Kwera is a non-profit organisation that finances higher education of students from low and middle income countries and develop their employability and entrepreneurship skills.

This privacy policy explains how Kwera processes your personal information when we receive donations from you, when you visit our website and collect your personal information through cookies and when we process your personal data as part of our general business administration.

Data controller

The entity responsible for the processing of your personal information is:

Kwera
c/o Plesner Advokatpartnerselskab
Amerika Plads 37
2100 Copenhagen
CVR: 40391622
info@kwera.com

Description of the processing

Donations and visits to our website

Donations:

Kwera is a non-profit organisation that finances higher education of students from developing countries and develop their personal and entrepreneurship skills.

Therefore, Kwera processes your personal data for the purpose of receiving and administering donations from you and for the purpose of sending you annual letters if you choose to receive such letters from us.

Cookies:

When you visit our website, we will also ask for your consent to use analytics cookies to be able to track your use of our website. These cookies collect information about you, so if you give us your consent to do so, we will process your information through the use of cookies.

We process the following categories of personal data about you:

Ordinary personal data:

• Name*, email address* and information about your payment*
• Information about your social media accounts if you choose to share your donation on social media
• Information about your use of and behaviour on our website, your consent, technical information about your visit (e.g. IP address, MAC address, location etc.) and your navigation around the site as well as data about your device.

We collect your personal data directly from you

• when you make donations to Kwera
• when you visit our website
  

We process your personal data on the following legal bases:

• Article 6.1.a (consent to process your personal data through the use of non-necessary cookies)
• Article 6.1.b (necessary for the performance of the contract between you and Kwera)
• Article 6.1.f (necessary for the pursuit of legitimate purposes and interests of Kwera)
  
  We process your personal data in order for us to pursue our legitimate interest in effectively receiving and administering donations and maintaining of relationship with our donors through ongoing communication such as annual letters as well as our interest in optimizing and developing our website.

We may share your personal data with:

• Suppliers and vendors that we work with (meaning e.g. service providers, technical support, supply services and financial institutions)
• Group entities
• Third parties as described in our cookie policy: Kwera uses analytics cookies to track the use of our website. For this type of processing we might in some cases be joint controllers together with the provider of the cookies. You can read more about our use of cookies and third parties in our cookie policy where you can also find a link to the third party's own privacy policy.

We will retain your personal data for 5 years from the time you make a donation to Kwera because of our obligation pursuant to the Danish Bookkeeping Act.

Personal data used for sending you annual letters will be retained for 2 years after our latest contact with you.

The retention periods with respect to cookies depend on each cookie being set. You can read more about our cookies and the retention periods here.

General business administration

Kwera processes your personal data for the purpose of general business operations, i.e. communication with vendors, business partners and other parties.

We process the following categories of personal data about you:

Ordinary personal data:

• Your contact information and other information that you may choose to provide

We collect your personal data directly from you.

We process your personal data on the following legal bases:

• Article 6.1.b (necessary for the performance of the contract between you and Kwera)
• Article 6.1.f (necessary for the pursuit of legitimate purposes and interests of Kwera).
  
  We process your personal data in order for us to pursue our legitimate interest in effective business operations and communication with various parties

We may share your personal data with:

• Suppliers and vendors that we work with (meaning service providers, technical support, supply services and financial institutions)
• Group entities

We will retain your personal data for as long as it is necessary for us to pursue our purpose with the processing of your data.

Generally, we will to delete your personal data 2 years after our latest contact. However, we may store it for a longer period if required for the purpose for which your data is processed, i.e. depending on the circumstances and in which way we have been in contact with you.

Mandatory information

The information marked with * is mandatory to collect from you in order for us to receive and administer your donation, e.g. to send you a confirmation email when you have made a donation on our website.

The consequence of not providing the information is that you will not be able to make donations to Kwera.

Transfers to countries outside the EU/EEA

In some cases, Kwera will be transferring personal data to countries outside the EU/EEA.
Personal data will be transferred to the United States when using mail-chimp as a data processor to send you confirmation emails when you have made a donation and to send you annual letters if you choose to receive these letters. Such transfers will take place on the legal basis that we will provide appropriate safeguards for the transfer through the use of "Model Contracts for the Transfer of Personal Data to Third Countries" as published by the Commission of the European Union or any other contractual agreement approved by the competent authorities.

Personal data might also be transferred to countries outside the EU/EEA when Kwera uses Microsoft services to communicate with you, as Microsoft uses sub-processors located in such countries. In some cases, the country will be deemed by the Commission of the European Union to have an adequate level of protection of personal data, and if not, we will provide appropriate safeguards for the transfer through the use of "Model Contracts for the Transfer of Personal Data to Third Countries" as published by the Commission of the European Union.

You may obtain a copy of the contract/agreement by contacting us, see our contact information in section 1.

Your rights

You have the following rights:

• You have the right to request access to, rectification or erasure of your personal data.
• You also have the right to have the processing of your personal data restricted.
• If processing of your personal information is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent. You may withdraw your consent by contacting us through email or phone, please see section 1 above.
• You have the right to receive your personal information in a structured, commonly used and machine-readable format (data portability).
• You may always lodge a complaint with a data protection supervisory authority, e.g. The Danish Data Protection Agency.

Furthermore, you have the right to object to processing of your personal data as follows.

• If processing of your personal data is based on article 6(1)(e) or article 6(1)(f), see above regarding legal basis, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data.
• Where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data about you for such marketing.

You can take steps to exercise your rights by contacting us by email or by phone, please see contact information in section 1 above.

There may be conditions or limitations on these rights. It is therefore not certain for example you have the right of data portability in the specific case - this depends on the specific circumstances of the processing activity.

Last updated: 17 December 2020