Privacy Policy

Effective Date: May 28, 2026 · Last Updated: May 28, 2026

Quenara Foundation is the humanitarian aid brand operated by No Name Foundation, a 501(c)(3) tax exempt nonprofit organization based in Dover, Delaware, USA (EIN: 35-2882867). This Privacy Policy explains how we collect, use, share, and protect personal data of donors, beneficiaries, volunteers, and website visitors. We are committed to transparency and to complying with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), the Children’s Online Privacy Protection Act (COPPA), and IRS Publication 1771 substantiation requirements for charitable contributions.

1. Who We Are

Legal entity: No Name Foundation, a Delaware nonprofit corporation recognized as tax exempt under Section 501(c)(3) of the Internal Revenue Code (EIN: 35-2882867).

Operating brand: Quenara Foundation, the public humanitarian aid brand under which we conduct field operations, fundraising, transparency reporting, and donor engagement.

Registered address: Dover, Delaware, USA.

Data controller: No Name Foundation is the data controller for all personal data processed through quenarafoundation.com and related donor systems.

Contact for privacy matters: privacy@quenarafoundation.com

2. Scope of This Policy

This Policy applies to personal data processed when you:

• Visit quenarafoundation.com or any subdomain we operate;
• Create a donor account, sign in, or manage your profile;
• Make a one time or recurring donation in any supported currency;
• Receive a tax deductible donation receipt issued under IRC §170(f)(8);
• Subscribe to our newsletter, transparency reports, or impact updates;
• Contact our help desk, submit a support ticket, or speak with a volunteer;
• Apply to volunteer, partner with us, or work with our field teams;
• Interact with us on social media platforms we operate;
• Receive a humanitarian aid package from us as a beneficiary (limited categories).

This Policy does not cover third party services we link to but do not operate (for example, the Stripe payment portal, a local partner organization’s website, or a social media platform’s own policy). When you leave our website, please read the privacy policy of the destination site.

3. Personal Data We Collect

3.1 Information You Provide Directly

3.2 Information Collected Automatically

3.3 Information We Receive From Third Parties

• Stripe, Inc.: Tokenized payment information, fraud risk score, card brand and last four digits, currency conversion data, dispute and refund status. Stripe is our PCI DSS Level 1 certified payment processor.
• Google Analytics 4 / Google Tag Manager: Aggregated and anonymized traffic data. IP anonymization is enabled.
• Social media platforms (Facebook, Instagram, X, YouTube, LinkedIn, TikTok): If you choose to interact with our content or share a donation, the platform may pass us limited public profile data subject to its own policy.
• Email service provider: Bounce status, open rate, click through data on emails we send to you.
• Local partner organizations: Anonymized or aggregated beneficiary impact data (no individual donor PII is exchanged).

4. How We Use Your Data: Purposes and Legal Basis (GDPR Article 6)

5. Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share data only with trusted service providers (data processors) and only as necessary to operate the foundation.

5.1 Service Providers (Data Processors)

Each processor is bound by a Data Processing Agreement that requires confidentiality, security, and GDPR compliant safeguards including Standard Contractual Clauses for international transfers.

5.2 Legal Disclosures

We may disclose your data to government authorities, courts, or law enforcement if compelled by a valid legal order or to defend against a legal claim. We will challenge overly broad requests and notify you where legally permitted.

5.3 Business Transfers

In the unlikely event of a merger, acquisition, or asset transfer involving No Name Foundation, your personal data may be transferred to the successor entity. We will provide notice and you will retain all rights under this Policy.

5.4 With Your Consent

We may share data with other parties if you direct us to do so or give explicit consent. For example, you may choose to make a donation public on our transparency ledger; in that case only your first name, last initial, city, and donation context are displayed.

6. International Data Transfers

No Name Foundation is based in the United States, but we serve donors and beneficiaries in many countries and rely on processors located in both the EU and the US. Where personal data of EU/UK residents is transferred outside the EEA/UK, we rely on:

• EU Standard Contractual Clauses (SCCs) approved by the European Commission;
• UK International Data Transfer Addendum approved by the Information Commissioner’s Office;
• Supplementary technical measures including encryption in transit (TLS 1.3) and at rest (AES-256);
• Periodic transfer impact assessments.

You may request a copy of the relevant transfer mechanism by emailing privacy@quenarafoundation.com.

7. Data Retention

8. Your Rights

8.1 GDPR / UK GDPR Rights (EU and UK Residents)

Under Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access (Article 15): Request a copy of the personal data we hold about you.
• Right to rectification (Article 16): Ask us to correct inaccurate or incomplete data.
• Right to erasure (Article 17): Ask us to delete your data, subject to legal retention requirements (e.g. IRS tax records).
• Right to restriction (Article 18): Ask us to limit how we process your data while we verify a request.
• Right to data portability (Article 20): Receive your data in a structured, commonly used, machine readable format.
• Right to object (Article 21): Object to processing based on legitimate interest, including direct marketing.
• Right not to be subject to automated decision making (Article 22): We do not make decisions about you based solely on automated processing.
• Right to withdraw consent (Article 7(3)): Withdraw consent for any consent based processing at any time.
• Right to lodge a complaint: File a complaint with your local supervisory authority. A list of EU authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en. UK residents may contact the Information Commissioner’s Office at ico.org.uk.

To exercise these rights, email privacy@quenarafoundation.com with the subject line GDPR Request. We will respond within 30 days. We do not charge a fee for reasonable requests.

8.2 CCPA / CPRA Rights (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to know: Request disclosure of the categories of personal information collected, sources, purposes, and third parties with whom it has been shared in the past 12 months.
• Right to delete: Request deletion of personal information we collected from you, subject to legal exceptions.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt out of sale or sharing: We do not sell personal information. We do not share personal information for across contexts behavioral advertising.
• Right to limit use of sensitive personal information: We collect only the minimum necessary sensitive data (payment information processed by Stripe).
• Right to non discrimination: We will not discriminate against you for exercising your CCPA rights.
• Right to authorized agent: You may designate an authorized agent to make requests on your behalf, subject to identity verification.

To submit a CCPA request, email privacy@quenarafoundation.com with the subject line CCPA Request. Identity verification will be required to protect your privacy.

8.3 Children’s Online Privacy Protection Act (COPPA)

We do not knowingly collect personal data from children under the age of 13. Our donation platform requires donors to be at least 18 years old or to have parental consent. If we become aware that we have inadvertently collected data from a child under 13, we will promptly delete it. If you are a parent or legal guardian and believe your child has provided us with personal data, please contact privacy@quenarafoundation.com immediately.

8.4 Other Jurisdictions

Donors in Canada (PIPEDA), Brazil (LGPD), Singapore (PDPA), Australia (Privacy Act), and other jurisdictions may have additional rights under their national privacy laws. We honor reasonable requests under any applicable law. Contact us at privacy@quenarafoundation.com.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the website, remember your preferences, secure your session, and understand usage. For the full list of cookies, their purpose, duration, and how to opt out, please see our Cookie Policy.

You can manage cookie preferences through our consent banner or your browser settings. We honor the Global Privacy Control (GPC) signal from your browser as an opt out of sale/sharing under CCPA.

10. Marketing Communications

We send marketing emails only with your explicit consent. Every marketing email includes an unsubscribe link in the footer. You can also manage your communication preferences from your donor dashboard. Transactional emails (donation confirmation, tax receipt, account security) are not marketing and continue regardless of your marketing preference.

11. Security

We take reasonable and appropriate measures to protect personal data:

• Transport security: TLS 1.3 encryption for all data in transit (HTTPS).
• Storage security: AES-256 encryption at rest for databases and backups.
• Payment security: Card data is tokenized and processed by Stripe (PCI DSS Level 1). We never store full card numbers, CVV codes, or magnetic stripe data on our servers.
• Access controls: Role based access, multi factor authentication for staff, audit logging.
• Vulnerability management: Periodic security scans, dependency monitoring, prompt patching.
• Incident response: Documented data breach notification procedure compliant with GDPR Article 33 (72-hour notification to supervisory authority where required).

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we work hard to protect your data and to be transparent if a breach occurs.

12. Your Choices

• Access and update your data: Log in to your donor dashboard at /hesabim/ (TR) or /my-account/ (EN).
• Manage email preferences: Use the unsubscribe link in any marketing email, or update preferences in your account.
• Manage cookies: Click “Cookie Preferences” in our footer or use your browser settings.
• Delete your account: Request deletion by emailing privacy@quenarafoundation.com. We will retain donation records for the legally required period.
• Do Not Track: We do not currently respond to Do Not Track signals because no industry standard exists. We do honor the Global Privacy Control signal.

13. Third Party Links

Our website may contain links to third party websites, services, or social media platforms that we do not control. We are not responsible for their privacy practices. Please read their privacy policies before sharing any personal data with them. Notable third parties:

• Stripe: stripe.com/privacy
• Google: policies.google.com/privacy
• Facebook/Instagram (Meta): facebook.com/privacy/policy

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes we will:

• Post the revised Policy on this page with a new “Last Updated” date;
• Notify registered donors by email at least 14 days before the change takes effect;
• Where the change relates to consent based processing, seek fresh consent before applying the change.

We encourage you to review this page periodically.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email (privacy matters): privacy@quenarafoundation.com
• Email (general): info@quenarafoundation.com
• Postal address: No Name Foundation, Dover, Delaware, USA
• Help desk: /help-center/ (EN) / /yardim/ (TR)

We aim to respond to all reasonable inquiries within 30 days. For GDPR data subject requests we respond within one month, extendable by two months for complex requests under Article 12(3).

Quenara Foundation is the humanitarian aid brand of No Name Foundation, a 501(c)(3) tax exempt nonprofit organization based in Dover, Delaware, USA. EIN: 35-2882867. Contributions are deductible under IRC §170(c)(2) to the fullest extent permitted by law. IRS Publication 1771 contemporaneous written acknowledgment is provided with each donation receipt.