Help Ukraine in Gothenburg (HUG) respects your privacy and is committed to protecting the personal data we process. All processing of personal data is carried out in accordance with applicabledata protection legislation, including the EU General Data Protection Regulation (GDPR).
Help Ukraine in Gothenburg (HUG), org.nr 802538-8045, is the controller of your personal data.
Address: Bankogatan 61, 414 80 Göteborg, Sweden
E-mail: contact@hug.ngo
We collect and process the following categories of personal data:
Contact information: name, surname, e-mail address, phone number, address.
Identification data: personnummer or samordningsnummer, for reporting and audits required by funding bodies or for example, for tax reporting to Skatteverket (KU65) when donors request a tax deduction.
Demographic data: age, gender, city of residence, employment or participation status (whererelevant for integration or support programmes).
Technical data: IP address, browser data, cookies (when visiting our website).
Participation data: information about registration, attendance, and participation in events or programmes.
Photos and videos: only with your consent.
Health data: only with your explicit and informed consent (Art. 9(2)(a) GDPR), if you seek support.
For children under the age of 13, we also collect contact information of parents or legal guardians, and written consent is required where applicable.
We process your personal data in order to:
• Register and organise events, consultations, and programmes
• Provide legal, social, integration, and support services
• Fulfil reporting and documentation requirements to funding bodies
• Process donations and comply with accounting and tax obligations
• Coordinate volunteers and project activities
• Communicate information about our activities (where consent is required)
• Evaluate programme effectiveness and analyse community needs
• Conduct research and advocacy related to the legal and social situation of Ukrainians in Sweden, using only anonymised and aggregated data
• Ensure website security and functionality
We process personal data on the following legal grounds:
Consent (Art. 6(1)(a) GDPR): For photos/videos, newsletters, non-essential cookies, and healthdata (Art. 9(2)(a) GDPR).
Contract (Art. 6(1)(b) GDPR): For providing requested services.
Legal obligation (Art. 6(1)(c) GDPR): For accounting, bookkeeping, tax reporting, and similarlegal requirements.
Legitimate interest (Art. 6(1)(f) GDPR): For organising events and programmes, coordinatingvolunteers, receiving and processing donations, communicating with participants, and fulfillingfunding requirements.
Processing of personnummer/samordningsnummer is carried out in accordance with 3 kap. 10 § dataskyddslagen, as it is necessary for reliable identification in reporting and audits required by funding bodies or other authorities.
Participation in our activities is voluntary. However, without certain mandatory data, we may not be able to verify eligibility for specific programmes.
Personal data is retained only as long as necessary for the purposes described above:
Accounting and financial records: 7 years (Swedish law)
Funded programme data: until project completion plus the retention period required by the respective funding body (e.g. 5 years for EU-funded projects)
Event and programme registrations: as long as necessary for administration and reporting
Volunteer data: as long as necessary for coordination and legal obligations
Consent-based data: deleted or anonymised upon withdrawal of consent
After the applicable retention period, data is securely deleted or anonymised.
Access to personal data is restricted and granted only to HUG employees who need the data to perform their work tasks, in accordance with internal access-control instructions and the principle ofleast privilege.
We use the following service providers (processors), who process data on our behalf under data processing agreements and may not use the data for their own purposes:
Microsoft 365 (Bookings, Forms, SharePoint) — servers located within the EU/EEA
Stripe — payment processing (certified under the EU–US Data Privacy Framework)
Mailchimp — newsletter distribution (certified under the EU–US Data Privacy Framework)
Webflow, Cloudflare — website hosting and security
Aggregated and anonymised statistics are shared for reporting purposes. In the event of an audit by a funding body, authorised auditors may access primary documentation confirming participation (suchas registration data, personnummer/samordningsnummer where required, and attendance records). The content of legal consultations, individual sessions, health data, or other sensitive information is never disclosed to auditors and remains confidential.
When visiting hug.ngo, we use cookies. Essential cookies are necessary for website functionality and are set automatically. Cookies for statistics (e.g. Hotjar) and marketing (e.g. YouTube, Vimeo) areused only with your consent. You can change or withdraw your consent at any time via the "Cookie settings" link in the website footer.
HUG is active on Facebook, Instagram, LinkedIn, YouTube, and Telegram. When you interact withus on these platforms, their own privacy policies apply. HUG is not responsible for data processingcarried out by third-party platforms.
We apply appropriate technical and organisational measures to protect personal data, including: encryption, two-factor authentication, access logging, role-based access control, and secure storageenvironments.
For children under 13 years of age, written consent from a parent or legal guardian is required for processing personal data and for photos/videos. Children aged 13 and above may provide consentthemselves, in accordance with GDPR.
Under the GDPR, you have the right to:
• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Request erasure of data (Art. 17)
• Restrict processing (Art. 18)
• Receive a copy of your data in a machine-readable format (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7)
To exercise your rights, contact us at contact@hug.ngo with the subject line "Dataskydd". We willrespond within one month.
Limitations: Certain data cannot be deleted due to legal obligations (e.g. accounting records or funding body audit requirements).
If you believe your personal data is processed incorrectly, you have the right to lodge a complaintwith the supervisory authority:
Integritetsskyddsmyndigheten (IMY)
Box 8114, 104 20 Stockholm, Sweden
www.imy.se • imy@imy.se • +46 8 657 61 00
We may update this Privacy Policy when necessary. The current version is always available at hug.ngo/integritet.
Last updated: 2026-03-24
Help Ukraine in Gothenburg (HUG) • Org.nr 802538-8045 • contact@hug.ngo • hug.ngo
