Privacy Policy

1. Who we are (data controller)

The data controller is VARADERO AND FRIENDS FAMAGUSTA CYPRUS, a registered non-governmental association / non-profit club (somateio) registered under Ministry of Interior Registration Number MOI ΑΜΜ4191, with its registered office at Vasilissis Amalias 17, Nicosia 1101, Cyprus. You may contact us by telephone on +357 22 776 246 or by email at info@varaderofriends.org for any question relating to this policy or to your personal data.

2. What personal data we collect

• Contact inquiries: your name, email address, inquiry category, subject, and the content of your message.
• Volunteer and membership records: name, contact details, district, stated availability, relevant experience or qualifications, emergency contact, and — for participants under 18 — the name and consent of a parent or guardian.
• Event and programme records: attendance lists for seminars and training sessions, and incident records where a safety matter must be documented.
• Beneficiary information: the minimum details required to deliver relief assistance, normally received through partner municipal or welfare services.
• Photography: images of public events, published only where the individuals concerned have given consent.

We do not operate advertising trackers or sell data. We do not knowingly collect data from children without parental consent.

3. Why we process your data and our legal basis

• Consent (Art. 6(1)(a)): answering your inquiry, adding you to a volunteer list, publishing event photography.
• Legitimate interests (Art. 6(1)(f)): organising and documenting our non-profit programmes, safeguarding participants, and maintaining our records of activity.
• Legal obligation (Art. 6(1)(c)): keeping the members' register, accounting records, and statutory filings required of a registered association in Cyprus.

4. How long we keep data

Contact inquiries are retained for up to 24 months after the matter is closed. Volunteer and membership records are retained for the duration of involvement plus five years. Accounting and statutory records are retained for the period required by Cyprus law. Beneficiary details are retained only for the duration of the relief cycle and are then securely destroyed unless a legal obligation requires otherwise.

5. Who has access to your data

Access is restricted to the volunteer officers who need it to perform their role — typically the Secretary, the Treasurer, and the programme coordinator concerned. We do not sell, rent, or trade personal data. Data may be shared with: our email and hosting service providers acting as processors under contract; medical services in relation to blood donation campaigns (where you supply your data directly to them); and public authorities where disclosure is required by law. Where a processor operates outside the European Economic Area, transfers are covered by an adequacy decision or Standard Contractual Clauses.

6. Security measures

We apply access controls and strong authentication on association accounts, keep paper records in locked storage at the registered office, limit data collection to what is necessary, and review access rights whenever officers change. Personal data is never posted in public groups or shared through unofficial channels.

7. Your rights under the GDPR

• Access to the personal data we hold about you, and a copy of it.
• Rectification of inaccurate or incomplete data.
• Erasure of your data where no legal obligation requires its retention.
• Restriction of processing and the right to object to processing.
• Data portability where processing is based on consent or contract.
• Withdrawal of consent at any time, without affecting past lawful processing.

To exercise any of these rights, email info@varaderofriends.org or write to our registered office. We respond within one month. If you believe your rights have been infringed, you may lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.

8. Cookies and website analytics

This website is informational. It sets no advertising or profiling cookies. Any strictly necessary technical storage is limited to what is required to serve the pages and load web fonts. If we introduce analytics in future, this policy will be updated and, where legally required, consent will be requested before any non-essential cookie is set.

9. Changes to this policy

We review this policy periodically and will publish any revision on this page with an updated date. Material changes affecting volunteers or members are also communicated by email.