Privacy Policy

Last updated: 5 November 2026

This policy explains what personal data Ukrainsk kultur og kunnskapssenter collects through this website, why we collect it, and what rights you have. We follow the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

1. Who is responsible for your data

The data controller is:

• Ukrainsk kultur- og kunnskapssenter (UKKS)
• Organisation number: 936 220 428
• Address: Vangsgata 31, 302, 5700 Voss, Norway
• E-mail: [email protected]

If you have questions about how we handle your data, write to us at the address above.

2. What we collect and why

Contact form

When you write to us through the contact form, we collect your name, e-mail address and the content of your message. We use this only to answer you and to follow up on what you asked about. The legal basis is our legitimate interest in responding to people who contact us (GDPR Art. 6(1)(f)).

Membership and participation requests

When you apply for membership or sign up for an activity, we collect your name, e-mail address, phone number and any other information you choose to give us in the form. We use it to register you, to contact you about the activity, and to keep the member records the organisation needs. The legal basis is the agreement between you and the organisation (GDPR Art. 6(1)(b)), and, for record keeping, our legal obligations as an association (GDPR Art. 6(1)(c)).

Newsletter

If you subscribe to our newsletter, we collect your e-mail address and, if you give it, your name. We use it only to send you news about our work and events. The legal basis is your consent (GDPR Art. 6(1)(a)). You can withdraw your consent at any time by using the unsubscribe link in any newsletter or by writing to us.

Supporting us and your personal page

When you support us with money through the website, the payment is handled by the payment provider Stripe. You enter your card details on Stripe’s page; they never reach us, and we neither see nor store them.

From Stripe we receive and store in the website’s database:

• the e-mail address and name you gave when paying;
• your customer ID at Stripe;
• your history of gifts: date, amount, type (one-time or monthly), subscription status and, if any, the fundraiser or event you gave to;
• the badges you have earned and a log of events on your personal page (for example “subscription started”, “thank-you sent”);
• the language you use and whether your name is shown on the “Our patrons” list.

We use this to process the payment, send you a receipt and a thank-you, show your history and badges on your personal page, and keep the records of donations the law requires. Legal basis: performing our agreement with you (GDPR Art. 6(1)(b)) and our legal accounting obligations (GDPR Art. 6(1)(c)).

Age, phone and address. In your account settings you can add a phone number, an age group (for example 30–44) and a postal address. All of this is optional. Only the centre’s administrators see it: the phone to reach you quickly, the age group to understand who our meetups are for, and the address only to send you something (for example a gift or materials). We do not publish it or share it with anyone. You can change or delete it at any time in the settings. A business partner can add their business address to their public profile; it is shown on the site with a link to a map.

Where you are from. To show how many countries and towns our supporters come from, we keep a town and a country in your account. We take them in this order: what you entered in your settings; the town and country of the billing address Stripe receives; or a rough town from the network you sign in from (worked out by our host Cloudflare; we do not store the IP address itself). Publicly, only the number of countries and towns is shown. If you show your name on the patrons page, your card also shows your town (the town only, never the address); you can switch this off in your settings. Administrators see the town, the country and where they came from. The legal basis is our legitimate interest in showing that people from many places support the centre (GDPR Art. 6(1)(f)).

Signing in. We do not use passwords. When you sign in, we e-mail you a one-time link that is valid for 15 minutes. After you sign in, your browser gets a session cookie that lasts 60 days or until you sign out. Links and sessions are stored only in encrypted (hashed) form.

“Our patrons” list. To thank the people who support us, we show the first and last name of everyone who has given on the public patrons list, together with their league (never the amount). The legal basis is our legitimate interest in thanking donors publicly (GDPR Art. 6(1)(f)); this is also stated in the information next to the payment form. You can become anonymous at any time in the settings of your personal page — your name disappears from the list immediately — or write to us.

Talking with Ravn the raven

So that Ravn the raven remembers you and does not repeat himself, we keep your talks with him in the site’s database (the text of your messages and his answers, the date and the topic) and a short note that an AI makes from these talks now and then: what you told about yourself, what you have already talked about, which words you learned and which mistakes come back. Nothing sensitive (health, religion, politics, money) goes into the note. The talks are not shown as a history on the site. Only the centre’s administrators can see this data, when they need to look into a problem. The legal basis is performing our agreement with you: you use the learning conversation (GDPR Art. 6(1)(b)). Write to us to have the talks and the note erased.

Technical data from the website

Our hosting provider records standard technical information when you visit the site: your IP address, browser type, the pages you open and the time of the visit. This is used to keep the website running and secure. The legal basis is our legitimate interest in operating a safe and functioning website (GDPR Art. 6(1)(f)).

Article likes

When you press the like button under an article, we only increase a counter for that article. We do not store your IP address, a cookie or any other information about you. Which articles you liked is remembered only in your own browser.

Analytics

Cloudflare Web Analytics counts page visits without cookies and without data that identifies you. No consent is needed for it.

Microsoft Clarity only starts after you press “Accept” in the banner on the page. Clarity shows us how people use the site: which pages they open, where they click, how they scroll, which device and browser they use, plus de-identified session recordings. Text you type into fields is masked. We use this only to make the site easier to use. Clarity sets its own cookies (_clck, _clsk and others), and the data is processed by Microsoft Corporation. The legal basis is your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time: “Cookie settings” at the bottom of every page → “Decline”. After that Clarity no longer loads and its cookies are deleted.

Our own visit statistics also start only after “Accept”. We record which pages of the site you open, how much active time you spend on them (only while the tab is open and you are doing something), how far you scroll, and a few actions: opening meeting materials, voting for an idea, pressing “Support”, opening a patron card, downloading a file or an event for your calendar. We do not record your screen and do not store text you type. For this your browser keeps a random visitor ID (ukk-vid) and a visit ID (ukk-sid). If you are signed in to “My account”, the statistics are linked to your profile. Only the centre’s administrators can see them; we use them to understand what people are interested in and to plan meetups and materials. The data is stored on our own server (Cloudflare) and is not shared with anyone. The legal basis is your consent (GDPR Art. 6(1)(a)); you can withdraw it the same way, with “Cookie settings” → “Decline”, and recording stops.

Partners’ shop

In the shop we show goods from Ukrainian partner businesses. UKKS sells nothing, takes no payment and is not a party to any sale. Payment, delivery, returns, exchanges and warranty are handled by the partner’s (seller’s) shop and are governed by the seller’s own terms and privacy policy. When you go to the seller’s website or write to the seller, the seller processes your data.

We count how many times an item was viewed and how many people went on to the seller or contacted them through our site, and share these totals with the seller, without any data about you. If you have agreed to our own visit statistics, these actions are recorded as described above.

When a business applies to become a seller, we keep the details from the application (name, organisation number, contact person, e-mail, phone, link to the shop) to review it and to run the partner’s public card. The legal basis is entering into and carrying out the partnership agreement (GDPR Art. 6(1)(b)).

3. What we do not do

We do not sell your personal data. We do not share it with advertisers. We do not use it to build profiles about you, and we do not make automated decisions about you.

4. Who has access to your data

Your data is available to the volunteers and staff of the organisation who need it for the purposes described above. In addition, we use service providers who process data on our behalf:

• Cloudflare, Inc. – website hosting and delivery, and the database behind personal pages (Cloudflare D1).
• Stripe Payments Europe, Ltd. (Ireland) – processing payments and subscriptions, and subscription management (Customer Portal). Stripe also processes data on its own account to prevent fraud and meet financial regulations.
• Resend, Inc. – sending sign-in e-mails and thank-you e-mails. E-mails are sent from the service’s European region.
• Microsoft Corporation – Microsoft Clarity visit statistics, only if you have agreed to them; the voice in «Talk with the raven» (Azure Speech, Europe): your recording is turned into text and the raven’s answer into sound. We do not keep recordings of your voice.
• Anthropic, PBC (USA) – the Claude AI in learning: translating words and sentences in the dictionary, lesson topics, reading text from a photo of a page, and «Talk with the raven». We send only the text (or photo) to be processed, without your name or e-mail address.
• Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (China) – the DeepSeek AI: the main one in «Talk with the raven» (your messages, the raven’s answers and the note about you, without your name or e-mail) and a back-up for the rest — when Claude is unavailable, the same text (without your name or e-mail) is processed by DeepSeek. Photos of pages are never sent to it. China has no EU adequacy decision, so the transfer relies on the European Commission’s Standard Contractual Clauses.
• [Form provider] – receiving messages sent through our forms.
• [Newsletter provider] – sending the newsletter.
• [E-mail provider] – our e-mail correspondence with you.

These providers act on our instructions under a data processing agreement. Some of them are based outside the EU/EEA. Where that is the case, the transfer is covered by the European Commission’s Standard Contractual Clauses.

5. How long we keep your data

• Contact messages: up to [12] months after the matter is closed.
• Membership and activity records: for as long as you are a member, and afterwards as long as accounting or reporting rules require.
• Newsletter subscriptions: until you unsubscribe.
• Supporter profile (e-mail, name, badges, settings): until you delete your personal page or ask us to.
• History of gifts: for as long as your personal page exists; payment records needed for accounting are kept by us and by Stripe for as long as Norwegian accounting law requires (usually 5 years).
• Talks with the raven and the note about you: as long as your account exists or until you ask us to erase them.
• Sign-in links: 15 minutes; sign-in sessions: up to 60 days or until you sign out.
• Technical server data: as long as our hosting provider retains its logs.
• Visit statistics: for as long as the centre operates. We remove the link to your name when you delete your account or ask us to; after that the records only remain in general, de-identified figures.

6. Your rights

Under the GDPR you have the right to:

• ask what data we hold about you and get a copy of it;
• have incorrect data corrected;
• have your data deleted;
• ask us to limit how we use your data;
• object to processing based on legitimate interest;
• receive your data in a machine-readable format;
• withdraw your consent at any time, without it affecting what we did before you withdrew it.

To use any of these rights, write to [email protected]. We answer within one month.

You can delete your profile yourself: “My page” → “Settings” → “Delete my profile”. This immediately removes your profile, history, badges and sessions from our database. If you have an active monthly gift, cancel it first under “Manage subscription” – otherwise Stripe will keep charging it. Records of payments already made are kept by Stripe as the law requires.

If you believe we handle your data incorrectly, you can complain to the Norwegian Data Protection Authority (Datatilsynet), postboks 458 Sentrum, 0105 Oslo, [email protected].

7. Children

When a child under 15 takes part in our activities, we ask a parent or guardian to give the information and the consent on their behalf.

8. Cookies

Cookies are described separately in our Cookie Policy.

9. Changes to this policy

We may update this policy, for example if we add new forms or new tools to the website. The date at the top shows when it was last changed.