Privacy Policy
Imdad Relief takes the protection of personal data seriously. This policy explains what information we process, why we process it, how long it is retained, who it may be shared with and the rights you have.
Imdad Relief · 895 938 432Non-profit association · Oslo, Norway
Data controller
Imdad Relief is the controller for personal data processed by the organisation. Our organisation number is 895 938 432 and our registered address is Selma Ellefsens vei 6, 0581 Oslo, Norway.
Questions and requests may be sent to post@imdad.no. Do not send national identity numbers, card details or other sensitive information by ordinary email.
Information we may process
A national identity number or D-number is used only when secure identification is necessary, for example for relevant tax-deduction reporting. It should not be sent by ordinary email.
The information we process depends on your relationship with Imdad and how you use our services.
- Name, address, telephone number and email address
- Date of birth and, where necessary, a Norwegian national identity number or D-number
- Donation history, payment method and recurring donation information
- Campaign, project or purpose designation
- Consent and communication preferences
- Correspondence with Imdad
- Technical website information such as IP address, browser, device and cookie identifiers where applicable
Purposes
- Processing and recording donations
- Managing recurring donations
- Issuing confirmations and receipts
- Donor administration and responding to enquiries
- Meeting accounting, tax and regulatory obligations
- Reporting qualifying donations for tax-deduction purposes
- Preventing misuse and protecting payment systems
- Sending communications where there is a lawful basis
- Analytics and marketing only where required consent has been obtained
Legal basis
Processing relies on one or more lawful bases under the General Data Protection Regulation (GDPR). The relevant basis depends on the purpose and circumstances.
- Consent – Article 6(1)(a)
- Contract – Article 6(1)(b), where relevant
- Legal obligation – Article 6(1)(c)
- Legitimate interests – Article 6(1)(f), following an appropriate assessment
Donor administration in Solidus CRM
Imdad uses Solidus CRM, provided by Solidus AS, for donor administration. The system may contain donor history, contact details, communication preferences and other information needed to manage the donor relationship. Solidus AS processes information for Imdad within agreed instructions.
Payment and other service providers
Available payment methods are shown for the selected purpose. The gift is completed with the payment provider. When PayPal is available, its own donation page opens so the donor can choose an amount and confirm any monthly giving. Card data is processed by the payment provider and is not stored on this website. Returning to the Imdad website is not itself confirmation of payment.
Where necessary, personal data may be processed by CRM providers, payment providers, banks, accounting providers, auditors, hosting and IT providers, email providers and – where consent has been obtained – analytics or marketing providers. We do not sell personal data.
Reporting gifts for tax relief
Imdad reports qualifying gifts through Islamsk Råd Norge (the Islamic Council of Norway). Necessary donor details and gift amounts are shared for this reporting. Contact us to check your registration or for guidance on how to provide information securely.
International transfers
Some technology providers may involve processing outside the EU/EEA. Where this occurs, the transfer must rely on a valid transfer basis under the GDPR. The appropriate basis is assessed for the provider and processing concerned.
Server logs and visitor statistics
According to hosting provider Webspesialisten, the Apache server records the time, domain name, requested path, HTTP status, response size, referring page, browser information (user-agent) and full IP address.
The raw logs are stored only on the server, rotated daily and deleted after 14 days. The raw logs are not anonymous.
The panel calculates visitor statistics from the logs in memory and displays masked IP addresses. Masking in the panel does not change the raw logs. According to the provider, these statistics use no third-party tools, browser scripts or cookies.
Retention
Information is retained for as long as necessary for the purpose and for statutory documentation requirements. Certain accounting records must be retained for the period required by Norwegian bookkeeping and accounting law. Data that is no longer necessary is deleted or anonymised.
Your rights
Depending on the circumstances, you may have rights of access, correction, deletion, restriction, objection and data portability, and the right to withdraw consent. Withdrawal does not affect processing already carried out lawfully. You may also complain to the Norwegian Data Protection Authority, Datatilsynet.
Automated decisions
We do not currently use personal data to make decisions that produce legal or similarly significant effects solely through automated processing.
Instagram videos
Videos in the homepage Instagram feed load directly from Meta only when you select Play video. Meta then receives your IP address and technical information needed to deliver the video. The player does not send Meta login cookies and does not use Meta’s embedded player or tracking pixel. Preview images are delivered through Imdad’s image optimisation service. If you open the original post on Instagram, that service’s own privacy terms apply.