Privacy notice
How the personal data of the platform users is handled.
Who is responsible
The controller of the personal data processed on Give&Need is Studio Present (the legal entity, its registered office and registration details are to be confirmed).
Give&Need is a platform where municipalities and companies pass on office equipment they no longer need. This notice explains which personal data the platform processes, why, and what rights you have.
What data we process
We process only what the platform needs:
- Account and organization data: your name, e-mail address, preferred language and password (stored only as a hash), your role in the organization, and the organization's details. The listings, claims, messages and handovers you make are linked to your account.
- Join applications: the organization's name, type, country and city, the contact person's name, e-mail address and phone number, and the message sent with the join form.
- Analytics, only with your consent: the pages you visit, your device and browser, and an approximate location derived from your IP address, collected by Google Analytics 4 through Google Tag Manager.
- Server logs: the IP address, time, requested address and browser identifier of each request.
Why, and on what legal basis
- Running the accounts and the exchanges between organizations: performance of the platform's terms of use (GDPR Art. 6(1)(b)) and the legitimate interest of the participating organizations in passing on equipment (Art. 6(1)(f)).
- Assessing join applications and creating the organization's account: steps taken at the applicant's request (Art. 6(1)(b)).
- Measuring site traffic to improve the platform: your consent (Art. 6(1)(a)), which you can withdraw at any time.
- Security and troubleshooting: our legitimate interest in a safe, working service (Art. 6(1)(f)).
- Keeping records of completed exchanges where the law requires it: legal obligation (Art. 6(1)(c)) (the applicable obligations are to be confirmed).
How long we keep it
- Account data: while the account exists, then (period to be confirmed). Records of completed exchanges may be kept longer where the law requires it.
- Join applications: an approved application becomes part of the organization's account; a rejected one is kept for (period to be confirmed).
- Analytics data: as set in the Google Analytics property (period to be confirmed); the cookies expire as listed below.
- Server logs: (period to be confirmed).
Who receives it
Within the platform, other organizations see what an exchange needs: your organization, and on listings and claims the details of the exchange. We do not sell personal data.
Processors working for us: the hosting provider of the platform (to be confirmed) and the e-mail service that sends the platform's messages (to be confirmed).
Google Ireland Limited (Google Tag Manager and Google Analytics 4), only if you accept analytics cookies. Google may transfer the data to the United States; the transfer relies on the EU–US Data Privacy Framework and Google's standard contractual clauses.
Cookies
The site sets the following cookies. The analytics cookies are set only after you accept them in the cookie banner.
| Cookie | Purpose | Lifetime | Needs consent |
|---|---|---|---|
payload-token | Keeps you logged in. | 2 hours, renewed while you are active; deleted when you log out | No |
gn_locale | Remembers the language you chose. It stores only that choice, so it needs no consent. | 1 year | No |
gn_consent | Remembers your cookie choice. | 180 days | No |
_ga | Google Analytics: tells visitors apart. | 2 years | Yes |
_ga_<id> | Google Analytics: keeps the state of the visit. | 2 years | Yes |
Changing your cookie choice
You can change or withdraw your choice at any time with “Cookie settings” at the bottom of every page. Withdrawing deletes the analytics cookies; processing before the withdrawal remains lawful.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- have the processing restricted;
- receive the data you gave us in a machine-readable format;
- object to processing based on legitimate interest;
- withdraw your consent at any time, without affecting earlier processing.
To exercise these rights, write to the address below; we answer within one month.
You may also lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, or where the alleged infringement took place (the controller's lead authority is to be confirmed).
For users in Serbia, the Law on Personal Data Protection gives the same rights; the authority there is the Commissioner for Information of Public Importance and Personal Data Protection.
Contact
Questions about your data: info@studiopresent.com