Privacy Policy

Last updated: 07.05.2026.

Wings of Hope Foundation (hereinafter: “the Foundation”, “we”) is committed to protecting the privacy of all individuals whose personal data we process. This Privacy Policy describes what data we collect through the website wings-of-hope.ba, why we collect it, how we use it, and what rights you have regarding your data.

This Policy is aligned with the Law on Personal Data Protection (“Official Gazette of BiH”, No. 12/25) and the EU General Data Protection Regulation (GDPR).

1. Data Controller

Wings of Hope Foundation (Fondacija Krila nade)
Address: Grbavička 32, 71000 Sarajevo, Bosnia and Herzegovina
Phone: +387 62 772 591
E-mail: info@wings-of-hope.ba

2. Data Protection Officer (DPO)

In accordance with the Law, which requires the appointment of a Data Protection Officer when special categories of personal data are processed, the Foundation has appointed a DPO whom you may contact regarding any question or to exercise your rights:

• Name: [DPO NAME]
• E-mail: [dpo@wings-of-hope.ba]
• Postal address: Grbavička 32, 71000 Sarajevo, marked “For the Data Protection Officer”

3. What data we collect and on what legal basis

Special categories of data

The Foundation provides psychotherapy, psychosocial support, and shelter services for vulnerable groups. As a result, we process special categories of personal data (Article 9 of the Law) — data on mental health, sexual orientation, gender identity, and other sensitive circumstances.

We process such data exclusively on the basis of explicit, freely given, and informed consent of the data subject, with the highest level of confidentiality. Access is granted only to authorised professionals (psychotherapists, counsellors, legal teams) bound by professional secrecy.

Data of children

For users under 16 years of age, processing is carried out with the consent of the holder of parental responsibility, except in cases where the law allows otherwise (e.g. protection of the child’s vital interests).

4. How long we keep the data

• Contact enquiries: up to 2 years from the last communication
• Newsletter: until consent is withdrawn
• Psychotherapy and Safe House users: in accordance with professional standards and statutory retention periods applicable to health/social documentation
• Donations: 11 years (BiH accounting regulations)
• Technical logs and analytics: see cookie policy (section 7)

After the retention period expires, data is deleted or anonymised.

5. With whom we share data

We do not sell your data and do not share it with third parties for marketing purposes. We may share data with:

• Data processors who provide us with technical services (hosting, e-mail, newsletter tools, accounting) — under a data processing agreement that binds them to the same level of protection
• Project partners and donors (UNDP, EU/CoE, EERA, cfd, and others) when necessary for project reporting — in aggregated or anonymised form wherever possible, and in identifiable form only with consent
• Competent authorities when required by law

6. International data transfers

Some of our tools (e.g. Google Analytics, Meta Pixel, e-mail and hosting services) involve the transfer of data to EU/EEA member states or the United States of America. Such transfers are carried out on the basis of adequacy decisions, EU Commission Standard Contractual Clauses, or other legal mechanisms prescribed by the Law and the GDPR.

7. Cookies and tracking tools

The website uses cookies and similar technologies:

• Essential cookies — necessary for the operation of the website (language, session). No consent required.
• Analytics cookies — Google Analytics — measuring visits, user behaviour, and site performance. Set only with your consent via the cookie banner.
• Marketing cookies — Meta Pixel (Facebook) — measuring campaign effectiveness and retargeting. Set only with your consent.

You may withdraw your consent at any time through the cookie settings on the website or your browser settings.

8. Your rights

In accordance with the Law, you have the right to:

• access your data
• rectification of inaccurate data
• erasure (“right to be forgotten”)
• restriction of processing
• data portability in a structured format
• object to processing based on legitimate interest
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

You may submit a request to info@wings-of-hope.ba or to the DPO contacts in section 2. We respond without undue delay, no later than 30 days.

If you believe your rights have been violated, you have the right to lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina (azlp.gov.ba).

9. Data security

We apply appropriate technical and organisational protection measures (access control, encryption where applicable, restriction of employee permissions, regular security checks). Data from psychotherapy and counselling work is subject to an additional regime of professional secrecy.

In the event of a personal data breach that may pose a risk to your rights, we will notify the Personal Data Protection Agency and, where required, you directly.

10. Changes to the Privacy Policy

We may update this Policy from time to time. The current version is always published on this page with the date of the last update. For significant changes, we will inform you additionally (e.g. via newsletter or a prominent notice on the site).

11. Contact

For any questions about this Policy or the processing of your personal data:

Wings of Hope Foundation
Grbavička 32, 71000 Sarajevo
info@wings-of-hope.ba | +387 62 772 591