1. Data controller
The data controller is Udruženje žena „Ustikolina“, Kralja Tvrtka 36, Tešanj 74260, Bosnia & Herzegovina, registration MPBK: RI12015. Enquiries about personal data may be sent to guerrero-jcp@gmx.com or by telephone to +387 61 063 848. Written requests may also be delivered to the registered office.
The Executive Director is responsible for data protection oversight and reports any incident to the Management Board without delay.
2. Legal framework
We process personal data in accordance with the Law on Protection of Personal Data of Bosnia & Herzegovina („Zakon o zaštiti ličnih podataka“) and, where we process data of individuals located in the European Union — for example diaspora donors and EU partner organisations — in accordance with Regulation (EU) 2016/679 (GDPR).
3. What data we collect
- Contact data: name, telephone number, email address, and postal address where correspondence is required.
- Membership data: membership category, date of joining, membership fee payments and attendance at assemblies.
- Programme data: courses attended, attendance records, skills assessed, and outcome follow-up (whether independent income was achieved).
- Volunteer data: skills, availability, references, and where the role involves contact with minors or vulnerable adults, the outcome of our safeguarding check.
- Donation data: donor name (unless anonymity is requested), amount, date, stated purpose and payment reference.
- Sensitive data, only where you provide it voluntarily and only for the purpose you provide it: health information disclosed in a health programme, and social circumstances disclosed during counselling or an assistance request.
- Website data: our website does not use advertising or profiling cookies. Server logs may record an abbreviated IP address and request time for security and availability purposes. Your language selection is stored in your browser only, and never transmitted to us.
4. Lawful bases for processing
- Consent — for newsletters, photography and any publication of your name, image or story. Consent is always specific, written where practicable, and may be withdrawn at any time without consequence for your participation.
- Contract and membership relationship — for administering membership, training enrolment and craft orders.
- Legal obligation — for accounting records, donation registers, statutory reporting and, in narrowly defined cases, mandatory reporting to protect a child.
- Legitimate interest — for programme evaluation, donor stewardship and the security of our premises and records.
- Explicit consent or vital interest — for any processing of health or social-circumstance data.
5. Photography, stories and testimonials
We never publish a photograph, name or personal story without separate written consent from the woman concerned. Consent forms state exactly where the material may appear and for how long, and can be withdrawn by a phone call. Where a woman has experienced violence, her identity is never used in any public material, even with consent, if disclosure could place her at risk.
6. Who we share data with
We do not sell, rent or trade personal data. We share the minimum necessary data only with: our bank and accounting service for financial records; donors and grant-makers in aggregated, anonymised form unless you have consented to be named; healthcare professionals or the centre for social work where you have asked us to refer you; and competent authorities where disclosure is required by law.
7. Retention periods
- Membership and contact records: for the duration of membership plus three years.
- Accounting and donation records: eleven years, as required by applicable accounting regulations.
- Programme participation and outcome records: five years after the last activity, then anonymised for statistical use.
- Counselling and assistance case notes: three years after case closure, then securely destroyed.
- Volunteer safeguarding records: for the duration of the role plus five years.
- Contact-form enquiries: twelve months, unless the enquiry becomes an ongoing relationship.
8. Security measures
- Paper records containing sensitive information are stored in a locked cabinet accessible only to the Executive Director and the relevant programme coordinator.
- Digital records are held on password-protected devices with encrypted storage and are backed up to an encrypted drive kept at the registered office.
- Access is granted strictly on a need-to-know basis and reviewed annually.
- All staff and volunteers sign a confidentiality undertaking before beginning work.
- Any suspected data breach is investigated immediately and, where required, reported to the competent supervisory authority and to affected individuals.
9. Your rights
We respond to any request concerning your rights within thirty days, free of charge. We may ask you to confirm your identity before disclosing personal data.
- To be informed about how your data is processed.
- To access a copy of the data we hold about you.
- To have inaccurate data corrected.
- To request erasure where there is no overriding legal obligation to retain it.
- To restrict or object to processing, including withdrawal of consent at any time.
- To data portability where processing is based on consent or contract.
- To lodge a complaint with the Personal Data Protection Agency of Bosnia & Herzegovina, or with your local supervisory authority if you are in the EU.
10. Children
Our heritage programme involves participants under eighteen. We collect only the data needed for attendance, safety and parental contact, and always with the written consent of a parent or guardian. No image of a minor is published without that consent.
11. Changes to this policy
Material changes are approved by the Management Board and published on this page with a revised date. Members are informed of substantive changes at the annual assembly.