Privacy and Digital Conduct Policy of the Principality of Kaharagia

This Policy applies to all domains and systems owned or operated by the Principality of Kaharagia, including those under the primary domain kaharagia.org and any related or successor domains. It also governs Kaharagia's official presence on social-media platforms and interactive digital communities. Our purpose is to ensure that all Kaharagian digital environments are secure, lawful, and respectful—preserving the dignity of every participant and the sovereignty of the Kaharagian digital state.

Article 1—Introduction

1. This Policy explains how the Fondazár, acting on behalf of the Principality of Kaharagia, collects, uses, stores, and protects personal information obtained through its digital systems and services.
2. By accessing or using any official Kaharagian website, platform, or online service, you acknowledge and consent to the practices described herein.
3. The Fondazár is committed to transparency and lawful processing in all matters relating to personal information.

Article 2—Legal and Institutional Basis

1. The Fondazár is the legal entity responsible for the operation of all Kaharagian digital services and delegates their technical administration to the Office of Digital Infrastructure.
2. All processing conforms to international standards inspired by the EU General Data Protection Regulation (GDPR) and Council of Europe Convention 108+, and observes applicable provisions of United States non-profit law.
3. In the exercise of its public and administrative functions, the Fondazár acts under the law of the Principality of Kaharagia, including any Royal Decrees or directives governing data protection and digital administration.
4. Processing may occur where necessary for the performance of a public-interest task, a legal obligation, or a legitimate administrative purpose.

Article 3—Data Controller and Contact

• Data Controller: Káhareží Fondazár
• Operational Contact: Office of Digital Infrastructure
• E-mail: privacy@kaharagia.org

Third-party processors engaged by the Fondazár operate only under written contracts requiring confidentiality, restricted access, and protection equivalent to this Policy. All processors are reviewed and re-certified on a scheduled basis.

Article 4—Information We Collect

1. The Fondazár collects only information necessary for lawful and administrative purposes.
2. Categories of information include:
   • (a) Account Information: name, e-mail address, user ID, authentication credentials.
   • (b) Administrative Information: citizenship or affiliation records, petitions, submissions, uploaded documents.
   • (c) Technical Information: browser and device details, IP metadata, timestamps, security logs.
   • (d) Communications: messages, notices, or correspondence with officials.
   • (e) Cookies and Analytics: essential session cookies and optional consent-based analytics.

Article 5—Sensitive or Special-Category Information

1. Certain information constitutes sensitive data.
2. Such data are subject to heightened protection, accessible only to authorised personnel bound by perpetual non-disclosure agreements (NDAs), and processed solely on lawful bases within Kaharagian law.
3. Sensitive data are never disclosed externally without explicit legal authority or necessity arising from Kaharagian law.

Article 6—Lawful Bases for Processing

Personal data are processed under one or more of the following bases:

• (a) Your explicit consent.
• (b) Performance of official or charitable functions of the Fondazár.
• (c) Compliance with a legal or archival obligation.
• (d) Performance of a task carried out in the public interest.
• (e) Legitimate interests such as security, integrity, and service continuity.

Article 7—Purpose of Processing

Data are used to:

• (a) Register and authenticate accounts.
• (b) Process petitions, applications, and official communications.
• (c) Maintain accurate records and archives.
• (d) Provide status updates and official notifications.
• (e) Safeguard systems against unauthorised use or fraud.
• (f) Improve the performance, accessibility, and reliability of digital services.

No personal data are sold, leased, or shared for commercial or marketing purposes.

Article 8—Data Security and Access Controls

1. All digital communications use encrypted protocols.
2. Access to administrative systems is limited to essential personnel under a least-privilege principle.
3. All authorised individuals sign perpetual NDAs, binding them to confidentiality beyond the end of their service.
4. System access is logged, monitored, and periodically audited.
5. Security measures are reviewed regularly to maintain confidentiality, integrity, and availability of information.
6. Only secure methods of administrative connection are used; remote access is permitted solely through controlled and encrypted channels.

Article 9—Hosting and Location of Processing

1. All Kaharagian digital systems operate within secure non-U.S. environments that meet or exceed international data-protection standards.
2. Where data are accessed or transferred across jurisdictions, the Fondazár ensures adequate contractual and technical safeguards to preserve equivalent levels of protection.
3. All infrastructure access is restricted to essential personnel subject to confidentiality and security clearance.

Article 10—Incident Response and Breach Notification

1. In the event of a personal-data breach, the Office of Digital Infrastructure will act immediately to investigate, contain, and remediate the incident.
2. Where required by law or policy, affected individuals and relevant authorities will be notified promptly.
3. All incidents are recorded, analysed, and used to strengthen future preventive measures.

Article 11—Data Retention

1. Data are retained only for the period necessary to fulfil their intended purpose or comply with legal obligations.
2. Records of permanent public or historical value may be preserved indefinitely in the Official Archives.
3. All other information is securely deleted or anonymised once it is no longer required.

Article 12—Cookies

1. Essential cookies support authentication and security.
2. Optional cookies store preferences or enable anonymous analytics only with your consent.
3. You may disable non-essential cookies without affecting core functionality.

Article 13—Information Sharing and Disclosure

1. Personal data may be shared only with:
   • (a) Authorised departments of the Fondazár and its offices.
   • (b) Contracted service providers under binding confidentiality agreements.
   • (c) Public authorities where disclosure is required by and consistent with Kaharagian law.
   • (d) Other parties with your explicit consent for a defined purpose.
2. The Principality of Kaharagia and the Fondazár maintain a strict policy of non-disclosure to any foreign government, court, or agency.
3. No information shall be released—even if demanded under another jurisdiction's law—unless explicitly required under Kaharagian law or necessary to investigate a verified breach thereof.
4. Data are never shared for advertising, commercial, or non-Kaharagian regulatory purposes.

Article 14—International Transfers

All cross-border data access or transfers are governed by adequate safeguards, ensuring a level of protection consistent with international privacy norms and the laws of the Principality of Kaharagia.

Article 15—Your Rights

1. Individuals may exercise the following rights: access, correction, erasure of non-archival data, restriction or objection to processing, data portability, and withdrawal of consent without prejudice to prior lawful processing.
2. Requests should be sent to privacy@kaharagia.org; proof of identity may be required to protect your information.

Article 16—Automated Processing

The Principality does not use automated decision-making or profiling that produces legal or significant effects without human review and approval.

Article 17—Children and Vulnerable Persons

1. Use of Kaharagian digital services by individuals under 16 years of age requires the consent or authorisation of a parent or guardian.
2. Additional protections apply to minors and other vulnerable persons.

Article 18—Third-Party Services

1. External tools (such as authentication, messaging, document, and analytics systems) operate under binding contracts that ensure confidentiality and equivalent data protection.
2. All providers are subject to periodic compliance reviews by the Office of Digital Infrastructure.

Article 19—Compliance and Oversight

1. The Office of Digital Infrastructure maintains comprehensive records of processing activities.
2. Regular technical, administrative, and policy audits are conducted to verify compliance with this Policy and Kaharagian law.
3. The Fondazár and its offices are committed to continuous improvement and accountability in the protection of personal data.

Article 20—Policy Updates

1. This Policy may be revised to reflect legal, technological, or administrative developments.
2. The current version is published on official Kaharagian websites with its effective date and version number.
3. Substantial amendments will be announced publicly through official digital channels.

Article 21—Contact and Complaints

• Data Protection Officer: Office of Digital Infrastructure
• E-mail: privacy@kaharagia.org

Unresolved issues may be referred to the Board of Trustees of the Káhareží Fondazár or a competent data-protection authority in your jurisdiction.

Article 22—Social Media and User Conduct Policy

1. Kaharagian social-media channels and interactive platforms are maintained to foster civic engagement and public dialogue.
2. The Principality reserves the right to moderate, hide, or remove any post, comment, or submission deemed inappropriate, offensive, defamatory, misleading, unlawful, or otherwise inconsistent with the dignity and values of the Kaharagian People.
3. The Fondazár may restrict or block users who engage in spam, abuse, harassment, or repetitive disruption of official discussions.
4. Content posted to Kaharagian pages remains the responsibility of its author. The Fondazár does not endorse external views appearing in user comments.
5. Participation in any Kaharagian digital community constitutes acceptance of these rules and of the Principality's right to enforce them.

Article 23—Governing Law and Jurisdiction

1. This Policy and all Kaharagian digital operations are governed by the law of the Principality of Kaharagia, including Royal Decrees and directives issued by the Office of Digital Infrastructure.
2. The Fondazár's U.S. 501(c)(3) registration does not extend jurisdiction over Kaharagian data or systems.
3. All personal information collected under Kaharagian authority is protected by Kaharagian sovereignty and shall not be disclosed to any foreign entity or authority except where a verified breach of Kaharagian law requires it.
4. Any dispute arising from this Policy or its implementation falls under the exclusive jurisdiction of the competent bodies of the Principality of Kaharagia, unless mandatory international law provides otherwise.

Article 24—Statement of Commitment

1. The Káhareží Fondazár and its Office of Digital Infrastructure affirm that privacy, civility, and mutual respect are foundations of Kaharagian public life.
2. We maintain non-U.S. hosting environments, strict security controls, and perpetual confidentiality for all authorised personnel.
3. We moderate digital spaces responsibly to preserve their integrity and civility.
4. Through continuous improvement and ethical governance, we safeguard the dignity, freedom, and trust of every individual interacting with the digital services of the Principality of Kaharagia.

---

Notice of Issuance and Amendment

The initial version of this Privacy and Digital Conduct Policy was promulgated by Sovereign Decree No. 2025/0012.

All subsequent updates, revisions, and administrative modifications are authorised and issued through the Office of Digital Infrastructure under the authority of the Káhareží Fondazár.

The current and official text of this Policy, together with any future amendments, shall be published and maintained at hq.kaharagia.org/privacy as the central repository of record.