Privacy policy
ARTESA respects the privacy of all its visitors and supporters. This privacy policy explains what data we collect, why we collect it, how we use it and what your rights are under the General Data Protection Regulation (GDPR – EU 2016/679).
1. Who we are
ARTESA – non-profit organization
We are a non-profit organization that promotes social equity through STEAM education programs and by supporting talented children to participate in robotics competitions.
ARTESA is the personal data controller for the information described in this policy.
2. What data do we collect?
We only collect the data necessary to operate the site and process donations.
2.1. Data collected automatically by visiting the website
When accessing the site, the following may be automatically collected:
-IP address;
-device and browser type;
-pages accessed and duration of visit;
- cookies essential for the functioning of the site.
This data is automatically collected by the hosting server and is used for the proper functioning and security of the site.
2.2. Data collected through the donation form (Donorbox + Stripe)
ARTESA does not directly collect bank details; they are processed exclusively by Stripe and Donorbox. During a donation, the following may be collected:
-name and surname;
-email address;
-donation amount and frequency (one-time or recurring);
-IP address;
-data related to the payment method (Stripe only – not visible to ARTESA).
2.3. Data collected through direct contact
If you contact us via email or other channels, we may receive:
-name;
-email address;
-the content of the message.
3. Who processes your data?
3.1. Stripe (card payment processing)
Card payments are processed through Stripe, a PCI-DSS certified payment processor. You can view Stripe's policy here: https://stripe.com/privacy.
3.2. Donorbox (donation form)
The donation form integrated on the site is provided by Donorbox, which manages data related to donations (amount, frequency, contact details). Donorbox Policy: https://donorbox.org/privacy.
3.3. Hosting provider
The server on which the site is hosted collects technical logs (e.g. IP addresses and errors) to ensure the security and proper functioning of the site.
3.4. Integrated content (YouTube)
Our pages may include YouTube videos. YouTube may collect data about users according to its own privacy policy: https://policies.google.com/privacy.
4. The purposes for which we collect data
We process your data only for legitimate purposes, such as:
-processing donations made through the site;
-sending donation confirmations and administrative communications;
-response to questions and requests received from you;
-ensuring the security and proper functioning of the site;
-compliance with legal and accounting obligations related to donations.
5. Legal basis for processing (GDPR)
Depending on the context, we process data based on one or more legal grounds:
Consent – for certain communications or services that you explicitly request;
Execution of a contract / donation – for processing payments and managing donations;
Legitimate interest – for site security and fraud prevention;
Legal obligation – for accounting and tax records of donations.
6. How long do we keep the data?
-technical data (server logs): usually between 30 and 90 days;
-data related to donations: according to legal and accounting obligations (usually between 5 and 10 years);
-emails and correspondence: until the request is resolved or until you request their deletion, within the limits of the law.
We do not retain data longer than is necessary for the purposes for which it was collected.
7. Your rights under GDPR
You have the following rights in relation to your personal data:
-the right of access to data;
-the right to rectification;
-the right to erasure ("the right to be forgotten");
-the right to restriction of processing;
-the right to opposition;
-the right to data portability;
-the right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).
To exercise any of these rights, you can contact us at: contact@artesa.ong.
8. Data security
We take reasonable steps to protect your personal data, including:
-use of secure connections (HTTPS);
-collaboration with certified processors (Stripe – PCI-DSS, Donorbox – according to GDPR);
-limiting access to data only to authorized persons.
ARTESA does not store and does not have access to complete bank card data.
9. International data transfers
Stripe, Donorbox and other third-party services may process data outside the European Economic Area. These transfers are made under GDPR-compliant mechanisms (e.g. standard contractual clauses or other appropriate safeguards).
10. External links
Our site may contain links to other sites. We are not responsible for the content or privacy policies of these sites. We encourage you to review their privacy policies separately.
11. Changes to this policy
We may update this policy from time to time to reflect changes in the law or in the way we process data. The updated version will always be published on this page.
12. Contact
For questions or requests regarding personal data, you can contact us at: