Privacy policy

1. Controller and scope

The controller for personal data processed through this website is Paw Alliance International (PAI), an Austrian association. The full association name, address, ZVR number and contact details are provided in the imprint. This policy describes the intended website functions, including public content, newsletters, petitions, contact, donations, optional donation accounts and administration.

2. Processing principles

PAI processes personal data for specified purposes, transparently and only to the extent needed. Donation, petition, survey and newsletter data is not automatically combined. In particular, none of those activities subscribes a person to the newsletter without separate consent. Passwords, payment secrets and comparable security information are never stored in plain text.

3. Website access and server logs

Technical log data may be processed when the website is accessed, including IP address, time, requested resource, transferred data volume, browser identifier and referrer. This supports secure delivery, error analysis and abuse prevention. Logs are retained only as long as required for security, operation and investigation of specific incidents. The legal basis is the legitimate interest in a secure and functional website.

After voluntary consent to the “Statistics” category, PAI performs privacy-conscious first-party audience measurement without an external analytics provider. The requested path, content language, time and an HMAC of the technical session identifier generated with a secret system key are processed. The session identifier itself, IP address, browser identifier, referrer, name and email address are not stored in the analytics table. The data is used only for aggregate page-view, unique-session and popular-page figures in the protected administration area. Do Not Track and Global Privacy Control are respected. Analytics data is deleted automatically after no more than 395 days. The legal basis is consent, which can be withdrawn for the future through the privacy settings at any time.

4. Forms, newsletters and petitions

Form data is processed to handle the respective request. The German-only newsletter uses double opt-in and a separate consent. This also applies when the optional newsletter choice is made in the donation form or donation account: the donation and account are processed independently, and newsletter messages begin only after the separate confirmation email has been approved. Every message contains a visible unsubscribe option and the system additionally supports standardized one-click unsubscribe. Withdrawal immediately changes the status to unsubscribed and also prevents messages that have already been queued but not yet sent.

When the contact form is used, PAI processes the name, email address, selected topic and message solely to allocate and answer the enquiry and conduct necessary follow-up communication. The legal basis is Article 6(1)(b) GDPR where the enquiry requests pre-contractual measures; otherwise it is the legitimate interest in handling genuine enquiries and reliable communication under Article 6(1)(f) GDPR. The website does not create a permanent contact-request record in a dedicated application table. The message is delivered to the PAI mailbox configured in the website settings through an encrypted, temporary queue. It is deleted there after the enquiry has been handled unless a statutory retention obligation or the establishment, exercise or defence of legal claims requires longer retention. Contact requests do not create a newsletter subscription and are not used for advertising.

For reliable newsletter delivery, the campaign, scheduled run, recipient assignment, delivery status, attempt count and delivery or failure timestamp are processed. Technical error messages are stored in a limited form and must not contain unnecessary content or credentials. No open-tracking pixels or personal click profiles are used.

For petitions, PAI processes the email address and only the additional fields visibly enabled in the relevant form, such as first name, last name, country or city. The record also includes status, language, consent and confirmation timestamps, an encrypted snapshot of the consent text and the related version of this privacy policy. A signature is counted only after email confirmation. A participation receipt containing a personal, non-public withdrawal link is sent after successful confirmation. That link allows support to be withdrawn for the future and removed from the public count at any time. Optional consent to updates about the specific petition is stored separately from the general newsletter and is also ended upon withdrawal. The data is used solely to administer the specific petition, reliably count confirmed signatures and demonstrate the integrity of the process. Participation is based on consent under Article 6(1)(a) GDPR. Where support for a petition may allow inferences about political beliefs, that consent explicitly also covers this possible processing of special categories of personal data under Article 9(2)(a) GDPR.

For security and abuse prevention, PAI uses time-limited rate limits and pseudonymous HMAC identifiers on the basis of legitimate interests under Article 6(1)(f) GDPR. The raw IP address is not stored in the petition-signature table. Supporter data is not displayed publicly; only the aggregate number of confirmed signatures is public. Signing does not create a newsletter subscription, data is not used for advertising and no automated decision-making takes place.

5. Donations and payment processing

A donation requires at least the amount, currency, payment method, payment frequency, status, unique reference, relevant timestamps and an email address. The email address is needed to match the payment, send bank transfer instructions and provide a donation or payment confirmation after receipt. The donor chooses whether the donation is private or made for a company; a company donation additionally stores the company name in encrypted form. The current online form does not collect a salutation or postal address. A bank transfer initially creates a pending one-time payment instruction; its status changes only after the payment is actually matched. Where Stripe is enabled, payments are processed through Stripe Hosted Checkout. For a recurring donation, PAI additionally processes the selected monthly, quarterly, six-monthly or yearly interval, Stripe customer, subscription and invoice identifiers, subscription status, the current billing period and scheduled cancellation information. A personal non-public link creates a short-lived Stripe Customer Portal session when needed so that the payment method and cancellation can be managed. PAI does not store full card or wallet payment details. Information on recipients and international transfers will be completed and reviewed before Stripe is enabled in production.

6. Austrian tax consideration

First name, surname and date of birth are not collected for every donation. These fields are offered only to private donors and only after PAI has verified the required BMF eligibility and authorization to report through FinanzOnline. Only where the donor expressly requests Austrian tax consideration are the registered first name, surname and date of birth mandatory. Under Austrian rules, providing this information indicates that the donation is to be considered as a special expense and requires PAI to make the statutory report. No tax report is made where this information is not provided. Company donations are not processed through this private identity reporting route. Tax data is encrypted and is never used for advertising.

7. Optional donation account

The donation account is optional. It may be requested expressly during a donation or, where the feature is enabled, through a standalone registration using the email address. An inactive account is created first and a time-limited activation link is sent to the supplied email address. Sign-in is possible only after the address has been verified and a secure password has been set. Stored data includes the encrypted email address, a non-reversible HMAC lookup value, password hash, language, account and verification status and necessary security timestamps. Activation and reset tokens are stored only as hashes with an expiry.

After activation, earlier and future donations using the same normalised email address are linked to the account. This uses an email HMAC generated with a secret system key rather than a public plain SHA hash. No newsletter consent is created. The account provides access to linked transactions, password changes and account deletion.

8. Account deletion and retention of payment records

Deleting an account removes sign-in access and the visible account-history link and makes the account identifier unusable. It does not automatically erase payment, accounting or tax records that PAI must retain under law or for the establishment, exercise or defence of legal claims. Such records remain separate from the deleted login and are erased or anonymised after the relevant retention or limitation period. A lawfully retained transaction may therefore be linked again if the same person later donates using the same address and verifies a newly requested account.

9. Passwords, sessions and account security

Passwords are stored only with the secure hashing mechanism provided by Laravel. Sign-in attempts, activation links and password reset requests are time and rate limited. Session identifiers are renewed after security-sensitive actions. Strictly necessary cookies may be used for sessions, CSRF protection and sign-in. They are not marketing cookies.

10. External content and Google Maps

External map content is not loaded automatically. Google Maps is embedded only after the visitor actively selects it. Loading creates a connection to Google that may process the IP address. First-party audience measurement does not use an external analytics provider. External analytics and marketing trackers are not enabled. Any such services added later will be blocked until any required consent and this policy will be updated.

11. Recipients and processors

Data is available only to persons and providers who need it for operations, hosting, email delivery, payment processing, accounting, security or statutory reports. Providers are reviewed contractually and for data protection. Where eligibility exists and the donor requests it, Austrian donation reports are submitted to the financial administration through FinanzOnline. Personal donor information is not published.

12. Legal bases

Depending on the activity, processing is based on steps or services expressly requested by the user, statutory accounting and tax obligations, consent such as for newsletters or optional external content, or legitimate interests in security, abuse prevention, evidence and reliable operations. Consent can be withdrawn for the future where it is the applicable legal basis.

13. Retention

Data is retained only while required by its purpose, statutory retention duties or possible legal claims. Unconfirmed petition signatures and expired confirmation data are deleted automatically after the short technically configured retention period. Confirmed petition signatures are retained until the documented petition purpose has ended and thereafter only while required for evidence or the establishment, exercise or defence of legal claims. Unused account tokens expire automatically. Account data remains until the account is deleted; payment and tax records follow their applicable legal periods independently. Concrete deletion and review intervals are technically documented and run regularly.

14. Data subject rights

Subject to the GDPR, individuals have rights including access, rectification, erasure, restriction, portability and objection and may withdraw consent. A complaint may be made to the Austrian Data Protection Authority. Requests can be sent to the contact address in the imprint. Appropriate identity verification may be required to prevent unauthorized disclosure.

15. Changes and document version

This policy is updated when functions, providers or legal bases change. The published version and effective date are documented. This draft must receive final legal and organisational review before publication and before production payments are enabled.