Privacy Policy

The data controller for Donaya's own website, platform accounts, billing, support, security, and service operation is:

For some supporter, donor, customer, attendee, and certificate-related data, the organization using Donaya may also act as an independent controller or as the main controller. Donaya may process some data on behalf of that organization to provide the platform.

The final controller and processor roles for donor and supporter data should be confirmed in Donaya's customer agreements and data processing terms.

We may collect the following categories of personal data.

Account and organization data

• Name.
• Email address.
• Password authentication data.
• Organization name.
• Organization description and public profile information.
• Billing and subscription information.
• Role, account permissions, and dashboard activity.

Supporter, donor, customer, and attendee data

• Name.
• Email address.
• Donation, order, ticket, RSVP, or payment-related information.
• Donation amount, product purchased, event attendance, or support preferences.
• Tax certificate information, when requested or required.
• Communication preferences.

Payment-related data

• Payment status.
• Stripe customer, checkout, payment, subscription, or connected-account identifiers.
• Transaction metadata needed to record donations, purchases, subscriptions, refunds, or payouts.

Donaya does not store full card numbers. Payment card processing is handled by payment providers such as Stripe.

Technical and security data

• IP address.
• Device and browser information.
• Log data.
• Session data.
• Security and fraud-prevention signals.
• Cookie and consent preferences.

Support and communication data

• Messages sent to Donaya.
• Support requests.
• Feedback.
• Email communication records.

We use personal data for the purposes and legal bases below.

Where we rely on consent, you may withdraw it at any time.

Account registration

We use account registration data to create and manage your Donaya account, authenticate access, assign permissions, send service messages, and secure the platform.

Organization profile

We use organization profile data to create and display public organization pages, manage projects, products, events, fundraising-related information, and administrative records.

Contact and support forms

We use contact details and message content to respond to requests, provide support, keep communication records, and improve our service operations.

Donation and payment forms

We use payment-related data to process contributions, purchases, subscriptions, tickets, and related records; send confirmations; support refunds or disputes; and share necessary information with the organization you support.

Product and order forms

We use order information to process purchases, provide confirmations, manage records, and support fulfillment by the organization where applicable.

Event RSVP forms

We use RSVP data to manage attendance, send event-related information, and help the organization administer the event.

Donation certificate forms

We use certificate information to help generate and manage donation certificates or related tax records. The organization may need to keep this information for legal, tax, or accounting purposes.

Newsletter and supporter updates

If you choose to receive updates, we use your contact details and preferences to send the relevant communications. Newsletter or supporter update consent is separate from cookie consent and should not be pre-selected.

Admin and verification documents

We may use verification or administrative documents to review organization eligibility, enable payment features, support compliance checks, prevent misuse, and maintain required records.

We use trusted providers to operate Donaya. These may include:

• Hosting and infrastructure providers.
• Database providers.
• Payment providers, including Stripe.
• Email providers.
• Image and file hosting providers.
• Analytics providers, if enabled.
• Customer support, monitoring, logging, and security tools.
• Professional advisers where needed for legal, tax, accounting, or compliance purposes.
• Public authorities where required by law.

These providers may process personal data only as needed to provide their services to Donaya or to the organization using Donaya.

Current expected providers may include Stripe, Neon/PostgreSQL, Netlify, Cloudflare, Cloudinary, Mailgun, and any analytics provider that Donaya chooses to enable. Donaya should maintain a current subprocessor and vendor list.

Some providers may process data outside the European Economic Area. Where this happens, we rely on appropriate safeguards required by data protection law, such as adequacy decisions, Standard Contractual Clauses, or equivalent contractual and technical protections.

We keep personal data only for as long as necessary for the purposes described in this policy, including:

Exact retention periods may vary depending on legal obligations, the type of data, and the final Donaya data model.

Fields marked as required are necessary to provide the requested service. If you do not provide them, we may not be able to create your account, process your request, complete a payment, manage an RSVP, or generate a donation certificate.

Optional fields are not required to use the relevant feature, but may help Donaya or the organization provide a more complete service.

Depending on your situation, you may have the right to:

• Access your personal data.
• Correct inaccurate data.
• Request deletion.
• Request restriction of processing.
• Object to certain processing.
• Request data portability.
• Withdraw consent.
• Lodge a complaint with a data protection authority.

In Spain, you may contact the Agencia Española de Protección de Datos (AEPD).

To exercise your rights, contact us at contacto@donaya.es.

If your request concerns data controlled by an organization using Donaya, we may direct the request to that organization or support the organization in responding, depending on Donaya's role.

We use technical and organizational measures designed to protect personal data, including access controls, secure authentication, encryption where appropriate, secure hosting, monitoring, and internal access restrictions.

No online service can guarantee absolute security, but we work to protect the data we process and to reduce the risk of unauthorized access, loss, misuse, alteration, or disclosure.

If you interact with Donaya through social networks, the relevant social network may also process your data under its own privacy policy.

Donaya may process public profile information, messages, comments, and interaction data only to respond to your interactions, manage our relationship with you, and share information about Donaya.

Donaya is intended for organizations and adult users. Donaya is not designed for children to create accounts. If we become aware that we have collected children's data without appropriate authorization, we will take appropriate steps to delete or protect it.

We may update this Privacy Policy from time to time. If changes are significant, we will take reasonable steps to notify users or make the changes clear on the platform.

For privacy questions or rights requests, contact: