Is my banking and personal information protected?
Yes. Donoor never sees your card number or banking credentials: each payment is processed directly by Stripe or PayPal, the two PCI-DSS level 1 certified payment providers that collect donations on the platform. Your personal data (name, email, amount) is only passed on to the recipients who genuinely need it: the association you support, and a limited number of technical providers required to run the site.
This article explains what Donoor knows about you, who can see it, how this information is protected, and how to exercise your rights if needed.
Your banking details never pass through Donoor
When you pay by card, through Stripe or PayPal, your banking details are entered directly on a secure page of that provider, never on a Donoor server. Stripe and PayPal are both PCI-DSS level 1 certified, the highest level of certification for card payment security, and apply 3-D Secure authentication when regulations require it.
| Who does what | Details |
|---|---|
| Entering your card | Directly on a Stripe or PayPal page, never on a Donoor server |
| Verifying the payment | Stripe or PayPal, with 3-D Secure authentication if your bank requires it |
| Storing your card number | With Stripe or PayPal only; Donoor never receives it |
| Destination of the money | The association's Stripe or PayPal account, never a Donoor account |
Why does a different name appear on my bank statement?
The description that appears on your statement depends on the payment method. If the association collects with Stripe, it is the description Stripe asked it to configure, close to the association's name or its website. If it collects with PayPal, the description starts with "DONOOR" followed by the association's name, preceded by "PAYPAL *" or "PP *" depending on the card type. In both cases, this is the normal way the provider identifies the payment: it is not in itself a sign of fraud.
Who has access to your personal data
The association you donate to can see your name, your email, the amount and the history of your donations to it: this is necessary to send you a receipt, answer your questions or recognise you if you become a member. It never sees your card number, since Donoor does not receive it either.
Outside the association, your data is only passed on to the following recipients:
| Recipient | Why |
|---|---|
| Our technical providers | Hosting and maintenance of the site |
| Address suggestion services (IGN, OpenStreetMap, Google Places) | Only the text typed into an address field, to suggest existing addresses to you |
| Cloudflare | Anti-bot verification, only on address fields |
| The association's tools, if it has enabled them | Amount, name and email sent automatically so that it can measure its campaigns or update its donor records |
| The competent authorities | Only where legally required |
Good to know: if an association has connected an external tool to track its campaigns, it becomes responsible for the data transmitted to that tool at that point, not Donoor.
How your data and account are protected
- Encryption of sensitive data and access restricted to the people who need it.
- Regular backups.
- Logging in to your donor area without a password: Donoor sends you a single-use link by email, valid for 15 minutes, so there is no password to remember or to have stolen.
- In the mobile app, the six-digit code, fingerprint or facial recognition are verified by your phone itself: Donoor neither receives nor stores any biometric data, only the result (success or failure).
Your rights over your personal data
In accordance with the GDPR, you can at any time:
- Right of access: obtain a copy of your data.
- Right to rectification: correct inaccurate information.
- Right to erasure: delete your data.
- Right to data portability: retrieve your data.
- Right to object and right to restriction of processing: refuse or limit certain processing.
To exercise any of these rights, write to contact@donoor.org or go through our Contact page. To correct your name, email or address yourself, open My profile in your donor area. You can also delete your account and data at any time; see also create or recover your donor account.
Important: if you do not receive a satisfactory response from us, you can lodge a complaint with the CNIL, the French data protection authority.
Does a payment seem suspicious to you?
If you do not recognise a payment on your statement, or if a fundraising campaign seems dubious, this article is not enough: see how to report an unknown payment or a suspicious donation. If you are simply looking for a refund, see how to get a refund for a donation, ticket or membership.
Key takeaways
- Donoor never stores your card number or banking credentials: Stripe or PayPal, both PCI-DSS level 1 certified, process each payment.
- The name that appears on your statement depends on the association and the provider chosen; it is not in itself a sign of fraud.
- Your personal data is only passed on to the association, a limited number of technical providers, and the authorities where legally required.
- Logging in to your donor area requires no password: you use a link sent by email, valid for 15 minutes.
- You can access, correct or delete your data at any time by writing to contact@donoor.org.