Privacy Statement

Who is responsible

OpenCharities B.V. (Chamber of Commerce 96761253, based in Zaandam) builds and operates the platform on opencharities.com, and is responsible for technical and user data. Each charity on the platform — including Stichting OpenCharities Foundation (Chamber of Commerce 42069457, based in Haarlem) — has its own Stripe account and is responsible for the donations it receives. OpenCharities B.V. creates the payment link on a charity's Stripe account and reads Stripe's API to show the correct balance on the platform; it never holds your donation itself and holds no signing key over the money. Whether OpenCharities B.V. is a GDPR processor or a controller for this donation data is still being determined; we will update this statement once that is settled. It makes no difference to you whom you contact: you can always reach us at info@opencharities.com.

What data we collect

We process the following categories of personal data: • Donation data: your name, email address, donation amount and the project or charity you support. Pilot one takes one-time gifts only — via iDEAL, Bancontact, Apple Pay, Google Pay and similar methods — through Stripe; there is no SEPA direct debit. Stripe collects your payment details (such as your bank account or card information) directly; OpenCharities does not store them. • Contact data (if you provide it): address. • Newsletter and waitlist data: your email address, if you sign up. • Technical and usage data: IP address, browser type, device information, and browsing and click behaviour. The platform is intended for people aged 18 and over; we do not knowingly process minors' data.

How we use your data

We process your data for the following purposes: • Processing your donation: your donation goes to the charity's own Stripe account; OpenCharities creates the payment link and reads Stripe's API to show your donation and the charity's balance on the platform. OpenCharities does not receive, hold or disburse the money itself. • Communicating about your donation: confirmation and updates on spending. • Newsletter: only if you have signed up for it; you can unsubscribe at any time. • Transparency about donations: we may show your name alongside your donation on the platform, unless you choose to give anonymously (opt out). • Managing, securing and improving the platform: technical operation, fraud and abuse prevention (including limiting the number of requests per IP address), error tracking and usage analysis. • Legal obligations: such as the statutory retention requirement. Legal bases: performance of the donation agreement (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f), for security, platform management, analysis and public attribution of donations), legal obligation (Art. 6(1)(c)), and consent (Art. 6(1)(a), for analytics cookies and the newsletter, which you can always withdraw).

Who we share your data with

To operate the platform we engage external parties, grouped into the categories below. A Data Processing Agreement applies where a party processes data on our instructions. Some parties, including Stripe, also act under their own rules for their own legal duties, such as fraud prevention and financial-crime checks — for that part they are not bound by our instructions.

Some of these parties are based in or use infrastructure outside the European Economic Area (EEA), in particular the United States. For such transfers we rely on the applicable EU safeguards, such as the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs).

A complete, current list of all our processors is available on request via info@opencharities.com.