Your data

Privacy Policy

Who is responsible for your data, what little of it we hold, and how to make us stop. Last updated 13 September 2026.

1. Who is responsible

The controller of your personal data is Fundacja European Mental Health Foundation, ul. Ignacego Krasickiego 124K/1, Nowa Wola, 05-500 Mysiadlo, Poland.

Registered in the Polish National Court Register (KRS) under number 0001034164, tax number (NIP) 1231533398.

For anything to do with your data, write to contact@mentalhealthfoundation.eu. We have not appointed a Data Protection Officer, because the law does not require one of an organisation our size. A board member answers these messages personally.

2. What we collect

  • If you write to us — your email address, your name if you give it, and whatever is in your message.
  • If you offer to volunteer — what you choose to tell us: name, contact details, skills, availability.
  • Automatically, when you visit — server logs kept by our hosting provider: IP address, browser type, time, and which page was requested. These exist for security and diagnostics.

We run no analytics, no advertising and no tracking of any kind on this site. We do not buy, rent or scrape contact lists.

3. Why, and on what legal basis

  • Answering correspondence — our legitimate interest, art. 6(1)(f) GDPR. We cannot reply to a message without reading it.
  • Volunteer applications — steps taken at your request before an agreement, art. 6(1)(b) GDPR, and our legitimate interest in building a volunteer base, art. 6(1)(f).
  • Keeping the site running and secure — our legitimate interest, art. 6(1)(f).
  • Accounting and statutory reporting, once donations open — a legal obligation, art. 6(1)(c).

4. A word about health information

We are a mental health foundation, so people sometimes write to us about their own situation. Please do not send us medical or other health details. We are not a clinic, we cannot offer treatment, and we are not a crisis service.

If you send them anyway, we treat them as special category data under art. 9 GDPR, processed only on the basis of the explicit consent you give by sending them (art. 9(2)(a)). We do not pass them on to anyone, and we delete them once the matter is closed.

If you are in crisis, please contact the emergency services or a crisis line in your country rather than us. We cannot answer quickly enough to help.

5. How long we keep it

  • Correspondence — up to 12 months after the exchange ends, unless we are required to keep it longer.
  • Volunteer records — until you withdraw, or 24 months after we last heard from you.
  • Server logs — for as long as our hosting provider retains them, typically a few weeks.
  • Accounting records — 5 years from the end of the tax year, as Polish law requires.

6. Who else sees it

Our hosting and email provider, OVH SAS (France), acts as our processor under a data processing agreement. The servers holding this site are in the European Union.

Nobody else, unless we are legally obliged to disclose something. We do not transfer personal data outside the European Economic Area.

The public pages of this site load nothing from third parties — no external fonts, no analytics, no social media widgets, no embedded video. Your visit is between your browser and our server.

7. Your rights

Under the GDPR you have the right to ask us for access to your data, to correct it, to erase it, to restrict how we use it, to object to our using it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time, which does not affect what we lawfully did before.

To use any of these rights, write to contact@mentalhealthfoundation.eu. We answer within one month.

You can also complain to the supervisory authority: Prezes Urzedu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warsaw, Poland.

8. Automated decisions

We do not profile you and we make no automated decisions about you.

9. Cookies

This site sets almost no cookies, and none for marketing. The full list is on the Cookie Policy page.

10. Changes

If this policy changes we will publish the new version here with a new date. We will not quietly widen what we do with your data.