Privacy Policy

Last Updated: 5 November 2026

People's Fundraising is committed to protecting your privacy and handling your personal data in a safe, ethical and lawful way. This Privacy Policy explains what data we collect, how we use it, how we keep it safe, and what rights you have in relation to your personal information.

• Summary of key points
• Introduction and scope
• Relationship with our Terms & Conditions
• Who we are and our data protection roles
• Controller and processor responsibilities
• Information we collect
• How we use your information (purposes and legal bases)
• Cookies & tracking technologies
• Third-party data sharing and disclosures
• International data transfers
• Data retention and disposal
• Data security measures
• Incident response & data breach notification
• Your data protection rights
• Exercising your rights & how to contact us
• Automated decision-making
• Data minimisation & accuracy

Summary of key points

Who we are and our roles: People's Fundraising is operated by Golden Giving Limited. When we host and handle an organisation's fundraising and supporter data on its behalf, the organisation is the data controller and we act as its data processor. We separately act as a data controller where we determine our own lawful purposes, for example for certain account, security, payment, statutory and business records. Our Data Protection Officer (DPO) can assist with privacy enquiries.

Data we collect: We collect personal information you provide (such as your name, contact details, donations and fundraising activity) and data automatically gathered when you use our website (such as IP address, device and browser information, and cookies). We do not collect more data than we need and clearly indicate what is optional.

How information is handled: We store and operate on organisation-controlled data only to deliver, maintain, secure and support the services on the organisation's instructions, or as UK law requires. We do not sell, profile, market to or commercially exploit the charity's private supporter data for our own purposes. For processing where we are a controller, we rely on an appropriate lawful basis as explained below.

Cookies & tracking: We use cookies and similar technologies to run our website and understand how people use it. Essential cookies are needed for things like login and security; optional analytics and marketing cookies are only used with your consent. You can manage cookies through our cookie banner, site settings or your browser at any time.

Data sharing: We do not sell personal information. We disclose it only where necessary for the service or authorised by the relevant organisation, or where we are legally required to do so. This may include charities, payment providers, contracted technology and security providers, and competent authorities, with appropriate safeguards.

International transfers: We mainly store data in the UK and the European Economic Area (EEA). Where data is transferred outside these regions, we use UK-approved safeguards such as adequacy decisions or Standard Contractual Clauses (or equivalent mechanisms) to protect your data.

Data retention: Different rules apply to records we control independently and to data held for organisations. For the latter, we follow the relevant controller's instructions and the processor terms, subject to legal retention requirements. Records no longer required are deleted or anonymised, with backups expiring under protected cycles.

Security: We apply strong security measures, including encryption, access controls, secure hosting, backups, vulnerability management and staff training. We also offer features such as two-factor authentication (2FA) to help protect your account.

Your rights: You have rights over your personal data, including the rights to be informed, access, rectification, erasure, restriction, objection, data portability and rights in relation to automated decision-making. You can also withdraw consent (such as for marketing) at any time.

No automated decisions: We do not rely on any fully automated decision-making (including profiling) that produces legal or similarly significant effects about you.

If there is a data breach: We investigate and contain incidents. For a breach involving information held on an organisation's behalf, we notify that organisation as controller without undue delay. For breaches where we are controller, we make any legally required ICO and individual notifications within the applicable statutory timescales.

Exercising rights and contact: You can contact our DPO at support@peoplesfundraising.com to exercise your rights or raise any concerns. We generally respond within one month. You also have the right to complain to the UK Information Commissioner's Office if you are not satisfied with our response.

Introduction and scope

People's Fundraising is committed to safeguarding personal data and handling information in a safe, ethical and lawful way. This unified Privacy Policy explains how we collect, use, retain, protect and share your personal data, in line with UK data protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

This policy covers personal information handled through Golden Giving Limited (trading as People's Fundraising), including donors, fundraisers, organisations, participants and users of the service. It explains both our processing as an independent controller and our role as processor for information held on an organisation's behalf. Staff, contractors and service providers with authorised access must comply with the applicable confidentiality and security requirements.

We provide this policy to explain our practices and your rights; where consent is required for a particular purpose, we request it separately. We regularly review and update this policy to reflect legal requirements and changes to our services.

Relationship with our Terms & Conditions

This Privacy Policy should be read together with our Terms & Conditions, which govern your use of our website and services. Together, these documents explain legal responsibilities and the different roles that apply when we hold an organisation's data as processor or handle other information as an independent controller. The Data Processing Schedule in the Terms governs our processor role.

For full details please refer to our Terms and Conditions .

Who we are and our data protection roles

Golden Giving Limited, trading as People's Fundraising, is registered in England and Wales under company number 06688164, with its registered office at 167–169 Great Portland Street, 5th Floor, London, W1W 5PF.

Within this policy, "we", "us" and "our" mean Golden Giving Limited/People's Fundraising. We act as a data processor for organisation-controlled data and as an independent controller for certain other activities, as explained below.

Our Data Protection Officer (DPO) can be contacted at:

• Email: support@peoplesfundraising.com
• Post: Data Protection Officer, Golden Giving Ltd (People's Fundraising), 167–169 Great Portland Street, 5th Floor, London, W1W 5PF

Controller and processor responsibilities

When the organisation is the controller

For supporter, donor, participant, member, customer and fundraising information collected or managed on behalf of a charity, school, PTA, club or other organisation for that organisation's purposes, the organisation determines why and how the information is used and acts as the data controller. People's Fundraising acts as its data processor by hosting, storing, making available and otherwise handling that information to provide the configured fundraising service on the organisation's documented instructions.

Storing, retrieving, securing, transmitting and deleting data are forms of processing under UK GDPR. We do not sell, on-sell, mine, profile or independently analyse organisation-controlled personal data; nor do we use that data for our own advertising, marketing or other unrelated commercial purposes. Technical processing needed to deliver, protect, troubleshoot and support the service remains permitted under the organisation's instructions and the contractual Data Processing Schedule, subject to applicable law.

The organisation is responsible for its own privacy notices, lawful bases, marketing permissions, choices about the information it collects and uses, authorised users and compliance with individuals' rights. We assist the organisation as required by the processor terms and law.

When People's Fundraising is an independent controller

We separately determine the purposes and essential means of certain processing necessary for our own legal and operational responsibilities. Depending on the activity, this may include our direct customer-account administration, service enquiries, platform access and security logs, fraud prevention, payment reconciliation, Gift Aid or tax records and statutory compliance. Such processing is limited to the information relevant to those purposes and is described in the sections below. Payment service providers may also be independent controllers for processing they determine themselves.

A person's information may therefore be subject to different controller/processor relationships for different purposes. Our role is not determined simply by whose database holds the information or by whether an organisation can access it.

Our Data Processing Schedule provides legally binding processor terms for organisation-controlled data, while this Privacy Policy explains our independent-controller processing and the safeguards that apply across the service.

Information we collect

We collect and hold the information necessary to provide our fundraising platform and comply with applicable legal obligations. Some information is collected by us as controller; other information is collected or recorded on behalf of an organisation as its processor. Which role applies depends on the specific purpose of processing. We seek to limit information to what is needed and indicate when it is optional.

1. Information you provide to us

This is information you voluntarily give us when you interact with People's Fundraising, for example when you create an account, make a donation, set up or support a fundraising page, buy event tickets or contact us.

• Account information: When you register, we collect your name, email address and login credentials (such as username and password). Passwords are stored in a one-way hashed or encrypted form and are never stored in plain text.
• Contact details: If you choose to provide additional contact information, we may collect your postal address and telephone number, for example when you give a billing address for a donation or sign up for an event.
• Donation and payment details: When you donate or make payments through our platform, we process information needed to complete the transaction, such as the donation amount, currency, date and time, and basic payment details. Full card or bank details are handled securely by our accredited payment providers (for example Ryft or PayPal) and are not stored in full on our systems. We may receive and store limited billing details and transaction references (such as the last four digits of your card, card type, expiry date or a transaction ID). If you claim Gift Aid, we also collect the information required for the Gift Aid declaration, such as your UK address and confirmation of taxpayer status.
• Public fundraising page information: If you create a public fundraising page or join a campaign or event, we process the content you choose to publish, such as your story, fundraising target, updates, photos or videos. If you donate to a page, we record your donation. Unless you choose to donate anonymously, your name and any message you add may appear in public association with that page. Donors can choose anonymity options which we respect in what is displayed.
• Communications and support: When you contact us (for example by email, through our contact form or via other communication channels), we collect the information you provide such as your name, email address and the contents of your message. We may also collect responses you give in surveys or feedback requests.
• Preferences: We record your marketing and communication preferences, such as whether you have opted in or out of newsletters or how you wish to receive notifications.

2. Information we collect automatically

When you use our website, certain information is collected automatically, primarily to operate the service securely and improve your experience.

• Usage and device data: We log technical details about your visit, such as your IP address, browser type and version, device type, operating system, the pages and features you access, dates and times of access, and the website or source that referred you to us. We use this information to monitor usage, diagnose technical issues and improve our services.
• Cookies and similar technologies: We use cookies and other tracking technologies to support core functionality (such as keeping you logged in, remembering preferences and enabling security features) and, where you consent, to collect analytics and marketing information. Details are set out in the "Cookies & tracking technologies" section below.

3. Children's data

Our platform is intended for users aged 18 and over. If you are under 18, you may only use the Website to create a fundraising page or event under the direct supervision and consent of a parent or legal guardian, as described in our Terms and Conditions. We do not knowingly collect personal data from children under 13. If you are under 13, please do not provide personal information to us. If we become aware that we have collected personal data from a child under 13, we will take steps to delete it. If you are a parent or guardian and believe your child has provided personal data to us, please contact us so that we can remove it.

4. Limited use and data minimisation

We only collect personal data that is necessary for the purposes described in this policy. If you are simply browsing our site without registering or making a transaction, we only collect minimal data, such as basic logs and cookies needed to provide a secure connection and essential analytics. Providing personal data is generally voluntary, but some information is required to use particular features (for example we cannot process a donation without payment details, or create an account without an email address). Where information is optional, we aim to make this clear.

How we use your information (purposes and legal bases)

This section describes processing for which People's Fundraising is an independent controller. We rely on an appropriate lawful basis, such as performance of a contract, a legal obligation, legitimate interests or consent where required. Where we act as processor for organisation-controlled data, the relevant organisation determines the lawful basis and instructs our processing under the Data Processing Schedule; we do not choose separate purposes for that data.

Provide and manage our services (contractual necessity and other applicable bases)

For information we control independently, we use necessary contact, account and service information to register and authenticate users, administer direct relationships and deliver the agreed platform. Recording fundraising activity, showing pages and processing supporter data for an organisation are performed on the organisation's behalf where that organisation is the controller, rather than for our own unrelated purposes.

Process transactions and donations (contract and legal obligation)

We handle information necessary for donations, ticket purchases and other transactions, including payment-provider communications, confirmations, receipts and, where relevant, Gift Aid submissions to HM Revenue & Customs on a charity's behalf. Some operations are performed as processor for the benefiting organisation; other payment, reconciliation and statutory record-keeping activities may be under our independent-controller responsibilities or those of payment providers. We do not use charity-controlled transaction records for our own unrelated marketing or profiling.

Communicate with you (contract and legitimate interests)

We use your contact details to send you service-related communications, such as donation confirmations, receipts, account notifications, security alerts, updates about pages you support and responses to your enquiries. These communications are considered an essential part of the service and are generally not optional while you continue to use the platform. In some cases we also send important notices about changes to our terms or policies where we have a legitimate interest in keeping you informed.

Marketing and newsletters (consent or legitimate interests)

We may send our own newsletters, platform information or service updates to people with whom we have a direct relationship where a lawful basis and applicable electronic-marketing rules permit it. Individuals can withdraw consent or opt out as applicable. We do not extract, analyse or use organisations' private donor and supporter lists for People's Fundraising's own marketing campaigns.

Analytics and service improvement (legitimate interests and consent)

We may use website interaction data, technical performance information and feedback for service improvement where we have an appropriate lawful basis, preferring aggregated or pseudonymised information where possible. Website analytics tools such as Google Analytics may be used for user journeys with required cookie consent. This is not a licence to analyse, profile or monetise the private personal records organisations hold through the platform.

Security and fraud prevention (legitimate interests)

We process certain data to protect users, charities and the integrity of our platform. This includes monitoring for suspicious activity, preventing fraud and abuse, detecting unauthorised access and enforcing our terms. We may, for example, use IP addresses, login history and transaction patterns to detect fraud, temporarily suspend accounts while we investigate, or share necessary information with payment providers or authorities where required.

Legal compliance and record-keeping (legal obligation and legitimate interests)

We process and retain certain personal data in order to comply with laws and regulations, such as charity law, tax law, anti-money laundering and fraud prevention rules. We may be required to provide information to authorities such as HMRC, the Charity Commission, the Fundraising Regulator or law enforcement when legally obliged to do so. We also keep records of data protection requests and how we respond to them, to comply with accountability requirements.

We will not use your personal data for any purpose that is incompatible with those described in this policy unless permitted by law or you have given your consent. If we introduce any new processing purposes, we will update this Privacy Policy and, where appropriate, notify you and/or seek your consent.

Cookies & tracking technologies

Like most websites, People's Fundraising uses cookies and similar technologies to support our services, improve your experience and, where you agree, to help us understand how our site is used.

Cookies are small text files that are placed on your device when you visit a website. Related technologies include local storage and tracking pixels. Together we refer to these as "cookies" or "tracking technologies".

We use the following broad categories of cookies:

• Essential cookies: These are necessary for our website to function properly. They enable core functions such as logging in, maintaining a secure session and protecting against fraud and malicious activity. You cannot opt out of these cookies via our consent tools, although you can disable them through your browser (which may impair the site).
• Preference cookies: These remember your choices and settings, for example language preferences or display options, to make your experience more convenient.
• Analytics cookies: With your consent, we use analytics tools to collect information about how visitors use our site, including page views, navigation patterns and time spent. This helps us improve content and design. We configure such tools to support privacy (for example by anonymising IP addresses).
• Marketing cookies: We do not currently host third-party ads in the way that some commercial sites do, but we may use marketing-related tracking (for example social media pixels) to measure the effectiveness of our own campaigns or to promote fundraising content. These cookies are only used with your consent.

Some cookies are set by third parties such as analytics providers, payment processors or social networks when you interact with their embedded content or services. Those third parties are responsible for their own cookies and you should refer to their privacy and cookie policies for more information.

When you first visit our website, we present a cookie banner or consent tool that allows you to accept or reject non-essential cookies. You can also change your choices at any time using the cookie settings link on our site or by managing cookies via your browser settings. Please note that blocking or deleting cookies may affect the functionality of our website.

Third-party data sharing and disclosures

We do not sell your personal data. We share personal data only where necessary, with trusted third parties and under appropriate safeguards.

Categories of recipients include:

• Payment processors and banking partners: To process donations and payments securely, we share necessary details with payment service providers and, where relevant, banks or financial institutions. These providers are typically independent controllers for the payment information you supply directly to them and are responsible for keeping that information secure.
• Charitable organisations and fundraising page owners: When you donate or participate, relevant information is made available to the benefiting organisation and, where authorised, the page organiser, subject to the choices and visibility settings presented to you. The organisation is the controller for its own fundraising and supporter purposes, including information hosted within the platform; it does not become controller only upon download. Page organisers must use information only as authorised and lawfully.
• Service providers and vendors: We use hosting, infrastructure, communications, monitoring and security providers to deliver our services. Depending on the processing, they may act as processors for us in our controller capacity or as authorised sub-processors of organisation-controlled data, subject to appropriate contractual and security safeguards. Other providers, including certain payment providers, may be independent controllers.
• Regulators and authorities: We may disclose personal data to government bodies, regulators, law enforcement or other authorities where required by law or where necessary to protect our rights or the rights of others. We only provide the minimum information that is legally required and review requests carefully.
• Business transfers: If Golden Giving Limited is involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of that transaction. Any new controller would be required to honour the commitments in this Privacy Policy or provide a policy with similar or stronger protections.

We require all service providers who process data on our behalf to enter into appropriate data processing agreements and to maintain adequate technical and organisational security measures. Where a provider is located outside the UK or EEA, we also put in place appropriate international transfer safeguards as described below.

International data transfers

We primarily store and process personal data in the United Kingdom and, in some cases, the European Economic Area. However, some of our service providers or partners may be located in, or process data in, other countries.

Whenever we transfer personal data outside the UK/EEA, we ensure there is a lawful basis and adequate protection in place. This may include:

• transfers to countries deemed by the UK government (or EU, as applicable) to provide an adequate level of data protection (adequacy decisions);
• Standard Contractual Clauses or the UK International Data Transfer Agreement, which are contractual safeguards approved for international transfers;
• other lawful bases, such as transfers necessary for the performance of a contract in your interest, or in rare cases to protect vital interests or where you have given explicit consent.

No matter where your data is processed, we require recipients to protect it to standards that are essentially equivalent to those required under UK data protection law. If you would like more information about international transfers or copies of the relevant safeguards (where legally permitted), you can contact our DPO.

Data retention and disposal

Where we are an independent controller, we retain information for our own specified lawful purposes and legal requirements. Where we are a processor, retention and disposal of organisation-controlled information follow the relevant organisation's documented instructions and the Data Processing Schedule, subject to mandatory retention rules. The table below sets out typical categories of data handled by the platform, not an independent right for us to retain processor data for additional purposes.

When personal data is no longer required, or when the relevant organisation properly instructs its return or deletion under the Data Processing Schedule, we delete or anonymise it unless a legal obligation requires us to retain it. Deletion from active systems may precede expiry of protected backups; data awaiting the backup cycle is kept beyond ordinary use and removed as those backups expire. Records independently required for tax, accounting, fraud or legal purposes are managed separately for those purposes.

In some situations (for example where there is a legal dispute or investigation) we may place a "legal hold" on certain data, meaning we retain it beyond the standard period until the matter is resolved. We limit such extended retention to what is strictly necessary.

Data security measures

We take the security of your personal data very seriously and implement a range of technical and organisational measures to protect it from unauthorised access, loss, misuse or alteration.

• Encryption: Data transmitted between your browser and our servers is protected using HTTPS/TLS. Passwords are stored using strong, one-way hashing algorithms and sensitive data at rest may also be encrypted.
• Access controls: Access to personal data is restricted to staff and service providers who need it to perform their duties. We use role-based access controls, strong authentication and audit logging for administrative access.
• Secure infrastructure: Our website and databases are hosted on secure infrastructure with modern security practices, including firewalls, intrusion detection, physical security and redundancy.
• Backups: We maintain regular encrypted backups of key data in order to restore services in the event of a failure or incident. Old backups are removed when they are no longer needed.
• Vulnerability management: We keep software up to date, conduct security scans and, where appropriate, penetration testing. We promptly address identified vulnerabilities and follow secure coding practices.
• Staff training and policies: Our team members receive regular training on data protection and security. We have internal policies covering secure handling of data, password practices, incident reporting and device security. Staff are bound by confidentiality obligations.
• Vendor due diligence: We assess the security practices of third-party providers that process personal data on our behalf and put contractual safeguards in place.
• User account protection: We offer features such as two-factor authentication (2FA) to help you secure your account and we encourage you to use strong, unique passwords and to keep your login details confidential.

While no system can be guaranteed as completely secure, we work continuously to maintain and improve our security controls in line with industry standards and evolving threats.

Incident response & data breach notification

We maintain procedures to identify, investigate, contain and respond to security incidents and personal data breaches. Our response includes securing affected systems, assessing impact, taking remedial steps and recording relevant details.

Where we are a processor: If we become aware of a personal data breach affecting data processed on an organisation's behalf, we notify the organisation as controller without undue delay and provide information reasonably available to us to help it assess and fulfil its legal obligations. The organisation is responsible for determining whether it must notify the ICO or affected individuals, and we assist as required under the Data Processing Schedule.

Where we are a controller: We assess the breach and, where notification is required, notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. We inform affected individuals without undue delay where the breach is likely to result in a high risk to them, subject to applicable law.

Our Security & Data Protection page explains our incident response safeguards.

Your data protection rights

Under UK data protection law, you have a number of rights in relation to your personal data. For information that an organisation controls, that organisation is responsible for deciding and responding to rights requests, and we assist it as processor. For information we control independently, we handle applicable requests ourselves. Rights are subject to their statutory conditions and exceptions and include:

• Right to be informed: to receive clear information about how your data is used, which this Privacy Policy is intended to provide.
• Right of access: to request confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how it is used.
• Right to rectification: to have inaccurate data corrected or incomplete data completed. You can often update your own details via your account settings.
• Right to erasure: in certain circumstances, to request the deletion of your personal data (for example where it is no longer needed, where you withdraw consent, or where you successfully object to processing). This right may be limited where we need to retain data to comply with legal obligations or for legal claims.
• Right to restrict processing: in certain situations, to request that we restrict the processing of your data (for example while accuracy is being verified, or where you have objected and we are considering that objection).
• Right to data portability: for certain data you have provided to us, to receive it in a structured, commonly used, machine-readable format and/or to request that we transmit it directly to another controller where technically feasible.
• Right to object: to object at any time to processing of your personal data that is based on our legitimate interests or for direct marketing. We will stop processing your data for direct marketing if you object.
• Rights in relation to automated decision-making and profiling: to not be subject to a decision based solely on automated processing (including profiling) that has legal or similarly significant effects on you, except in limited circumstances permitted by law.

Exercising your rights & how to contact us

If you want to exercise a data protection right or have questions, you can contact our DPO below. Where the information is controlled by a charity or another organisation, requests should normally be directed to that organisation. If you contact us about such information, we will assist or refer the request to the controller as appropriate, without unnecessarily disclosing it. We handle requests for information we control independently in accordance with applicable law.

• Email: support@peoplesfundraising.com
• Post: Data Protection Officer, Golden Giving Ltd (People's Fundraising), 167–169 Great Portland Street, 5th Floor, London, W1W 5PF

To help us process your request, please provide enough information to identify you (for example the email address associated with your account) and specify what you would like us to do. In some cases we may need to request additional information to verify your identity, particularly where a request relates to sensitive data.

For requests where we are controller, we respond within the applicable statutory period, subject to permitted extensions and exceptions. Where we act as processor, we support the organisation with its own response deadlines. Fees or refusals are only applied where permitted by data protection law.

If you are not satisfied with how we have handled your personal data or responded to a request, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO). Details of how to contact the ICO are available at www.ico.org.uk. We would encourage you to contact us first so that we have an opportunity to address your concerns.

Automated decision-making

We do not currently use automated decision-making, including profiling, that produces legal effects or similarly significant effects for individuals. While we may use automated tools to help identify potential fraud or to prioritise certain activities, any important decisions about users involve human review and judgment.

If we introduce automated decision-making processes in future that are likely to have significant effects on individuals, we will ensure they comply with legal requirements, update this Privacy Policy and provide any additional notices or rights required by law.

Data minimisation & accuracy

We follow the principles of data minimisation and accuracy in all our processing activities. This means we only collect and retain personal data that is necessary for the purposes described in this policy, and we take reasonable steps to ensure that data is accurate and kept up to date.

You can help us by keeping your account details current and letting us know if any of your information changes or is incorrect. Where we become aware that data is inaccurate, we will update or correct it without undue delay.