Privacy Policy

1. Who We Are

Helmet Heroes Foundation, Inc. ("Helmet Heroes", "we", "our", or "us") is a non-profit organisation registered in the State of Wyoming, United States, operating a road-safety campaign in Thailand. We distribute TIS-certified motorcycle helmets to children and run fundraising campaigns through our website at helmetheroesthailand.org.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, make a donation, or otherwise interact with us. By using our site or making a donation, you agree to the practices described in this policy.

2. Data We Collect

We collect the following categories of personal data:

• Donor information: Your name and email address, provided when you make a donation or contact us.
• Payment information: Payment card details, billing name, and transaction amount. This is processed directly and securely by Stripe — we never see or store your full card number.
• Student details: The student's first name, surname initial, grade, and class team, entered when sponsoring a student. We collect only the minimum information necessary to credit the correct student on the leaderboard.
• Encouragement messages: Any personal message you choose to write to a student as part of your donation.
• Device and usage data: Standard web server logs, including IP address, browser type, and pages visited, collected automatically when you access our website.

We do not collect sensitive personal data such as national identification numbers, health information, or financial account details beyond what is necessary to process a payment through Stripe.

3. How We Use Your Data

We use your personal data for the following purposes:

• Processing donations: To complete your payment, generate your unique reference code, and link your donation to the correct student.
• Sending your certificate: To generate and email your personalised Helmet Heroes Superhero Award Certificate as a PDF attachment via Brevo.
• Updating the leaderboard: The student's first name, surname initial, and grade are displayed publicly on the campaign leaderboard. No other personal information is displayed.
• Campaign administration: To maintain records of donations, verify PromptPay bank transfers, and manage campaign progress.
• Communication: To respond to contact form enquiries submitted through our website.
• Legal and compliance: To maintain records as required by applicable law.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

4. Third-Party Services

We use the following third-party services to operate our platform. Each has its own privacy policy and handles your data subject to its own terms:

• Stripe (stripe.com): Processes all card payments. Stripe receives your payment card details, billing name, and transaction amount. Stripe is PCI-DSS compliant. See stripe.com/privacy.
• Google Firebase / Firestore (firebase.google.com): We store donation records — including donor name, email, student details, amount, and reference code — in Google Firestore, a cloud database operated by Google LLC. See firebase.google.com/support/privacy.
• Brevo (brevo.com): Sends transactional emails on our behalf, including your certificate email. Brevo receives your name, email address, and the PDF certificate. See brevo.com/legal/privacypolicy.
• Google Fonts: Fonts are loaded from Google's servers. Google may log your IP address. See policies.google.com/privacy.

We require all third-party providers to handle your data securely and only for the purposes we specify.

5. Data Retention

We retain donation records (name, email, amount, student details, reference code) in our Firestore database for as long as necessary to fulfil the purposes set out in this policy, including for legal, accounting, or reporting requirements. In practice, we retain records for a minimum of five years following the close of each campaign.

Leaderboard data (student first name, surname initial, helmets funded) is retained for the duration of the campaign and for a reasonable period afterwards for historical records. It is not linked to any identifiable email address in public-facing displays.

If you request deletion of your personal data, we will honour that request where we are not legally required to retain the records.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request that we delete your personal data, subject to legal retention requirements.
• Objection: Object to certain types of processing of your personal data.
• Data portability: Request that we provide your data in a commonly used, machine-readable format.

If you are located in Thailand, these rights are provided under the Personal Data Protection Act B.E. 2562 (PDPA). If you are located in the European Economic Area, these rights are provided under the General Data Protection Regulation (GDPR).

To exercise any of these rights, please contact us at legal@helmetheroesthailand.org. We will respond within 30 days.

7. Cookies & Local Storage

Our campaign pages use browser localStorage (not cookies) to temporarily cache leaderboard and campaign data on your device for faster page loading. This data contains no personal information and is not transmitted to any server.

Third-party services embedded in our site (Stripe, Google Fonts) may set cookies in accordance with their own privacy policies. We do not use tracking or advertising cookies.

8. Children's Privacy

Our donation platform is intended for adults making donations on behalf of or in support of students. We do not knowingly collect personal data directly from children under the age of 13. Student information entered into the donation form (first name, surname initial, grade) is entered by an adult donor and is kept to a strict minimum.

If you believe we have inadvertently collected personal data from a child, please contact us immediately at legal@helmetheroesthailand.org and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after any changes constitutes your acceptance of the updated policy.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us: