Privacy Policy

STICHTING WOMEN WIN

Rapenburgerstraat 173

1011 VM Amsterdam

The Netherlands

KvK Registration: 34267612

Purpose of this policy

Women Win (hereinafter WW, we, us, our) respects the privacy of our supporters and website users and is committed to protecting your personal data. This privacy policy is intended to inform you about the way that we or third partiers process and collect your personal data, when visiting Women Win websites or making donations to Women Win, weather through the online donation form or direct bank payment. We recommend that you carefully read this data storage and privacy policy so that you are fully aware of how and why we are using your data.

Questions

If you have any questions about this policy or the processing of your personal data by us, please contact operations@womenwin.org.

The personal data that we collect about you

Personal data means any information about an individual from which that person can be identified, such as first and last name, telephone number, postal and electronic addresses, date of birth and bank account details. It does not include data where the identity has been removed (anonymous data).

When you visit a Women Win website, or when you make a donation to Women Win – whether through our online donation form or by direct bank payment – we collect, use, store, and transfer various categories of personal data about you. Depending on how you interact with us, this may include:

Personal contact details such as name, title, postal address, telephone number and email address.
Donation details such as the amount donated, the date and frequency of your donation, the currency used and whether the donation is one-off or recurring.
Payment information provided when you make an online donation. Financial information such as your bank account details, credit or debit card number, name, CVV code and card expiry date is collected and stored directly by our third-party payment processors, Stripe and PayPal, and is not stored by Women Win or by our donation platform (see below).
Bank transfer details when you make a direct donation by bank payment, such as your name, account number (IBAN) and the payment reference you provide.
Communication preferences, including whether you have consented to receive newsletters or other updates from us.
Technical and usage data collected automatically when you visit our websites, such as your IP address, browser type and version, device information, and information about how you use our site. This is collected in part through cookies and similar technologies (see “How we collect and use your personal data” below).

In line with the principle of data minimisation, we only collect the personal data that is strictly necessary and relevant for the purposes for which it is processed, as described in this policy.

Special categories of personal data. We do not seek to collect special categories of more sensitive personal data (such as information about health, race or ethnicity, or religious beliefs) through our websites or donation channels. Please do not provide such information to us unless we specifically request it and explain the basis on which we will process it. Where the collection of special category data is unavoidable, we will only process it where we have a valid legal basis to do so and appropriate additional safeguards are in place, in accordance with Article 9 of the GDPR.

How we collect and use your personal data

We collect your personal data in the following ways:

Information you give us directly. You provide personal data when you make a donation through our online donation form or by direct bank payment, subscribe to a newsletter, complete a form on our website, or otherwise correspond with us by email, telephone or in writing.
Information we collect automatically. When you visit our websites, we may collect technical and usage data about your device and browsing actions through cookies and similar technologies. This type of data is used for internal purposes such as maintaining the security and functionality of our site, understanding how our site is used, and improving our services.
Information from third parties. We may receive donation and payment-related information from the third-party service providers we use to operate our websites and process donations, as described under “Disclosures of your personal data” below.

We use your personal data for the following purposes:

To process and administer your donation, including recurring donations, and to send you a confirmation or receipt.
To comply with our legal and regulatory obligations, including financial administration, tax and audit requirements, and anti-money laundering and counter-terrorism financing obligations that apply to us where relevant.
To communicate with you about your donation, respond to your enquiries, and – where you have given your consent – to send you newsletters and updates about our work.
To operate, secure, maintain and improve our websites and to understand how visitors use them.

Legal bases for processing. We only process your personal data where we have a lawful basis to do so under the GDPR. Depending on the purpose, this will be one or more of the following: your consent (for example, to send you newsletters or to place non-essential cookies); the performance of a contract or steps taken at your request (for example, to process your donation); compliance with a legal obligation (for example, financial record-keeping and, where applicable, obligations under anti-money laundering and counter-terrorism financing law); and our legitimate interests (for example, to secure and improve our websites), provided these are not overridden by your interests and fundamental rights.

Where our processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it.

Cookies. Our websites use cookies and similar technologies. Cookies are also placed by third parties we have engaged. To manage cookie consent in a way that is compliant with the GDPR and the Dutch Telecommunications Act, we use Complianz as our cookie consent solution. Complianz enables us to inform visitors about the cookies we use and, in almost all cases, to obtain your consent before non-essential cookies are placed or read on your device. Complianz records and stores your cookie consent preferences so that your choices are respected. You can find more information about cookies in our Cookie Policy (EU) and Cookie Policy (UK).

Disclosures of your personal data

We may share your personal data with third parties, including the third-party service providers we use to operate our websites and to collect and process donations. We require all our service providers to respect the security of your personal data and to treat it in accordance with the law, and we only permit them to process your personal data for specified purposes and in accordance with our instructions.

Online donation platform – Fundraise Up. Women Win uses Fundraise Up as its online donation platform. All donation data collected through the platform is subject to the provisions of the General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act of 2018 (“CCPA”) and other applicable privacy laws. Non-personal information that is collected remains anonymous or non-personally identifiable, and all personally identifiable information (PII) is encrypted. Financial information – such as banking information or credit card number, name, CVV code or expiration date – is collected and stored by third-party payment processors, Stripe and PayPal, and is not stored by Fundraise Up.

Payment processing – Stripe. Stripe is the payment processor for our online donations system. When you make an online donation via credit or debit card, Apple Pay, Google Pay or iDeal, your payment and financial information is collected and processed directly by Stripe as a data controller in order to process your payment securely, prevent fraud and comply with financial and legal obligations. Women Win does not store your card or bank details from online donations. For details of how Stripe collects and uses personal data, please see the Stripe Privacy Policy.

Payment processing – PayPal. Where you choose to donate using PayPal, your donation is processed through PayPal as one of the payment processors available via Fundraise Up. To complete your payment, PayPal collects and processes your personal and financial information – such as your name, contact and account details and payment information – as an independent data controller, in order to process your donation, verify your identity, prevent fraud and comply with its legal obligations. Women Win does not receive or store your full PayPal account or financial details. PayPal may use and share the personal data it collects in accordance with its own privacy policy, including with other members of the PayPal group and with third parties where necessary to provide its services or meet legal requirements. For details of how PayPal collects, uses and shares personal data, please see the PayPal Privacy Statement.

We may also share your personal data with:

Other third-party service providers (including contractors and designated agents), such as our IT and website providers, external accountants, auditors, lawyers and insurers, who provide services to us. We require these service providers to respect the security of your data and to treat it in accordance with the law, and you can expect a similar degree of protection with respect to your personal data.
Tax authorities and other governmental or regulatory bodies, where we are required to do so to comply with our legal obligations.

We may also disclose your personal data if we believe, at our sole discretion, that disclosure is necessary in the following circumstances:

Following a corporate transaction, such as a divestiture, merger, acquisition, consolidation or asset sale, or in the unlikely event of bankruptcy. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes.
If we are legally obliged to do so, in which case we will transfer the personal data we collect to law enforcement agencies and other governmental bodies.

We will not sell or rent your personal data. Access to your data is only authorised for Women Win staff and the third-party service providers outlined above, on a need-to-know basis. All staff and third-party actors (such as contractors) who are given access to personal data and/or internal systems are bound by confidentiality agreements. Where any of our service providers process personal data outside the European Economic Area, we take steps to ensure that appropriate safeguards are in place as required by the GDPR.

Data Security

We take the security of your personal data very seriously. We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. This includes but is not limited to:

Internal password policy
Multi-factor authentication for key systems
Implementation of tool-specific security features

In case of violation of personal data, and in compliance with the GDPR, we will notify within a maximum of 72 hours from the time we become aware of it, the violation of personal data to the supervisory authority of the Netherlands in accordance with Article 55, unless the violation of personal data is unlikely to pose a risk to the rights and freedoms of natural persons. Affected users will be notified within this time period.

How long we retain your personal data

We will only store your personal data for as long as it is necessary for the purposes described in this Privacy Policy.

Your legal rights

In accordance with applicable law, you may have the right to access, rectification and erasure of your personal data, the right to restriction of and objection to the processing of your personal data, and the right to data portability. Please find below more details and information on how and when you can exercise your rights:

The right to access your personal data enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

The right to request to correct your personal data if it is inaccurate including supplementing any incomplete personal data we have, taking into account the purposes of its processing.

The right to request deletion of your personal data if

Your personal data is no longer necessary for the purposes we have outlined in this policy; or
You withdraw your consent if the processing of your personal data is based on consent and no other legal grounds exist; or
Your personal data has to be deleted for compliance with a legal obligation.

The right to object to or restrict the processing of your personal data in which case we will comply with your request, unless we have a compelling overriding legitimate interest for processing, or we need to continue processing your personal data to establish, exercise or defend a legal claim.

The right to data portability which entitles you to submit a request to us to receive the personal data that concerns you. You may also request us to send this personal data to a third party, where feasible.

You can exercise your rights as outlined above by sending an email request to operations@womenwin.org. You may also email us with inquiries about your data at any time. We aim to respond to your request within one month after receiving such a request; however, this may be extended to two months. In such an event, we will inform you within one month after receipt of your request and explain why the extension is necessary.

You also have the right to lodge a complaint to the supervisory authority about the way we process your personal data. We would, however, appreciate the opportunity to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance.

Changes to this privacy policy

We may amend this policy from time to time. We will note the date on which the last revisions were made at the top of this policy document. We invite you to check our privacy policy from time to time to review the most current version.