Privacy policy

1. Who controls personal data

Unity Bridge, legal entity code 307054936, is responsible for personal data collected through this website and direct contact with the organization, unless a separate project notice identifies another controller.

2. Data we may process

• Contact details and message content you choose to send
• Grant, partnership, volunteer or donation-enquiry information
• Technical security logs required to keep the website reliable
• Consent and communication preferences, when relevant
• Donation and compliance records where a giving channel is used

3. Why we process it

We process data to answer enquiries, administer relationships and donations, meet legal obligations, protect our systems, document consent and pursue legitimate nonprofit operations. Where law requires consent, you may withdraw it.

4. Data minimization and safety

We ask only for information proportionate to the purpose. Do not submit passports, banking credentials, political-risk details or sensitive case information through ordinary website or email channels unless a secure route has been agreed.

5. Sharing and international access

Data may be handled by necessary hosting, email, payment, accounting or professional-service providers under appropriate terms. We do not sell personal data. Project partners receive only information necessary for an agreed purpose.

6. Retention and your rights

Information is retained only as long as needed for the purpose, legal obligations, security and legitimate documentation. Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability and may complain to the competent Lithuanian supervisory authority.

Optional Analytics and advertising measurement

Analytics (GA4) and Google Ads are separate optional purposes, off by default for new visitors. GA4 measures visits, sessions and confirmed payments using client/session identifiers and payment amount/currency. Advertising permission separately enables ad-click measurement and optional export to Google Ads. A previous ub-paid-ads-v2 grant permits advertising only, never Analytics. Save selected or reject all; donations work either way. No personalization or donor contacts.

After consent, Google may receive technical request data including IP address, browser information and page URL, and use advertising cookies such as _gcl_. A Stripe link click is only a checkout start, never proof of payment: no revenue is sent with that click. A Belonews email-button click opens a draft, not a submitted enquiry; we cannot verify that the email app opened or the message was sent. Draft text and donor contact details are not sent for advertising measurement.

With this consent, we send Google the actual amount and currency of a confirmed payment together with its advertising click identifier (gclid, wbraid or gbraid) to measure donations attributable to ads. We do not send your name, email, phone or payment-card details for this measurement. Advertising storage and advertising user-data consent are granted only for this measurement; ad personalization remains denied.

Only after consent, we retain the click identifier across this site’s pages for up to 30 days in localStorage under ub-paid-attribution-v2, together with its expiry and opaque attribution references. Our attribution endpoint receives the identifier, project and consent version and returns an opaque reference for the existing Stripe link. The raw click identifier is not added to Stripe links. Verified payment processing can resolve that reference for measurement; attribution failure never blocks payment or changes the original project link.

ub-measurement-v3 stores your separate choices. ub-measurement-receipts-v3 retains opaque references, not raw GA identifiers; ub-measurement-revocations-v3 keeps pending revocations for retry on the next visit or reconnection. Privacy settings in the footer lets you withdraw all or change either choice. Withdrawal clears local identifiers, accessible _ga / _ga_* and advertising cookies, restores exact project links, and requests revocation of all retained receipts. Failed server revocation stays pending; already sent data cannot be recalled. Clearing browser data also removes references required for revocation.

Google determines its cookie lifetimes; _ga / _ga_* (GA4), _gcl_ cookies commonly last up to 90 days. See https://policies.google.com/technologies/cookies and https://policies.google.com/privacy. Hosting/security, external fonts and the separate Stripe checkout process their own necessary requests; rejecting Google Ads does not disable them.