Privacy & cookies

Who is responsible

Pamoja Girls is a Danish voluntary association (CVR 41977493), Amerika Plads 32B, 1. 3., 2100 København Ø, Denmark. We are responsible for the personal data collected on pamojagirls.org. You can always reach us at hello@pamojagirls.org.

What we collect and why

We only collect what we need, and we never sell your data or use it for advertising.

• Book applications: your name, role, email and phone, and the details about your organisation and group you give us. We use them to review your application, get the books to you and follow up. Kept for 3 years after our last contact.
• Newsletter: your email and language, with your consent. We use it only to send you stories a few times a year. Kept until you unsubscribe: every newsletter has an unsubscribe link, or write to us.
• Donations: your name, email, country and the amount. We use them to process your donation, send a receipt and keep our accounts. Card details go straight to Stripe; we never see them. Kept for 5 years, as Danish bookkeeping law requires.
• Shop pre-orders: your name, email, phone, delivery address and what you ordered. We use them to deliver your order and keep our accounts. Kept for 5 years, as Danish bookkeeping law requires.
• "Tell me when it opens" (shop): your email and the product. Used only to tell you when that drop opens, then deleted.
• Leaders' portal: your name, email, organisation, country and region, the messages you post and the resources you ask for. We use them to run the portal and decide who gets access to the books. Kept while you have an account; ask us and we delete it.
• Emails to us: what you write and your address, kept in our email for as long as we need it to help you.

Our legal basis

We collect newsletter sign-ups with your consent, which you can withdraw at any time. Applications, donations, orders and portal accounts are handled because you ask us to (to process your application, donation or order), and because we have a legitimate interest in running our programme. We keep accounting records because the law requires it.

Who helps us

A few trusted services store or process data for us, under data processing agreements:

• Supabase: our database and the leaders' logins. Stored in the EU (Paris).
• Vercel: hosts the website.
• Stripe: handles all payments and receipts. Stripe is also responsible for the payment data it needs to prevent fraud and meet financial rules.
• Google Workspace: our email.

Where data leaves the EU, it is protected by the EU's standard contractual clauses or the EU–US Data Privacy Framework.

Cookies

We don't use tracking or advertising cookies, so there is no cookie banner.

The leaders' portal sets a login cookie so you stay logged in. It is strictly necessary and only used for that.

Our visitor statistics (Vercel Web Analytics) work without cookies and without collecting personal data: we only see totals, like how many people visited a page.

When you pay, Stripe's payment page uses its own cookies to keep the payment secure.

Photos of girls

We only publish photos that the partner organisation confirmed it has consent for, from the girls and their parents. If you see a photo that should be removed, write to us and we take it down.

Your rights

You can ask us to see the data we have about you, correct it, delete it, limit how we use it, object to how we use it, or get a copy to take elsewhere. Write to hello@pamojagirls.org; we answer within a month.

If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk. We'd be grateful if you talk to us first.