Privacy Policy

WhyDonate B.V. is responsible for the personal data described in this policy (the controller). Chamber of Commerce (KvK) 58485317, Johan Huizingalaan 763A, 1066 VH Amsterdam, the Netherlands.

For privacy questions and requests, email [email protected], use our contact form or call +31 (0)85 1074458.

If you donate

Name, email address, donation amount and date, tip, payment method and status, your message, whether you donated anonymously, IP address, approximate location, and device and browser data. Payment details, such as your IBAN for SEPA Direct Debit, are processed by our payment processor. We don't store full card numbers.

If you start a fundraiser

Name, email address, phone number, login details (handled by our login provider; passwords are never stored in plain text), profile details and photo, fundraiser content (story, photos, videos, updates and location), bank account and payout details, and identity-verification data such as your ID document, date of birth and address. For organizations, also registration details such as a charity number.

If you are the subject of a fundraiser

Your name, story and photos as the organizer shares them. This can include health information, information about children or religious beliefs (section 7). If you receive payouts, also your bank and verification details.

If you visit our website

IP address, device and browser data, the pages you visit, where you came from (referrer, landing page and ad campaign details such as click IDs), error and performance data, and your cookie choices (see Cookies).

If you contact us

Your messages and contact details by email, chat, phone, social media or WhatsApp, including your phone number or social media name, records of phone calls, and the pages you visited before contacting us.

If you receive our emails

Whether you open our newsletters and click their links.

If you receive payouts

Results of identity checks by our payment processor, and of checks against public sanctions lists.

Processing donations and tips, and sending confirmations

Contract

Creating and running your account and fundraiser, including suggesting locations as you type

Contract

Showing donations on the fundraiser page, without your name if you donate anonymously

Contract

Sharing donors' names and email addresses with the organizer, unless they donate anonymously

Legitimate interest: letting organizers thank donors and keep them informed

Translating fundraiser texts into other languages

Legitimate interest: helping fundraisers reach donors in other languages

Payouts, identity verification, and anti-money-laundering and sanctions checks

Legal obligation where it applies; otherwise legitimate interest in preventing fraud, money laundering and misuse

Preventing fraud and keeping the platform secure, including error monitoring

Legitimate interest: protecting donors, organizers and WhyDonate

Handling reports, and checking new fundraisers for fraud and harmful content

Legal obligation under the Digital Services Act, and legitimate interest in preventing fraud

Customer support and complaints, including automatic translation of messages

Contract, or legitimate interest if you don't have an account

Welcome and follow-up messages after you sign up or start a fundraiser

Legitimate interest; you can object at any time

Emails with updates about fundraisers you supported

Legitimate interest; you can object or unsubscribe at any time

Newsletters and marketing emails, including measuring opens and clicks

Consent

Measuring how the website is used

Consent for performance cookies; legitimate interest for measurement without cookies

Measuring our ads, including sending your hashed email address or phone number to advertising platforms after a donation or sign-up

Consent for marketing cookies

Personalized ads

Consent for marketing cookies

Tax and accounting records

Legal obligation

Responding to authorities and handling legal claims

Legal obligation, or legitimate interest in defending our rights

Hosting health, religious or other sensitive information in fundraisers

Explicit consent of the person concerned, which the organizer must obtain, or information that person has clearly made public

Where we rely on legitimate interest, you can object (section 9).

To donate, we need your name, email address and payment details. To receive payouts, identity verification is required by our payment processor and anti-money-laundering rules. Without this data, we can't process your donation or payout.

Donation, tip, fee and payout records

7 years, as required by Dutch tax law

Account, profile and fundraiser data

While your account is open. We delete it 30 days after you close your account, except what we must keep by law.

Identity verification

We keep the data from identity and anti-money-laundering checks for 5 years after your account is closed, as Dutch anti-money-laundering law requires. Stripe also keeps this data under its own rules.

Support conversations (chat, email, WhatsApp and social media)

Deleted automatically 24 months after the last message. The pages you visited before contacting us: 90 days.

Reports about fundraisers

24 months

Email logs, including newsletter opens and clicks

24 months

Ad campaign and conversion data

24 months

Newsletter subscription

Until you unsubscribe

Server logs

A few days; our hosting provider deletes them automatically

Error reports

Deleted automatically after 90 days

Cookies

See the cookie table

We don't sell your personal data. We share it only with:

• Organizers of the fundraiser you donate to: your name, email address, amount and message. If you donate anonymously, they don't see your name or email address. They may only use this for their fundraiser and are responsible for it themselves.
• Visitors of the fundraiser page: your name, amount and message as shown on the page. If you donate anonymously, your name isn't shown.
• Stripe, our payment processor, to process donations, payouts and identity checks. Stripe processes some data under its own responsibility, for example to prevent fraud and meet financial regulations. See Stripe's privacy policy.
• Service providers that work for us under a data processing agreement. The table below shows which types of service we use and where they're based. Email [email protected] if you want to know which companies these are.
• Advertising and analytics partners, only if you accept marketing or performance cookies: Google (Analytics and Ads), Meta, TikTok, Microsoft (Bing), Reddit and LinkedIn. They may also use the data for their own purposes; their privacy policies apply to that.
• Zapier, only if an organization connects its WhyDonate account to Zapier. Donation data for that organization's fundraisers then goes to the organization's own Zapier account.
• Authorities, courts and the police, when the law requires it, or to protect someone's life or safety.
• Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality.

Hosting and security

What for: Our website, support inbox and files; security and bot checks; website statistics; the connection to our ad tools. Where: EU, plus a worldwide network.

Database

What for: Storing account, fundraiser and donation data. Where: Germany.

Email

What for: Sending emails, and our support mailbox. Where: EU and United States.

Login

What for: Login, social login and SMS codes. Where: EU.

AI services

What for: Translating fundraiser texts and support messages, and checking new fundraisers for fraud and harmful content. Where: EU and United States.

Maps

What for: Location suggestions when you enter a fundraiser's location. Where: United States.

Workflow automation

What for: Automated checks of new fundraisers. Where: Same as hosting (we run this tool ourselves).

Team communication

What for: Internal alerts, including reports about fundraisers. Where: United States.

Error monitoring

What for: Finding and fixing errors. Where: United States.

Analytics and session recordings

What for: Seeing how visitors use the website, including recordings of visits. Where: EU.

Phone support

What for: Handling your calls. Where: EU and United States.

Messaging

What for: Messages you send us via WhatsApp, Messenger or Instagram. Where: United States.

Some of the parties in section 5 process data outside the European Economic Area:

• United States: Stripe, the advertising partners in section 5, and some of our service providers (email, AI services, maps, team communication, error monitoring, messaging and phone support). We rely on the EU–US Data Privacy Framework where the company is certified, and otherwise on the European Commission's standard contractual clauses.
• India: members of our support and development teams work from India, employed through an employer of record (EOR). They can access personal data to help you and to build the platform. We protect these transfers with standard contractual clauses with the EOR.

You can ask us for a copy of these safeguards at [email protected].

Fundraisers sometimes include information about someone's health, religion or children. Organizers may only share this with the explicit consent of the person concerned, or of a parent or legal guardian for a child. Don't share information about someone's criminal record or criminal proceedings unless it's about you or you have their permission.

If you're featured in a fundraiser and want information about you removed, email [email protected]. We review your request, remove the information where appropriate and let the organizer know.

You must be at least 18 to start a fundraiser. Children can only donate, or be featured in a fundraiser, with permission from a parent or legal guardian.

We protect your data with appropriate technical and organizational measures, such as encrypted connections (HTTPS) across the whole website, passwords that are never stored in plain text, access controls and backups. If there's a data breach, we report it to the Autoriteit Persoonsgegevens when the law requires it, and we tell you if it's likely to put your rights at high risk.

You have the right to:

• access the personal data we hold about you;
• have incorrect data corrected;
• have your data deleted, unless we must keep it, for example under tax law;
• restrict how we use your data;
• receive your data in a structured, commonly used and machine-readable format, or have it sent to another organization;
• withdraw your consent at any time, without affecting what we did before you withdrew it.

Right to object. You can object at any time to our use of your data based on legitimate interest, for reasons related to your situation. We then stop, unless we have compelling grounds that override your interests, or we need the data for legal claims. You can always object to direct marketing, and we'll stop.

You can update your details and unsubscribe from emails in your account. For anything else, email [email protected] or use our contact form. We respond within one month. Complex requests may take two more months, and we'll tell you if so. We may ask you to confirm your identity first.

Complaints. We'd like to hear from you first, so we can try to solve the problem together. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the data protection authority in the EU country where you live or work.

We don't make decisions based only on automated processing that have legal or similarly significant effects on you. Our fraud and sanctions checks can flag a donation, payout or account, but a person always reviews it before we act.

If you donate through a WhyDonate donation form on another website, this policy applies to the data you enter in the form. The website owner's own privacy policy applies to the rest of their site.

We may update this policy, for example when we add features or the law changes. We announce important changes by email or on the platform. The date at the top shows when it was last updated.

• Email: [email protected]
• Contact form
• Phone: +31 (0)85 1074458
• WhatsApp: +31 (0)6 23923163
• Post: WhyDonate B.V., Johan Huizingalaan 763A, 1066 VH Amsterdam, the Netherlands