Data Processing
Agreement.

This Data Processing Agreement (“Agreement”) applies to organizations using StrayDash services.

1. Roles

Under this agreement:

• The organization using StrayDash acts as the Data Controller.
• StrayDash acts as the Data Processor.

2. Purpose of Processing

StrayDash processes personal data solely for the purpose of:

• Receiving and managing animal-related reports
• Providing dashboard functionality
• Supporting communication related to submitted reports

3. Categories of Data

The following categories of personal data may be processed:

• Names
• Email addresses
• Phone numbers
• Uploaded images
• Location data
• Report descriptions
• The address of the shelter or organization holding the account

4. Duration of Processing

• Organization account data is stored while the account remains active.
• Reports submitted by the public are stored until deleted by the organization through their dashboard.
• Volunteer sign-ups are kept as a record of who attended, and are not deleted automatically. An organization can remove a sign-up at any time, and a volunteer can ask the organization to do so.

5. Responsibility of Organizations

Organizations using StrayDash remain fully responsible for:

• The data submitted through their forms
• Managing stored reports
• Handling GDPR requests from individuals
• Determining retention periods inside their organization

Individuals submitting reports must contact the organization that received the report for any data-related requests.

6. Confidentiality

StrayDash ensures that all persons authorized to process personal data are bound by confidentiality obligations.

7. Security Measures

StrayDash implements reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction.

8. Map Tiles and Third-Party Services

Public report forms (such as the wound-report form) include an interactive map powered by the Leaflet JavaScript library. The visual map tiles displayed inside this map are served by third-party tile providers, specifically Esri (ArcGIS World Imagery) and CARTO.

These tile providers only receive the technical information required to render the visible portion of the map — namely, the tile coordinates (zoom level and tile X/Y indices) and standard HTTP request metadata such as the visitor’s IP address and browser user-agent. This is the same information any website using a public map service receives, and is used by the provider solely to deliver the requested map image.

Esri and CARTO do not receive, and have no access to, any information that is entered or uploaded through the report form. This includes (but is not limited to) names, email addresses, phone numbers, uploaded photos, descriptions, and the precise reported location selected on the map. None of this data is ever transmitted to the tile providers.

All data submitted through StrayDash forms is stored exclusively in StrayDash’s own databases. It is accessible only to:

• The shelter or organization that owns the form through which the report was submitted, via their authenticated dashboard.
• Authorized StrayDash team members, strictly for the purpose of operating, maintaining, and supporting the platform.

No other third party — including map tile providers, analytics services, or advertising networks — has access to submitted form data.

9. Shelter Address and the Public Partner Map

Organizations provide their address when they register, and can change it later in their dashboard settings. The address is converted into coordinates through the OpenStreetMap Nominatim geocoding service, which receives only the address text entered in the form.

The address and its exact coordinates are stored privately and are visible only to the organization itself and authorized StrayDash team members. On the public partner map, an organization is shown as a pin placed at a random point within five kilometres of its actual address, together with its name, city and country. The exact address and exact coordinates are never published or exposed through any public page or interface.

10. Volunteer Shifts and Sign-ups

Organizations can publish shifts that volunteers sign up for, either on a StrayDash page or through an embedded form on the organization's own website. Signing up records the name, email address and number of people given on the form, any phone number and any answers to the organization's own questions, and the time of the sign-up. This is processed on the instruction of the organization, which decides what its form asks.

These details are visible to that organization and to authorized StrayDash team members, and to nobody else. The public page shows only the shift itself and how many places are left: it never shows who has signed up. Two emails follow a sign-up, a confirmation to the volunteer and a notification to the organization; replies to the confirmation go to the organization, not to StrayDash.

The confirmation contains a private link, holding a random token, through which the volunteer can see their own sign-up and cancel it. That link gives access to that one sign-up and to nothing else. After the shift, the organization may record whether the volunteer attended. Sign-ups are kept as a record and are not deleted automatically; see section 4.

Sign-up forms are protected by Cloudflare Turnstile, which receives the visitor's IP address to tell people from automated abuse. The IP address and the email address are also stored briefly, for at most 48 hours, purely to limit how many sign-ups one source can send in an hour. A daily job removes anything older than a day, so a row lives between one and two days.

11. Data Usage

StrayDash does not sell, share, or use submitted data for advertising or unrelated purposes.

12. Contact

For privacy or data processing questions regarding the platform itself: info@worldanimalfederation.com