Privacy Policy

Last updated: 15 October 2026

Spot the Dot is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we process personal data when you visit our website, contact us or make a donation.

1. Who is responsible for your personal data?

Spot the Dot: Verein zur Förderung des Bewusstseins für verschiedene Arten von Hautkrebs

Goldschlagstrasse 82/36
1150 Vienna, Austria

Email: contact@spotthedot.org
Website: https://spotthedot.org

Spot the Dot is the controller responsible for the processing of personal data described in this Privacy Policy.

2. What personal data do we process and why?

Contact enquiries

When you contact us by email, we process the information you provide, such as your name, email address and message, to respond to your enquiry and manage any subsequent communication.

The legal basis for this processing is our legitimate interest in responding to enquiries and communicating with people who contact us, in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR).

Donations

Spot the Dot accepts donations by PayPal and bank transfer.

When you make a donation, we may process information such as your name, payment or transaction details, donation amount and any other information made available to us in connection with the donation.

We use this information to receive and administer donations, maintain financial records and fulfil our legal and accounting obligations.

The legal basis for this processing is compliance with legal obligations under Article 6(1)(c) GDPR and, where applicable, our legitimate interest in administering and documenting donations under Article 6(1)(f) GDPR.

For donations made through PayPal, PayPal processes personal data in connection with the payment and may provide us with relevant transaction information. PayPal also processes data under its own privacy policy: https://www.paypal.com/privacy.

For donations by bank transfer, relevant information may be provided to us through our bank as part of the transaction.

Website operation and security

When you visit our website, technical information may be processed to deliver the website and maintain its security. This may include your IP address, browser information, access timestamps and server log data.

This information may be used to operate, maintain and protect the website, troubleshoot technical problems and prevent misuse.

The legal basis for this processing is our legitimate interest in ensuring the secure and reliable operation of our website under Article 6(1)(f) GDPR.

3. Embedded YouTube Videos

Our website uses the Embed Privacy plugin to prevent YouTube videos from loading automatically. Videos are embedded using YouTube’s privacy-enhanced domain, https://www.youtube-nocookie.com. They load only when you choose to play a video or have previously selected the option to always accept YouTube content on our website.When a video loads, information such as your IP address and browser data may be transmitted to Google/YouTube. For more information, please see Google’s Privacy Policy

Selecting “Always accept content from YouTube” saves your preference in a cookie for six months. You can withdraw this preference at any time using the privacy settings below.

4. Cookies

Our website uses the following cookies:

  • pll_language: Set by the Polylang plugin to remember your selected website language when you return. It stores the selected language code and expires after one year.
  • embed-privacy: Set by the Embed Privacy plugin to store your preference to always display content from a selected embed provider. It expires after six months. You can withdraw this preference at any time using the privacy settings in the Embedded YouTube Videos section above.

You can also manage or delete cookies through your browser settings. Please note that deleting these cookies may mean that your language preference or YouTube content preferences are no longer remembered.

5. Who receives your personal data?

Personal data may be disclosed to service providers where necessary for the purposes described in this policy. These may include our website hosting provider, email provider, bank and payment provider.

YouTube and Google may also process personal data when embedded videos load, as described above.

We do not sell personal data. Where service providers process personal data on our behalf, we take appropriate steps to ensure that the processing complies with applicable data protection law.

6. International data transfers

Some third-party service providers, including Google and PayPal, may process personal data outside the European Economic Area.

Where personal data are transferred outside the European Economic Area, the transfer must comply with the GDPR. Depending on the circumstances, this may involve an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses.

Further information about the relevant safeguards can be requested from Spot the Dot.

7. How long do we retain personal data?

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to applicable legal retention requirements.

Email correspondence is retained for as long as necessary to handle the enquiry and any subsequent matters.

Donation and accounting records are retained for the periods required by applicable Austrian law. Accounting records and supporting documents generally have a seven-year retention period under Austrian tax law, with longer retention where legally required.

Technical server logs are retained for the period necessary for website operation, security and troubleshooting, according to the applicable retention arrangements of our hosting provider.

8. Your rights under the GDPR

Subject to the applicable legal requirements, you have the right to:

  • Access your personal data and obtain information about how it is processed.
  • Rectification of inaccurate or incomplete personal data.
  • Erasure of your personal data where the legal conditions are met.
  • Restriction of processing in certain circumstances.
  • Object to processing based on legitimate interests, on grounds relating to your particular situation.
  • Data portability, where the relevant legal conditions are met.
  • Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise your rights, contact us at contact@spotthedot.org.

You also have the right to lodge a complaint with the competent supervisory authority if you believe that your personal data have been processed unlawfully.

In Austria, the supervisory authority is:

Österreichische Datenschutzbehörde

Barichgasse 40–42
1030 Vienna, Austria

Website: https://www.dsb.gv.at
Email: dsb@dsb.gv.at

9. Changes to this Privacy Policy

We may update this Privacy Policy when our data processing practices or applicable legal requirements change. The latest version will be published on our website, together with the date of the latest update.

10. Contact

If you have any questions about this Privacy Policy or the processing of your personal data, please contact us at contact@spotthedot.org.