Our policies & practices

Goodstack Privacy Policy

Effective Date: November 15, 2024

This privacy policy (“Policy”) describes how We Are Percent Limited t/a Goodstack (“Goodstack”, “us”, “we”, “our”) collect, use and share Personal Data of individual users of our website (https://goodstack.io) and our services (“Services”). Our individual users may be associated with, or may be, any of the following: 

• Clients (as defined in the Standard Terms and Conditions), 

• Charities and Applicants (both as defined in the Standard Terms and Conditions), 

• Donors (as defined in the End User Hosted Donation Gateway Additional Terms),

• Client Employees (as defined in the Employee Engagement Solution Additional Terms), and

• Any visitors to our website. 

Please take a moment to read this Policy as it includes important information. By using our Services and providing us with your Personal Data, you acknowledge and agree that your Personal Data may be processed for the purposes identified in this Policy. Please note that our Cookie Policy also applies to your use of our website.

This Policy sets out:

• who we are;

• the Personal Data we collect about you;

• how we use your Personal Data;

• the circumstances in which we may share your Personal Data with third parties;

• how we may contact you for marketing purposes;

• the circumstances in which we may transfer Personal Data outside of the European Economic Area;

• how we protect your Personal Data;

• how we may retain your Personal Data;

• your legal rights in relation to your Personal Data; and 

• who we may disclose your Personal Data to.

You can find out more about Goodstack on our website and in our contract with you.

1. WHO WE ARE & CONTACT INFORMATION

We Are Percent Limited t/a Goodstack is a company registered in England and Wales with registered company number 09387321 and having its registered office address at 7 Bell Yard, London, England, WC2A 2JR.

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this policy. If you have any questions about this policy, including any requests to exercise your legal rights, please contact our Data Protection Officer at dpo@goodstack.io or write to us using the details set out above. 

You have the right to make a complaint at any time to the supervisory authority for data protection issues for your country (“Data Protection Authority”). We would, however, appreciate the chance to deal with your concerns before you approach the Data Protection Authority so please contact us in the first instance.

2. WHAT WE COLLECT

a. Personal Data you disclose to us 

“Personal Data” means any information which, either alone or in combination with other information in our possession, enables you to be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of Personal Data about you which you provide to us when you contact us and/or when you use the Services.  The types of information which we may collect includes:

• Identity Data includes first name, last name, username or similar identifier, job title, social media handles/URLs.

• Contact Data includes your address, email address and telephone numbers.

• Financial Data includes any financial information about you which you provide to us.

• Transaction Data includes details about payments to and from you through our website.

• Profile Data includes your username and password, your interests, preferences, feedback and survey responses.  

• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose (“Aggregated Data”). Aggregated Data may be derived from your Personal Data but is not considered Personal Data under applicable law as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this privacy policy.

b. Information automatically collected when you use our website

We automatically collect certain information when you visit, use or navigate our website. This information does not reveal your specific identity (unless your device name is the same as your name) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, browsing patterns, clicks you make on a page, and other information about how and when you use the website and other technical information. This information is primarily needed to maintain the security and operation of the website, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Policy.

3. HOW WE USE PERSONAL DATA

We will only use your Personal Data when the law allows us to. Most commonly, we will use your Personal Data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

• Where we need to comply with a legal or regulatory obligation.

Generally, we do not rely on consent as a legal basis for processing your Personal Data other than when legally required before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

We have set out below a description of all the ways we plan to use your Personal Data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your Personal Data where more than one ground has been set out in the table below.

4. MARKETING AND OPTING OUT 

You hereby consent to us contacting you for marketing purposes with information about our Services, promotions and special offers. If you no longer wish to receive such marketing information, you can withdraw your consent at any time by contacting us as indicated in Section 1 above or unsubscribing from the communications.

If you have given consent, we may share your information with carefully selected third party organisations and business partners and they may contact you directly. If you would prefer to no longer receive direct marketing communications from third parties and partners after previously giving your consent, please contact those third parties and partners directly to withdraw the consent. 

If you reside in California, you have the right to ask us one time each year if we have shared personal information with third parties for their direct marketing purposes. To make a request, please contact us as indicated in Section 1 above. Indicate in your email or letter that you are a California resident making a “Shine the Light” inquiry.

5. INTERNATIONAL TRANSFER OF PERSONAL DATA

Many of our external third parties are based throughout the world so their processing of your Personal Data may involve a transfer of data outside of your country of residence.  

Whenever we transfer your Personal Data out of your country of residence, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your Personal Data using processes that have been deemed to provide an adequate level of protection for Personal Data. 

• Where we use certain service providers, we may use specific contracts approved for use by the UK and the EU which give Personal Data the same protection it has in the UK and EU. 

Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Data out of your country of residence.

6. PROTECTING YOUR INFORMATION

We want you to feel confident about using our website, and we are committed to protecting the Personal Data we collect. We limit access to Personal Data about you to employees who reasonably need access to it, to provide products or services to you or in order to do their jobs. We maintain appropriate technical and organisational physical, electronic, and procedural safeguards to protect the Personal Data that you provide to us against unauthorised or unlawful processing and against accidental loss, damage or destruction.

We have also put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

7. RETENTION OF PERSONAL DATA

We retain your Personal Data for no longer than is necessary for the purposes as described in this Policy above.

To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

You can obtain details of retention periods for different aspects of your Personal Data by contacting us.

8. YOUR PRIVACY RIGHTS

Under certain circumstances, if you have a direct contractual relationship with Goodstack, you may have rights under data protection laws in relation to your Personal Data. You can learn more about your rights further down in this section. However, if we have collected your Personal Data as a result of agreements we have in place with our Clients, those Clients control our use of your Personal Data and determine how and for what purpose we process Personal Data.

If we do not have a direct contractual relationship with you, but you have any questions or concerns about how your Personal Data is handled or would like to exercise your rights as a data subject, you should contact the Client who has contracted with us to use the Services to process your Personal Data. We will provide assistance to the Client to address any concerns you may have, in accordance with the terms of our contract with them and applicable law.

If you have a direct contractual relationship with Goodstack, in certain circumstances, you have the right to:

• Request access to your Personal Data (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.  Where we have good reason, and where data protection law permits, we can refuse your request for a copy of your information, or certain elements of the request. If we refuse your request or any element of it, we will provide you with our reason(s) for doing so. 

• Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. 

• Right to Object to or Restrict Processing.  In certain circumstances, you have the right to object to our processing of your information (for example, if we are processing your information on the basis of our legitimate interests but there are no longer any compelling legitimate grounds to justify our processing overriding your rights and interests).

• You may also have the right to restrict our use of your information, for example during a period in which we are verifying the accuracy of your information in circumstances where you have challenged the accuracy of that information.

• Request the transfer of your Personal Data to you or to a third party. In certain instances, you have a right to receive the information that we hold about you (or a portion thereof) in a structured, commonly used and machine-readable format.

• In such circumstances, you can ask us to transmit your information to you or directly to a third-party organisation on your behalf.

• While we are happy for such requests to be made, we are not able to guarantee technical compatibility with a third-party organisation’s systems. We are also unable to comply with requests that relate to personal information of others without their consent.

• Withdraw consent at any time where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us. 

NO FEE USUALLY REQUIRED

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

WHAT WE MAY NEED FROM YOU

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

TIME LIMIT TO RESPOND

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

CHANGE OF PURPOSE 

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. 

If we need to use your Personal Data for an unrelated purpose, we will notify you to obtain consent or to explain the legal basis which allows us to use the Personal Data for the unrelated purpose.

Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

9. WHEN WE MIGHT DISCLOSE YOUR PERSONAL DATA

We only share and disclose your information in the following situations:

• Contractual. We may share information with brand providers, charities and other Nonprofits, and partners to facilitate the provision of services. 

• Compliance with Legal Obligations. We may disclose your information where we are legally required to do so in order to comply with applicable laws, governmental requests, judicial proceedings, court orders, or legal processes, such as in response to a court order or a subpoena (including in response to requests from public authorities in order to meet national security or law enforcement requirements).

• Third Party Service Providers. We may share your information with third party vendors, service providers, contractors or agents who perform services and require access to such information to carry out that work. Examples include: service providers acting as processors who provide IT and system administration services. They will only have access to your information to the extent that they need to perform those services. They are required to keep your information confidential and may not use it other than as we ask them to and always in accordance with this Policy.  We also store information through Amazon Web Services, a cloud storage services provider.  

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

• Third Party Advertisers. We may use third party advertising companies to serve ads when you visit our website. These companies may use information about your visits to the website and other websites that are contained in web cookies and other tracking technologies in order to provide personalised advertisements about goods and services that may be of interest to you. See our Cookie Policy for further information

• Business Partners. Provided you have given us consent to do so we may share your information with our business partners to offer you certain products, services or promotions.

• With your consent. We may disclose your information for any other purpose with your consent.

We may disclose aggregated, anonymous information (i.e. information from which you cannot be personally identified), or insights based on such anonymous information, to selected third parties, including (without limitation) analytics and search engine providers to assist us in the improvement and optimisation of the Services. In such circumstances we will not disclose any information which can identify you personally.

10. THIRD PARTY WEBSITES

Our website may feature links to third party websites or contain advertisements from third parties that are not affiliated with us and which may link to other websites, online services or mobile applications. We cannot guarantee the safety and privacy of data you provide to any third parties. Any data collected by third parties is not covered by this Policy. 

We are not responsible for the content or privacy and security practices and policies of any third parties, including other websites, services or applications that may be linked to or from the website. You should review the policies of such third parties and contact them directly if you have any related questions.

Please note that if you link your profile to third party sites such as Twitter, Facebook, Google +, Linkedin or Tumblr then your use of those sites is subject to the respective third party’s terms and conditions. We recommend that you read any third-party terms and conditions before linking your profile.  If you consent, we may collect information about you from those third-party sites, for example a list of your Facebook friends and, where you consent, that information may be shared with Clients and Charities.