Privacy Policy (New organisations)

Personal information protection accounts created from October 19, 2026 onwards.

Version October 2026

1. Introduction and scope

Zeffy provides a fundraising platform (the "Platform") that allows nonprofit and charitable organizations ("Organizations") to collect donations, sell event tickets, run raffles and lotteries where permitted, operate online stores and memberships, run peer-to-peer campaigns, send newsletters and manage their supporters. This Policy also covers our website at https://www.zeffy.com and any subdomain (the "Website"), and our mobile applications, including the Tap to Pay app. Together, these are the "Services".

This Policy explains what personal data we handle, why, on what legal basis, who we share it with, how long we keep it, and what rights you have.

Depending on how you use the Services, you may be:

• a Contributor: you make a payment to an Organization, register for an event, or complete an Organization's form;

• an End User: you are authorized by an Organization to use the Services through that Organization's account;

• a Member: you are a Contributor who has created an account on the Platform (creating one is optional);

• a Visitor: you start filling in a Zeffy-powered form on an Organization's website but do notx complete it;

• a Website Visitor: you browse our Website;

• a Participant: you have a personal or team fundraising page as part of an Organization's peer-to-peer campaign.

These categories are not mutually exclusive. In this Policy, "you" means any individual whose personal data we handle.

Please read section 3 carefully. For much of the data that Organizations collect through the Platform, the Organization, not Zeffy, decides what is collected and why. If your question is about how a specific Organization uses your data, that Organization is the right place to start, and we will help you reach them.

2. Summary

This summary is provided for convenience. It is not exhaustive, and the detailed sections below govern.

We do not sell your personal data for money. Section 12 explains how "sale" and "sharing" are defined under US state laws, and how to opt out.

3. Who is responsible for your data, and our role

3.1 The Zeffy entity responsible for you

Zeffy operates through the following entities. The entity that contracts with the Organization in your region is the entity responsible for the personal data described in this Policy, and each entity is jointly responsible with the others where they act together.

Platform operations, engineering and our fraud and compliance function are carried out from Canada, France and other locations where our teams are based. This means your personal data may be handled by colleagues outside your country. Section 11 explains how we protect it when that happens.

3.2 When we are a controller and when we are a processor

This distinction matters, because it determines who you should ask about what.

We act as a controller (we decide the purposes and means of processing) for:

• End User and Member accounts;

• payments, payouts and financial reconciliation;

• verification of Organizations and their representatives;

• fraud prevention, anti money laundering, counter terrorist financing and sanctions screening;

• security, logging and abuse prevention;

• our own marketing, advertising, analytics and support;

• meeting our own legal, tax, accounting and regulatory obligations.

We act as a processor (we act on an Organization's documented instructions) for:

• the contact and supporter records an Organization holds in the Platform CRM, including records it imports from another platform;

• the content and custom questions of an Organization's forms, and the answers you give;

• emails and postal mail an Organization sends through the Platform;

• an Organization's own reporting and exports.

Where we act as a processor, the Organization is the controller and its own privacy notice applies to those activities. Our commitments to Organizations are set out in our Data Processing Agreement, which includes our current list of subprocessors.

Some parties are independent controllers in their own right, not our processors. In particular, Stripe is an independent controller for the identity verification, payment processing and financial crime obligations it performs under its own regulatory permissions. Stripe's privacy policy applies to those activities.

Where an Organization chooses to add its own tracking technology to a Zeffy-powered form, for example its own Meta Pixel or Google Analytics tag, the Organization is the controller for that tracking and is responsible for obtaining any consent required in your jurisdiction. Zeffy provides the ability to add these tags but does not control them.

3.3 Contacting us

For any privacy question or request:

Privacy Team, Zeffy
[email protected]

Or by post to any of the entity addresses in section 3.1, marked "Privacy Team".

We aim to acknowledge requests within 5 business days and to respond substantively within the period required by the applicable law, which is generally one month in the EEA and the UK, 30 days in Canada, 45 days in California and 30 days in Australia. We will tell you if we need an extension and why.

4. Data protection laws referred to in this Policy

• PIPEDA, the Canadian Personal Information Protection and Electronic Documents Act, and substantially similar provincial laws;

• the Quebec Privacy Act, the Act respecting the protection of personal information in the private sector, as amended by Law 25;

• the CCPA, the California Consumer Privacy Act as amended by the California Privacy Rights Act, and the other US state privacy laws that apply to us from time to time. We no longer list these individually, because the list changes several times a year;

• the UK GDPR and the UK Data Protection Act 2018. Where this Policy refers to the GDPR without qualification, the UK GDPR is included as applicable;

• the Australian Privacy Act 1988 and the Australian Privacy Principles;

• the EU GDPR, Regulation (EU) 2016/679, together with the national implementing laws of the EEA countries where we operate, including the Irish Data Protection Act 2018, the German Bundesdatenschutzgesetz and the French Loi Informatique et Libertés;

• electronic marketing and cookie rules, including the EU ePrivacy Directive as implemented locally (such as the Irish ePrivacy Regulations 2011 and the German TDDDG), the UK PECR, Canada's CASL, the US CAN-SPAM Act and the Australian Spam Act 2003.

"Personal data" means information relating to an identified or identifiable individual. Where a law uses a different term, such as "personal information" under PIPEDA, the Quebec Privacy Act, the CCPA or the Australian Privacy Act, this Policy uses "personal data" to mean the same thing.

5. What we collect, why, and on what legal basis

Where we act as a controller, the table below sets out what we handle and why. Where we act as a processor, the Organization determines what is collected.

Where the legal basis is a contract or a legal obligation and you do not provide the data, we will not be able to provide the relevant part of the Services.

Where the legal basis is legitimate interests, you may object at any time. We will stop unless we have compelling grounds, which will usually only be the case for fraud prevention, security and legal compliance.

Where the legal basis is consent, you may withdraw it at any time. Withdrawing consent does not affect processing already carried out, and does not affect processing we carry out on another basis.

6. Data we receive from other sources

We collect and check publicly available information about Organizations and the individuals who represent or control them, from the sources described above, for verification and fraud prevention purposes, as further described in section 7. We do not build profiles of donors from public sources, and we do not buy personal data from data brokers for marketing.

7. Fraud prevention, financial crime compliance, and automated processing

What we do. To protect Organizations, donors and our payment partners, and to meet our own legal obligations, we operate automated screening and risk detection. This includes:

• automated risk scoring of new Organizations, accounts, forms, websites and transactions;

• automated checks against sanctions lists, watch lists and adverse media;

• automated detection of patterns associated with fraud and abuse, such as card testing, account takeover, unusual bank account changes and unusual payout requests;

• automated triage of cases, which may include the use of the AI and automation providers listed in section 9.

• collection and review of publicly available information about an Organization and its representatives, including public registries and the Organization's own online and social media presence, to corroborate legitimacy and detect fraud.

We carry out this public source collection in relation to Organizations and the individuals who represent or control them, in order to verify them and to protect the Platform. We do not use it to enrich profiles of donors.

How decisions are made. Automated systems generate signals, scores and recommendations. Decisions that significantly affect you or an Organization, such as suspending an account, holding a payout, refusing to onboard an Organization, or filing a report with an authority, are always reviewed by a member of our fraud and compliance team before they take effect, except where an immediate automated block is necessary to prevent imminent harm or to comply with sanctions law. In those cases, we review the block promptly afterwards.

Your rights here. Your rights in relation to this automated processing depend on the law that applies to you.

If the EU GDPR or the UK GDPR applies to you, and a decision affecting you was made without meaningful human involvement and has legal or similarly significant effects, you may ask us for an explanation, contest the decision, and ask for human review. Please write to [email protected]. We may not be able to disclose the detail of our fraud detection logic, because doing so would undermine its purpose and may be restricted by law, but we will explain the main reasons and the information we relied on, and a human will look at your case again.

If you are in a US state whose law provides it, you may opt out of profiling carried out in furtherance of decisions that produce legal or similarly significant effects concerning you. Where we can offer you human review of such a decision, we will. Please write to [email protected]. The limits on what we can disclose about our fraud detection logic, described above, apply in the same way.

Limits on your rights here. Where data is held for fraud prevention, AML/CFT or sanctions purposes, we may be unable to delete it, correct it in the way you would prefer, or tell you everything about it, because doing so would breach a legal obligation or prejudice an investigation. We will tell you when this is the reason.

8. Who we share personal data with

We share personal data with the following categories of recipients.

We may disclose personal data to authorities where we are required by applicable law, including in response to a lawful request, subpoena, warrant or court order, or where we reasonably believe disclosure is necessary to investigate, prevent or act on illegal activity, fraud, sanctions risk, threats to anyone's safety, or abuse of the Services or of internet infrastructure.

We do not sell your personal data for money, and we do not rent it. Section 12 explains how the broader US definitions of "sale" and "sharing" apply and how to opt out.

9. AI and automation providers

We use AI and automation tools to help our teams work faster and to improve support and fraud detection. Because this is a common concern, here is exactly where we stand.

Providers we currently use for these purposes include Anthropic, OpenAI, Mistral, Make.com and n8n. The current list is maintained on our Data Processing Agreement (DPA), and we update that page before adding a new provider.

What they may process. Depending on the workflow, this can include End User and Member account data, support and chat content, form and campaign content, Organization records, and the fraud and compliance case data described in section 7. Where a workflow does not need a particular field, we do not include it.

Where they are located. These providers are mainly in the United States and the European Union. Section 11 explains the safeguards we apply.

Where we act as a processor for an Organization, we only use AI and automation providers in a manner permitted by our Data Processing Agreement with that Organization, and our subprocessor section is the notification mechanism described in that agreement.

10. Cookies, similar technologies, analytics and advertising

10.1 How consent works

We use cookies, tags, pixels, web beacons, local storage and session recording on the Website, the Platform and in our emails.

Strictly necessary technologies are always active. These keep you logged in, keep your session secure, remember your consent choices, make payments work, and help us detect fraud and abuse.

All other categories, meaning analytics, functional and advertising technologies, are only set if you consent. In the EEA, the UK, and everywhere else we have to, we ask through a consent banner that lets you accept all, reject all, or choose by category, with reject being as easy as accept. Browsing the Website does not by itself constitute consent. You can change or withdraw your choices at any time through and through your browser settings.

We honour the Global Privacy Control and similar opt out preference signals sent by your browser, and we treat them as an opt out of advertising and of the sale or sharing of personal data where applicable law requires that.

10.2 Analytics and session recording

We use the analytics providers listed in section 8, such as Google Analytics and Amplitude, to understand how the Services are used, to run A/B tests, and to improve the product. Where these providers set cookies or use similar technology that is not strictly necessary, they are activated only after you consent through our consent banner, and you can withdraw your consent at any time.

Our session recording tool (Hotjar) is configured to mask form fields, payment fields and free text, so that the content you type, including any donation or payment details, is not recorded. Session recording is activated only with your consent.

Separately, we use your IP address and related technical signals to detect and investigate fraud and other abuse of the Services. We do this on the basis of legal obligation and our legitimate interests, not consent, using signals we treat as strictly necessary as described in section 10.1. This activity does not rely on the analytics cookies above and does not stop if you decline them.

10.3 Advertising

We advertise Zeffy to Organizations and prospective Organizations. We currently use Google and Meta advertising products for this, including audience matching based on email addresses that Organizations and prospects have given us. We only do this where we have the consent required in your jurisdiction, or where the applicable law permits it and you have not opted out.

You can opt out:

• through our consent banner and privacy preferences menu, which is also how you opt out of the sale or sharing of your personal data under US state laws;

• by sending a Global Privacy Control signal from your browser;

• through your Google ad settings and your Meta ad preferences.

We do not run our own advertising technology on Organizations' donation and ticketing forms. Where an Organization adds its own pixel or tag to its forms, that Organization is responsible for it, as explained in section 3.2.

11. International transfers

We operate in North America, Europe, the UK and Australia, so personal data moves between countries. Here is how we handle that.

Adequacy. Transfers to Canada from the EEA and the UK rely on the European Commission's and the UK's adequacy findings for Canadian commercial organizations. Transfers from the EEA to the UK rely on the UK adequacy decision.

United States. For our US entity and US providers, we rely, in order of preference:

1. on the EU-US Data Privacy Framework and the UK Extension to it, where the provider is certified for the relevant data categories;

2. otherwise, on the European Commission's Standard Contractual Clauses, and for the UK on the International Data Transfer Addendum or the IDTA, together with a transfer impact assessment and, where appropriate, supplementary measures such as encryption and access controls.

Other countries. For Australia and any other country without an adequacy finding, we use Standard Contractual Clauses and the UK Addendum.

Within the Zeffy group. Our entities are bound by an intragroup data transfer agreement incorporating the Standard Contractual Clauses and the UK Addendum, which limits what each entity may do with the data it receives.

Quebec. Before communicating personal data outside Quebec, we carry out the privacy impact assessment required by the Quebec Privacy Act. If the assessment does not show that the data will receive adequate protection, we do not proceed. Where it does, we put a written agreement in place with the recipient.

Australia. Before disclosing personal data overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, as required by APP 8.

You can ask us for a copy of the safeguards we rely on by writing to [email protected].

12. Your rights

12.1 How these rights apply

The rights you have, and the way they apply, depend on the privacy law that covers you. To make this clear, we have grouped the rights below by the law that grants them. If more than one law applies to you, you have the rights available under each of them.

We do not charge you for exercising your rights, and we will not treat you differently for doing so. Please note that exercising some rights may limit your ability to use parts of the Services.

To exercise any right, please write to [email protected] or use our privacy preferences menu. We will ask for enough information to verify who you are, which for security reasons may include confirming details of an account or a transaction, and we will not ask for more than we need. You may use an authorized agent where your law allows it.

A note on Organizations' data. If your request concerns data an Organization holds in the Platform, we act as a processor and we will refer you to that Organization, which is the controller. Please tell us who they are, and we will pass your request on and confirm to you that we have done so.

12.2 If the EU GDPR or the UK GDPR applies to you

• Access. Ask what personal data we hold about you, and why.

• Copy and portability. Receive a copy in a commonly used, machine readable format, and ask us to send it to another provider where technically feasible.

• Correction. Have inaccurate or incomplete data corrected.

• Deletion. Ask us to delete your data. We will do so unless we need to keep it, for example for accounting, tax, AML/CFT, sanctions, fraud prevention or the defense of legal claims. We will tell you which exception applies.

• Restriction. Ask us to pause processing while a dispute about accuracy or lawfulness is resolved.

• Objection. Object to processing based on our legitimate interests, and object at any time to direct marketing.

• Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect processing already carried out, or processing we carry out on another basis.

• Automated decisions. Ask for human review of, and an explanation for, a decision made about you by solely automated means that has legal or similarly significant effects, and contest that decision. Please see section 7.

• Instructions after death. In some countries, including France, you may give instructions about what happens to your data after your death, and your heirs may exercise certain rights.

• Complain. Complain to a supervisory authority. Please see section 15.1.

12.3 If you are in a US state with a consumer privacy law

The specific rights available to you, and the thresholds that apply, vary from state to state. Subject to your state's law, you may:

• Know and access. Ask us to confirm whether we process your personal data, and to give you access to it and to information about how we use it.

• Delete. Ask us to delete personal data we collected from you, subject to the exceptions the law allows, for example for accounting, tax, AML/CFT, sanctions, fraud prevention or the defense of legal claims. We will tell you which exception applies.

• Correct. Ask us to correct inaccurate personal data.

• Portability. Receive a copy of your personal data in a portable, and to the extent technically feasible, readily usable format.

• Opt out of sale and sharing. Opt out of the sale of your personal data and of sharing it for cross context behavioral advertising. Please see the paragraph on sale and sharing below.

• Opt out of targeted advertising. Opt out of the use of your personal data for targeted advertising.

• Opt out of certain profiling. Where your state provides it, opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

• Limit the use of sensitive personal information. If you are in California, limit our use of sensitive personal information to the permitted purposes. As explained in section 15.3, we only use this information for those permitted purposes today, so this right does not currently arise.

• Non-discrimination. Not receive discriminatory treatment for exercising your rights.

• Appeal. In states that provide an appeal right, if we decline your request you may appeal by replying to our decision. We will respond within the period your law requires and tell you how to contact your Attorney General.

Sale and sharing. We do not sell your personal data for money, and we do not rent it. However, our use of Google and Meta advertising products on our own Website may qualify as "sharing" for cross context behavioral advertising, and in some states as a "sale". We treat it as such. You can opt out through our privacy preferences menu, or by sending a Global Privacy Control signal from your browser, which we honor where applicable law requires. We do not knowingly sell or share the personal data of anyone under 16.

12.4 If you are in Canada, including Quebec

• Access. Ask what personal data we hold about you, and why.

• Correction. Have inaccurate or incomplete data corrected.

• Withdraw consent. Where we rely on consent, withdraw it at any time, subject to legal or contractual restrictions and reasonable notice.

• De-indexing and cessation of dissemination. If you are in Quebec, ask us to stop disseminating personal data about you, or to de-index it, in the circumstances the Quebec Privacy Act provides.

• Instructions after death. If you are in Quebec, the rules on the handling of your personal data after your death apply as provided by law.

• Complain. Complain to the Office of the Privacy Commissioner of Canada, and if you are in Quebec, to the Commission d'accès à l'information du Québec. Please see section 15.2.

12.5 If the Australian Privacy Act applies to you

• Access. Ask what personal data we hold about you.

• Correction. Have inaccurate, out of date or incomplete data corrected.

• Anonymity or pseudonymity. Ask to deal with us anonymously or under a pseudonym where that is lawful and practicable, which is generally not possible for payments and verification.

• Complain. Complain to the Office of the Australian Information Commissioner. Please see section 15.4.

13. How long we keep personal data

We keep personal data only as long as we need it. The periods below are our defaults. They may be longer where a specific legal obligation, investigation, dispute or regulatory request requires it.

You can also ask us to delete your data earlier, at any time. Where we are not legally required to keep it, we will delete or anonymise it promptly, as described in your right to deletion in section 12. Where an exception applies, for example accounting records, tax receipts, or fraud, AML and sanctions records we are required to retain, we will tell you which one and delete the data once that reason no longer applies.

Where permitted, we may keep aggregated or anonymised data indefinitely. Once data is genuinely anonymised it is no longer personal data and this Policy no longer applies to it.

14. Security

We take security seriously and design our systems to protect your data, though no system can be guaranteed to be completely secure.

Measures we apply include:

• encryption of personal data in transit using TLS, and encryption at rest;

• access control on a need to know basis, with multi factor authentication for our staff and logging of access to production systems;

• separation of environments;

• vendor due diligence before a provider handles personal data;

Payment cards. We do not receive, store or process full payment card numbers or card security codes. Card details are captured directly by Stripe in a payment field hosted by Stripe, so they do not pass through our systems. We hold only limited information such as the card brand, the last four digits, the expiry date and the cardholder name and billing address.

Incidents. We have a process for handling suspected security incidents. Where the law requires it, we will notify the relevant supervisory or regulatory authority, and you, within the applicable deadline, which is 72 hours to the authority under the GDPR and as soon as feasible under the other laws that apply to us.

15. Region specific information and complaints

15.1 EEA and the UK

Representative. Simplyk France is our EEA establishment and Zeffy Limited is our UK establishment, so we do not appoint a representative under Article 27 of the GDPR or of the UK GDPR.

Lead supervisory authority. Because our main establishment in the Union is Simplyk France, the Commission Nationale de l'Informatique et des Libertés is our lead supervisory authority for cross border processing under Article 56 of the GDPR. This does not limit your right to complain to the authority in your own country, and it does not apply to national cookie and electronic marketing rules, for which your local authority is competent.

Data Protection Officer. We have assessed whether we are required to appoint a Data Protection Officer under Article 37 of the GDPR and have concluded that we are not. Our Privacy Team performs the equivalent function, coordinates with the teams responsible for each processing activity, and can be reached at [email protected]. We keep this assessment under review, in particular as our activities in the European Economic Area grow.

Complaints. You have the right to complain to a supervisory authority, in the country where you live or work or where the alleged breach took place. We would be grateful for the chance to resolve your concern first, but that is your choice and not a condition.

• Ireland: Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, dataprotection.ie

• France: Commission Nationale de l'Informatique et des Libertés, cnil.fr

• Germany: the supervisory authority of your Land, or the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, bfdi.bund.de

• United Kingdom: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, 0303 123 1113, ico.org.uk

• Other EEA countries: the list of authorities is published by the European Data Protection Board at edpb.europa.eu

15.2 Canada and Quebec

Person in charge of the protection of personal information. As required by the Quebec Privacy Act, the person in charge of the protection of personal information within Zeffy is François de Kerret, CEO, who can be reached at [email protected] or at the Montreal address in section 3.1.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, and if you are in Quebec, to the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.

Our internal policies on the governance of personal data, including our retention and destruction framework, the roles and responsibilities of our staff across the life cycle of personal data, and our process for handling complaints and requests, are maintained as required by the Quebec Privacy Act. A summary is available on request.

15.3 United States

Notice at collection. The categories in sections 5 and 6, the purposes in those sections, the recipients in section 8 and the retention periods in section 13 constitute our notice at collection. Mapped to the CCPA categories, we collect identifiers, customer records, commercial information, internet and network activity, geolocation inferred from IP address, professional information for End Users, and, for the verification and screening purposes in section 7, government identifiers and information about alleged criminal conduct. We do not collect biometric information, precise geolocation, or the contents of your private communications with others.

Sensitive personal information. We handle government identifiers and financial account information for verification, payment and financial crime purposes only, and we do not use or disclose sensitive personal information for purposes beyond those permitted by the CCPA, so the right to limit its use does not currently arise.

Rights. You have the rights in section 12 to know, access, delete, correct, opt out of sale and sharing, and not be discriminated against. Use [email protected] or our privacy preferences menu. You may complain to the California Privacy Protection Agency at cppa.ca.gov, or to your state Attorney General.

15.4 Australia

We handle personal data in accordance with the Australian Privacy Principles. In addition to the rights in section 12, you may ask us to deal with you anonymously or under a pseudonym where that is lawful and practicable, which is generally not possible for payments and verification. Section 11 lists the countries to which we are likely to disclose personal data.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

16. Sensitive and special category data

We do not ask you for sensitive or special category data for our own purposes, with two exceptions:

• Verification. Identity verification is normally carried out through Stripe, which captures and holds any identity document directly in a flow hosted by Stripe, as an independent controller (see section 3.2). In that normal flow we do not store identity documents in our systems, and we receive only the outcome of the verification and limited related data

Exceptionally, where the Stripe-hosted flow cannot be used, for example in certain sanctions review situations where you are unable to upload a document directly, we may ask you to send the document to us so that we can pass it to Stripe or its support team on your behalf. In that case we hold the document only for as long as needed to complete that step, we store it only in access-controlled systems, and we delete it from our own records once it has been passed to Stripe.
If you send us an identity document on your own initiative when we did not ask for it, we treat it as unsolicited data and delete it once it is no longer needed.

We handle all of the above on the basis of our legal obligations, and, where sanctions screening is involved, the substantial public interest.

• Financial crime screening. Sanctions, watch list and adverse media results, which may include data relating to alleged criminal offences. We handle this on the basis of substantial public interest and our legal obligations, under the conditions set out in the applicable national law, and with restricted internal access.

Separately, Organizations may collect sensitive data through their forms. For example, a health charity may ask about a condition, a place of worship may reveal religious affiliation, or an advocacy group may reveal political opinion. For that data, the Organization is the controller and is responsible for having a valid basis and, in the EEA and the UK, a valid Article 9 condition. Our terms require Organizations to comply with data protection law and prohibit them from using our forms to collect special category data without a lawful basis for doing so. If you have a concern about what an Organization is asking for, contact us and we will look into it.

We ask you not to send us sensitive data through our chat, feedback or support channels, because those channels are not designed for it. If you do, we will handle it under this Policy and delete it when it is no longer needed.

17. Electronic marketing

We use Twilio Sendgrid and HubSpot to send our own emails, and Twilio SendGrid to send emails on behalf of Organizations.

Marketing emails from us always include an unsubscribe link, which we honour promptly. Emails from Organizations sent through the Platform include an unsubscribe link for that Organization's communications. Transactional messages, such as payment confirmations, tax receipts, security notices and account notifications, do not include an unsubscribe link because they are necessary for the Services.

Our email practices are designed to comply with the electronic marketing laws listed in section 4, including CASL, CAN-SPAM, PECR, the Australian Spam Act 2003 and local implementations of the ePrivacy Directive. If you believe you have received a message from us in breach of those rules, please tell us at [email protected].

Our emails contain tracking pixels that tell us whether a message was opened and whether links were clicked. Where consent is required for this, we ask for it, and you can prevent it by disabling remote image loading in your email client.

18. Children and young people

The Services are intended for adults. Our terms require account holders to be at least 18, or the age of majority where they live. Some products, such as raffles and lotteries, carry higher minimum ages in some jurisdictions, and those are set out in the terms for the relevant product.

We do not knowingly create accounts for, or seek personal data directly from, anyone below those ages, and we will delete such data if we become aware of it.

We recognise that young people appear in the Services in other ways. Organizations run peer to peer campaigns for schools, youth sports and youth programmes, in which a young person may have a fundraising page or be named as a participant, and a young person may be included in the records an Organization holds. In those cases the Organization is the controller and is responsible for obtaining any parental consent required, for keeping what it collects to a minimum, and for complying with children's data rules such as the UK Age Appropriate Design Code and the Irish Fundamentals for a child oriented approach to data processing. Our terms require this of Organizations. If you are a parent or guardian and you have a concern about a page or a record, contact us at [email protected] and we will act on it and put you in touch with the Organization.

We do not knowingly sell or share, in the US law sense, the personal data of anyone under 16.

19. Changes to this Policy

We review this Policy at least once every 12 months and update it when our practices change. The version number and date at the top tell you which version you are reading. You can request previous versions at any time by writing to [email protected].

Where a change is material, we will notify End Users and Members before it takes effect, by a prominent notice in their account areas on the Platform and by email. Where a change requires your consent, we will ask for it rather than assume it.

Other users, including Contributors, see the then-current version of this Policy when they use a Zeffy-powered form, which is linked at the point of collection.

Thank you for reading. If anything here is unclear, or if you think we have got something wrong, please tell us at [email protected].

© Zeffy, 2026. Zeffy is a trading name of the entities listed in section 3.1.