1. Introduction

Charity Extra respects the privacy of charities, donors, fundraisers, campaign participants and other users of the Charity Extra platform.

This Privacy Policy explains how personal data is processed through Charity Extra, the circumstances in which Charity Extra acts as a data processor on behalf of a charity or other organisation, the circumstances in which Charity Extra acts as a data controller, and the rights available to individuals under applicable data-protection law.

Charity Extra is operated by Giving More Online Limited, company number 12228700.

Email: info@charityextra.com

2. Our Role in Processing Personal Data

Charity Extra provides technology enabling charities and other eligible organisations to advertise campaigns, receive donations, conduct fundraising and use associated campaign functionality.

Our role under data-protection law depends upon the particular processing activity.

When Charity Extra acts as a data processor

Where Charity Extra processes personal data on behalf of a charity in connection with that charity's campaigns, donations, donors, fundraisers, Gift Aid information, reporting or other platform functionality, the relevant charity will generally act as the data controller and Charity Extra will act as a data processor on its behalf.

This may include processing:

• donor names and contact details
• donation information
• Gift Aid declarations and related information
• fundraiser and team information
• campaign participation information
• communications and preferences collected on behalf of the charity; and
• other information collected through campaign functionality provided to the charity

In these circumstances, Charity Extra processes personal data on the documented instructions of the relevant charity and in accordance with the Data Processing Terms contained within Charity Extra's Terms and Conditions and applicable data-protection law.

The charity determines the purposes for which this personal data is processed and is responsible for establishing an appropriate lawful basis for that processing.

When Charity Extra acts as a data controller

Charity Extra acts as a data controller where we determine the purposes and means for which personal data is processed for our own legitimate business, legal or operational purposes.

This may include personal data processed in connection with:

• charities, organisations and individuals that contract or communicate directly with Charity Extra
• administration of Charity Extra accounts and services
• enquiries and communications made directly to Charity Extra
• optional Tips made to Charity Extra
• payments, accounting and financial records relating to Charity Extra
• fraud prevention, security and misuse of the Charity Extra platform
• compliance with legal and regulatory obligations
• operation, security and improvement of our website and services where we determine the relevant processing purposes; and
• Charity Extra's own business communications and marketing, where permitted by law

Where Charity Extra acts as a data controller, the provisions of this Privacy Policy relating to our own processing apply directly.

3. Personal Data Processed Through Charity Extra

Depending upon how the Charity Extra platform is used, personal data processed through the platform may include:

• name, title and contact information
• postal address, email address and telephone number
• donation and transaction information
• taxpayer status and Gift Aid declarations
• information about fundraising activity, teams or campaigns
• account and profile information
• communication preferences
• technical information relating to use of the platform
• communications and correspondence
• information required for fraud prevention, security and legal compliance; and
• other information voluntarily provided when using the Charity Extra platform

Payment-card information may be processed by third-party payment providers used in connection with transactions. The information available directly to Charity Extra may therefore differ depending upon the payment method and payment provider used.

4. How Personal Data Is Collected

Personal data may be collected:

• directly from you when you use Charity Extra
• when you make a donation or participate in a fundraising campaign
• when you create or administer a campaign or account
• when a charity, fundraiser or other authorised person provides information to Charity Extra
• through our website and campaign functionality
• from payment providers and other service providers
• from publicly available sources where appropriate; and
• when you communicate directly with Charity Extra

5. How Charity Extra Uses Personal Data as a Processor

Where Charity Extra acts as a data processor, we process personal data on behalf of the relevant charity or other data controller and in accordance with its documented instructions, except where processing is otherwise required by law.

This processing may include:

• processing and recording donations
• recording donor information
• providing campaign and fundraising functionality
• processing Gift Aid declarations and related information
• providing campaign-management functionality
• providing reports and data to charities
• facilitating communications authorised by the charity
• maintaining campaign records
• providing technical and operational support
• preventing fraud and maintaining platform security; and
• providing other functionality requested by the relevant charity

Charity Extra does not independently determine the purposes for which charity-controlled donor data is used merely because that data is processed through the Charity Extra platform.

The contractual terms governing Charity Extra's processing of personal data on behalf of charities are contained within the Data Processing Terms forming part of Charity Extra's Terms and Conditions.

6. Gift Aid

Where a donor provides a Gift Aid declaration through Charity Extra, Charity Extra processes that information on behalf of the relevant charity.

Charity Extra provides the relevant Gift Aid information to the charity through its reporting and data services.

Charity Extra does not determine whether a donation qualifies for Gift Aid and does not submit Gift Aid claims to HM Revenue & Customs ("HMRC") on behalf of the charity.

The relevant charity is responsible for determining Gift Aid eligibility, maintaining the records required by HMRC and submitting any Gift Aid claim.

7. How Charity Extra Uses Personal Data as a Controller

Where Charity Extra acts as a data controller, we will only process personal data where we have an appropriate lawful basis.

Depending upon the circumstances, this may include processing that is necessary:

• to perform a contract or take steps at your request before entering into a contract
• to comply with a legal obligation
• for our legitimate interests or those of another person, where those interests are not overridden by your rights
• where you have provided consent; or
• on another lawful basis available under applicable data-protection law

Our legitimate interests may include operating and protecting our business and platform, preventing fraud and misuse, improving our services, administering our relationships with charities and other organisations, and communicating about Charity Extra's services where permitted by law.

Where Charity Extra sends its own direct marketing communications, we will do so only where permitted by applicable law.

You may opt out of Charity Extra's marketing communications at any time.

8. Optional Tips

Where a donor chooses to make an optional Tip to Charity Extra, the Tip is separate from the donation made to the relevant charity.

Charity Extra may process information relating to that Tip as a data controller where necessary to administer the Tip, maintain financial and accounting records, process any refund request, prevent fraud and comply with legal obligations.

Charity Extra will not treat the making of a Tip as consent to receive unrelated marketing communications.

9. Sharing Personal Data

Where Charity Extra acts as a data processor, personal data may be made available to the relevant charity or other data controller on whose behalf Charity Extra processes the information.

Charity Extra may also use carefully selected service providers and sub-processors where necessary to provide, maintain, secure and support its services.

These may include:

• payment providers and banks
• hosting and cloud-infrastructure providers
• communications providers
• email and messaging providers
• security and fraud-prevention providers
• identity-verification providers
• analytics and technical-service providers; and
• other technology providers necessary to operate the Charity Extra platform

Where Charity Extra uses a sub-processor in relation to personal data processed on behalf of a charity, we will do so in accordance with applicable data-protection law and our Data Processing Terms.

Charity Extra may also disclose personal data where required by law, court order, a regulatory authority or another lawful requirement.

We do not sell personal data.

10. International Transfers

Charity Extra and its service providers may process personal data in the United Kingdom and other countries.

Where personal data is transferred outside the United Kingdom and applicable data-protection law requires additional safeguards, Charity Extra will ensure that an appropriate lawful transfer mechanism is used.

This may include applicable UK adequacy regulations, recognised contractual safeguards or another lawful transfer mechanism available under applicable data-protection law.

11. Security

Charity Extra takes appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal data is restricted to personnel, contractors and service providers who require access for legitimate purposes and who are subject to appropriate confidentiality and security obligations.

While no method of electronic transmission or storage can be guaranteed to be completely secure, Charity Extra takes reasonable and appropriate measures having regard to the nature of the information processed and the risks involved.

12. Retention

Where Charity Extra acts as a data processor, personal data is retained in accordance with the instructions of the relevant controller, Charity Extra's Data Processing Terms and any applicable legal obligations.

Where Charity Extra acts as a data controller, we retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including satisfying applicable legal, accounting, regulatory and reporting requirements.

Different categories of personal data may therefore be retained for different periods.

13. Your Data-Protection Rights

Depending upon the circumstances and applicable law, individuals may have rights including:

• the right to be informed about processing
• the right of access to personal data
• the right to have inaccurate personal data corrected
• the right to erasure in certain circumstances
• the right to restrict processing in certain circumstances
• the right to object to certain processing
• the right to data portability in certain circumstances
• the right to withdraw consent where processing is based upon consent; and
• rights relating to certain automated decision-making

These rights are subject to the conditions, limitations and exemptions contained in applicable data-protection law.

14. Exercising Your Rights

Where Charity Extra processes your personal data solely as a data processor on behalf of a charity, the relevant charity, as data controller, is generally responsible for dealing with requests concerning your data-protection rights.

If you submit such a request directly to Charity Extra, we may refer or forward your request to the relevant charity and will provide reasonable assistance to that charity in responding to the request in accordance with applicable data-protection law.

Where Charity Extra acts as the data controller for the personal data concerned, you may exercise your applicable rights directly with Charity Extra by contacting:

Email: info@charityextra.com

We may request information reasonably necessary to confirm your identity before responding to a request.

15. Children and Young People

The Charity Extra platform is not intended to be used independently by children where parental or guardian involvement is required by applicable law.

Where a person under the age of 18 participates in fundraising or crowdfunding through Charity Extra, this must be carried out with any parental or guardian consent or supervision required by Charity Extra's Terms and Conditions and applicable law.

Where personal data relating to a child or young person is processed on behalf of a charity, Charity Extra will process that information in accordance with the relevant charity's instructions, our Data Processing Terms and applicable data-protection law.

16. Complaints

If you have concerns about how your personal data has been processed, please contact Charity Extra or, where the processing is carried out by Charity Extra on behalf of a charity, the relevant charity.

Where Charity Extra is acting as a data processor, we will assist the relevant charity as required under applicable data-protection law.

You also have the right to make a complaint to the Information Commissioner's Office ("ICO") where applicable.

Further information about your rights and the ICO is available at www.ico.org.uk.

17. Gmail and Connected Services

Where a Charity Extra feature allows an authorised user to connect a Gmail account using Google OAuth, Charity Extra will access Gmail data only to provide the functionality authorised by that user and in accordance with the permissions granted.

Gmail data accessed for this purpose will not be used by Charity Extra for unrelated advertising or marketing purposes.

Charity Extra's use and transfer of information received from Google APIs will comply with the applicable Google API Services User Data Policy, including applicable Limited Use requirements.

Users may revoke access through their Google Account permissions.

18. Cookies and Similar Technologies

Charity Extra may use cookies and similar technologies in connection with its website and platform.

Some cookies are necessary for the operation and security of the platform. Other cookies or similar technologies may be used for analytics, functionality or other purposes, subject to applicable consent requirements.

Further information about the cookies and similar technologies used, their purposes and the choices available to users is provided through Charity Extra's Cookie Policy and cookie-consent tools where applicable.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal obligations or data-processing arrangements.

The latest version will be published on the Charity Extra website together with the date on which it was last updated.

20. Contact Us

For questions about this Privacy Policy or Charity Extra's processing of personal data, please contact:

Giving More Online Limited trading as Charity Extra

Company number: 12228700

Email: info@charityextra.com