1. Who is responsible for your data?
The controller is Asociația Tutti Cancer Warriors (“TCW”), a Romanian nonprofit association, CIF 50156252, based in Bucharest, Romania. For privacy questions or to exercise your rights, email tcw@tutticancerwarriors.org.
2. Data we collect
- Website and security data: IP address, device/browser information, requested pages, date/time and security logs processed by our hosting provider.
- Contact and peer-support data: name, contact details, messages, preferences and information you choose to share for matching and support.
- Dream Support applications: identity and contact details, adult-eligibility confirmations, country, wish, cost information, cancer-diagnosis or treatment information, diagnosis-verification and identity/passport documents, optional photographs, consent choices, grant agreement information and proof that approved support was used as agreed.
- Donations: donor and transaction information supplied by payment providers, banks or by you. For cryptocurrency verification, a transaction hash and public blockchain data may be checked.
- Stories and publicity: text, name, photographs, video, audio and the permission choices you submit.
3. Why we use data and our legal bases
- To answer requests, take steps you ask us to take and administer a program or agreement.
- To assess Dream Support eligibility and need, make and record decisions, deliver approved support and verify its agreed use.
- To manage donations, accounting, fraud prevention, audits and legal obligations.
- For our legitimate interests in operating and securing the website, keeping appropriate records and improving charitable services, where those interests do not override your rights.
- With consent where required. Health data is special-category data and is processed on the basis of your explicit consent, unless another Article 9 GDPR condition clearly applies. Public use of your story, name, diagnosis summary or image uses a separate, optional choice and does not affect grant eligibility.
You may withdraw consent at any time for future processing. Withdrawal does not affect processing already carried out lawfully. If information is required to assess or administer a request, we may be unable to continue without it.
4. Dream Support applications and medical evidence
Dream Support applications are submitted through TCW’s website. Application answers and reviewer records are encrypted by TCW’s application and stored in private application storage. Uploaded diagnosis evidence, identity documents and optional photographs are kept in restricted cloud document storage managed for TCW. The encrypted application record contains only the private file identifier; no public file link is created. The submission alert contains only the application reference, language and submission time and does not contain the applicant’s name, answers, photographs or medical evidence. Please do not send medical records through ordinary email.
5. Who receives data?
Dream Support application access is limited to authorised TCW reviewers who need it for assessment and administration. We use hosting, identity-access, private application-storage and restricted cloud document-storage providers to operate the portal. Other parts of our operations may use Supabase, PayPal, Better Giving, banks, cryptocurrency infrastructure, communications providers, accountants, legal advisers and security providers. We may disclose information to public authorities when legally required. Service providers may process data only for the agreed service or under their own legal obligations.
6. International transfers
Some providers or recipients may be outside Romania or the European Economic Area. Where GDPR transfer rules apply, we use an adequacy decision, approved contractual safeguards or another lawful transfer mechanism, as appropriate. Public blockchain information is globally accessible by design.
7. How long we keep data
TCW Connect profiles are kept while participation is active. Unverified profiles are scheduled for deletion after 14 days and rejected mentor profiles after 90 days. Closing a profile or withdrawing consent stops matching immediately and schedules the encrypted profile and related proposal, contact and meeting records for deletion within 24 hours. Terminal proposals are kept for up to 90 days and ended connections for up to one year, unless they are deleted sooner with a participant profile. Resolved or dismissed safeguarding records may be kept for up to five years where necessary for participant safety, accountability or legal claims; open matters and legal holds may be kept as long as required.
Incomplete Dream Support drafts and their uploads are scheduled for deletion after 24 hours. Declined applications are scheduled for deletion after 365 days. Closed cases, including their supporting evidence, are retained for up to five years so TCW can meet administration, verification, audit and lawful recordkeeping needs, then securely deleted or anonymised where appropriate. Limited grant, payment, decision, consent and accounting records may need to be kept separately for periods required by tax, accounting, audit, limitation or other laws. Deletion may be paused where evidence is reasonably required for a dispute, safeguarding matter or legal obligation. Public stories remain within the permission given until removed or permission is withdrawn, subject to lawful archival or recordkeeping needs. Provider security logs follow the provider’s configured retention period.
8. Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. You may withdraw consent at any time and complain to the Romanian supervisory authority, ANSPDCP, or another competent authority where you live. To make a request, email tcw@tutticancerwarriors.org. We may need to verify your identity.
9. Security
Dream Support application answers and the stored document-service authorisation token are encrypted by the application using AES-256-GCM before private storage. Documents are transferred over encrypted connections into restricted cloud document storage. Reviewer access requires invited and approved accounts; no public file links are created. Private responses are marked not to be cached, file types and sizes are restricted, stored filenames are pseudonymous, and protected portal links open an authorised provider preview rather than serving document bytes publicly. Our providers also protect data in transit and at rest. No internet transmission or storage system is completely secure, so please share only the information requested and use the designated form.
10. Cookies, local storage and analytics
TCW currently does not run Google Analytics, advertising pixels or marketing trackers and does not set analytics or marketing cookies on this website. The public site uses a functional NEXT_LOCALE cookie for up to one year to remember the language you select. Netlify Identity uses strictly necessary authentication storage in the private reviewer area. The hosting provider still processes ordinary request and security logs. External services, including payment providers, social networks and any remaining external forms, may use their own cookies under their own notices. If TCW later adds non-essential analytics, advertising or embedded services, they will not be activated until the required information and consent controls are in place.
11. Children
Dream Support applicants must be at least 18. Our online services are not directed at children who cannot lawfully provide the required consent. If you believe a child’s data was submitted without proper authorisation, contact us so we can assess and act.
12. Changes and contact
We may update this Notice when our services or legal obligations change. The effective date above identifies the current version.
Asociația Tutti Cancer Warriors
Bucharest, Romania · CIF 50156252
Email: tcw@tutticancerwarriors.org
Website: https://tutticancerwarriors.org