Privacy Policy

This policy is prepared in compliance with EU GDPR and Mongolian privacy law. This website belongs to the Darkhan Women Federation (DWF), implementing partner for the EU-funded "Empowering Women at Work" project (Contract NDICI HR INTPA/2025/489-198).

1. Data Controller

Darkhan Women Federation (DWF) is the data controller responsible for processing your personal data.

Address: Women's Palace, 13th Bagh, Darkhan Soum, Darkhan-Uul Province, Mongolia

Phone: 77358486

Email: darkhanwomenfederation@gmail.com

2. Data We Collect

We may collect the following data:

• Contact form: name, email, phone number, message

• Donation form: name, donation amount, contact details

• Volunteer/membership registration: name, contact details, area of interest

• Analytics: page views, clicks (anonymised)

⚠️ AI Rights Assistant chatbot: Fully anonymous. No personally identifiable information is collected, stored, or logged on our servers.

3. Purpose of Processing

We use your data for the following purposes:

• Responding to your enquiries, requests, and donations

• Sending programme updates and notifications (with your consent)

• Processing programme and training registrations

• Fulfilling legal and reporting obligations

• Reporting under EU Contract NDICI HR INTPA/2025/489-198

4. Legal Basis (GDPR)

Legal basis for processing your data:

• Contractual performance: processing registrations, donations, and contact requests

• Legal obligation: tax, audit, and EU contract reporting requirements

• Consent: opted-in mailing updates

• Legitimate interest: analytics supporting organisational operations

5. Data Sharing

We do not sell, rent, or give away your data. We only share data in the following cases:

• Service providers (e.g. email delivery) — under contractual restrictions

• The EU and auditors — per Article 8 of Contract NDICI HR INTPA/2025/489-198 (the European Commission, OLAF, and external auditors have the right to on-the-spot checks)

• Where required by law

The European Union holds a royalty-free, non-exclusive, irrevocable licence to use, reproduce, and communicate this website and chatbot materials globally (Art. 5.2).

6. Retention Periods

• Contact form and enquiry data: 3 years

• Donation records: 7 years (tax law compliance)

• Audit records (source code, supporting documents): 5 years following payment of the contract balance (Art. 8.1)

• Chatbot conversations: never stored on server

7. Your Rights (GDPR)

You have the following rights under GDPR:

• Right of access: see what data we hold about you

• Right to rectification: correct inaccurate data

• Right to erasure ("right to be forgotten"): request deletion under certain conditions

• Right to restrict processing: limit our use of your data

• Right to data portability: receive your data in a portable format

• Right to object: withdraw consent at any time

To exercise your rights: email darkhanwomenfederation@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the relevant Mongolian supervisory authority.

8. International Transfers

When you use the AI Rights Assistant (powered by Google Gemini), your messages are processed on Google servers. No personal data is included, so GDPR Article 44 transfer restrictions do not apply. Google privacy policy: policies.google.com

Analytics (Google Analytics) processes data in anonymised form. You can disable this through the cookie consent settings.

9. Security

We take the following security measures:

• HTTPS/TLS encryption with HSTS

• Content Security Policy (CSP) headers

• Access controls and rate limiting

• Chatbot conversations not stored — fully anonymous

• MongoDB encrypted database

In the event of a data breach, we will comply with GDPR 72-hour notification requirements.

10. Policy Changes

We may update this policy periodically. We will notify users of significant changes on the website. We encourage you to review it regularly.