Privacy Policy – Impaktera

1. Controller

The controller responsible for the processing of personal data within the meaning of the Swiss Federal Act on Data Protection (revDSG) and the EU General Data Protection Regulation (GDPR) is:

Impaktera
Non-profit association pursuant to Art. 60 et seq. Swiss Civil Code
Registered seat: Wettingen, Switzerland
Email: impaktera@gmail.com

Impaktera does not have an appointed representative in the European Union pursuant to Article 27 GDPR, as its data processing activities relating to EU residents are occasional, limited in scope, and do not involve large-scale processing of sensitive data.

2. Scope of This Privacy Policy

This Privacy Policy explains how Impaktera processes personal data:

• when you visit our website
• when you contact us
• when you make a donation to Impaktera (including via the Dopaya platform)

It applies to individuals located in Switzerland and the European Union.

3. Legal Basis for Processing

Personal data is processed on the following legal bases:

• Art. 6(1)(b) GDPR – performance of a contract
  (e.g. processing donations, confirmations, refunds)
• Art. 6(1)(c) GDPR – compliance with legal obligations
  (e.g. accounting, record-keeping)
• Art. 6(1)(f) GDPR – legitimate interests
  (e.g. donor communication, fraud prevention, security)
• Art. 31 revDSG – lawful processing under Swiss data protection law

Where required by law, processing is based on your consent.

4. Categories of Personal Data Processed

Depending on the context, Impaktera processes the following personal data:

4.1 Donation-Related Data

• Name
• Email address
• Donation amount
• Donation date
• Transaction reference number

4.2 Communication Data

• Content of inquiries sent via email or contact forms

4.3 Technical Data

• IP address
• Date and time of access
• Browser and device information

Technical data is processed solely to ensure website security, functionality, and abuse prevention.

5. Purpose of Processing

Personal data is processed for the following purposes:

• processing and administering donations
• issuing donation confirmations and receipts where legally required
• handling withdrawals, refunds, and complaints
• complying with legal and regulatory obligations
• communicating with donors and interested parties
• ensuring website security and preventing misuse

6. Donation Processing via Dopaya

Donations to Impaktera may be made via the Dopaya platform.

6.1 Roles

• Impaktera acts as the recipient of the donation
• Dopaya acts as a technical platform provider

6.2 Data Sharing with Dopaya

For the purpose of donation processing, the following data may be shared with Dopaya:

• donor name
• donation amount
• transaction status
• confirmation reference

Data is shared with Dopaya solely to the extent necessary to facilitate the donation process and provide transaction confirmation.

Dopaya processes personal data under its own Privacy Policy and acts as an independent controller for platform-related processing.

7. Payment Service Providers

Payment processing may be carried out by the following providers, depending on the payment method selected:

7.1 Online Payment Providers

For online card payments, payment processing is carried out by regulated payment service providers integrated into the donation flow:

• Stripe Payments Europe Ltd. – an authorized payment institution under Directive (EU) 2015/2366 (PSD2)
• Raisenow – a payment service provider specializing in donation processing for non-profit organizations

Each payment service provider processes payment data (such as payment method details) independently as a controller.

Impaktera does not receive or store full payment details such as credit card numbers.

7.2 Bank Transfers

Bank transfers are processed directly through Aargauische Kantonalbank. Impaktera receives only the transaction information necessary for accounting purposes (donor name, amount, date, reference).

Bank account details:
Bank: Aargauische Kantonalbank
IBAN: CH9800761649583092001
SWIFT/BIC: KBAGCH22

8. Data Sharing with Third Parties

Personal data may be shared with the following recipients, strictly for the purposes described in this Privacy Policy:

• payment service providers (transaction processing), including Stripe Payments Europe Ltd. and Raisenow
• banks (for bank transfer processing), including Aargauische Kantonalbank
• Dopaya (donation routing and confirmation)
• designated social enterprises
  (name and donation amount only, where a specific initiative is selected)

Personal data is not sold and is not shared for commercial purposes.

9. International Data Transfers

Personal data may be processed in Switzerland and, where required, in the European Union.

If personal data is transferred to countries outside Switzerland or the EU, appropriate safeguards pursuant to Article 46 GDPR are applied, such as adequacy decisions or standard contractual clauses.

10. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes set out in this Privacy Policy.

• Donation and accounting records are retained for 10 years, in accordance with Swiss legal record-keeping obligations.
• Communication data is deleted once no longer required, unless statutory retention obligations apply.

11. Data Subject Rights

If you are located in Switzerland or the European Union, you have the following rights under applicable data protection law:

• right of access
• right to rectification
• right to erasure
• right to restriction of processing
• right to data portability
• right to object to processing
• right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

Requests may be submitted to:
impaktera@gmail.com

You also have the right to lodge a complaint with a competent supervisory authority, in particular:

• the Federal Data Protection and Information Commissioner (FDPIC), Switzerland, or
• the data protection authority in your EU Member State of residence.

12. Cookies and Tracking

Impaktera's website does not use tracking cookies or profiling technologies unless explicitly stated.

If analytics or tracking tools are introduced in the future, this Privacy Policy will be updated accordingly.

13. Security Measures

Impaktera implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or misuse.

14. Changes to This Privacy Policy

This Privacy Policy may be updated where legally required or to reflect changes in data processing activities.

The version applicable at the time of data collection applies.

15. Contact

For any questions regarding data protection, please contact:

Email: impaktera@gmail.com