Privacy Policy
How we protect your data
Introduction.
Welcome to the Privacy Policy of iDonate Ltd.
We are dedicated to protecting your personal information and being transparent about how we manage your data. This policy describes how we collect, use, and safeguard your information as you use our services. Moreover, we strive to ensure clarity and provide comprehensive details about our practices, so you are well-informed.
To fully understand how we handle your personal information across our platforms, please read this document carefully. This will help you see our commitment to data protection and the steps we take to keep your information secure.
Who we are.
iDonate Ltd is part of a group of companies that includes Eventmaster and its affiliated entities (“Group Companies”).
For certain services, including shared platform access and authentication (such as Single Sign-On), iDonate Ltd and other Group Companies may jointly determine the purposes and means of processing your personal data.
In such cases, iDonate Ltd and the relevant Group Company act as joint controllers within the meaning of Article 26 of the General Data Protection Regulation (GDPR).
We have entered into an arrangement with these Group Companies to define our respective responsibilities for compliance with data protection laws. The essence of this arrangement is available upon request.
For example, if you register a Cause with us, we function as the data processor, while you act as the data controller under GDPR. These roles are detailed in our Terms of Service or other relevant contracts.
Contact us at: [email protected]
Governance.
Operating in Ireland, this document adheres to Irish Data Protection Law, governed by the Irish Data Protection Commission. It details what Personal Data we collect, how we process it, and our obligations.
We are not liable for the content or privacy practices of external websites linked from our platforms.
Applicable Laws:
- General Data Protection Regulation (EU Regulation 679/2016)
- Irish Data Protection Acts 1988 to 2018
- Regulations from DPA 2018
- ePrivacy Regulations 2011
This Privacy Policy explains how we use your personal information, whom we share it with, and your rights related to your data.
What personal data do we collect?
We collect personal information that you provide when setting up your account and interacting with our site and social media pages. We only gather the data necessary for our intended purposes.
When Registering a Cause (charity, school, non-profit):
We collect basic contact details such as your name, address, and email. Additionally, you will need to create a username and password to ensure secure account access.
When Making a Donation:
We collect payment information along with your name, home address, and email address. If you choose not to remain anonymous, your name and donation amount will be visible on the public page.
Creating a Fundraising or Crowdfunding Page:
We gather contact information and details about the charity or non-profit you support, as well as information about your fundraising plans. We also verify your bank account and identity.
Submitting a CHY3 or CHY4 Form:
These forms help charities claim tax relief. We either send postal forms to the relevant charity or notify them if you eSign online.
Giving Us Information About Others:
If you provide information about others, please ensure you have their consent and keep a record of it, especially for sensitive information.
When Visiting Our Social Media Pages:
We collect information you post, your interactions with our content, and aggregated statistical data.
Children’s Personal Data:
For users under 16, we require an adult to be present during registration. We will obtain consent from the authorized adult. If we discover that a child has submitted personal data without proper consent, we will delete it.
Single Sign-On (SSO)
We may provide a Single Sign-On (SSO) service that allows you to access multiple platforms operated by iDonate Ltd and Group Companies using one set of login credentials.
When you use SSO:
Your authentication credentials (such as email address and password or authentication tokens) are processed centrally;
Certain account data (such as your name, email address, and unique user ID) may be shared between Group Companies;
Your account may be recognised across multiple platforms without requiring separate logins.
This processing is necessary to provide a seamless user experience and to maintain secure access across services.
Special Category Personal Data:
We do not collect special category data.
Categories of Personal Information We Use:
We process various types of personal information, including:
- Biographical: Life experiences.
- Contact: Details for communication.
- Banking/Billing: Information for transactions.
- Identity: Verification documents or unique identifiers.
- Fundraising: Details of your donations and fundraising activities.
- Marketing Preferences: Your preferences for marketing communications.
- Correspondence: Information from our communications with you.
How we use your personal infomation.
We process personal data for several purposes based on various legal grounds, including:
- Consent: If you consent, we may send you marketing information. You can withdraw your consent at any time by contacting us or adjusting your profile settings.
- Contract: We use your information to fulfill contracts and pre-contract requests, such as setting up fundraising pages and processing donations.
- Legal Obligations: We comply with legal requirements by keeping records, performing necessary checks, and addressing complaints.
- Legitimate Interests: We process data to promote our business, analyze marketing effectiveness, improve our services, and ensure security.
We process your personal data in connection with SSO and shared services on the following legal bases:
Contractual necessity – to provide you with access to our services across platforms
Legitimate interests – to operate integrated systems, improve user experience, and maintain security
Where required, we will rely on your consent for specific processing activities.
Marketing
If you consent, causes may send you marketing communications. In these cases, they act as controllers for your data. You can opt out of our newsletter at any time by using the “Unsubscribe” link or by contacting us directly.
Joint Controllers
Where iDonate Ltd and a Group Company jointly determine the purposes and means of processing your personal data (for example, in relation to SSO and shared platform access), we act as joint controllers.
Under our joint controller arrangement:
We jointly ensure that your data is processed lawfully, fairly, and transparently
We define responsibilities for handling data subject rights requests
We implement appropriate technical and organisational security measures
You may exercise your data protection rights with either iDonate Ltd or the relevant Group Company.
iDonate Ltd acts as the primary contact point for data protection queries unless otherwise specified.
Who we share your data with.
We share your information in the following situations:
- Causes: When you make a donation or set up a fundraising page, we pass your details to the relevant cause. They will only contact you if you have opted in to receive further communications from them.
- Suppliers and Service Providers: We share data with third parties who help maintain our site and provide other services. These third parties are required to protect your data and comply with our contractual agreements.
- Suppliers, Service Providers, and Third Parties: We provide necessary personal information to our suppliers under strict contractual terms. Additionally, we may disclose your data if we undergo restructuring or need to comply with legal obligations.
How Causes (charities and non-profits) use your data.
When we share your information with charities, those charities become the data controllers. As data controllers, they must comply with data protection laws when handling your personal data. Each charity’s use of your data is governed by their own privacy notices. Please be aware that iDonate does not oversee how charities use your data or ensure they meet legal requirements.
If you choose to donate or create a Fundraising Page, we will request your consent to receive emails from the charity. These emails may include updates on the impact of your donation, as well as information about future events and campaigns. We will forward your consent preferences to the charity, which will then use your personal data to send you the emails you have agreed to receive.
To update your preferences regarding how a charity uses your data, please contact the charity directly.
Keep in mind that charities collect information about their supporters from various sources. Since we are not the system of record for our Causes, we can only manage and document your consent to receive email fundraising appeals based on your choices on our platform.
We cannot track or reflect changes in your consent preferences if you make them directly with the charity. For instance, if you opt in to receive emails from a charity through iDonate but later choose to opt out by contacting the charity directly, we will not have a record of your opt-out.
Transfers of your personal information outside of Europe.
We generally keep your personal information within Europe. However, in a few cases, we may need to transfer it outside the region. When we do, we implement strong measures to protect your data.
For transactions using PayPal, your data is transferred according to PayPal’s Binding Corporate Rules, which you can review here.
When transferring your personal data outside the EEA, we ensure it receives adequate protection through one of the following safeguards:
- We only transfer data to countries recognised by the European Commission as providing an adequate level of protection.
- For certain service providers, we use specific contracts approved by the European Commission to ensure your data receives the same level of protection as in Europe.
- In all other cases, we will obtain your explicit consent before transferring your data outside the EEA.
Security & links to other websites.
We implement stringent security procedures to protect your personal data from accidental loss, destruction, or damage. Our measures actively prevent unlawful or unauthorized processing and guard against accidental loss.
Your data benefits from modern encryption, intrusion prevention, and secure account access techniques. These advanced procedures and technologies ensure that your personal data remains protected from collection through to destruction.
To maintain robust data security, we focus on three key areas:
Confidentiality
Only authorised individuals can access the data.
Integrity
Personal Data is kept accurate and suitable for its intended purpose.
Availability
Authorised users can access the data when needed for legitimate purposes.
Our Site and social media pages may include links to other websites operated by organizations that we do not control. Therefore, this policy does not cover those external sites, and we recommend that you review their privacy policies.
We do not assume responsibility for the privacy policies or practices of other websites, even if you access them through our links. These links are provided solely for your convenience and information. We disclaim any responsibility for the content, privacy practices, and terms of use of these external sites. Furthermore, we do not endorse or guarantee the accuracy or completeness of their information.
Any decision to share personal information on third-party websites is entirely at your own risk.
If you arrived at our Site from a third-party website, we cannot be held accountable for the privacy policies or practices of that site. We advise you to review the privacy policy of the third-party website as well.
How long we store your data.
We follow a documented data retention schedule to ensure your personal data is managed appropriately. Your personal data is retained only as long as necessary to fulfil the purposes for which it was collected, and for up to seven years afterward as required by Revenue or other applicable laws. Additionally, we may keep your information for the duration needed to complete legitimate business operations, including legal, accounting, or reporting requirements.
To determine the appropriate retention period for your personal data, we evaluate factors such as the data’s volume, nature, and sensitivity. We also consider the potential risk of unauthorised use or disclosure, the purposes for processing, whether those purposes can be achieved through other means, and applicable legal requirements.
Data Retention for Fundraising Pages:
- Donations to a Fundraising Page: If you provide an email address, postal address, or contact phone number, we retain this data for three months after the fundraising page closes.
Data Retention for Direct Donations to a Cause:
- Direct Donations: If you provide an email address, postal address, or contact phone number, we keep this data for six months following your donation date.
Your rights in relation to your personal information.
Under certain circumstances and depending on the legal basis for processing your personal data, you have the following rights:
- Information Access: Request details on whether we hold your personal data, including what data we have and why we are holding or using it.
- Data Access: Submit a “Data Subject Access Request” to obtain a copy of your personal data and verify that we are processing it lawfully.
- Correction: Correct any incomplete or inaccurate information we hold about you.
- Erasure: Request the deletion or removal of your data if there is no valid reason for us to continue processing it. You also have the right to request deletion if you have objected to its processing.
- Objection: Object to the processing of your personal data if we rely on legitimate interests or if we are processing it for direct marketing.
- Automated Decision-Making: Opt out of decisions made by automated means, including profiling, based on your personal data.
- Restriction: Request a pause in processing your data if you need us to verify its accuracy or the reason for processing it.
- Data Portability: Ask us to transfer your personal data to you or another party in a structured, electronic format that is easy to use and transfer.
How to exercise your rights.
If you have an account on www.idonate.ie, please log in and select the “Close Account” option within your account settings. Keep in mind that doing so may restrict the services we can offer you.
Where your data is processed jointly with Group Companies, you may exercise your rights against any of the joint controllers.
We will coordinate with relevant Group Companies to respond to your request in accordance with GDPR requirements.
Sale of organisation.
In certain situations, we might need to transfer your information, including your Personal Data, to a third party. This may occur during a sale, merger, liquidation, receivership, or the transfer of nearly all our organization’s assets. Rest assured, the third party will be required to adhere to our Data Protection and Privacy Policy and use your Personal Data solely for the purposes you initially provided it for.
We will limit the transferred Personal Data to what is strictly necessary. Moreover, we will notify you about any such transfer and provide you with an opportunity to opt out.
Changes to our Privacy Policy.
Please check this page regularly for changes to this policy. We will email you with changes if we hold a valid email address for you.
We may review this policy from time to time and any changes will be notified to you by posting an updated version on our Site and, where appropriate, by contacting you by email.
Any changes will take effect 7 days after we post the modified terms on our Site or after the date we notify you by email. It is recommended that you regularly check this page for changes and review this policy each time you visit our Site.
Cookies.
The law allows us to store cookies on your device if they are strictly necessary for the operation of this site. However, for all other types of cookies, we require your permission. By clicking “Agree,” you consent only to the Necessary cookies.
You have the option to change or withdraw your consent at any time. To do so, visit the Cookie Declaration on our website via the “Cookie Policy” link located at the bottom of every page.
To learn more about our organisation, how to contact us, and how we process your personal data, please refer to our Data Protection and Privacy Notice.
Please note, your consent applies to the following domains and their subdomains: idonate.ie, giv.i.ng, idonate.ltd, and charitytaxback.ie.
For further information about how your data is shared within our group, or to request a summary of our joint controller arrangement, please contact us at [email protected]
