Privacy Policy

Last updated: 25 October 2026

On this page

The short version

  • Who: ForBetterPurpose o.z., a Slovak civic association. Contact: privacy@forbetterpurpose.eu.
  • What: mainly your email address and your orders as the partner brands report them, so we can credit your voting points, email you your points and set up your voting account.
  • Promotional emails: only if you agree. One click to stop.
  • Who else: our hosting and email providers, the voting platform for each round and our bank. We never sell your data.
  • How long: points and orders for the current round plus 24 months; other data as the table in section 4 shows.
  • Your rights: see, correct, delete, restrict, take with you, object, withdraw consent, and complain to the Slovak data protection authority.

1. Who is responsible for your data

The controller is ForBetterPurpose o.z., a civic association registered in Slovakia (IČO 55397417). Our registered seat and full legal details are on our Imprint page (/imprint/).

For anything about your data, write to privacy@forbetterpurpose.eu. You can also write to info@forbetterpurpose.eu.

We have not appointed a data protection officer, because the law does not require one for an organization of our size and kind (GDPR Art. 37). The address above reaches the people who look after your data.

2. What this policy covers

This policy covers the Website, the voting points scheme and voting rounds, our emails, our contact and nomination forms, gifts to our charity account, the causes we work with, and our Facebook and Instagram pages.

It does not cover the partner brands' shops. When you shop, the brand is responsible for your customer account and your order under its own privacy policy. The same applies to our bank and to the voting platform where it acts on its own behalf.

3. Where your data comes from

  • From you: when you write to us, nominate a cause, claim gift points, vote or agree to promotional emails.
  • From the partner brands: when you open a shop through our link and place an order, the brand reports the order to us through our partner back-office access and its affiliate tools. That report is how your purchase turns into voting points. We tell you about it in the first email we send you, within one month (GDPR Art. 14).
  • From our bank: when you send a gift to the charity account, Slovenská sporiteľňa, a.s. shows us the payment details.
  • From the voting platform: the votes you cast in a round.
  • Automatically: the technical data your browser sends when you visit the Website (row A), and cookies (see our Cookie Policy).

4. What we do with your data, why, and for how long

The table below lists every use, its legal basis, who receives the data and how long we keep it.

What we do and which data Legal basis Who receives it, and transfers How long we keep it
A. Running the Website and keeping it secure Your IP address and the technical data your browser sends (such as the page requested and browser type), used only to deliver each page and keep the Website safe. We have switched off server access logs, so we keep no record of your visits. We also count how often each page is viewed: the counter only adds one to a total for each page and does not record who you are. Legitimate interest in running a secure website (GDPR Art. 6(1)(f)). Our hosting provider WEDOS, a.s., Masarykova 1230, 373 41 Hluboká nad Vltavou, Czech Republic (hosting brand VEDOS), as our processor. Stays in the EU. Not kept by us: server access logs are switched off.
B. Cookies and your cookie choice Your cookie choice and the cookies described in our Cookie Policy. Strictly necessary cookies: exempt from consent (Act 452/2021 § 109(8)). All other cookies: your consent (GDPR Art. 6(1)(a)). See the Cookie Policy. No cookies are shared with third parties. As listed in the Cookie Policy. Proof of your choice: 12 months.
C. Linking your orders and crediting your voting points Your name, the email address you registered with the partner brand, your country (not every brand reports it), the brand, the order date, the order's point value as the brand calculates it (some brands, such as Epicure, report the order value in money instead), and whether an order was returned or cancelled, where the brand reports it. The points we credit. We receive this from the partner brands through our partner back-office access and their affiliate tools. What each brand reports differs slightly. Running the points scheme you take part in under our Terms (GDPR Art. 6(1)(b)). Nobody outside For Better Purpose. Kept in our own files on an encrypted device used only for this; when we email you, see D. The current round plus 24 months, then deleted. We keep only totals that no longer identify anyone.
D. Service emails Your email address and points. These are the monthly points summary, voting-round and voting-account emails, and notices about changes to our Terms or this policy. They never contain promotions. Running the points scheme (GDPR Art. 6(1)(b)). Our business email provider, which hosts our mailbox in the EU, as our processor. We send these emails from our own mailbox. As C. Sent emails stay in our mailbox for 12 months.
E. Voting accounts and votes Your email address, any name the voting platform asks for, and the votes you cast. Running the voting rounds (GDPR Art. 6(1)(b)). The external voting platform for that round, as our processor. We name it in each round's announcement and in the list at the end of this policy before any of your data is passed to it. If it is outside the EU, see section 6. Voting accounts are deleted from the platform within 3 months after the round result is published. Your votes are kept with C. Results by cause are published and contain no personal data.
F. Promotional emails (only if you agree) Your email address and a record of your consent: when you gave it, the words you agreed to, and where. These emails tell you about special events or causes, notable price reductions, valuable new products and new partner brands. Your consent (GDPR Art. 6(1)(a); Act 452/2021 § 116; Act 22/2004 § 4(6)). You can withdraw it at any time with one click. Ecomail (Ecomail.cz s.r.o., Prague, Czech Republic), which runs our sign-up form and sends these emails, as our processor. Its main servers are in Frankfurt, Germany; Ecomail says data may also be held in the United States, see section 6. Until you unsubscribe. The record of your consent and of your withdrawal is kept for 4 years after you withdraw, because the law asks us to be able to prove it (Act 452/2021 § 116(5)).
G. Messages you send us Your name, email address, the topic, your message and any attachments, from our contact form or by email. Our legitimate interest in answering you (GDPR Art. 6(1)(f)), or running the points scheme where the message is about your points (Art. 6(1)(b)). The form runs on our website at WEDOS, a.s., Masarykova 1230, 373 41 Hluboká nad Vltavou, Czech Republic (hosting brand VEDOS) and delivers the message to our mailbox with our email provider (see D). The form does not store messages on the website. 12 months after we reply, unless the message is needed for a gift record (I) or a legal claim (N).
H. Nominations Your email address, the cause's name and website, its registration number if you give it, and your reason for nominating it. Our legitimate interest in checking and choosing causes (GDPR Art. 6(1)(f)). Our nomination form (https://forbetterpurpose.eu/nominate-a-cause/) runs on our own website at WEDOS, a.s., Masarykova 1230, 373 41 Hluboká nad Vltavou, Czech Republic (hosting brand VEDOS) and delivers the nomination to our mailbox with our email provider (see D). We share it with nobody else. 3 years after the nomination.
I. Gifts and gift points For a gift to the charity account: the payer's name, account number, amount, date and payment note, as the bank reports them. For a points claim: your email, the date and amount, and the points we credit. Keeping our accounts (legal obligation, GDPR Art. 6(1)(c); Act 431/2002 § 35). Crediting points (Art. 6(1)(b)). Our bank, Slovenská sporiteľňa, a.s., which runs the transparent account as an independent controller. On the account's public page it shows, for each payment, the date, the amount, the name of the account holder who sent it, the payment note and the variable symbol, but not the account number. Our accountant, as our processor. The tax authority, if it asks. Accounting records: 10 years after the end of the year they relate to (Act 431/2002 § 35). Points claims: as C.
J. Checking large gifts For a gift of €1,000 or more: the donor's name and contact details, confirmed by the donor. We do not ask for identity documents. Our legitimate interest in knowing where larger amounts come from (GDPR Art. 6(1)(f)). The anti-money-laundering act (297/2008) does not oblige a civic association to identify donors. Nobody, unless an authority asks under the law. With the accounting record of the gift: 10 years after the end of the year (Act 431/2002 § 35).
K. Causes and donation agreements Names, roles and contact details of the people we deal with at each cause, the signatories of donation agreements, and the cause's bank details. Concluding and carrying out the donation agreement (GDPR Art. 6(1)(b) or (f)); keeping our accounts (Art. 6(1)(c)). Our bank, Slovenská sporiteľňa, a.s., and our accountant, as our processor. Donation agreements and payment records: 10 years after the end of the year (Act 431/2002 § 35). Other contact details: until the cause leaves our list, plus 24 months.
L. A person or family in need Name, contact details, bank details, and a short description of the situation that makes them eligible. That description can reveal health or other sensitive information. Who recommended them, if anyone did. The person's explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)), and the donation agreement (Art. 6(1)(b)). We never publish personal details about the people we help without their consent, but we always publish what the money was for. Our bank, Slovenská sporiteľňa, a.s., and our accountant, as our processor. Never published without consent. Donation agreement and payment: 10 years (Act 431/2002 § 35). Other notes: deleted 12 months after the payment. People shortlisted but not chosen: deleted when the round closes, unless they ask to stay on the shortlist for the next round.
M. Our Facebook and Instagram pages What you share with our pages, such as comments, likes and messages, and the page statistics Meta gives us. Our legitimate interest in talking with people who follow us (GDPR Art. 6(1)(f)). For page statistics, Meta and we are joint controllers (Art. 26). Meta Platforms Ireland Limited, under its own terms and privacy policy. Meta can process data outside the EU, see section 6. Messages: 12 months after the conversation ends. Public comments: until you or we remove them.
N. Legal claims and requests from authorities The data needed to establish, exercise or defend a legal claim, or to answer an authority. Our legitimate interest (GDPR Art. 6(1)(f)) or a legal obligation (Art. 6(1)(c)). Courts, authorities and our lawyer, only where needed. Until the claim or request is closed and any limitation period has passed.
O. Website statistics (only if you accept Statistics cookies) The pages you visit, when, the website that brought you here, your browser and device type, an approximate location worked out from a shortened IP address, and a random visitor ID stored in a cookie. Your consent (GDPR Art. 6(1)(a); Act 452/2021 § 109(8)). Nothing is collected until you accept Statistics, and you can withdraw at any time with Cookie settings. Matomo, an analytics program that runs on our own website server at WEDOS, a.s., Masarykova 1230, 373 41 Hluboká nad Vltavou, Czech Republic (hosting brand VEDOS). No data goes to Matomo the company or to anyone else, and none leaves the EU. Detailed visit data: deleted after 13 months. Summary reports that identify no one are kept.

5. Who receives your data

We never sell your data, and we never give it to the partner brands for their marketing.

We use these service providers, each under a contract that lets them use your data only on our instructions (GDPR Art. 28):

  • Hosting: WEDOS, a.s., Masarykova 1230, 373 41 Hluboká nad Vltavou, Czech Republic (hosting brand VEDOS).
  • Email: our business email provider, which hosts our mailbox in the EU.
  • Voting platform: named in each round's announcement and in the list at the end of this policy.
  • Accounting: our external accountant, bound by a written contract and by confidentiality, who handles the data only on our instructions (GDPR Art. 28).
  • Promotional emails: Ecomail (Ecomail.cz, s.r.o., Prague, Czech Republic).
  • Website statistics: Matomo, running on our own server at WEDOS, so no data goes to Matomo the company.

These organizations receive data as independent controllers, under their own privacy policies: the partner brands (Ringana, Greenway, Norwex, Epicure), our bank Slovenská sporiteľňa, a.s., Meta for our social media pages, and courts or authorities when the law requires it.

6. Data outside the EU

Our website and our mailbox are hosted in the EU. Some providers, such as Meta, Ecomail or a voting platform, can process data in other countries, including the United States.

When data goes outside the EU, we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified US companies (GDPR Art. 45), or on the Commission's standard contractual clauses (Art. 46(2)(c)). If an adequacy decision is withdrawn, we switch to standard contractual clauses or stop the transfer. You can ask us for a copy of the safeguards.

7. Our public transparent account

Our charity account is a transparent account: anyone can view its payments online (https://www.transparentneucty.sk/#/ucet/SK9009000000005225464140). That is the point of it. It also means that for every gift the public page shows the date, the amount, the name of the account holder who sent it, the payment note and the variable symbol. It does not show the account number. Please send a gift only if you are comfortable with that. Please don't put your email address in the payment note: our account is public, so anyone can read it.

We never publish personal details about the people we help without their consent, but we always publish what the money was for.

8. Your rights

You have the right to:

  • see the data we hold about you and get a copy (GDPR Art. 15);
  • correct it if it is wrong (Art. 16);
  • have it deleted where we no longer need it or you withdraw consent (Art. 17);
  • restrict how we use it while a question is being settled (Art. 18);
  • take it with you in a common format, where we use it on the basis of the Terms or your consent (Art. 20);
  • object to any use based on our legitimate interest (Art. 21). If you object to promotional emails, we stop, no questions asked;
  • withdraw your consent at any time, as easily as you gave it, without affecting what happened before (Art. 7(3)).

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you (Art. 22). Points are added up by fixed rules that are the same for everyone.

To use any of these rights, write to privacy@forbetterpurpose.eu. We reply within one month. If a request is complex, we can extend that by up to two further months and will tell you why within the first month (Art. 12(3)). There is no charge. We may ask you to confirm your identity, for example by writing from the email address you registered with.

9. Complaints

If you are unhappy with how we handle your data, please tell us first and we will try to put it right.

You also have the right to complain to a data protection authority (GDPR Art. 77). In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovakia, https://dataprotection.gov.sk. Its website explains how to file a complaint (https://dataprotection.gov.sk/sk/legislativa-metodiky/podavanie-navrhu-zacatie-konania/). You can also complain in the EU country where you live or work.

10. Age

Taking part is for people aged 18 or over (see our Terms). We do not knowingly process data of anyone under 18. If we learn that we have, we delete it.

11. Do you have to give us your data?

To earn voting points, the partner brand has to report your order to us, linked to your email address; without it, we cannot credit points. Everything else is up to you: you do not have to write to us, nominate a cause, claim gift points or agree to promotional emails.

12. How we protect your data

Only the members who run the points, the emails and the payments can see personal data, and they are bound to keep it confidential. We keep participant files on an encrypted device, use business accounts with strong sign-in for email, and have a contract with each service provider.

13. Changes to this policy

When we change this policy, we publish the new version here with its date. If a change matters for you, we also tell you by email before it applies.

Service providers by round

Service Provider
Voting platform for the current round Named here and in the round announcement once chosen, before any of your data is passed to it. We choose it in the last month of each round (or the month after), when the number of voters and causes is known.
Accounting An external accountant, bound by a written contract and by confidentiality (GDPR Art. 28)
Hosting WEDOS, a.s., Masarykova 1230, 373 41 Hluboká nad Vltavou, Czech Republic (hosting brand VEDOS)
Email Our business email provider, which hosts our mailbox in the EU
Nomination form Our own website (https://forbetterpurpose.eu/nominate-a-cause/), delivered to our mailbox
Promotional emails Ecomail (Ecomail.cz, s.r.o., Prague, Czech Republic), servers in Frankfurt
Website statistics Matomo On-Premise on our WEDOS hosting (no data to Matomo the company)