Privacy Policy

1. Introduction

Welcome to Good Shepherd Sri Lanka ("we," "our," or "us"). As a Norwegian-registered foundation, we are committed to protecting your privacy and complying with the Norwegian Personal Data Act (Personopplysningsloven) and the General Data Protection Regulation (GDPR). This Privacy Policy explains how we collect, use, and share information about you when you visit our website or interact with our foundation.

2. Information We Collect

We may collect and process the following categories of personal data:

• Contact Information: Name, email address, phone number, and physical address when you reach out to us or subscribe to updates.
• Donation Information: Transaction details when you make a donation (e.g., via Vipps or bank transfer). Please note that we do not store full credit card numbers; payment processing is handled securely by our payment partners.
• Technical Data: IP address, browser type, device type, and usage data collected through cookies and similar technologies to improve our website.

3. How We Use Your Information

Your personal data is processed for the following purposes:

• To process and record your donations in compliance with Norwegian accounting standards.
• To communicate with you regarding our projects, events, and your support.
• To improve and maintain our website functionality and security.
• To comply with legal obligations, including tax and accounting regulations.

4. Legal Basis for Processing

Under the GDPR, we process your personal data based on the following legal grounds:

• Consent: When you have explicitly agreed to receive newsletters or promotional materials.
• Legal Obligation: To fulfill accounting and tax reporting requirements in Norway.
• Legitimate Interests: To operate our foundation efficiently, maintain our website securely, and manage our donor relationships.

5. Sharing of Personal Data

We will never sell your personal data to third parties. We may share your data with trusted service providers who assist us in operating our website, processing donations (such as Vipps and our banking partners), or conducting our charitable activities. All third-party providers are bound by strict data processing agreements in compliance with GDPR.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. Processing related to donations and financial transactions will be kept for five years in accordance with the Norwegian Accounting Act (Bokføringsloven).

7. Your Rights

As a data subject under GDPR, you have the right to:

• Access the personal data we hold about you.
• Request rectification of inaccurate or incomplete data.
• Request the deletion of your personal data (the "right to be forgotten"), subject to our legal retention obligations.
• Restrict or object to our processing of your data.
• Data portability (receive your data in a structured, commonly used format).
• Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

8. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe we are processing your personal data unlawfully.