Privacy policy

Tactical Combat Casualty Care
Privacy policy

1. General Provisions

1.1. This Privacy Policy defines the procedure for collecting, using, storing, transferring, protecting, and deleting the personal data of users of the tccc.org.ua website and the TCCC mobile application.

1.2. In this Policy, the tccc.org.ua website and the TCCC mobile application are collectively referred to as the Services, and a person who uses the Services is referred to as the User.

1.3. The contact email address of the tccc.org.ua administration for matters related to privacy and the processing and deletion of personal data is: info@tccc.org.ua.

1.4. By using the Services, registering an account, sending messages through the contact form, or using other functions of the Services, the User confirms that they have read this Policy.

1.5. If the User does not agree with the terms of this Policy, they must stop using the Services and, where necessary, submit a request to delete their data.

1.6. Personal data is processed in accordance with the legislation of Ukraine on personal data protection, as well as other legal provisions that may apply to the relevant processing.

2. Scope of the Policy

2.1. This Policy applies to personal data processed when:

visiting the tccc.org.ua website;
using the TCCC mobile application;
creating and using an account;
using the forum;
adding materials to favorites or saving them in an account;
sending messages through the contact form;
contacting support;
using third-party authentication services;
downloading educational materials to a device.

2.2. This Policy does not apply to third-party websites, mobile applications, and services that the User may access through links provided in the Services. Such third parties independently determine how personal data is processed in accordance with their own privacy policies.

3. Personal Data That May Be Processed

3.1. Depending on how the Services are used, the following categories of data may be processed:

3.1.1. Account Data

name, alias, or profile name;
email address;
data required for authentication and account access recovery;
information independently added by the User to the profile;
account identifier;
registration date and date of last activity.

3.1.2. Data on the Use of the Services

a list of materials added to favorites or saved in the account;
account settings and selected Service preferences;
activity history required for the operation of Service functions;
information about downloads of educational materials;
information about the use of specific website or application functions.

3.1.3. User-Generated Content

forum posts, comments, and replies;
questions and other materials published by the User;
messages sent through the contact form;
correspondence with support;
attached files, if this function is available.

3.1.4. Technical Data

IP address;
browser type and version;
device type and operating system;
language and regional settings;
mobile application version;
date, time, and duration of use of the Services;
addresses of visited pages;
cookies and similar technologies;
technical logs, error messages, and diagnostic data;
information required to prevent fraud, abuse, and unauthorized access.

3.1.5. Data Obtained Through Third-Party Authentication

If the User signs in to an account using a third-party service, the administration may receive an account identifier, name, email address, and other data that the User has permitted the relevant service to provide.

3.1.6. Information About Payments and Charitable Donations

If the User makes a charitable donation or another payment through a third-party payment service, the payment details are processed by the relevant payment provider. The administration of the Services does not store full bank card details, but it may receive information about the payment status, amount, date, transaction identifier, and other information required for payment records.

4. Sensitive Personal Data

4.1. The Services are not intended to collect Users' medical data, health information, exact locations of military units, personal data of injured persons, information about combat missions, or other restricted information.

4.2. The User must not publish on the forum, send through forms, or otherwise transmit:

personal medical data of patients and injured persons;
information that makes it possible to identify military personnel without their consent;
exact coordinates, routes, deployment locations, and other operationally sensitive information;
passwords, bank details, and copies of documents;
information whose distribution is prohibited by law.

4.3. If the User voluntarily publishes personal data in public sections of the forum, such data may be accessible to other users and search engines.

5. Sources of Personal Data

5.1. Personal data may be obtained:

directly from the User during registration, use of the forum, or communication with the administration;
automatically when the website or mobile application is used;
from a third-party authentication service with the User's consent;
from a payment provider in connection with a payment or charitable donation;
from mobile application stores and other technical platforms to the extent required for distributing and supporting the application.

6. Purposes of Personal Data Processing

6.1. Personal data may be processed for the following purposes:

creating, maintaining, and protecting an account;
authenticating the User and restoring account access;
providing access to personalized functions of the Services;
saving materials, settings, and selected content;
ensuring the operation of the forum and other interactive functions;
processing inquiries, questions, complaints, and suggestions;
providing technical and informational support;
ensuring the stable and secure operation of the Services;
detecting errors, technical failures, fraud, and abuse;
conducting statistical analysis and improving the Services;
complying with legal requirements and lawful requests from authorized authorities;
protecting the rights, security, and legitimate interests of the administration, Users, and third parties;
sending informational or advertising messages with the User's separate consent.

7. Legal Grounds for Data Processing

7.1. Personal data is processed on the basis of:

the User's consent;
the need to take action at the User's request;
the need to provide Service functions and maintain the account;
legitimate interests related to the security, support, and improvement of the Services;
the need to comply with legal requirements;
the need to establish, exercise, or defend legal claims.

7.2. The User may withdraw consent by contacting info@tccc.org.ua. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

8. Cookies and Analytics Technologies

8.1. The website may use cookies and similar technologies to:

authenticate the User and maintain the User's session;
save language and other settings;
ensure the operation of the website's core functions;
protect against unauthorized access and abuse;
analyze website traffic and improve the website.

8.2. The website may use tag management and web analytics tools, including Google Tag Manager and Clicky. Such services may process technical data in accordance with their own privacy policies.

8.3. The User may restrict or disable cookies in the browser settings. Disabling essential cookies may cause authentication, the personal account, and other website functions to operate incorrectly.

9. Mobile Application Features

9.1. The TCCC mobile application provides access to materials from tccc.org.ua and may use the User's account to synchronize available functions.

9.2. When the User signs in to an account through the mobile application, authentication data is transmitted to the tccc.org.ua server for verification and access authorization.

9.3. Educational materials downloaded by the User for offline access may be stored directly on the User's device.

9.4. Google Play, Apple App Store, the device manufacturer, and the operating system provider may independently process technical data in accordance with their own rules and privacy policies.

10. Transfer of Personal Data to Third Parties

10.1. The administration does not sell or transfer personal data to third parties for their independent use for advertising purposes.

10.2. Data may be transferred only to the extent necessary for the specified purpose to the following categories of recipients:

hosting, server infrastructure, and backup providers;
email and technical support providers;
authentication service providers;
web analytics and technical diagnostics providers;
mobile application stores;
payment providers;
contractors that develop, maintain, or protect the Services;
authorized public authorities in cases provided for by law.

10.3. Service providers receive access only to the data required to perform their functions and must ensure an appropriate level of confidentiality and security.

10.4. Messages and other content published by the User in public sections of the forum may be accessible to an unlimited number of persons.

11. International Data Transfers

11.1. Certain technical service providers, the mobile application developer, or servers used to operate the Services may be located outside Ukraine.

11.2. In the event of an international data transfer, the administration takes reasonable measures to ensure an appropriate level of protection, including limiting the scope of the data and access to it and using contractual and technical safeguards.

12. Personal Data Protection

12.1. Organizational and technical measures are used to protect personal data, including:

data transmission through a secure HTTPS connection;
segregation of access rights to administrative systems;
restriction of data access to authorized persons only;
use of authentication and access control measures;
protection of servers and technical infrastructure;
data backup;
security event logging;
software updates;
review of and response to reports of possible security breaches.

12.2. Despite the measures taken, no method of data transmission or storage can guarantee absolute security.

12.3. The User is responsible for maintaining the confidentiality of their password and for actions performed through their account. If unauthorized access is suspected, the User must change the password and notify the administration.

13. Data Retention Periods and Rules

13.1. Personal data is retained no longer than necessary for the purposes for which it was collected, unless longer retention is required by law or necessary to protect legitimate rights.

13.2. The following principal retention periods and criteria apply:

account data is retained for the entire period during which the account exists;
data related to saved materials, settings, and favorite content is retained until the relevant data is deleted by the User or until the account is deleted;
forum posts are retained until they are deleted and, after the account is deleted, are deleted or anonymized;
support requests and messages submitted through the contact form are retained for up to 12 months after their review is completed;
technical logs, security logs, and diagnostic data are retained for up to 12 months unless a longer period is required to investigate an incident;
data concerning consent, newsletter opt-out, and the fulfillment of personal data requests may be retained for the period required to demonstrate compliance with legal requirements;
locally downloaded materials are stored on the User's device until they are manually deleted, the application data is cleared, or the application is uninstalled;
backups may retain deleted data for up to 90 calendar days, after which the data is overwritten or permanently deleted.

13.3. Data may be retained for a longer period if necessary to comply with a legal obligation, resolve a dispute, prevent fraud, ensure security, or protect the rights of the administration, Users, or third parties.

13.4. After the retention period expires, personal data is deleted, destroyed, or anonymized so that the User can no longer be identified.

14. Deletion of the Account and Personal Data

14.1. The User has the right to request the deletion of their account and the personal data associated with it.

14.2. To submit a deletion request, the User must send an email to info@tccc.org.ua or contact@aumf.org.

14.3. The subject line of the email must state: "TCCC Account Deletion".

14.4. The request should preferably be sent from the email address used for the account. The email must include:

the email address associated with the account;
a request to delete the entire account or specific personal data;
additional information required to identify the account if the registered email address cannot be used.

14.5. To protect against unauthorized deletion, the administration may ask the User to confirm that they own the relevant account. For this purpose, an email containing a confirmation link or code may be sent.

14.6. The administration confirms receipt of the request within 7 business days. The account and active personal data are deleted within 30 calendar days after the User's identity has been confirmed.

14.7. After the request has been fulfilled:

access to the account is terminated;
profile and authentication data is deleted;
saved materials, settings, and the favorites list are deleted;
forum posts and comments are deleted or irreversibly anonymized;
the link between the account and anonymized statistical information is removed;
other data that directly identifies the User is deleted unless its continued retention is required by law.

14.8. Data contained in backups may be retained for up to 90 calendar days. During this period, it is not used for the ordinary operation of the Services and is deleted during the scheduled overwriting of backups.

14.9. Certain data may be temporarily retained after the account is deleted if necessary:

to comply with legal requirements;
to investigate a security breach or fraud;
to comply with a lawful request from an authorized authority;
to establish, exercise, or defend legal claims;
to retain evidence that the deletion request was fulfilled.

14.10. If certain data is retained on the grounds specified above, its use is limited to the relevant purpose, and once those grounds no longer apply, the data is deleted or anonymized.

14.11. Deleting the account does not automatically delete files that the User has downloaded to their device.

14.12. The User may also request the deletion of specific data without deleting the entire account. Such a request must clearly specify which data is to be deleted.

15. User Rights

15.1. The User has the right to:

receive information about the processing of their personal data;
obtain access to the personal data being processed;
request the correction of inaccurate or outdated data;
request the deletion of data;
withdraw previously given consent;
object to processing in cases provided for by law;
request restriction of processing;
opt out of informational and advertising messages;
lodge a complaint with the competent personal data protection authority;
protect their rights by other means provided for by law.

15.2. To exercise their rights, the User may contact info@tccc.org.ua.

15.3. Before fulfilling a request, the administration may reasonably verify the identity of the applicant to prevent the disclosure, alteration, or deletion of data by a third party.

16. Informational and Advertising Messages

16.1. Informational or advertising messages are sent only with the User's appropriate consent or on another lawful basis.

16.2. The User may opt out of such messages by using the unsubscribe link in the message or by contacting info@tccc.org.ua.

16.3. System messages related to security, password changes, account operation, or the fulfillment of the User's request may be sent regardless of consent to receive advertising messages.

17. Minors' Data

17.1. Persons who have not reached the age at which they may independently consent to the processing of personal data under applicable law must use the Services with the consent of a parent or legal representative.

17.2. The administration does not knowingly require minors to provide additional personal or sensitive data.

17.3. If a parent or legal representative believes that a minor has provided personal data without proper consent, they may contact info@tccc.org.ua and request the deletion of such data.

18. User Responsibility

18.1. The User must provide accurate data and update it promptly if it changes.

18.2. The User must not provide the administration with third parties' personal data without an appropriate legal basis or their consent.

18.3. The User is solely responsible for personal data and other information that they publish in public sections of the forum.

19. Changes to the Privacy Policy

19.1. The administration may periodically update this Policy due to changes in legislation, Service functionality, the composition of service providers, or data processing methods.

19.2. A new version takes effect when it is published on the tccc.org.ua website unless otherwise specified in the updated Policy.

19.3. If changes materially affect Users' rights or data processing procedures, the administration may additionally notify Users through the website, mobile application, or email.

20. Dispute Resolution

20.1. The parties will attempt to resolve disputes related to the processing of personal data or the use of the Services through negotiations and the exchange of written communications.

20.2. If a dispute cannot be resolved through negotiations, it will be considered in accordance with applicable law.