How does Donoor protect association and donor data (GDPR)?
No, Donoor never sells your donors' data, and complies with the European General Data Protection Regulation (GDPR). The data of your association and of your donors belongs to you, not to Donoor.
This page explains what is collected, to whom this data is passed on, how it is technically protected, and how a donor exercises their rights.
Does Donoor sell donors' data?
No, never. Donoor does not sell or rent your donors' data to anyone, and does not use it for advertising purposes. It is only passed on to the service providers strictly necessary for the operation of the service, or to the competent authorities if the law requires it.
| Recipient | Why |
|---|---|
| Stripe or PayPal | Processing the payment, depending on the provider chosen by your association |
| Donoor's technical providers | Hosting and maintenance of the platform |
| Address suggestion services (Institut national de l'information géographique et forestière, OpenStreetMap, Google) | Completing an address typed into a form; only the text entered is sent to them |
| Cloudflare | Checking that an address field is not filled in by a bot |
| Tools connected by your association, if it has enabled webhooks | Receiving the donor's amount, name and email for its own needs; the association then becomes responsible for them |
| The competent authorities | Only where legally required |
Your data never circulates beyond this list: no resale to data brokers, no sharing with other associations, no targeted advertising outside the cookies that the visitor has themselves accepted (see below).
Is my data secure?
Yes. Exchanges with Donoor are encrypted and, as explained in Are payments secure?, no bank card data passes through or is stored by Donoor: Stripe and PayPal take care of it.
Beyond payments, access to your account is protected against repeated login attempts: after several failures, login is temporarily blocked, which never prevents you from resetting your password. And in Settings › Team, you decide who in your association can see or change what (see below).
Your donors' rights over their personal data
A donor may at any time request:
- Access to their data: Donoor can provide them with an export of all information concerning them (contact details, donations, subscriptions, memberships, tickets).
- Rectification of inaccurate information, for example a misspelt address.
- Erasure of their personal data.
To exercise these rights, the donor writes to us from the Contact page. However, a tax receipt or accounting document must be kept for ten years, by legal obligation: if this period has not yet expired, the donor's personal information (name, email, address) is anonymised rather than deleted, so that your association's accounts remain accurate. Donations already made therefore remain visible in your totals, but without being linkable to an identified person.
Cookies and audience measurement
On donoor.org, cookies strictly necessary for the operation of the site (login, basket, preferences) are always active. Audience measurement and advertising cookies are only activated with the visitor's consent, given in the banner that appears on their first visit: the Accept all, Customize and Decline buttons are offered there, and declining requires no more clicks than accepting.
Audience measurement uses anonymised data; advertising cookies, if accepted, make it possible to measure the effectiveness of Donoor's campaigns with its advertising partners. A visitor can also manage cookies directly in their browser settings.
Who in your team sees your donors' data?
You decide. Each member of your team is given a role which determines, among other things, whether they see the Donors page of the Fundraising menu and whether they can export the list. You set these rights in Settings › Team, where a History button also shows, for a member or for the whole team, the creations, modifications and deletions recorded. For the steps to follow, read How do I invite members of my team and manage their rights?
Your association is also not held hostage by its own data: you can track your activity and export your donations from the dashboard, see What can I track in the dashboard and how do I export my data? A donor, for their part, finds how to manage or delete their own account in How do I delete my account and personal data?
Good to know: if a donor does not receive a satisfactory response to a request about their data within the following month, they may lodge a complaint with the CNIL, the French data protection authority.
Important: accounting documents and tax receipts must be kept for ten years. This is why a deletion request results, for these documents, in anonymisation rather than complete erasure.
Key takeaways
- Your donors' data belongs to you: Donoor does not sell it or use it for advertising.
- It is only passed on to the providers needed for the service (payment, hosting, address, anti-bot) and to the authorities where legally obliged.
- A donor can request access, correction or deletion of their data from the Contact page; tax and accounting documents are kept for ten years, in anonymised form where necessary.
- Audience measurement and advertising cookies are only activated with the visitor's consent, and declining is just as simple as accepting.
- You choose, in Settings › Team, who in your association sees your donors' data.