Overzicht privacybeleid

Our Website and Services are not intended for children under 16 years of age. We do not knowingly collect Personal Information from children under 16 or permit individuals under 16 to create an account or use our Services.

If we become aware that we have collected Personal Information from a child under 16 in violation of this Privacy Policy or applicable law, we will promptly delete that information or take other appropriate action as required by applicable law.

If you believe that a child under 16 has provided us with Personal Information, please contact us at support@donorbox.org so that we can investigate and take appropriate action.

We collect information that identifies, relates to, or could reasonably be linked to an individual ("Personal Information"), as well as non-personal or aggregated information that does not identify an individual.

Controller vs. Processor Roles

For the purposes of applicable data protection laws, Donorbox acts in dual capacities:

• Data Processor: When we process donor information on behalf of non-profit organizations using our platform, we act as a Data Processor (or Service Provider), and the non-profit organization acts as the Data Controller.
• Data Controller: When we collect information directly from organization account holders who register to use our services, or from visitors to our Website, we act as a Data Controller.

Categories of Personal Information We Collect

Depending on how you interact with us, we may collect:

• Identifiers: name, email address, IP address, account credentials
• Commercial Information: transaction and billing details
• Internet Activity: browsing history, clickstream data, interactions with our Website
• Technical Data: device type, browser, operating system
• Communications: messages, chat transcripts, survey responses

Where required by law, we treat IP addresses and online identifiers as Personal Information. Personal Information does not include publicly available information from government records, deidentified or aggregated information. If we combine or connect non-personal, demographic, or technical data with Personal Information so that it directly or indirectly identifies an individual, we treat the combined information as Personal Information.

How We Collect Personal Information

We collect Personal Information:

• Directly from you when you create an account, complete forms, communicate with us, or use interactive features
• Automatically through cookies, tracking pixels, session recording, and similar technologies
• From third parties and publicly available sources such as service providers, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies, data brokers, or aggregators.

Public and User-Generated Content

You also may provide information to be published or displayed (hereinafter, 'posted') on public areas of the Website, or transmitted to other users of the Website or third parties (collectively, 'User Contributions'). Information you choose to post in public areas of the Website or share with other users may be visible to others. While we provide privacy settings where available, we cannot control how other users use or further disclose information you choose to make public.

Although we may limit access to certain pages, or may permit you to set certain privacy settings for such information, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of other users of the Website with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

Information From Third Party Use of Cookies, Analytics, Session Replay Technology, and Other Tracking Technologies

We use cookies, tracking pixels, and session recording tools (including Hotjar) to understand how users interact with our Website. These tools may collect usage data such as page views, mouse movements, and interactions. Where required by law, we obtain your consent before using non-essential cookies or similar technologies.

Some content or applications, including advertisements, on the Website are served by third parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons, location, or other tracking technologies to collect information about you when you use our website. The information they collect may be associated with your Personal Information or they may collect information, including Personal Information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.

We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the provider responsible for that advertisement or other targeted content directly.

Why We Collect and Use Personal Information

We use personal information to:

• Provide and operate our Website and services
• Perform contracts with you, including account management and payments
• Respond to inquiries and provide customer support
• Improve Website functionality, performance, and security
• Conduct analytics and measure usage
• Send service-related or marketing communications (where permitted)
• Comply with legal obligations and respond to lawful requests, and as required by applicable law, court order, or government regulations
• Support corporate transactions such as restructuring, reorganization, mergers or acquisitions or similar proceedings, in which Personal Information held by us about our Website users or consumers is among the assets transferred.

Required Information

Certain Personal Information is required for us to provide our Services, establish and maintain your account, process transactions, comply with legal obligations, or otherwise perform our contractual obligations. If you choose not to provide Personal Information that is required for these purposes, we may be unable to provide certain products, services, features, or functionality.

We may also use your information to contact you about our goods and services that may be of interest to you. If you have agreed to receive marketing, you may always opt out at a later date. If you no longer wish to be contacted for marketing purposes, please contact us at support@donorbox.org.

Where applicable (e.g. for GDPR), we collect/process Personal Information based on:

• Performance of a contract
• Compliance with legal obligations
• Our legitimate interests
• Consent

During the twelve months preceding the effective date of this Privacy Policy, we collected and disclosed the following categories of Personal Information for business purposes. We do not include information regarding sales of Personal Information to third parties because we do not sell Personal Information to third parties.

Where required by law, we rely on your consent, which may be withdrawn at any time.

Payment Processing and PCI-DSS Compliance

We comply with the Payment Card Industry Data Security Standard (PCI-DSS). We do not directly store or process full credit card numbers on our servers. All payment information is processed through secure, tokenized payment gateways (such as Stripe and PayPal) acting as our service providers.

We may collect Sensitive Personal Information only where necessary to provide our Services, process transactions, ensure the security and integrity of our systems, or comply with applicable legal obligations. We do not use or disclose Sensitive Personal Information for purposes that would require offering a right to limit its use or disclosure under the California Privacy Rights Act.

We retain Personal Information only for as long as reasonably necessary to:

• provide and improve our Services;
• fulfill the purposes described in this Privacy Policy;
• perform contractual obligations;
• comply with applicable legal, accounting, tax, and regulatory requirements;
• resolve disputes;
• enforce agreements; and
• protect the security and integrity of our Services.

Retention periods are determined based on factors including:

• the nature and sensitivity of the Personal Information;
• the purposes for which it was collected and processed;
• applicable legal and regulatory requirements;
• operational needs; and
• our legitimate business interests.

When Personal Information is no longer required, we securely delete, anonymize, aggregate, or deidentify it in accordance with applicable law.

Where we maintain deidentified or aggregated information, we implement appropriate safeguards designed to prevent reidentification and use such information only in accordance with applicable law.

We will not collect additional categories of Personal Information or use Personal Information for materially different purposes without providing appropriate notice, except as otherwise permitted by law.

We disclose Personal Information only as described below and only to the extent necessary to operate our business, provide our services, comply with the law, or protect our rights. We do not sell your Personal Information to third parties.

Categories of Recipients

Service Providers and Processors

We disclose Personal Information to service providers, contractors, and data processors that perform services on our behalf, such as:

• Payment processing
• Website hosting and infrastructure
• Customer support and communications
• Analytics and performance measurement
• Security, fraud prevention, and risk monitoring

These entities process Personal Information only on documented instructions from us and are contractually prohibited from retaining, using, or disclosing Personal Information for any purpose other than providing services to us, consistent with applicable data protection laws. For purposes of the GDPR, these entities act as data processors. For purposes of the CPRA, these entities act as service providers or contractors.

Analytics and Technology Providers

We may disclose limited Personal Information (such as online identifiers and usage data) to analytics and technology providers to help us understand how our Website and services are used and to improve performance and security.

Where required by law, such disclosures occur only with your consent. We do not permit these providers to use Personal Information for their own independent purposes unless separately disclosed to you and permitted by applicable law.

Legal, Compliance, and Safety Disclosures

We may disclose Personal Information:

• To comply with applicable law, regulation, court order, or legal process
• To respond to lawful requests from public authorities
• To enforce our terms and agreements
• To protect the rights, property, or safety of Donorbox, our users, or others, including for fraud prevention and credit risk reduction

Such disclosures are made only where permitted or required by law.

Corporate Transactions

We may disclose Personal Information to advisors, affiliates, or prospective counterparties in connection with a merger, acquisition, restructuring, sale of assets, or similar transaction. Any such disclosure is subject to appropriate confidentiality and data protection obligations.

Disclosures Based on Your Explicit Direction

We may disclose Personal Information to third parties only where you have provided explicit, informed, and affirmative direction for a specific disclosure (for example, initiating a social sharing feature or authorizing an integration). Such disclosures are limited to the scope of your request.

We may disclose aggregated or deidentified information for lawful purposes, provided that such information cannot reasonably be used to identify an individual, and we maintain appropriate safeguards against reidentification.

Because we operate globally, Personal Information may be transferred to, stored, and processed in countries other than the country in which it was originally collected, including the United States.

Where required by applicable data protection laws, including the EU GDPR and UK GDPR, we implement appropriate safeguards for international transfers, including:

• European Commission Standard Contractual Clauses (SCCs);
• the UK International Data Transfer Agreement (IDTA);
• adequacy decisions adopted by competent authorities; or
• other lawful transfer mechanisms recognized under applicable law.

You may contact us using the information provided below if you would like additional information regarding these safeguards.

If you provide us with a telephone number capable of receiving SMS messages, we may send you SMS messages only in accordance with applicable law and with your consent where required.

We may send SMS messages for transactional, informational, or service-related purposes, such as account notifications or support communications. Where required by law, including for marketing or promotional messages, we obtain your prior express consent before sending such messages.

You may opt out of receiving SMS messages at any time by following the instructions included in the message (such as replying “STOP”). Message and data rates may apply. We use third-party service providers to facilitate SMS delivery. These providers act on our behalf and are contractually restricted from using your phone number for any purpose other than providing SMS services to us. We do not sell, share, or disclose your SMS consent or telephone number for third-party marketing or advertising purposes.

Users of our Website may send and receive emails or other messages through our services. We use automated technologies, including artificial intelligence and machine learning technologies, to assist with summarizing messages and generating suggested replies. As part of this process:

• The contents of messages may be processed by these tools solely to provide the requested functionality
• Suggested replies are not sent automatically and are subject to human review
• Authorized members of our support team may access message contents to provide support, evaluate the accuracy of suggested replies, and improve our services

These technologies are used solely to provide, support, secure, and improve our Services and are not used to make automated decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on individuals.

Important Note on AI Training: Where third-party providers are involved, they act strictly as service providers or data processors. They are contractually prohibited from using message contents, donor data, or any other Personal Information for their own independent purposes, including, but not limited to, training public, generalized, or cross-tenant AI and machine learning models.

We provide individuals with rights and choices regarding their Personal Information in accordance with applicable data protection laws.

Your Choices

Cookies and Tracking Technologies

You may control cookies through your browser settings or, where required by law, through our cookie consent tools. Disabling cookies may affect Website functionality.

Marketing Communications

You may opt out of receiving promotional communications at any time by following the unsubscribe instructions in our messages or contacting us at support@donorbox.org. This does not apply to service-related or transactional communications.

We do not control third parties' collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative ("NAI") on the NAI's website at https://optout.networkadvertising.org/?c=1.

You may request to:

• Access the Personal Information we hold about you
• Correct inaccurate or incomplete Personal Information
• Delete Personal Information, subject to legal and contractual limitations

Requests may be submitted through your account or by contacting us at support@donorbox.org. We may need to verify your identity before responding. We may decline or limit requests where permitted by applicable law, including where fulfilling the request would adversely affect the rights and freedoms of others, reveal another person's Personal Information, interfere with legal proceedings, or conflict with our legal or regulatory obligations. Where we decline a request, we will explain the basis for our decision as required by applicable law.

If you delete your User Contributions from the Website, copies of your User Contributions may remain viewable in cached and archived pages or because other Website users may have copied or stored them. Our terms of use located at https://donorbox.org/terms govern proper access and use of information provided on the Website, including User Contributions.

United States State Privacy Laws (California, Virginia, Colorado, Texas, etc.)

Depending on your state of residence, you may have specific rights regarding your Personal Information under comprehensive state privacy laws (such as the CPRA in California, VCDPA in Virginia, CPA in Colorado, and TDPSA in Texas). These rights may include:

• Know the categories and specific pieces of Personal Information collected, used, and disclosed
• Delete Personal Information
• Correct inaccurate Personal Information
• Opt out of the sale or sharing of Personal Information (or targeted advertising)
• Limit the use of sensitive Personal Information
• Not be discriminated against for exercising privacy rights

We do not sell Personal Information or share Personal Information for cross-context behavioral advertising.

Canada (PIPEDA & Québec Law 25)

Canadian residents have the right to:

• Access and correct Personal Information
• Withdraw consent where consent is the lawful basis, subject to legal limitations

Residents of Québec have additional rights, including data portability, de-indexing, and enhanced protections for sensitive Personal Information. We collect, use, and disclose Personal Information only with consent or another lawful basis recognized under applicable Canadian privacy laws.

EU GDPR / UK GDPR

Residents of the EU or UK have the right to:

• Access, correct, or delete Personal Information
• Object to or restrict processing
• Data portability
• Withdraw consent where applicable
• Lodge a complaint with a supervisory authority
• Object to processing based on our legitimate interests

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on individuals.

You may exercise your rights by contacting us at support@donorbox.org or by contacting our data privacy manager, Tyler Holmes (Donorbox Sr. Manager, Compliance) at tyler.holmes@donorbox.org.

We will respond within the timeframe required by applicable law. If permitted by applicable law, you may designate an authorized agent to submit certain requests on your behalf.

We maintain administrative, technical, and physical safeguards designed to protect Personal Information against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use. These measures may include access controls, encryption in transit and/or at rest where appropriate, logging and monitoring, and employee training.

The security of your information also depends on you. If you use a password to access certain parts of our Website or services, you are responsible for keeping it confidential and not sharing it with others.

If you choose to post information in public areas of the Website, it may be visible to other users or the public. Although we implement safeguards designed to protect Personal Information, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

This Website is owned and operated by Rebel Idealist Inc., d/b/a Donorbox, from the United States.

This Privacy Policy is intended to comply with applicable privacy and data protection laws. Your use of the Website is also subject to our Terms of Use, available at https://donorbox.org/terms.

Nothing in this Privacy Policy is intended to limit or waive any rights or remedies available to individuals under applicable privacy or data protection laws.

We may update this Privacy Policy at any time. We will post the updated Privacy Policy on this page and update the "Last Updated" date at the top of the policy.

If we make material changes to how we process Personal Information, we will provide notice as required by law, such as by email to the primary email address associated with your account and/or by a prominent notice on our Website. Where required by law, we will obtain your consent before applying material changes.

Your continued use of the Website after an updated Privacy Policy is posted means you acknowledge the updated policy, subject to any rights you may have under applicable law.

If you have any questions about this Privacy Policy, our privacy practices, or if you would like to exercise your privacy rights, you may contact us by:

• Emailing us at support@donorbox.org
• Mailing us at Rebel Idealist Inc., d/b/a Donorbox, ATTN: Privacy Request, 1520 Belle View Blvd #4106, Alexandria, VA 22307
• Visiting https://trust.donorbox.org.