Privacy policy

Introduction

Brainfloss UK Private Limited (trading as DonorStack) ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, and protect personal data when you use our website and services.

We are registered with the Information Commissioner's Office (ICO) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What data we collect

We collect and process the following data:

• Contact information: name, email address, phone number, organisation name
• Account information: login credentials, role, preferences
• Usage data: how you use our website and application
• Technical data: IP address, browser type, device information

How we use your data

We use your data to:

• Provide and improve our services
• Communicate with you about your account
• Send service updates and security alerts
• With your consent, send marketing communications about DonorStack
• Comply with legal obligations

Legal basis for processing

We process your data based on:

• Contract: processing necessary to provide our services
• Legitimate interests: improving our services, security, fraud prevention
• Consent: where you have opted in to marketing communications
• Legal obligation: where required by law

Data storage and security

All data is stored on secure servers located in the United Kingdom. We use industry-standard security measures including:

• 256-bit SSL encryption for data in transit
• AES-256 encryption for data at rest
• Regular security audits and penetration testing
• Role-based access controls
• Multi-factor authentication

Data retention

We retain your data for as long as necessary to provide our services and comply with legal obligations. When you close your account, we will delete your data within 30 days, except where we are required to retain it for legal or regulatory purposes.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing of your data
• Request restriction of processing
• Data portability
• Withdraw consent at any time

To exercise these rights, contact us at privacy@donorstack.co.uk

Third parties

We share data with third parties only where necessary to provide our services:

• Cloud hosting providers (UK data centres only) for infrastructure
• Payment processors for subscription billing
• Analytics providers (privacy-focused, no personal data)

We never sell your data to third parties or share it for marketing purposes.

Contact us

If you have questions about this policy or our data practices, contact us at:

Email: privacy@donorstack.co.uk
General enquiries: hello@donorstack.co.uk

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk