═══════════════════════════════════════════════════════ PRIVACY NOTICE ═══════════════════════════════════════════════════════ Last Updated: February 24, 2026 ────────────────────────────────────────────────────── 1. INTRODUCTION This Privacy Notice explains how Ekaterina Mikholap ("we", "us", or "our") handles information when you visit our website, use our services, or contact us. Data Controller: Ekaterina Mikholap NIF: PT 318589125 Email: hello@rbingood.com Portuguese Data Protection Authority (CNPD): https://www.cnpd.pt ────────────────────────────────────────────────────── 2. WHAT DATA WE COLLECT We process your personal data in the following situations: a) Contact via Email or Social Media When you contact us via email (hello@rbingood.com), LinkedIn, or Instagram, we may process: • Your name • Your email address • The content of your message b) Event Chat Our events include a shared chat visible to all participants. When you use the event chat, we process: • Your name or display name • The content of your messages Please note: Messages in the event chat are VISIBLE TO ALL EVENT PARTICIPANTS. Do not share sensitive personal information in the chat. Legal Basis: Legitimate interest (GDPR Art. 6(1)(f)) — enabling communication between event participants. c) Email Communications (Event Information) When you subscribe to receive information about our events, we process: • Your email address • Your name (if provided) Legal Basis: Your consent (GDPR Art. 6(1)(a)). You can unsubscribe at any time using the link in each email or by contacting hello@rbingood.com. d) Donations via Stripe When you make a donation, your payment is processed by Stripe Payments Europe, Ltd. We process: • Your name • Your email address • Donation amount and date We do NOT collect or store your credit card number, CVV, or full payment details. This data is handled exclusively by Stripe in accordance with PCI DSS standards. See Stripe's Privacy Policy: https://stripe.com/privacy Legal Basis: Your consent (GDPR Art. 6(1)(a)) for processing the donation, and legal obligations for financial records (GDPR Art. 6(1)(c)). e) Photographs and Videos We display photographs and videos from our community cleanup events on this website. What we photograph/record: • Wide-angle shots of cleanup activities (general view) • Group photos/videos of event participants • Results of environmental cleanup work • Focus on activities, not individual portraits Legal Basis: • Legitimate interest (GDPR Art. 6(1)(f)) — documenting our public community activities • Photos/videos are taken at public events with participant awareness Your rights regarding photos/videos: • You may request removal of your image at any time • We will remove the photo/video within 7 days of your request • Contact us: hello@rbingood.com Storage: Photos and videos are stored securely and used only for documenting our environmental activities. ────────────────────────────────────────────────────── 3. HOW WE USE YOUR DATA Purpose | Legal Basis ---------------------------------|--------------------------- Respond to inquiries | Legitimate interest Event chat communication | Legitimate interest Send event information by email | Consent Process donations | Consent Financial record-keeping | Legal obligation Document cleanup events | Legitimate interest ────────────────────────────────────────────────────── 4. DATA RETENTION Data Type | Retention Period -------------------------|---------------------------------- Email inquiries | 30 days after resolution Event chat messages | Duration of event + 30 days Email subscribers | Until you unsubscribe Donation records | 10 years (Portuguese tax law) Photos/videos | Until removal requested ────────────────────────────────────────────────────── 5. DATA SHARING We share your data only with: • Stripe Payments Europe, Ltd. — for processing donations (name, email, payment data) • Firebase (Google) — for authentication and event chat We do NOT sell or share your data for marketing purposes. Exception: We may disclose data if legally required by Portuguese or EU authorities. International Data Transfers: Some of our service providers (Stripe, Firebase/Google) may process data outside the European Economic Area (EEA). These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection in accordance with GDPR Chapter V. ────────────────────────────────────────────────────── 6. COOKIES For details about the cookies used on our website, please see our Cookie Policy: [link to cookie policy page] ────────────────────────────────────────────────────── 7. YOUR RIGHTS (GDPR) You have the right to: ✓ Access your data (request a copy) ✓ Rectification (correct inaccurate data) ✓ Erasure ("right to be forgotten") ✓ Restriction of processing ✓ Data portability (receive your data) ✓ Object to processing ✓ Withdraw consent at any time To exercise your rights: Contact us at hello@rbingood.com To file a complaint: Portuguese Data Protection Authority (CNPD): https://www.cnpd.pt ────────────────────────────────────────────────────── 8. THIRD-PARTY SERVICES Our website uses or links to the following third-party services: • Stripe — Donation payments (https://stripe.com/privacy) • Firebase (Google) — Authentication and event chat (https://firebase.google.com/support/privacy) • WhatsApp, Telegram — Community communication • LinkedIn, Instagram — Social media links These services have their own privacy policies. We are not responsible for their data practices. ────────────────────────────────────────────────────── 9. CHILDREN'S PRIVACY We do not knowingly collect personal data from children under the age of 16. If you become aware that a child has provided us with personal data without parental consent, please contact us. ────────────────────────────────────────────────────── 10. SECURITY We take reasonable measures to protect your data: • Encrypted communication (TLS/SSL) • Secure data storage • Access controls • Payment data handled by PCI DSS-compliant Stripe ────────────────────────────────────────────────────── 11. CHANGES TO THIS NOTICE We may update this Privacy Notice from time to time. Changes will be posted on this page with a new "Last Updated" date. ────────────────────────────────────────────────────── 12. CONTACT US For any questions about this Privacy Notice or your data: Email: hello@rbingood.com Data Controller: Ekaterina Mikholap Address: RUA R DOUTOR ANTONIO RIBEIRO DOS SANTOS 11, Lisbon, Portugal ────────────────────────────────────────────────────── This Privacy Notice complies with the EU General Data Protection Regulation (GDPR) and Portuguese data protection laws.