Legal

Privacy Policy

Global Data Protection and Privacy Policy · Last updated December 2025

Global policy

GivenGain Foundation (“we”, “our”, “us”) operates several websites, including givengain.com and givengain.org. We respect your privacy and are committed to protecting your personal data. This global privacy policy outlines how we collect, use and safeguard your information globally, along with specific provisions for the European Union (EU), United Kingdom (UK), United States (USA) and South Africa.

Relation with services

It may be difficult, and in some cases impossible, for GivenGain to provide services if you refuse to allow GivenGain to process your data. If you do not agree with this Data Protection and Privacy Policy, you should not provide GivenGain with any data. You can delete your account at any time by logging into your account and navigating to Settings > Account > Delete Account.

As a data subject, you also have the right to object to the processing of your data and/or its deletion.

If you have provided GivenGain with additional data beyond your account details, you also have the right to withdraw your consent to the processing of such data by contacting our Data Protection Officer at privacy@givengain.com. However, withdrawing consent may prevent GivenGain from providing some or all of its services. You also retain the right to lodge a complaint with a supervisory authority if necessary.

Scope of this policy

This policy applies to the services offered by GivenGain through its websites. It does not apply to services offered by other companies or individuals, nor does it cover the activities performed by third parties advertising GivenGain’s services, or websites to which GivenGain may link.

Data controller, representative and DPO

  • The GivenGain Foundation, Avenue Centrale 122, 1884 Villars-sur-Ollon, Switzerland, is the data controller.
  • Johannes van Eeden is the data controller’s representative.
  • Our Data Protection Officer is Bruce Jackson, who can be contacted at privacy@givengain.com.

Information we collect

We collect the following types of information to optimize the user experience.

Technical data

  • browser type;
  • language preference;
  • referring site, time of visit, and similar details.

Personal data

  • Registered users: name, email address, IP address.
  • Donations: name, address, phone number, email, donation amount, messages to charities.
  • Transactions: payment information.
  • Support: any information provided during communications with our support team.

We also collect information from third parties, such as charitable organizations, in order to distribute earmarked funds to Charities from donors.

How we use your information

  • manage and maintain user accounts;
  • process donations and facilitate interaction with charities;
  • conduct financial transactions securely;
  • improve the website experience and analyze trends;
  • respond to inquiries and provide customer support;
  • comply with legal obligations (fraud prevention, financial reporting); and
  • make reports or submit claims to tax authorities or government agencies for the purposes of our administration.

GivenGain works with a variety of third-party partners to make the Platform available to you, to host and store the information we collect, to collect and process donations, and to provide certain functionality and features.

Except as stated in this Privacy Policy, we do not reveal personally identifiable information about you to third parties for their independent use unless:

  • you expressly authorize GivenGain to do so;
  • it is necessary to allow GivenGain and its service providers or agents to provide services on GivenGain’s behalf;
  • it is to provide products or services to you;
  • it is disclosed to entities that perform marketing, advertising or data aggregation services for GivenGain (including direct marketing via postal mail);
  • it is necessary in connection with a sale of all or substantially all of the assets of GivenGain, or a merger, consolidation, share exchange, combination, reorganization or like transaction in which GivenGain is not the survivor; or
  • GivenGain is required or permitted to do so to comply with a subpoena, legal process, government request or other legal obligation; to prevent, investigate, detect or prosecute criminal offenses or attacks on the technical integrity of the Platform or our network; and/or to protect the rights, privacy, property, business or safety of GivenGain, its partners and employees, or the visitors to the Platform.

Data sharing

We may share your data with trusted third-party service providers, such as payment processors, IT providers, and tax or legal authorities or government agencies, as required by law or for the purposes of our administration. All third parties are bound by contracts ensuring the protection of your data.

Third-party platforms

We may also provide links to a variety of third-party social media sites and/or websites, such as X, Instagram and Meta, as a service to you, and to provide additional information or content related to our work. We have no affiliation with these other parties or websites, and cannot control and are not responsible for the information collection, use and disclosure practices of such third parties. We encourage you to review and understand their privacy practices and policies, if any, before providing any personally identifying information to them or initiating any financial transactions.

Data retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy, or as required by law:

  • Account data: retained for the lifetime of the account and three years after deletion for auditing purposes;
  • Donation records: retained for seven years in line with financial regulations; and
  • Marketing data: retained until you withdraw your consent or opt out.

Data security

We implement appropriate technical and organizational measures to protect your data from unauthorized access, misuse or disclosure. However, no system is completely secure. If you have concerns about data security, please contact us.

International data transfers

We operate globally, and your data may be transferred outside of your country, including to the United States, South Africa and the EU. International data transfers will only be made in compliance with applicable legal frameworks. Where applicable, we will ensure data transfers are only made where there are adequate safeguards to protect your data in place, such as the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum to the SCCs (UK Addendum), the UK International Data Transfer Agreement (IDTA), and Binding Corporate Rules (BCRs); or in line with an adequacy decision made by the relevant authorities in your jurisdiction (including in the UK or the EEA).

Data breach notification

In the event of a data breach, we will notify affected individuals and relevant authorities in compliance with applicable laws.

Cookies and tracking technologies

Cookies

A cookie is a piece of information that a web server may place on your computer when you visit a website. Cookies are commonly used to improve the user experience. Many cookies last only through a single website session; others may have an expiration date or may remain on your computer until you delete them. GivenGain may use “session cookies” so that we can properly verify a user’s identity as they move from one page to the next. We may also use cookies to identify and authenticate visitors, to maintain continuity during a user session, or to gather data about the usage of our website for research and other purposes.

Most browsers will tell you how to stop accepting new cookies, how to be notified when you receive a new cookie, and how to disable existing cookies. Without cookies, however, you may not be able to take full advantage of all the features on our Platform. Our cookies do not gather personally identifiable information. In some cases, GivenGain may use another company to operate web servers for our Platform; GivenGain uses the cookie information gathered by these companies in the same manner as stated in this Privacy Policy.

“Do Not Track” notice

Some web browsers incorporate a “Do Not Track” feature that signals to websites that you do not want your online activity tracked. How browsers communicate and respond to the Do Not Track signal is not yet uniform. For this reason, like many websites, the Platform does not currently respond to or alter its practices when it receives a Do Not Track signal. Third parties may collect personal information about your online activities over time and across different websites when you visit our Platform or other online services. To find out more about “Do Not Track”, you may wish to visit allaboutdnt.com.

Changes to this policy

We reserve the right to revise this Privacy Policy at any time by updating this posting. Please check back regularly to see if there have been any changes, which you can determine by reviewing the date listed above. By continuing to use the Platform after those changes become effective, you agree to be bound by the revised Privacy Policy. Where appropriate, we will notify you of material changes by email or post.

EU & UK Addendum

Legal basis for processing

  • Consent (Article 6(1)(a) GDPR): when you agree to marketing or other data processing activities;
  • Performance of a contract (Article 6(1)(b) GDPR): necessary for the services we provide, such as processing donations;
  • Legal obligation (Article 6(1)(c) GDPR): to comply with legal requirements; and
  • Legitimate interests (Article 6(1)(f) GDPR): for fraud prevention, website security and similar purposes.

Your rights (GDPR Articles 12 to 23)

  • the right to access, rectification, erasure, restriction of processing, portability, and objection;
  • the right to withdraw consent at any time; and
  • the right to lodge a complaint with your supervisory authority (e.g. the ICO in the UK).

Data transfers

Transfers outside the European Economic Area (EEA) are safeguarded by SCCs or BCRs. The UK has deemed EU countries adequate for transfer purposes and has recognized EU adequacy decisions in relation to other countries. Additionally, data transfer mechanisms may be performed provided they are in line with the International Data Transfer Agreement and the International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers.

Children’s privacy

Our services are not intended for individuals under 16. We do not knowingly collect data from children under this age without parental consent. For more details on your rights or to exercise them, contact us at privacy@givengain.com.

USA Addendum

Personal information you provide and how it is used

You may freely visit our Platform anonymously and without being required to provide us with any personal information. However, certain requests and access to certain features or functionality require that you provide us with some personally identifying information, as described below. Please do not send confidential information to us directly through this Platform or by email. We only collect personal information directly from you when you provide it.

Examples of instances in which we may collect personal information, and the types, include (but are not limited to):

  • for registered users, and in other situations, personal contact details such as name, address, telephone number and email address;
  • if you make a donation via the Platform, certain personally identifying information such as your phone number, name and home address, as well as your credit card billing information, in order to process the donation;
  • if you contact our support team or otherwise contact us through the contact form, your name and email address, and any additional information you choose to provide; and
  • if you sign up for our email newsletter, your email address.

Non-personal information collected by automated means

We, and certain third parties (including service providers, advertisers, advertising networks and platforms, and third-party partners), may use automated means to collect various types of non-personal information, including information about you, your computer or other device used to access our Platform. Much of this is collected through third-party tracking services, including Google Analytics, and may include usage information such as the number and frequency of users, pages visited, web browsing histories, online activities and searches, and similar data. This data, if used, is used in the aggregate, and not in a manner intended to identify you personally, and may be shared with third parties. We may also collect non-personal information through cookies, web beacons and IP addresses.

Web beacons

We may use web beacons (also known as internet tags, pixel tags and clear GIFs). These allow third parties to obtain information such as the IP address of the computer that downloaded the page on which the beacon appears, the URL of that page, the time it was viewed, the type of browser used, and information in cookies set by the third party. Web beacons may also be used to track whether you have opened an HTML email, how many times it was forwarded, and which links were clicked.

Log files, IP addresses and analytics

Adoption of communications standards on the internet and our use of standard analytical tools such as Google Analytics result in, or may lead to, the automatic receipt and tracking of: the URL of the website from which you came and the website to which you go when you leave the Platform; the IP address of your computer (or proxy server); your computer operating system and type of web browser; email patterns; your mobile device and mobile operating system (if accessing via a mobile device); and your ISP or mobile carrier’s name.

Consent and rights

By using our services, you consent to the collection and processing of your personal data. You can withdraw your consent at any time by contacting us at privacy@givengain.com. Withdrawing consent may affect our ability to provide services.

Children’s privacy

We do not knowingly collect, use or disclose personally identifiable information about visitors younger than 18 years of age. If you are under 18, you are expressly prohibited from accessing the Platform. If you are the parent or guardian of a child under 18 and believe they have disclosed personally identifiable information to us, please contact us at privacy@givengain.com so that we may delete your child’s information.

South Africa Addendum

Under the Protection of Personal Information Act (POPIA), you have the right to:

  • be informed of data processing;
  • access your personal information;
  • request corrections or deletion of inaccurate or irrelevant data; and
  • object to processing under certain circumstances.

We process your personal data in compliance with POPIA. Transfers of data outside South Africa are subject to appropriate safeguards in line with POPIA’s requirements.