Privacy notice

Who this notice is for

SwiftCause Ltd, company no. 17331949, registered office: Flat 2, Redcross Village, Redcross Street, Bristol BS2 0BB. Our ICO registration number is ZC244031.

This notice covers personal data processed through the SwiftCause website, charity administration tools, donor and Gift Aid journeys, mobile experiences and in-person collection points (a charity’s own phone or tablet), support channels, and related platform services.

Controller and processor roles

For a charity campaign, donor, Gift Aid, payment, and fundraising administration data, the charity will generally be the controller and SwiftCause will generally act as its processor under the agreed service terms. The role can depend on the service and the instructions given by the charity.

SwiftCause is generally a controller for its own platform account, security, service administration, support, billing, legal compliance, and direct marketing activities. The approved role matrix and the applicable charity agreement take priority where they provide more specific information.

What we use and why

Depending on the journey, we may process identity and contact details, charity and organisation information, account and authentication records, donation and payment details, Gift Aid declarations, campaign and in-person collection data, support messages, device and security telemetry, and consent or preference records.

Where an activity-based payment names a beneficiary — for example, a child taking part in an activity a donor is paying for — that name is provided by the paying adult, used only to identify who the payment is for, and minimised: we do not collect further details about a beneficiary beyond what is needed for that purpose.

We use this information to provide and secure the service, create and manage accounts, process donations and Gift Aid declarations, support charities and donors, prevent abuse, produce requested exports and reports, improve reliability, meet legal or tax obligations, and send marketing only where the relevant consent applies.

Lawful basis, sharing, and transfers

The lawful basis depends on the purpose and the role of the organisation deciding how the data is used. The approved record of processing activities and lawful-basis matrix documents that decision for each processing activity; it is not replaced by this summary notice.

We may share data with the relevant charity, payment and identity providers, hosting and database providers, email delivery providers such as Brevo, analytics and security providers such as Google services and reCAPTCHA, professional advisers, and public authorities where required. Stripe, Firebase/Google, Brevo, hosting, analytics, and reCAPTCHA are recorded in the vendor and subprocessor register.

Some providers may process data outside the UK. The approved subprocessor register, data processing agreement, transfer mechanism, and any transfer-risk assessment will identify the applicable locations and safeguards.

Retention and security

We keep personal data only for the purpose-based period approved for that data set. Retention may be extended for legal claims, audit, fraud prevention, or statutory and tax records such as Gift Aid evidence. The retention schedule controls deletion, anonymisation, and any legal hold; there is no single blanket retention period for all data.

We use access controls, tenant isolation, encryption in transit, service-provider controls, logging, monitoring, backup, and incident-response procedures appropriate to the risk. Security details are intentionally summarised here so that publishing this notice does not weaken controls.

Your rights and complaints

Subject to the applicable law and any exemptions, you may have rights to access, correct, erase, restrict, or receive your personal data, to object to certain processing, and to withdraw consent where consent is the lawful basis. See the Data rights page for how to make a request and what verification information may be needed.

You can contact SwiftCause at connect@swiftcause.com with “Data protection request” in the subject line. If the charity is the controller for your data, we may forward or coordinate the request with that charity. You can also complain to the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.

Changes and contact

We will publish a new version and date when this notice changes materially. For service questions, contact connect@swiftcause.com.