This Privacy Policy explains how personal data are processed when you use the EECA Regional Learning Hub website at eecaplatform.org (the “Website”). It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and the Law of the Republic of Lithuania on the Legal Protection of Personal Data.
1. Data controller
Eurazijos žalos mažinimo asociacija (Eurasian Harm Reduction Association, “EHRA”, “we”, “us”)
Association registered in the Republic of Lithuania
Gedimino pr. 45-4, LT-01110 Vilnius, Lithuania
General email: info@harmreductioneurasia.org
Privacy and data-subject requests: eecaplatform@harmreductioneurasia.org
Having assessed Article 37 GDPR, EHRA is not required to appoint a Data Protection Officer: the Website does not carry out large-scale regular and systematic monitoring or large-scale processing of special categories of data. Privacy matters are handled by the Executive Director, Ganna Dovbakh, reachable at the privacy address above.
2. Scope
This Policy applies to visitors of the Website, newsletter subscribers, people who submit forms (including technical-assistance requests) and people who interact with embedded media. It does not cover third-party websites linked from our pages or EHRA programmes governed by their own notices.
3. What we process, why, and on what legal basis
| Purpose | Personal data | Legal basis (GDPR Art. 6(1)) | Retention |
|---|---|---|---|
| Operating and securing the Website (hosting, server and security logs, error logs) | IP address, date and time, requested URL, browser and device type, referrer | (f) legitimate interest: keeping the Website available, secure and free from abuse | Access logs up to 30 days; security incident records for as long as the incident is handled |
| Remembering your language (English / Russian) | Language code in the pll_language cookie | (f) legitimate interest: showing the Website in the language you chose; strictly necessary under ERĮ Art. 73(4) | 12 months |
| Recording your cookie choices | kncc_consent cookie (choices, date); server log with hashed IP and browser signature, choice, categories, date | (c) legal obligation to demonstrate consent (Art. 7(1) GDPR) | Cookie 12 months; log 13 months |
| Measuring Website use with Google Analytics 4 | Pseudonymous client ID, pages viewed, events, approximate country/city, device and browser data. Raw IP addresses are used transiently to derive coarse location and, outside the EEA, Switzerland and UK, for basic service functions such as spam detection; they are then discarded and are not logged or stored in Google Analytics | (a) consent, given through the cookie banner (“Statistics”). No analytics script runs until you accept | Event data 14 months; aggregated reports may be kept longer |
| Sending the newsletter | Email address, optional name and organisation, subscription date, opens and clicks recorded by Mailchimp | (a) consent (ERĮ Art. 81(1) for electronic direct marketing) | Until you unsubscribe; your address then stays on the suppression list so we do not email you again |
| Answering technical-assistance requests submitted through Google Forms | Name, organisation, country, contact details, the content of your request | (b) steps taken at your request before entering into a technical-assistance arrangement | 2 years after the request is closed |
| Answering other enquiries (email, forms) | Contact details and the content of your message | (f) legitimate interest: responding to people who contact us | 2 years after the enquiry is closed |
| Showing embedded YouTube videos and Google Forms | Data collected by Google when the embedded content loads (IP address, cookies, viewing data) | (a) consent, given through the cookie banner (“Embedded content”) or the “Allow embedded content” button | Determined by Google — see our Cookie Policy |
| Complying with legal obligations (accounting, responding to authorities, handling your requests) | Data relevant to the obligation | (c) legal obligation | As required by the applicable law |
Providing your data is voluntary. Without an email address we cannot send you the newsletter; without contact details we cannot answer your request. We do not carry out automated decision-making or profiling within the meaning of Article 22 GDPR.
We do not intentionally collect special categories of personal data (such as health data) through the Website. Please do not enter such data in public forms unless a specific EHRA programme asks for them through a dedicated, documented procedure.
4. Where your data come from
Most data come directly from you. We may also receive work contact details of staff of partner organisations from EHRA members or project partners in order to invite them to technical-assistance activities; in that case we tell you the source when we first contact you (Article 14 GDPR).
5. Cookies and similar technologies
Under Article 73(4) of the Law of the Republic of Lithuania on Electronic Communications and Article 5(3) of Directive 2002/58/EC, non-essential cookies are stored only after you have given consent. Our banner offers Accept all, Reject all and Cookie Settings with equal prominence; nothing except strictly necessary cookies is set until you choose. Your choice is stored for 12 months, after which we ask again. You can change or withdraw consent at any time via the “Cookie Settings” link in the footer. Our Cookie Policy contains the current documented cookie names, purposes and typical maximum lifetimes.
6. Recipients
We share personal data only with the service providers below, which process them on our instructions under data-processing agreements, and with public authorities where the law requires.
- Hostinger International Ltd (Larnaca, Cyprus) and HOSTINGER, UAB (Vilnius, Lithuania) — web hosting; servers located in the European Union; processes server logs.
- Google Ireland Ltd (Dublin, Ireland) — Google Analytics 4 (processor under the Google Ads Data Processing Terms), Google Forms (responses are stored in EHRA’s own Google Workspace account) and YouTube embeds. Google LLC (USA) may receive data as described in section 7. Google’s privacy policy: policies.google.com/privacy.
- The Rocket Science Group LLC d/b/a Mailchimp, an Intuit company (Atlanta, USA) — newsletter subscription and delivery.
- IT and security providers engaged by EHRA to maintain the Website.
7. Transfers outside the EEA
Google LLC and Intuit Inc. (Mailchimp) are established in the United States. Transfers to them rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, under which both companies are certified, and additionally on the Standard Contractual Clauses (Commission Decision 2021/914) included in their data-processing terms. You can obtain a copy of these safeguards by writing to eecaplatform@harmreductioneurasia.org.
8. Your rights
Under Articles 15–22 GDPR you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data (“right to be forgotten”) where there is no longer a legal ground to keep them;
- restrict processing in the cases set out in Article 18;
- object at any time to processing based on our legitimate interests (Article 21); we will stop unless we demonstrate compelling legitimate grounds;
- data portability for data you provided to us that we process by automated means on the basis of consent or contract;
- withdraw consent at any time (newsletter link, “Cookie Settings”, or by email) without affecting the lawfulness of processing before withdrawal;
- not be subject to automated decision-making — we do not carry out any.
To exercise these rights, email eecaplatform@harmreductioneurasia.org. We reply within one month; this may be extended by two further months for complex requests, in which case we will tell you. We may ask you to confirm your identity before acting on a request.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EEA state where you live or work or where the alleged infringement occurred. The authority for EHRA is the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania; tel. +370 5 271 2804; email ada@ada.lt; vdai.lrv.lt.
9. Children
The Website is aimed at professionals and organisations in public health and harm reduction. It is not directed at children, and we do not knowingly process data of persons under 14 years of age (the age of digital consent in Lithuania under Article 6 of the Law on the Legal Protection of Personal Data). If you believe a child has provided us with personal data, contact us and we will delete them.
10. Security
We apply appropriate technical and organisational measures: HTTPS encryption of all traffic, access limited to staff who need it, regular software updates and backups, and contractual obligations on our processors. No transmission over the internet is completely secure; please avoid sending sensitive information by email or form unless we have asked for it.
11. Changes to this Policy
We may update this Policy when our practices or the law change. The version number and date at the top will be revised, and significant changes will be announced on the Website. Earlier versions are available on request.
Santrauka lietuvių kalba
Duomenų valdytojas — Eurazijos žalos mažinimo asociacija, Gedimino pr. 45-4, LT-01110 Vilnius, el. p. eecaplatform@harmreductioneurasia.org. Svetainė tvarko duomenis svetainės veikimui užtikrinti, naujienlaiškiui siųsti ir užklausoms atsakyti; statistikos ir įterpto turinio slapukai naudojami tik gavus Jūsų sutikimą (ERĮ 73 str. 4 d.). Turite teisę susipažinti su duomenimis, juos ištaisyti, ištrinti, apriboti tvarkymą, nesutikti, atšaukti sutikimą ir pateikti skundą Valstybinei duomenų apsaugos inspekcijai (L. Sapiegos g. 17, Vilnius, ada@ada.lt).
