By this Privacy Notice for Personal Data Processing on the United24 Portal (hereinafter – the Privacy Notice), in compliance with Article 6, paragraphs 1 and 2 of part two of Article 8, and part two of Article 12 of the Law of Ukraine "On Protection of Personal Data", the Ministry of Digital Transformation of Ukraine informs about the controller, processor, location, composition, and purpose of personal data processing performed through the software of the Unified State Web Portal for collecting donations in support of Ukraine "United24" (hereinafter – the United24 Portal), third parties to whom such personal data are transferred, and the rights of the personal data subject – the user of the United24 Portal (hereinafter – the User).

The Ministry of Digital Transformation of Ukraine has ensured the creation and commissioning of the United24 Portal pursuant to the Resolution of the Cabinet of Ministers of Ukraine dated May 3, 2022, No. 516 "Issues of the Unified State Web Portal for Collecting Donations in Support of Ukraine 'United24'" (as amended).

1. Data Controller and Data Processor

The Controller of the personal data processed through the software of the United24 Portal is the owner (holder) of the United24 Portal – the Ministry of Digital Transformation of Ukraine (identification code of the legal entity in the Unified State Register of Enterprises and Organizations of Ukraine – 43220851) (hereinafter – the Data Controller), location: 24 Dilova St, Kyiv, 03150.

The Processor of the personal data processed through the software of the United24 Portal application is the technical administrator of the United24 Portal – the state enterprise "DIIA" (identification code of the legal entity in the Unified State Register of Enterprises and Organizations of Ukraine – 43395033) (hereinafter – the Data Processor), location: 24 Dilova St, Kyiv, 03150.

2. Processing of Personal Data

The personal data of the User processed on the United24 Portal includes:

2.1. The User's email address provided by the User for subscription to the newsletter.

2.2. Data processed during payments.
During a voluntary contribution (charitable donation), the following User data are collected:

• User ID;
• payment amount;
• payment currency;
• User's email (in case of a recurring payment for the "Defense" direction for the possibility of managing it).

The User has the opportunity to set up a recurring monthly payment. After the first successful payment, the subscription will automatically renew every month without further notice until its cancellation. In the event of a monthly payment for the Defense program, the User grants permission to the Portal to store the payment method and automatically deduct funds every month.

All other personal data provided by the User when making payments (including recurring ones) are processed by payment services under the terms of the public offer agreement between the User and these services, as well as the personal data processing policies of these services.

You can review the personal data processing notices of these services via the following links:

• JSB “UKRGASBANK” service: https://www.ukrgasbank.com/en/confidence
• Donorbox service: https://donorbox.org/privacy

A Special Account to Raise Funds for Ukraine’s Armed Forces was opened by The National Bank of Ukraine. Please note that the NBU does not refund the amounts credited to the special account to legal entities or individuals upon their requests.

2.3. Technical information and usage information transmitted automatically:

• Device and browser information: device type and model, online identifiers (IP address, MAC address, etc.), browser type, version, and language settings;
• Usage data: pages visited, time spent on pages, links clicked, referral sources, and other browsing behavior;
• Cookies and similar technologies: Information collected via cookies is used to improve user interaction and analyze the traffic of the United24 Portal.

3. Data storage location

Amazon cloud infrastructure.

4. Purpose of Personal Data Processing

The purpose of personal data processing is for the Data Controller and the Data Processor to exercise powers related to the purpose and primary tasks of the United24 Portal, as defined in the Regulation on the Unified State Web Portal for Collecting Donations in Support of Ukraine "United24", approved by the Resolution of the Cabinet of Ministers of Ukraine dated May 3, 2022, No. 516 "Issues of the Unified State Web Portal for Collecting Donations in Support of Ukraine 'United24'" (as amended), and other regulatory legal acts, namely:

4.1. Ensuring the User's ability to use the United24 Portal.
Processing of the User's personal data is carried out, in particular, to enable the User to use the United24 Portal, view its pages and their content, and utilize its functional capabilities.

4.2. Enabling the User to make a voluntary contribution (charitable donation) to the accounts for attracting voluntary contributions (charitable donations) in support of Ukraine "UNITED24" using the United24 Portal software.

4.3. Sending information newsletters if the User has subscribed to them.

4.4. Analysis and optimization of the United24 Portal's operation.
Personal data processing is performed to analyze User interaction with the United24 Portal, identify aspects requiring improvement, and optimize content delivery and the User interface.

4.5. Implementation of the functional capabilities of the United24 Portal necessary for performing the primary tasks of the United24 Portal.

5. Compliance with Legal Requirements

Personal data processing may be performed to comply with legislative requirements, for example, to exercise the powers of the Data Controller and the Data Processor according to current legislation.

6. Third parties to whom personal data may be transferred

Third parties to whom the processed personal data may be transferred are other persons who approach the Data Controller and have the right to receive personal data exclusively on grounds defined by law.

Transfer of personal data to foreign subjects of relations associated with personal data (cross-border transfer of personal data) is not performed.

7. Security Measures

7.1. The Data Controller and the Data Processor ensure the use of appropriate technical and organizational measures to protect personal data processed on the United24 Portal.

7.2. Personal data processed on the United24 Portal are stored for the period necessary to achieve the processing purpose in accordance with this Notice. Typically, data are stored for 24 months from the moment of receipt, or as long as necessary to provide services requested by the User. If the data subject does not use the United24 Portal for 24 months, the personal data is deleted from the systems of the Data Controller and the Data Processor. However, some personal data may be stored for backup purposes and to comply with the Data Controller's obligations according to legislative requirements.

7.3. The United24 Portal may contain links to third-party web services. The Data Controller and the Data Processor are not responsible for the content of such services and the processing of personal data therein. The data subject must familiarize themselves with the privacy notice of each web service they use.

8. User Rights

The User has the right to:

8.1. Know the sources of collection, the location of their personal data, the purpose of its processing, the location or place of residence (stay) of the Controller or Processor of personal data, or to give an appropriate mandate to obtain this information to persons authorized by them, except in cases established by law;

8.2. Receive information about the conditions for granting access to personal data, including information about third parties to whom their personal data is transferred;

8.3. Access their personal data;

8.4. Receive, no later than thirty calendar days from the date of receipt of the request, except in cases provided for by law, a response as to whether their personal data is being processed, as well as to receive the content of such personal data;

8.5. Submit a reasoned request to the Data Controller objecting to the processing of their personal data;

8.6. Submit a reasoned request regarding the change or destruction of their personal data by the Data Controller and the Data Processor if these data are processed illegally or are unreliable;

8.7. The protection of their personal data from unlawful processing and accidental loss, destruction, or damage due to intentional concealment, failure to provide, or untimely provision, as well as protection from the provision of information that is unreliable or harms the honor, dignity, and business reputation of an individual;

8.8. Lodge complaints regarding the processing of their personal data with the Ukrainian Parliament Commissioner for Human Rights or with a court;

8.9. Apply legal remedies in case of violation of the legislation on the protection of personal data;

8.10 Make reservations regarding the restriction of the right to process their personal data when giving consent;

8.11. Withdraw consent for personal data processing;

8.12. Know the mechanism of automatic personal data processing;

8.13. Protection against an automated decision that has legal consequences for them.

If the User wishes to exercise any of their rights in the field of personal data protection, they may send an email to [email protected] with a description of their request.

9. Age Restrictions

The Portal is not intended for use by persons under 14 years of age. In the event of the United24 Portal being used by a person under the specified age, responsibility for the actions of such person shall be borne by their parents (adoptive parents), guardians, or other individuals who legally provide for the minor's upbringing.

10. This version of the Privacy Notice for Personal Data Processing on the United24 Portal is current and applies from February 23, 2026.

If any changes are made to this Privacy Notice, the updated version will be published on the United24 Portal. In the case of a change to the specified purpose of personal data processing to a new purpose incompatible with the previous one, the Data Controller must obtain the User's consent for further processing of their data in accordance with the changed purpose, unless otherwise provided by law.

11. Legal Basis for Personal Data Processing

The legal basis for personal data processing is the User's consent to the processing of their personal data.

If the User has any questions regarding the processing of their personal data on the United24 Portal, they may contact the Data Controller by sending an email to [email protected].