Privacy Policy
Last updated: July 2026
This policy explains what information Open Horizons collects, how we use it, how long we keep it, and the rights you have over it. It is written to be read, not to be skimmed past.
Who we are
Open Horizons is a humanitarian foundation registered in Luxembourg, with its headquarters at 36, Rue du Moulin à Vent, 9541 Wiltz, Canton Wiltz, Luxembourg. For the purposes of the General Data Protection Regulation (GDPR), Open Horizons is the data controller for the personal data described in this policy.
Information we collect
We collect only the information you choose to give us. That includes your name, email address, telephone number and country when you contact us, subscribe to our newsletter, apply to volunteer, or make a donation or sponsorship enquiry.
Volunteer applicants may also submit a CV, details of their skills, languages and availability. Donation payments are processed by Stripe, our regulated payment provider. We never see or store your full card details.
Our servers record standard technical information such as IP address and browser type for security and diagnostics.
Why we use it
To respond to your enquiry, administer donations and sponsorships, review volunteer applications, issue receipts, and send you the updates you have specifically asked to receive. We do not sell, rent or trade your personal data, and we do not share it with third parties for their own marketing.
Legal basis
We rely on your consent for newsletters and marketing communications, on the performance of a contract for donations and sponsorships, on our legitimate interest in operating and safeguarding our programmes, and on legal obligation where accounting or reporting law requires us to keep records.
How long we keep it
Newsletter subscriptions are kept until you unsubscribe. Enquiries are kept for two years. Volunteer applications are kept for two years after a decision, unless you ask us to delete them sooner. Donation records are kept for ten years, as required by Luxembourg accounting law.
Who processes data on our behalf
We use a small number of trusted providers: Stripe for payment processing, MailerLite for newsletter delivery, and our hosting and database provider for the website itself. Each is bound by a data processing agreement and processes data only on our instructions.
Keeping your data safe
Data is encrypted in transit and at rest. Access to personal data is limited to staff who need it for their role, protected by individual accounts and role-based permissions. Volunteer CVs are held in private storage that is not publicly accessible.
Children's data
We take particular care with information relating to the children in our programmes. Names and identifying details in published stories are changed, and photographs are only published with the informed consent of a parent or guardian. Programme records are held by our field teams under strict safeguarding procedures and are never published.
Your rights
You have the right to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent at any time. Send a request through the contact form on this website and we will respond within 30 days.
If you believe we have not handled your data properly, you may lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD).