Privacy and data processing policy

1. Who is responsible for your data

The controller of your data is Dame una mano, the free volunteering platform available at dameunamano.org.

For anything about your personal data, write to hola@dameunamano.org.

2. What data we collect

• Name: other people see it in events and chats.
• Email: for your account, the confirmation of each event, reminders and notices. It's never shown to other people.
• Phone, only if you choose to give it: only the organizer of the events you join sees it. If you organize and give a phone for the day of the event, only the people who join see it.
• Profile photo: required to create events and visible to other people. You can use any photo.
• Data about the events you create: title, description, photos, date, place, meeting point, tools and what to bring.
• Your participation: which events you joined, your support votes, your confirmed attendance and your medals.
• Messages you write in the chats and reports you send.
• Approximate location: we only use it to sort events by distance. It comes from your internet connection or, if you allow it, from your device's GPS. It stays on your device and we don't store it on our servers.
• Technical data: a session cookie, a language cookie and the IP address of the connection, which we use for security and to prevent abuse.
• Suggestions: if you send us one, your name and email are optional.

3. What we use your data for

• To create and keep your account, and let you sign in with a password or with a link we send to your email.
• To show events, let you join them and let the organizer know.
• To send you the confirmation with the calendar file, reminders one week, three days and two hours before, and notices if the event changes or is cancelled.
• To email you when someone mentions you in a chat.
• To give out medals when the organizer confirms your attendance.
• To look after the community: review reports, detect requests for money and prevent abuse.
• To improve the service with the suggestions you send us.

We don't sell your data or use it for advertising.

4. Your authorization

We process your data with your prior, express and informed authorization. You give it by ticking the consent box when you create your account or when you join an event without an account. We keep the date you gave it.

We don't ask for sensitive data and you're not required to give it. You choose your profile photo, and we don't use it for facial recognition or to identify you automatically.

If you upload photos that show other people, you must have their permission.

5. Your rights

As the owner of your data you have the right to:

• Know, update and correct your data.
• Ask for proof of the authorization you gave us.
• Know how we use your data.
• Revoke the authorization and ask us to delete your data, when no legal duty requires us to keep it.
• Access your data for free.
• File complaints with the Superintendence of Industry and Commerce (SIC), after making your request or claim with us.

6. How to exercise your rights

On your profile, under “My details”, you can see and correct your name, phone, photo and language, and delete your account.

You can also write to hola@dameunamano.org from your account's email. Tell us what you need. If needed, we'll ask you to confirm it's you.

• Requests: we answer within 10 business days at most. If we can't, we tell you why and answer within the following 5 business days.
• Claims to correct, update or delete data, or to revoke the authorization: we answer within 15 business days at most. If we can't, we tell you why and answer within the following 8 business days.
• If your claim is missing information, we ask for it within the following 5 days. If 2 months go by without an answer, we understand you withdrew the claim.

7. What happens when you delete your account

We delete your email, your phone, your password and your photo. Your name is replaced with “Cuenta eliminada” (deleted account) in participant lists, and your messages are replaced with “Mensaje eliminado” (deleted message).

The events you already organized stay, because other people took part in them, but without your name or your photo. If you organize events that haven't happened yet, you need to cancel them first. If you also want us to delete the events you already organized, write to us.

8. How long we keep your data

We keep your data while you have your account and while it's needed for the purposes of this policy. Past events show up in the list for 60 days. Chats only keep the most recent messages.

Reports are kept as long as needed to review them and protect the community. Some data may be kept longer if the law requires it.

9. Providers and international transfers

To work we use providers that process data on our behalf and following our instructions:

• Vercel, in the United States: hosts the site and stores the data and photos.
• Resend, in the United States: sends the emails.
• OpenStreetMap Nominatim: turns an event's address into a point on the map. We only send it the address and an approximate area, never your account data.

By accepting this policy you authorize the transfer of your data to these providers, which may be in countries with rules different from Colombia's. We require them to protect your data and use it only to provide us the service.

10. How we protect your data

• Your email and your phone are stored encrypted.
• Passwords are stored so that nobody can read them, not even us.
• Everything travels over a secure connection (https).
• When you upload a photo we remove its hidden data, like the GPS location.
• Only the Dame una mano team can access the administration.

No system is perfect. If an incident affects your data, we'll let you know and notify the Superintendence of Industry and Commerce, as the law requires.

11. Minors

If you're under 18, you need permission from your mother, your father or your guardian to use Dame una mano and give us your data.

Each event can set its own age limit: some are only for adults and others allow minors with an adult.

If you're a parent or guardian and believe a minor gave us data without permission, write to us and we'll delete it.

12. Cookies and data on your device

We only use two cookies, both necessary:

• The session cookie, which keeps you signed in for up to 180 days or until you sign out.
• The language cookie, which remembers whether you prefer Spanish or English.

We don't use advertising or tracking cookies. So the app works without signal, your device keeps a copy of the events and messages you saw. When you sign out we delete your account's data from your device.

13. Changes to this policy

If we change something important, we'll publish the new version here with its date and let you know before it applies.