Privacy Policy

The data controller for your personal data is the Public Benefit foundation under the name “KIND THINGS STICHTING”, with registered seat in The Hague, the Netherlands, at Johan De Wittlaan 7 – 2517JR.

The KIND THINGS Public Benefit Foundation collects personal data in the following cases:

i. When you send a message via social media accounts or an email to [email protected] or [email protected] and provide data such as, indicatively: full name, email and/or postal address, and contact telephone number.

ii. When you submit a funding application on behalf of a legal person: in order to submit a request, the representative of the organisation must create an account by entering their full name, email address and mobile telephone number in the specially designed form on the Website and then enter data such as, indicatively, the full name of the organisation’s representative, professional capacity, postal and/or email address, and contact telephone number. It is noted that the funding application includes open text fields only where necessary, in order to ensure that only the strictly necessary data are collected in relation to the purpose of their processing.

iii. When you submit an application for financial assistance to a natural person: in order to submit a request, the interested natural person must create an account by entering their full name, email address and mobile telephone number. Upon registration, you will be directed to the electronic financial assistance application form, where you complete your personal data, such as date of birth, residential address, identity card number, tax identification number, father’s name, mother’s name, evidence of family, income and asset status, certificates of registration in public authority registers, as well as any additional data you voluntarily enter in the free-text fields of the platform in support of your request.

iv. When you submit to us supporting documents in support of a funding request by a legal person or a financial assistance request filed by a natural person.

v. During your browsing in the Website, where we collect data through cookies for the purpose of improving the user experience and collecting information regarding traffic and the type of pages you browse. For more information about the cookies used by the Website, please read the Terms of Use.

vi. When you visit the Website, the server records in a special file (log file) the IP address, which constitutes personal data even if we are not able to identify you on that basis. Log files help us record information about the type of browser you use and other information, such as the date and time of your visit to the Website. The above data are stored for seven (7) days in order to ensure network and information security against accidental events or unlawful or malicious actions that may jeopardise the availability, authenticity, integrity and confidentiality of the stored data and the operation of the Website. During the seven (7) day period, only the authorised server administrator has access to the files, which are then automatically deleted.

The KIND THINGS Public Benefit Foundation collects only the strictly necessary personal data, in accordance with the purpose for which they are intended, and such data are not subject to any further processing in a manner incompatible with the purpose for which they were collected. The KIND THINGS Public Benefit Foundation does not transfer or send in any way personal data of data subjects to third parties, except for the specific cases exhaustively referred to below (in the next section), and always in accordance with the purpose for which they were collected.

The legal bases for the processing of the personal data we receive are:

the consent of the data subject,

the need to take steps at your request prior to entering into a contract,

the performance of a contract,

the explicit consent of the data subject for the processing of special categories of personal data,

the pursuit of the legitimate activities of the Foundation,

compliance by the data controller with obligations under applicable law, and

the legitimate interest of the data controller in establishing, exercising or defending legal claims.

Recipients of your personal data are the officers and/or authorised external associates of KIND THINGS Public Benefit Foundation and/or independent consultants/experts of recognised standing, who process your personal data solely for the fulfilment of their obligations towards KIND THINGS Public Benefit Foundation, while all the above natural or legal persons are bound by a Confidentiality and Personal Data Protection Statement towards KIND THINGS Public Benefit Foundation for the personal data they receive and/or process in any manner, always in accordance with the purpose for which they were collected. The data collected are under no circumstances disclosed to third parties, made public or exploited in any way.

By way of exception, KIND THINGS Public Benefit Foundation may disclose to third parties the personal data processed in a manner compatible with the processing purposes of this Policy in the following cases:

i. Where it has obtained explicit consent for the disclosure in any manner of the personal data of data subjects.

ii. Where they are disclosed to third-party providers acting in the capacity of Processor solely within the framework of their legal relationship with KIND THINGS Public Benefit Foundation, providing guarantees that they maintain appropriate security measures in accordance with applicable law. Third-party providers may be natural or legal persons providing consultancy services or services for the development and maintenance of systems and applications used by KIND THINGS Public Benefit Foundation.

iii. In the context of compliance with a law or an order of a public, regulatory or supervisory authority.

iv. For safeguarding the interests and establishing, exercising or defending legal claims the rights of KIND THINGS Public Benefit Foundation.

Your data are stored in systems used by KIND THINGS Public Benefit Foundation, hosted on servers located in a data centre within the European Union. Such servers are managed by the relevant provider in accordance with appropriate methods and internationally recognised practices, ensuring that access to information is granted only to duly authorised personnel who are subject to express confidentiality and personal data protection obligations.

As a general principle, KIND THINGS Public Benefit Foundation retains personal data in identifiable form only for as long as is necessary for the purposes for which they are processed and for the fulfilment of any applicable tax, statutory, regulatory or contractual obligations. Defined retention periods apply to each category of data. For example, data relating to financial payments and, in general, other assistance with monetary value may be retained for a longer period for the purpose of protecting the legitimate interests and legal claims of KIND THINGS Public Benefit Foundation. In other cases, personal data may be retained in anonymous or anonymised form, so that data subjects can no longer be identified, for statistical and research purposes.

The rules for determining the retention period derive from compliance with applicable data protection legislation, internationally recognised best practices and the Personal Data Retention Policy applied by KIND THINGS Public Benefit Foundation for the minimisation and deletion of personal data.

KIND THINGS Public Benefit Foundation has implemented appropriate technical and organisational measures, including technical content protection mechanisms, in order to ensure, to the extent possible, a secure environment in accordance with applicable statutory provisions. In this context, it regularly reviews its security systems and restricts access to the personal data to authorised personnel who need access to such data and who are expressly bound to keep such data strictly confidential through relevant confidentiality and personal data protection undertakings.

In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter the “GDPR”), and Law 4624/2019, you may exercise the following rights regarding the processing of your personal data by KIND THINGS Public Benefit Foundation:

a) Right of access: you may be informed by KIND THINGS Public Benefit Foundation whether your data are being processed. If processing is taking place, you may request information regarding the purpose of the processing, the type of data, the recipients, the retention period, as well as your other rights, such as rectification, erasure and lodging a complaint with the Hellenic Data Protection Authority.

b) Right to rectification and erasure: you may request the correction or completion of any inaccurate data concerning you and/or their erasure, which shall be carried out subject to conditions, in accordance with the Regulation and applicable Greek law.

c) Right to restriction of processing: you may request the restriction of the processing of your data if you consider that your data are inaccurate, that the processing is unlawful, that they are no longer necessary, or that you have objected to automated processing, if any.

d) Right to data portability: you may request the data you have provided in a structured, commonly used and machine-readable format, where technically feasible, in accordance with the provisions of the Regulation and applicable Greek law.

e) Right to object: in certain cases, you have the right to object to the processing of your personal data, and the data controller shall cease processing unless there are overriding legitimate grounds for the processing. You also have the right to object where a decision concerning you is based solely on automated processing, including profiling, and that decision produces legal effects or significantly affects you, subject to the exceptions provided by law.

f) Right to lodge a complaint: if you consider that the processing of your personal data violates personal data protection legislation, you have the right to lodge a complaint with the Hellenic Data Protection Authority.

It is clarified that the KIND THINGS Public Benefit Foundation has the right to refuse to satisfy your request for restriction of processing or erasure of your personal data or your objection to processing, if the processing or retention of the data is necessary for the establishment, exercise or defence of legal claims or for the fulfilment of its obligations.

Furthermore, exercising the right to data portability does not entail the erasure of your data from our records, which is subject to the terms of the immediately preceding paragraph and the conditions of the Regulation and Law 4624/2019.

To exercise the above rights or if you need assistance in exercising or understanding them, or if you have questions regarding the privacy policy, you may contact the Data Protection Officer. The KIND THINGS Public Benefit Foundation will make every possible effort to respond to your request within thirty (30) days from its submission. This deadline may be extended by an additional sixty (60) days, where deemed necessary at the sole discretion of the KIND THINGS Public Benefit Foundation, taking into account the complexity of the request and the number of other requests, following timely notification to you.

KIND THINGS Public Benefit Foundation has appointed a Data Protection Officer (DPO) to monitor compliance with the Privacy Policy, the individual Policies and Procedures for the processing of personal data, and, in general, the implementation of and compliance with applicable European and national legislation.

For any matter concerning the management of your personal data or if you wish to exercise the above rights, you may send a written request to the DPO at the email address [email protected] or at the postal address KIND THINGS STICHTING, 7 Johan De Wittlaan – 2517JR, The Hague, The Netherlands.

Supervisory Authority

The Greek supervisory authority for the application of the General Data Protection Regulation EU 2016/679 and Law 4624/2019 is the Hellenic Data Protection Authority. You may contact the above Authority for matters concerning the management of your personal data at: 1-3 Kifisias Ave., P.C. 11523 Athens, tel. 210-6475600, [email protected], www.dpa.gr.

Changes to the Privacy Policy

This Policy entered into force on 31.8.2026 and was posted on the Website. In order to protect your personal data more effectively, we systematically monitor our policies and procedures and seek, on the one hand, the continuous improvement of our policies and, on the other hand, the adoption of new internationally recognised best practices. Therefore, this Policy may be amended at any time and without prior notice, and for this reason we recommend that you review it regularly for any changes.