01Scope & who we are
Givana is operated by Givana Technologies Ltd(“Givana,” “we,” “us”), a private company registered in England and Wales with company number 17281898, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
We provide software that lets communities and faith organisations receive gifts and keep their giving records. This policy explains what information we handle, why, the lawful basis we rely on, and the choices you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
It applies to our websites (givana.uk and app.givana.uk), the community dashboard, the giving pages and kiosk screens we host on behalf of communities, the Givana mobile app, and any related services that link to this policy.
It does not govern the independent practices of a community that uses Givana, nor the practices of our payment processor, each of which maintains its own policy.
02Controller & processor roles
For donor information collected through a community's giving page, the community is the data controller and Givana acts as a processoron the community's behalf, under the data processing terms in our Terms of Service. This includes Gift Aid declarations, which the community needs to claim Gift Aid from HMRC. For the accounts of a community's own team, for waitlist and newsletter sign-ups, and for keeping our service secure, Givana is the controller.
This matters because it tells you who to approach with a request. A donor asking about their gift should generally contact the community first; we will support the community in responding.
03Information we collect
We collect only what a giving platform genuinely needs. The table below summarises the main categories.
| Category | Examples | Why |
|---|---|---|
| Community account | Name, email, role, community name, giving-page link | To create and secure accounts |
| Donor details | Name, email, gift amount, fund, optional message | To process a gift & issue a receipt |
| Gift Aid declaration | Full name, home address and postcode, the declaration wording you confirmed, and when | So the community can claim Gift Aid from HMRC |
| Payment metadata | Last 4 digits, brand, processor reference | Reconciliation & refunds |
| Technical | Device, browser, IP, approximate region | Security & fraud prevention |
| Waitlist & newsletter | Email, consent choice and when it was given | To tell you about launch and, if you opt in, news |
We do not collect full card numbers. See Payments & card data.
04How we use information
We use the information above to:
- Operate giving pages, process gifts, and deliver receipts.
- Reconcile payments and payouts so a community's records match what Stripe processed and paid out.
- Provide dashboards, exports, and statements to authorised community staff.
- Detect and prevent fraud, abuse, and security incidents.
- Send essential service messages (receipts, payout notices, security alerts).
- Comply with our legal, tax, and accounting obligations.
Our lawful bases are: contract (running the service a community has signed up for, and processing a gift a donor asked us to make), legal obligation (financial, tax and Gift Aid record-keeping), legitimate interests (keeping the service secure and preventing fraud), and consent (newsletter emails, which you can withdraw at any time).
We do not sell personal information, and we do not use donor information to advertise to donors.
05Payments & card data
Payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. Card details are entered directly into Stripe's secure checkout or read by a Stripe card reader or Tap to Pay on a phone. Full card numbers never reach Givana's servers, so there is nothing sensitive for us to store or lose.
Payments are processed into the community's own connected Stripe account and paid out to its bank account on its Stripe payout schedule. Givana never takes custody of the community's funds; we record and reconcile them.
06When we share information
We share information only in these limited circumstances:
- With the community whose giving page received the gift.
- With Stripe, our payment processor, to take payments, pay out to communities and prevent fraud. Stripe also acts as an independent controller for some of this data under its own privacy policy.
- With service providers acting only on our instructions and bound by confidentiality: our hosting provider (servers in the UK or European Economic Area), Resend (email delivery) and Cloudinary (logos and images communities upload).
- For legal reasons, where required by law or to protect rights and safety.
- In a business transfer, where information may pass to a successor under this same policy.
07Cookies & tracking
We only use cookies that are essential to sign-in and security. We don't use analytics or advertising cookies, and giving pages don't track donors.
For the full breakdown and your controls, see our Cookie Policy.
08Data retention
We keep information for as long as a community's account is active, and afterwards only as long as needed to meet legal, tax, and accounting obligations. Donation and Gift Aid records are kept for up to seven years, because HMRC requires Gift Aid records to be kept for at least six years. After that they are deleted or anonymised. Waitlist sign-ups are kept until launch and for a reasonable period afterwards, unless you ask us to delete them sooner.
A community can export and delete its data at any time; see Your rights & choices.
09How we protect data
We encrypt data in transit, keep each community's data separate, limit staff access by role, and log sensitive actions. For the full picture, see our Trust & security page.
No system is perfectly secure, but we work to keep the surface small. The less sensitive data we hold, the less there is to protect.
10Your rights & choices
Under UK data protection law you have the right to access, correct, export, or delete your personal information, to object to or restrict certain uses, and to withdraw consent where we rely on it.
- Communities can manage and export account and donation data directly from the dashboard.
- Donors should contact the community that received the gift; we will assist the community in responding.
- You can unsubscribe from non-essential email at any time via the link in those messages.
To make a request to Givana directly, see Contacting us. We will reply within one month. We will not treat you differently for exercising these rights.
If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
11Children's privacy
Givana is intended for use by adults administering a community and by adult donors. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will delete it.
12International transfers
Our servers are in the UK or the European Economic Area. Some of our service providers (Stripe, Resend and Cloudinary) may process information in the United States. Where information leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum, so it stays protected to the standard in this policy.
13Changes to this policy
We may update this policy as our service evolves. When we make material changes we will update the version and date at the top, and where appropriate notify communities in the dashboard or by email before the changes take effect.
14Contacting us
Questions about this policy or your information? We'd genuinely like to hear from you.
Email: legal@givana.uk
Post: Givana Technologies Ltd (Privacy), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom