Privacy Policy

The privacy policy on this page was last updated 10/14/2026

1. General

Mission East’s IT Security and Data Protection policy applies to all information you provide to us by virtue of your role as member, contributor, donor, participant in our activities, prospect, supplier, partner, beneficiary or user of our services, including when you visit our website.

At Mission East, we take care of the personal data you provide when interacting with us. On this page you can read about the data we collect, why and how we process it, how long we store it, and the security measures we have in place. We also set out your rights and how to exercise them.

Please read this page and contact us if you disagree with its contents, either in part or in whole. You can always download the current version of our IT Security and Data Protection policy.

2. Data Controller

2.1 Organisation

The organisation responsible for processing your personal data is:

Mission East

Kastaniehuset – Bernstorffsvej 20C.1, 2900 Hellerup, Denmark

www.missioneast.org

CVR number (company number): 1472 3692

(hereinafter the “Organisation”)

2.2 General framework

The general legal framework for our processing of personal data is the European General Data Protection Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC. In addition, we comply with the Danish Data Protection Act No. 502 of 23 May 2018, which contains supplementary provisions to the Regulation. Finally, we are a member of ISOBRO and are committed to marketing laws in our fundraising activities.

2.3 Commitment

This page commits Mission East when processing your personal data. All queries regarding this page, the processing of your data and any suspicion of non-compliance should first be directed to:

Annette Them Serup, Finance & Administration Director – complaints@missioneast.org

3. Definitions

Personal Data is defined by the GDPR as any kind of information about a person (you) which alone or combined can lead to your identification as a physical person, regardless of how the data is stored and processed, electronically or not.

Public Data is any information about you that can be made freely accessible by anyone or already is (for example social media, public records, press releases and promotional materials). Such data can be collected and processed without consent as long as it is used in accordance with the purpose of its original publication, and the data subject is informed of the source we have used.

Confidential Data is any of your personal information that is neither public nor sensitive. Such data requires elevated access permissions and often your consent. Bank account, family relationships, private phone number and email address are examples.

Special Categories of Personal Data reveal your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and include the processing of your genetic data, biometric data for the purpose of uniquely identifying you as a natural person, data concerning your health, or data concerning a natural person’s sex life or sexual orientation. Such data may only be collected if absolutely required and with your informed consent.

Processing means every operation performed on your personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Data Controller is the agency or other body which alone or together with others defines the purpose and the means for gathering your personal data. Mission East is the data controller of the personal data it holds on supporters, local partners, donors, recipients of marketing activities, third parties and other contacts used for our activities.

Data Processor is the physical or legal entity, authority, institution or other organisation which manages personal data on behalf of Mission East. Where Mission East receives, stores and processes personal data for the purposes of others, Mission East is the data processor.

Data Subject is, for the purpose of this page, you: the individual who can be identified behind the data.

Authorised Users or Data Users are staff who need access to information to complete the tasks they are assigned and fulfil the purpose of their role.

Pseudonymisation means processing your personal data in such a manner that it can no longer be attributed to you without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data is not attributed to you.

Personal Data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

4. What happens with your data

4.1 Purpose of processing your personal data

Depending on whether you subscribe to newsletters or take part in one of our activities, are a member or a contributor, a volunteer, a user of our website, a beneficiary of our programmes, a consultant, a partner or one of our providers of services or products, we are under an obligation to process your personal data to the extent necessary to provide you with the services you request and to fulfil our obligations as a member association. This applies to the management of any kind of contribution from you, unless you decide to contribute anonymously, to any services, products or support you expect to receive from us, and to any memberships you hold with us. Our processing may also include your use of our website.

4.2 Your personal data that we process

Personal data we collect directly from you:

When you donate to us or are a member of the association, we may process the following information if you have provided it to us: first and last name, date of birth, address, phone number, email address, CPR or CVR number, bank details including registration and account number if you pay with MobilePay, make a bank transfer or a recurrent payment, card details if you pay by credit card, and IP address if you donate via our digital services.

When you use our digital services, we process your IP address (website activity). See also the section on cookies if you have given your consent.

When you subscribe to newsletters or participate in one of our campaigns or activities, we may process the following information if you have provided it to us: first and last name, address, phone number, email address, and other personal data provided at your own initiative.

In some cases we need to collect information about you from others, for example from the Danish Civil Registration System, telephone companies and postal services. We collect such information to keep your contact details up to date so that you can receive materials from us, and to complement the information we hold about you, for example if we need your address.

If you work with us for one of our suppliers or partners, we may process the following information if you have provided it to us: first and last name, job title, phone number, email address, nationality and gender. We may further process information about your professional background (qualifications, CVs, relevant experience, training and capacity building records).

If you are an individual consultant either applying for or delivering a service to us, we may process the following information: first and last name, title, phone number, email address, nationality and gender, company tax or identification number and banking information. We may further process information about your professional background (qualifications, CVs, relevant experience, training and capacity building records).

When you apply as a consultant, supplier or partner, we process the following information: incident and safeguarding reports, including complaints, ethical concerns, protection-related issues and criminal record, either because you provide them to us or as a result of our due diligence screening.

When you are a beneficiary of our development or humanitarian programmes, we may process the following information if you have provided it to us: first and last name, date of birth, gender, nationality, household composition, contact information (address, phone number, email and so on), demographic and socioeconomic data (such as education level, employment status, income level and living conditions), health and disability information (such as medical conditions, disabilities and special needs relevant to programme support), vulnerability and protection data (status as a refugee, internally displaced person or other vulnerable category), programme participation data (details of assistance received, engagement in activities, feedback and assessments), consent and communication preferences, and photos and testimonials.

If you work with us for one of our donors (government agencies and multilateral organisations, development banks, private foundations, institutional NGO donors or corporate and CSR funds) or for a professional alliance: first and last name, job title, phone number, email address, nationality and gender.

When you visit some of our premises, we may also process the following information: your full name, organisation, and time and date of visit. This applies at the Mission East Afghan office (Taimani, Kabul, 3114, Afghanistan).

If you are on our premises (main office: Bernstorffsvej 20C.1, 2900 Hellerup, Denmark; Afghan office: Taimani, Kabul, 3114, Afghanistan; Syrian office: Damascus, 86, Syria; our two Tajik offices: Dushanbe, 734003, and Khorog, GBAO, 736000, Tajikistan), we monitor the entrances and some offices with video cameras.

4.3 Cookies

A cookie is a small text file stored in your browser when you visit our website. We use cookies to make the website work, to measure traffic and to display and measure the effect of our advertising.

We use Cookiebot by Usercentrics to obtain and document your consent. Your choice is stored in your browser for up to 12 months, and you can change it at any time via the cookie banner. Apart from the cookies necessary for the website to function, cookies are only set once you have given your consent.

We use Google Tag Manager and Meta Pixel, among other tools. Some of these may process your IP address, information about your browser and the pages you visit. If we share information about your use of the website with our social media, advertising and analytics partners, they may combine it with other information you have provided to them or that they have collected through your use of their services.

You can set your browser to notify you about the use of cookies so you can decide case by case, and you can disable cookies completely. If you do, some functions on the website may not work optimally.

You can always see the current overview of the cookies we use in our cookie policy.

4.4 Why we process your personal data (purpose)

We use your personal data for several purposes, depending on whether you are a member or contributor, a user of our website, a participant in our activities, a volunteer, a beneficiary, or working as a consultant or for our partners, suppliers, donors or professional alliances.

If you are a member or contributor, we use your personal data to:

• manage your membership or contribution
• contact you regarding your membership or contribution, inform you about our activities or ask you to assess our work by post, email, telephone and social media platforms
• report your membership fee or contribution to the Danish tax authorities (Skattestyrelsen) so that your contribution appears on your tax assessment notice
• send you personalised newsletters and marketing material, in compliance with marketing laws
• offer you the best user experience and build the best possible relationship with you based on your personal data, donations, behaviour on our website and response on social media. To do so, we may match your behaviour profile with one of our segments, which is called profiling and automation
• send you newsletters if you have subscribed to them
• process information regarding our correspondence with you, including your inquiries
• generate statistics for insights into donor demographics and donation trends
• improve the functionality of our website and compile usage statistics

If you are just a user of our website, we use your personal data based on your consent to:

• make functions on our website available to you
• gather statistics on behaviour on our website and optimise its appearance and navigation
• target advertisements on social media platforms

If you have participated in one of our campaigns or activities, we use your personal data to contact you to share our results, propose another activity or suggest another way to contribute to our work, unless you have actively refused to be contacted.

If you are a volunteer, we use your personal data to:

• create and manage your volunteer profile
• communicate with you and coordinate internally
• inform you about our activities

If you are a beneficiary, we use your personal data, generally pseudonymised and presented as statistics, to:

• define the target group for the aid we provide
• design, assess and adapt our programmes and the services we deliver
• coordinate joint humanitarian and development responses, prevent duplication of aid, and manage collaborative projects and communication
• track our service delivery, measure impact and improve the effectiveness of our programmes
• facilitate donor engagement and reporting
• learn from our efforts and enhance accountability and learning within the networks we are part of

We may also use your personal data without pseudonymising it to:

• ensure tailored support, including medical assistance, accessibility accommodations and special provisions
• identify at-risk groups, prioritise assistance and comply with safeguarding policies
• communicate your story to make our efforts more concrete in communication that aims to raise funds, either public or private. In such cases you will always be informed in advance and asked for your consent, with the opportunity to refuse without consequences for you

If you are working as a consultant or for our partners, suppliers, donors or professional alliances, we use your personal data to:

• ensure cooperation and communication with you as a representative of your organisation or company, or as a consultant
• comply with our safeguarding and anti-fraud duties

If you are on our premises, we use:

• the visitors register and video recording to investigate any cases of violence, theft or crime at our address. We download the footage and hand it over to the police, who process the case
• the visitors register to ensure security at the premises, for example in case of fire, to ensure that all people are evacuated
• video recording during some meetings to document the transparency and fairness of certain negotiations. We will always inform you in advance of such recording and will store the records until the end of the final audit of the project concerned

4.5 Why we may process your personal data (legal basis)

We must have a legal basis for processing your personal data.

When you become a Mission East member, make a contribution, enter into any kind of agreement with us, or have queries prior to entering into an agreement with us, we process your personal data to fulfil our contractual commitment with you. The legal basis is then a contractual interest as defined in Article 6(1)(b) of the GDPR.

We may also process your personal data because we have a legitimate interest in doing so, cf. Article 6(1)(f) of the GDPR, unless your right to have your personal data protected takes precedence over our legitimate interest. Our legitimate interests are, for example:

• to raise funds to provide humanitarian response and development aid to vulnerable people and fragile communities affected by crisis
• to better customise our offers and services to you, either as a beneficiary or as a member, contributor or prospect. In the latter cases we also comply with all provisions of the Danish Marketing Practices Act
• to document our processes
• to improve our deliveries and increase the value we add to people
• to understand trends and adjust our strategies and, ultimately, deliver the products and services that best meet your needs and preferences
• to ensure security at our premises

In certain cases we have a legal obligation to process your personal data, cf. Article 6(1)(c) of the GDPR, for example when we need to update your personal data or in connection with documentation of audit trails, pursuant to the provisions of the Danish Bookkeeping Act requiring accounting records to be kept for five years from the end of the accounting year, or the European rules requiring records to be kept for up to nine years after the end of an EU funded project. Another example is your civil registration number, which must be included when reporting to the Danish tax authorities.

We may have your vital interest in mind, as defined by Article 6(1)(d) of the GDPR, when we process health information or other special categories of personal data such as ethnicity or belonging to specific groups in order to tailor our support, including medical assistance, accessibility accommodations and special provisions for specific groups.

We need your consent as a legal basis, cf. Article 6(1)(a) of the GDPR, to process some personal data, including special categories of personal data, personal data concerning a child (an individual under 18 years), references, criminal records and due diligence screening output, personified portrait photos and portrait or group photos where the subject is easily identifiable, and digital information gathered via cookies.

4.6 Sharing your personal data

When we share your personal data, it is always limited to what is necessary for specific purposes aligned with our legitimate, legal or contractual interest, and sharing is based on clearly defined roles and signed data processor or corresponding agreements. You can see the list of the organisations we may share your personal data with at the end of this page.

We may share your personal data with our suppliers and partners who contribute to delivering our services to you, or who assist us with our IT operations, systems, hosting, payment services or marketing.

We may also share your data with other humanitarian or development agencies or alliances to coordinate and deliver joint initiatives.

In addition, we share your data to the extent that we are obliged to do so, for example due to requirements to report to public authorities such as the Danish tax authorities (Skattestyrelsen).

4.7 Sharing your personal data with recipients outside the EU/EEA

As an international NGO, we operate with our own offices as well as partners and donors outside the European Union (EU) and the European Economic Area (EEA). We also have suppliers outside the EU/EEA. For these reasons, we may transfer your personal data outside the EU/EEA. This is generally the case for personal data concerning natural persons in our countries of operation, and it happens occasionally with European citizens’ personal data.

You can see the list of the organisations based outside the EU/EEA that we may share your personal data with at the end of this page.

We share your personal data with a recipient outside the EU/EEA if one of the conditions below is fulfilled:

• we have agreed appropriate safeguards and standard data protection provisions passed by the European Commission with the recipient receiving your personal data (GDPR Article 46)
• the recipient is either a signatory of a code of conduct as per GDPR Article 40(2) or 40(3), or has a certification in accordance with GDPR Article 42, and we have signed a data transfer agreement
• the relevant country or international organisation has a sufficient level of protection as determined by the European Commission (GDPR Article 45)
• our local representation or office has signed and adopted our Binding Corporate Rules (GDPR Article 47)

When any of the conditions above are fulfilled, we may also share your personal data outside the EU/EEA based on contractual, legal, vital or public interest. If the transfer is based on our legitimate interest or on a previous consent you gave us, we will ask for your formal consent highlighting the data transfer (GDPR Article 49).

You may at any time request information about or a copy of the required guarantees that form the basis of sharing personal data with recipients outside the EU/EEA and, if exceptions apply according to GDPR Article 49, the exceptions that form the basis for any such sharing.

4.8 Storage and deletion of your personal data

We store and process your personal data as long as there is a legal and legitimate reason for doing so. Wherever possible, we use automated deletion and pseudonymisation processes in our systems. Where our systems do not allow us to use such processes, we have established ongoing controls to ensure that personal data is reviewed and deleted or pseudonymised.

• If you are a member or contributor, we retain your personal data for five years plus the current year from your last economic transaction, in accordance with the Danish Bookkeeping Act.
• If you are a volunteer, we retain your personal data for a maximum of 18 months after the relationship has ended, so that we can access your history if you come back to us in one or another role.
• If you participate in one of our campaigns or activities without financial commitment, we store your personal data for up to 18 months after the campaign or activity expires, to document the engagement.
• If you are just a user of our website or communicate with us on social media, we process information about your use of the website in accordance with your consent. You can see the individual cookies and their lifespan in our cookie declaration.
• If you are a beneficiary, we keep your personal data for up to one year after the project is finished in order to document our activities. Afterwards, your personal data is pseudonymised.
• If you are a beneficiary and have given consent to share your testimonial, we keep your personal data for the duration agreed in the consent.
• If you work as a consultant, we retain your personal data for at least five years plus the current year from the end of your contract, in accordance with the Danish Bookkeeping Act, and for up to nine years in accordance with EU audit rules.
• If you work for our partners, suppliers, donors or professional alliances, we keep your personal data for up to one year after the termination of our relationship with you.
• If you have requested not to be contacted any longer, we keep your information on the list of people we should not contact, unless you have actively requested that we delete your information.
• If you visit premises under video surveillance or with a guest register, we keep the video recording and your personal data for 30 days.

5. Your rights

If you want to exercise one of your rights or one of the options described below, please send your request in writing to person_data@missioneast.org.

We will always follow up without undue delay, normally considered as one month, informing you about the action we have taken or engaging in a dialogue to clarify any question or issue, for example if we have a legal interest in processing your personal data that conflicts with your request.

5.1 Insight

You are entitled to gain insight into the personal data we process about you, including which data we have registered about you, how we process it and the purposes for which it was collected.

5.2 Correction and deletion

You are entitled to request that the personal data we process about you be corrected (GDPR Article 16) or, on grounds relating to your personal situation, deleted (GDPR Article 17). You also have the right to be forgotten, which means that you can request that we no longer contact you. We will comply with your request as soon as possible to the extent necessary. If, for some reason, we are not able to comply with your request, we will contact you.

However, if you have requested not to be contacted by us, your contact information is registered on a special list in order to comply with your request, and we will not be able to delete your information from that list. Your request for deletion under the article above, in connection with your right to be forgotten, will therefore not apply to the list of people we should not contact. In other words, if you have declined to be contacted and at the same time asked us to delete your personal information, your contact information will still appear on that list so that we can ensure that we do not contact you again.

5.3 Limitation of or objection to processing

In certain circumstances and in accordance with GDPR Articles 18 and 21, you are entitled to request a limitation on the processing of your personal data, such as limiting the type of data we may process, the purposes we process it for, or excluding any processing for marketing purposes.

To the extent defined by GDPR Article 22, you also have the right not to be subject to a decision based solely on automated processing, including profiling.

You are also entitled to ask us not to process your personal data in cases where the processing is based on our legitimate interest, public interest or exercise of authority (GDPR Article 6(e)). The extent to which we process your data for such purposes appears from this page.

5.4 Withdraw your consent

You are entitled to revoke your consent at any time (GDPR Article 17(b)), and we will stop processing your personal data without undue delay unless there is another legal ground for processing. Your revocation does not affect the lawfulness of processing carried out prior to the revocation.

You may at any time revoke your consent to receive promotional information and offers in general, including by ordinary post, email, text message, telephone or other electronic means, by writing to us at person_data@missioneast.org.

If we are unsure of the identity of the person the revocation comes from, we may ask you to identify yourself. This is free of charge, except for the ordinary costs of communication.

5.5 Data portability

You are entitled to receive your personal data, meaning the information about yourself that you have provided to us, in a structured, commonly used and machine-readable format (data portability, GDPR Article 20).

5.6 Potential consequences of not providing personal data

If we need you to provide your personal data yourself, this will appear in the places where we collect such data. You may not wish to provide us with this personal data; as a consequence we may not be able to provide you with the services you request, register you as a contributor, enter into a contract with you, and so on.

6. How we create security around your data

Internally in our organisation, our processing of personal data is subject to our IT Security and Data Protection policy. This policy also contains rules for conducting risk and impact assessments of existing, new or changed processing activities. We train our staff and have implemented internal rules and procedures to ensure an appropriate level of security from the time of collecting personal data until deletion, including access rights limited to the people who need to process your personal data for the purpose of their role.

Externally, the processing of personal data is always carried out by data processors maintaining at least the same security standard as ours and who use Transparent Data Encryption for storing personal data, including backup data. HTTPS is used to encrypt data during transmission.

7. How to complain

You may at any time exercise your right to complain:

• first by contacting us at complaints@missioneast.org
• secondly at the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, DK-2500 Valby, phone +45 3319 3200, email dt@datatilsynet.dk, or via the electronic form at www.datatilsynet.dk

8. Update of this page

Mission East is committed to complying with the fundamental principles of personal data protection and privacy. Therefore, we regularly review our IT Security and Data Protection policy as well as this page to keep it up to date and in accordance with applicable principles and legislation.

Any future changes will be published on this page and can be sent to you by email if you so wish.

9. Sharing list

The following organisations, companies or systems are covered by either a data processor agreement (within the EU/EEA), a data transfer agreement (outside the EU/EEA) or a contract that contains corresponding terms.