Privacy Policy for Wish Applications

Thank you for taking the time to read our Privacy Policy for Wish Applications (this “Policy”).

About us

Make-A-Wish Greece (“Make-A-Wish”, “we”, “our”, “us”), are committed to protecting your privacy.

This Policy explains how and why we collect and process personal information relating to Wish Applications, and with whom we may share it. A Wish Application is a request for Make-A-Wish to grant a wish to a Wish Child.

In order to proceed with a Wish Application we will need permission from the Wish Child’s parent, legal guardian or other person with legal parental responsibility for the Wish Child (referred to in this Policy as a “Parent or Guardian”) in order to proceed with the Wish Application and to use the Wish Child’s personal information. Please see the Parental Consent section below.

Please read this Policy carefully. If you do not agree with this Policy, then please do not send any personal information to us (whether online or within any application forms).

For the purposes of data protection law (including the General Data Protection Regulation), the data controller is the Non-Profit Organization (NPO) Make-A-Wish Greece, , (47 Ethnikis Antistaseos str. Dafni 17237 Athens, Greece, VAT number 998947704), General Commercial Registry Number 175023001000.

Parental Consent[1]

In order for us to grant a Wish Child’s wish, we need to be able to process personal information relating to that Wish Child. We therefore need the Wish Child (if they are able to give informed consent) or the Wish Child’s Parent or Guardian to consent to that data processing.

If you are a Parent or Guardian of a Wish Child, then we ask that you read this Policy and complete the details at the bottom of the page in order to give your permission for us to use your and the Wish Child’s personal information in the way described throughout this Policy. If your Wish Child is at least 16 years old and is able to understand the meaning and impact of this Policy, then we would ask that your Wish Child also to give permission for us to use their personal information.

If you are a Wish Child, at least 16 years old and feel that you understand this Policy well enough in order to give us permission to proceed with your Wish Application using the personal information provided to us, then we would ask you as well as your Parent or Guardian to give us permission.

If you have any questions or queries, please contact us using the details given below.

If you do not agree with this Policy or do not wish to give permission, please be aware this is likely to affect our ability to grant the Wish Child’s wish. We would ask you to contact us as soon as possible to discuss any concerns you may have by emailing [email protected] or calling 2109637660.

Who this policy applies to

This Policy applies to:

Wish Children;
Parents or Guardians of Wish Children, persons who have sent in a Wish Application and the Wish Child’s friends and family who will be involved in granting the Wish Child’s wish (referred to as the “Wish Family”);
visitors to our website.

Other terms that may apply

This Policy refers to the following additional terms, which also apply to your use of our website and granting a Wish Child’s wish:

Our “Website Terms of Use” govern your use of our website.
Our “Cookies Policy” sets out information about the cookies we use on our website.

Information we collect

We may collect and use the following personal information:

name, postal address, telephone number, email address of Wish Children and the Wish Family;
the Wish Child’s age, date of birth, gender and language(s) spoken;
photographs and/or moving images of the Wish Family;
other personal information relating to the Wish Child and Wish Family, including details of family living arrangements, siblings and pets; and
information relating to the wish itself, and other information needed by us to help us in organising and granting the Wish Child’s wish, or for answering any enquiries and requests.

We may collect and use the following special category data:

details of the Wish Child’s physical and/or mental health conditions, where relevant to the Wish Child’s eligibility, needs and requirements (including but not limited to health records and information, details of current medication, diagnosis and treatment, equipment requirements, and mobility and/or disability requirements);
details of the Wish Child’s doctor and hospital details, and (where applicable) other related health professionals, such as community nurses and social workers; and
information related to religious or similar beliefs.

Subject to receiving consent to the Wish Child’s medical information being released (see our Parents Form), we may also collect health records and information relating to the Wish Child directly from the Wish Child’s doctor and related care team. We will combine, store and use this information together with information that we are given directly.

In addition to collecting information from Wish Application forms, we may also collect personal information during visits or other meetings with you and/or your Wish Child, or via telephone conversations or emails with or from you and/or your Wish Child.

How we use personal information and our legal basis for doing so

We collect, store and use personal information relating to Wish Applications in order to assist us with responding to enquiries, granting the Wish Child’s wish and providing related services to the Wish Family.

This includes:

processing and responding to applications, queries or requests;
seeking financial and in-kind contributions in order for us to be able to grant Wish Children’s wishes;
granting wishes on behalf of the Wish Child and liaising with medical professionals and/or carers in respect of such activities; and

More generally, we may also use personal information for the following reasons:

compliance with legal, regulatory and corporate governance obligations and good practice;
gathering information as part of investigations by regulatory bodies or in connection with legal proceedings or requests relating to those matters;
ensuring business policies are adhered to (such as policies covering security and internet use);
internal operational reasons, such as troubleshooting, testing, training and quality control;
ensuring the confidentiality of sensitive information;
security vetting, investigating complaints and allegations of criminal offences;
statistical analysis and research (including statistical studies, benchmarks and medical research related to our mission); and
preventing unauthorised access and modifications to our systems.

Summary table of personal data processed and the lawful basis for processing

Wish Children
*Type(s) of personal information we process*	*Why we process this personal information*	*Our legal basis for processing this personal information*
· Name · Age and date of birth · Email address · Address · Languages spoken · Photographs and moving images · Details of family members and living arrangements · Special category data (including details of any medical or other conditions, and religion) · Information required for insurance purposes · Information required for travel arrangements (including any passport and visa information required for international travel), where relevant	To enable us to process Wish Applications and grant the Wish Child’s wish.	(1) The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children; (2) in order to take steps prior to making arrangements for the wish (e.g. for travel, accommodation and other services); (3) (as applicable) in order to comply with our legal obligations; (4) (as applicable) your consent.
· Name · Age · Town or Country of residence · Medical condition information (general description only e.g. cancer) · Details of the Wish Child’s wish · Photographs and moving images · Social media contact details	To seek sponsorship (financial and/or in-kind contributions) To carry out statistical studies, benchmarks and medical research related to our mission.	Consent from the Wish Child (if applicable) and their Parent(s) or Guardian(s).
· Name · Telephone number · Email address · Address	To enable us to keep in touch with you after we have granted the Wish Child’s wish (subject to your preferences for receiving future communications).	(1) The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children; and (2) (as applicable) your consent.
· All of the above data categories	To enable us to provide and promote our services and to produce statistics and records (anonymised as appropriate) of our activities.	(1) The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children; and (2) (as applicable) in order to comply with our legal obligations.

Wish Family
· Name · Telephone number · Email address · Address · Photographs and moving images · Details of the Wish Child’s family members and living arrangements	To enable us: · to identify you; · to verify your and the Wish Child’s eligibility to access and use our services; · (as necessary) to contact the Wish Child’s Parent(s) or Guardian(s); and · to respond to queries and process Wish Applications.	(1) The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children; and (2) (as applicable) your consent.
· Name · Telephone number · Email address · Address · Social media contact details · Photographs and moving images · Details of the Wish Child’s family members and living arrangements · Information required for insurance purposes · Information required for travel arrangements (including any passport and visa information required for international travel), where relevant	To enable us to process Wish Applications and grant the Wish Child’s wishes.	(1) The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children; (2) in order to take steps prior to making arrangements for the wish (e.g. for travel, accommodation and other services); and (3) (as applicable) in order to comply with our legal obligations.
· Name · Details of the Wish Family · Photographs and moving images	To seek sponsorship (financial and/or in-kind contributions)	Consent from the relevant Wish Family members and (if applicable) their Parent(s) or Guardian(s)
· Name · Telephone number · Email address · Address	To enable us to keep in touch with you after we have granted the Wish Child’s wish (subject to your preferences for receiving future communications).	(1) The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children; and (2) (as applicable) your consent.
· All of the above data categories	To enable us to provide and promote our services and to produce statistics and records (anonymised as appropriate) of our activities.	The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children; and (2) (as applicable) in order to comply with our legal obligations.

Wish Family

Type(s) of personal information we process

Why we process this personal information

Our legal basis for processing this personal information

· Name

· Telephone number

· Email address

· Address

· Photographs and moving images

· Details of the Wish Child’s family members and living arrangements

To enable us:

· to identify you;

· to verify your and the Wish Child’s eligibility to access and use our services;

· (as necessary) to contact the Wish Child’s Parent(s) or Guardian(s); and

· to respond to queries and process Wish Applications.

(1) The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children; and

(2) (as applicable) your consent.

· Name

· Telephone number

· Email address

· Address

· Social media contact details

· Photographs and moving images

· Details of the Wish Child’s family members and living arrangements

· Information required for insurance purposes

· Information required for travel arrangements (including any passport and visa information required for international travel), where relevant

To enable us to process Wish Applications and grant the Wish Child’s wishes.

(1) The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children;

(2) in order to take steps prior to making arrangements for the wish (e.g. for travel, accommodation and other services); and

(3) (as applicable) in order to comply with our legal obligations.

· Name

· Details of the Wish Family

· Photographs and moving images

To seek sponsorship (financial and/or in-kind contributions)

Consent from the relevant Wish Family members and (if applicable) their Parent(s) or Guardian(s)

· Name

· Telephone number

· Email address

· Address

To enable us to keep in touch with you after we have granted the Wish Child’s wish (subject to your preferences for receiving future communications).

(1) The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children; and

(2) (as applicable) your consent.

· All of the above data categories

To enable us to provide and promote our services and to produce statistics and records (anonymised as appropriate) of our activities.

The legitimate interests of Make-A-Wish as a charity offering to grant wishes to Wish Children; and

(2) (as applicable) in order to comply with our legal obligations.

More about the information we use and why

Where we have a legal basis to use your personal information without consent (as we have described above), this Policy fulfils our duty to process personal information transparently, and helps us to do so fairly and lawfully and in a manner that you would expect given the nature of our relationship with you, by giving you appropriate notice and explanation of the way in which your personal information will be used.

Where consent is required for our use of your personal information, we will ask you to positively opt-in by ticking the appropriate consent box or otherwise communicating your consent. For example, (other than in cases where it is necessary in order to protect your vital interests), we will only share your medical or health details if you consent when we first collect this information from you as part of the Wish Application. You may withdraw this consent at any time, but please be advised that withdrawing such consent may mean that we are unable to continue to provide any services to you.

Where you provide us with personal information relating to other individuals (for example, if you are sending in a Wish Application and you give us details about the Wish Family), you must obtain the consent of those individuals before doing so.

If you have any questions or require any further information regarding our use of personal information please contact [email protected] (DPO Officer tel +302109637660).

Sharing your information

We may share your personal information with your consent or as is necessary with selected third-party service providers, and other companies that support us in the performance of the activities set out in the tables above.

We require all our third-party service providers and all other companies that support us to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal information for their own purposes, and we only permit them to process your personal information for specified purposes in accordance with our instructions.

We may also need to share your personal information with a regulator or otherwise to comply with the law or to respond to valid legal process, including from law enforcement or other government agencies.

Why we may share personal information with third parties

We may share your personal information with third parties where it is necessary in order to consider your Wish Application and how we may grant the Wish Child’s wish, or where we have another legitimate interest in doing so that is not overridden by your interests and fundamental rights. (For example, to provide assistance to the Wish Family in unforeseen circumstances or to operate and maintain the security of our computer systems.)

Who we may share personal information with

We may share your personal information and that of your Wish Child and Wish Family with the organisations or types of organisations listed below. The information we share may include the Wish Child’s special category data, such as health records, medical condition and requirements.

third parties or service providers as necessary in your country or in another country, as necessary, connection with granting the Wish Child’s wish;
Make-A-Wish Foundation International, a United States entity, in its role as provider of administrative and technical support to us, or as a liaison, in connection with any of the IT service providers mentioned below;
any Make-A-Wish entity located in any other country, where the wish is taking place in that other country or where we need to liaise with that overseas entity to assist us in granting the wish. That overseas entity will only have access to the information it needs in order to provide us with that assistance.
the trusted operators of secure cloud-based platforms accessed by us and/or our Make-A-Wish affiliates from time to time in order to provide centralised data storage, and data management and transaction processing services. Specifically, this includes Salesforce Inc., an entity established in the United States, which hosts a customer relationship management platform used by Make-A-Wish affiliates to enable them to administer, co-ordinate and track wish applications. Such operators or service providers shall only be permitted access to your information to the extent required by them in order to provide us with contracted system maintenance, support or related services, or to provide (or assist us in performing) any related data back-up, restoration or other error correction or bug fixing activities;

We also reserve the right to disclose some or all of your or your Wish Child’s personal information to:

government bodies or law enforcement agencies, or response to other legal or regulatory requests, but only if and to the extent required by law to do so; and
our auditors, Make-A-Wish Foundation International, lawyers or other professional advisers for any auditing, accounting or related business purposes, or in the enforcement, defence or settlement of any legal proceedings brought by or against us, but only if and to the extent such disclosure is reasonably necessary for these purposes.

Where we are unable to fulfil a wish we may introduce other charities to you, who might alternatively be able to help you and your wish child. In the course of doing so we may share your and/or your Wish Child’s contact details with them, together with an outline description of your Wish Child’s medical condition, and mobility/disability requirements. Please let us know if you would not like us to do so by contacting Joanna Liveri, [email protected], +302109637660 (int. 118)

We also reserve the right to disclose some or all of your or your Wish Child’s personal information to:

government bodies or law enforcement agencies, or response to other legal or regulatory requests, but only if and to the extent required by law to do so; and
our auditors, lawyers or other professional advisers for any auditing, accounting or related business purposes, or in the enforcement, defence or settlement of any legal proceedings brought by or against us, but only if and to the extent such disclosure is strictly necessary for these purposes.

Where we store and process your data

The information that we collect relating to you, your Wish Child and the Wish Family will be stored on our secure servers in Greece.

In addition, your, your Wish Child’s and the Wish Family’s personal information may also be transferred by us to, and stored by, entities located outside the European Economic Area, including entities located in the United States of America or to other countries around the world which do not have data protection laws equivalent to those in the European Union. This information may include special category data.

These entities may include Salesforce Inc. (and its relevant subsidiaries), Make-A-Wish Foundation International, and other overseas Make-A-Wish entities (as mentioned above).

Salesforce Inc. is certified under the EU-US Privacy Shield and as such has committed to internal practices and policies which ensure a level of protection equivalent to the data protection laws in the European Union (please refer to www.privacyshield.gov and http://www.salesforce.com/assets/pdf/misc/privacy-shield-notice.pdf for further details). We shall ensure that all information transferred to any entity outside the European Economic Area is transferred in compliance with all applicable data protection laws and regulations.

We believe that we have taken all technical and organisational steps reasonably necessary to ensure that your, your Wish Child’s and the Wish Family’s, personal information under our control is held securely and in accordance with applicable law and this Policy. However please note that the transmission of information via the internet is not completely secure. Although we will do our best to protect your and your Wish Child’s personal information, we cannot guarantee the security of any information which is transmitted to us via the internet.

Recording and Photography

We may collect and process photographs and/or moving film images in connection with the granting of any wish. In addition, where explicit consent has been provided under our Parents Form, we may photograph and/or film wishes for the purpose of sharing stories on behalf of Wish Children and raising awareness of our work.

If you have concerns about the use of photographs or moving film images of your Wish Child, please contact DPO Officer, [email protected] (tel. +30 210 9637660).

Cookies

Our website uses cookies to distinguish you from other users of our website. Cookies are pieces of information transferred from our website to your computer’s hard disk, which allow our website to store information about your browsing patterns. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. Every time you use our website, the cookie may be accessed. You may disable cookies on your browser options but please be aware that by doing so you may lose certain features or functionality of our website. For detailed information on the cookies we use and the purposes for which we use them, please refer to our Cookie Policy.

We also gather statistical and technical information about our web users, traffic patterns and website performance in order to provide a better experience to website visitors. This may include the IP address of the device you are using to access our website, your operating system and your browser type. This data does not identify you or your wish child.

Use of your information for direct marketing purposes

Where you have consented to receive marketing communications from us, and/or to be placed on mailing lists, in connection with future support of our charitable aims or as a potential donor, volunteer or fundraiser, we may also (in accordance with applicable law) use your contact details, including email address and telephone number(s), for requesting and/or processing donations, recording transactions and related direct marketing purposes. We may also obtain and store your bank or credit card details where you are an active donor or fundraiser, and use that information in connection with receiving donations and recording transactions from or with you.

We do not sell or share any of your or your wish child’s personal information to any other person or business for the purposes of marketing.

Even if you have initially consented to receive marketing communications from us, you have the right at any time to ask us not to use your personal information for marketing purposes. You may exercise this right by opting out of any marketing communications we may send you. You may also exercise this right by contacting DPO Officer, [email protected] (tel. +30 210 9637660).

Retaining your personal information

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of your information, the purposes for which we process your information and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Even if you request that we erase your information, we may still need to keep it (see Your rights below) or may keep it in a form that does not identify you.

If you would like details on how long we retain your information then please contact DPO Officer, [email protected] (tel. +30 210 9637660).

Transferring your personal information overseas

If you are based in the EEA, we may transfer, process and store the information we collect from you to the organisations mentioned under Where we store and process your data above, or to relevant third parties and service providers outside the EEA as necessary in connection with granting the Wish Child’s wish.

In each case, we will take all steps reasonably necessary to ensure that your personal information receives an adequate level of protection and is treated in a way consistent with European laws on data protection.

Updating and accessing your personal information

You have the right to access personal information held about you, subject to certain conditions, and to request its rectification or deletion.

If you would like to access or amend the personal information which we hold about you or you would like us to stop using your personal information, please contact DPO Officer, [email protected] (tel. +30 210 9637660).

Your rights

By law you have the right:

to request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. We will need to prove your identity before we release any personal information to you.
to request correction or erasure of your personal information (unless we have the legal right to retain it). You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
to object to processing of your personal information where we are relying on a legitimate interest (or that of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
to request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
(in certain circumstances) to request the transfer of your personal information to another party.
to change your information processing preferences (including to withdraw your consent to data processing and/or to receive marketing communications) at any time.

You should be aware that if you ask us to stop processing your personal information in a certain way or to erase your personal information, and this type of processing is necessary in order for us to continue to provide services to you and your Wish Child, then we may not be able to do so. This does not include your right to object to direct marketing, which can be exercised at any time without restriction.

If you want to exercise any of the rights listed above, please contact DPO Officer, [email protected] (tel. +30 210 9637660).

We may need to request specific information from you to help us confirm your identity and verify your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Where you have provided your consent to the collection, use or transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact DPO Officer, [email protected] (tel. +30 210 9637660).

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Marketing

You confirm your consent to receive communications from us by email, SMS and/or via social media about our activities and campaigns or other information that we consider may be of interest to you (including, for example promotional materials and newsletters).

You have the right at any time to withdraw your consent to us contacting you for marketing purposes or giving your information to Make-A-Wish affiliates. If you no longer wish to be contacted for marketing purposes, you can unsubscribe by using the “unsubscribe” link at the bottom of our marketing messages or by contacting DPO Officer, [email protected] (tel. +30 210 9637660).

We will not provide your personal information to any other third-party businesses for marketing purposes.

Other websites

Our website may contain links to other websites, including Facebook, Twitter and Instagram. This Policy only applies to our website so when you link to other websites you should read their own privacy policies.

Changes to this Policy

We keep this Policy under regular review and will post any updates on this webpage. This Policy was last updated in September 2025.

How to contact us

[email protected] (tel +302109637660)

Complaints

If for any reason you are not happy with the way that we have handled your personal information, please contact at [email protected] (tel +302109637660). If you remain dissatisfied, you have the right to file a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Avenue, Athens, 11523, Greece, [email protected], +30 210 6475600).

Consent

I, * parent/legal guardian of

(child 2) (child 3) have read and understand this Privacy Policy for Wish Applications and hereby give my full consent for Make-A-Wish Greece to process personal data in accordance with the policy.

Consent *
Please tick this box to confirm consent.

Submit

[1] Note:

Make-A-Wish is likely to receive information regarding a Wish Child’s medical condition(s) and needs. This is Special Category Data under the GDPR, making it necessary to obtain explicit consent for any data processing. If the Wish Child is capable of giving informed consent (and usually at least 16 years old) then consent may be given by the Wish Child. If not (and in any event where the Wish Child is a minor) then the Wish Child’s parent or legal guardian may give consent. Please note that in cases where the child is mature enough to give or withdraw consent, then it is likely that the child’s wishes would prevail over the parents’ wishes and the child’s consent/withdrawal of consent would need to be respected.

It may be helpful to provide a mechanism for someone other than the Wish Child’s parent or legal guardian to make the Wish Application, but for the parent/guardian to confirm their consent in order for the associated data processing to proceed in compliance with the GDPR.