PII frequently asked questions
Get answers to common questions about Fundraise Up’s PII protections.
- What controls does Fundraise Up have in place to ensure the security of sensitive client data including Personally Identifiable Information (PII) of our Donors? Fundraise Up is SOC2-Type 1 and PCI-DSS Level 1 compliant. Under these frameworks, we specifically utilize data encryption, role-based access controls, and Fundraise Up policy protocols to ensure the safety and security of all client data including all PII of donors.
- How does Fundraise Up use data encryption to secure my data? Fundraise Up utilizes full disk encryption for all data-at-rest and data-in-transit so that all data stored in our systems is only accessible through encryption keys. These encryption keys are tightly controlled by engineering personnel and rotated on a scheduled basis.
- How does Fundraise Up use RBAC to secure my data? Our dashboard is utilizing Role-Based Access Control (RBAC) protocols based on the principle of “Just Enough Access”, where access is limited to that which is required for the performance of job duties for individual users. For the Fundraise Up admin dashboards, there are also audit logs in place to do access analysis. Fundraise Up users are provided with only enough access to relevant systems, applications, and information to execute their job responsibilities.
- Will Fundraise Up have access to PCI data of Donors? Fundraise Up does not have access to donors’ PCI data as this is handled exclusively by Stripe. Fundraise Up only stores the last 4 digits along with the expiry date and brand name. Stripe and Fundraise Up are PCI-DSS Level 1 compliant which is the highest industry level of security certification.
- Will Fundraise Up have access to my CRM? Fundraise Up will be 'integrated' with your CRM using an API, and will send all donor data to your CRM, of which it will retain a copy. Fundraise Up will not have access to your CRM as the integration is a one-way sync and we only create and update records in your CRM.
- Specifically what PII data will Fundraise Up process and store on my behalf? With respect to each donation record, Fundraise Up stores some information that can be categorized as PII for regulatory purposes. This may include (i) basic donor information (name, email, mailing address, phone, etc) (ii) donor tech data (geolocation, device details, browser info, etc) (iii) last 4 digits and expiry dates of card/bank details (ii) other miscellaneous data where provided (family member details, tribute information, etc).
- Does the PII data processed by Fundraise Up include any sensitive data? The transfer does not include any special or sensitive categories of data.
- Does Fundraise Up require UK / EU donor data to be exported, stored or processed outside of the UK/EU? Fundraise Up utilizes cloud computing infrastructure to create an elastic, robust, and dependable platform for our clients. Furthermore, the nature of our services requires us to provide data access to our teams based outside of the EU. In that respect, we execute a Data Processing Agreement (DPA) which includes the UK International Data Transfer Addendum and EU standard contractual clauses documentation. This enables our data transfers to comply with the UK & EU data privacy frameworks and ensures the security of your data.
- What contractual arrangements does Fundraise Up put in place to ensure that international data transfers abide by UK & EU regulations? Fundraise-Up executes a Data Processing Agreement (DPA) which includes relevant documentation under the UK International Data Transfer Addendum and EU standard contractual frameworks. Under these frameworks, your organization is the ‘Data Controller’ for its donor’s PII data while Fundraise Up will be the ‘Data Processor’ of the PII of your donors. The DPA outlines checks and balances that ensure the Processor uses the data only for the purposes that are specified by the Controller and that the Processor fulfills the responsibilities and obligations of the Controller with respect to the donor’s PII.
- Do you foresee any significant changes to the UK & EU GDPR regulations that may disrupt international data transfers? Based on our research and understanding, while some changes are expected to the relevant regulations in the near future, we do not foresee any significant disruptions to the overall UK International Data Transfer Addendum and EU standard contractual clauses frameworks.
- Does Fundraise Up subcontract any of its processing of PII data to sub-processors? The nature of our services is such that we are required to contract storage of data on internet cloud infrastructure and utilize payment processors to process donations. Fundraise Up uses contractors who are Fundraise Up’s ‘Sub-Processors’ under the GDPR framework.
- What due diligence is conducted on sub-processors? Before engaging any service provider, we perform due diligence, including a vendor security assessment if required. We review vendor compliance reports on a periodic basis and determine whether any aspects need to be discussed or reviewed with the vendor.
- How is the processing of the Donor’s PII addressed in the contractual terms with your sub-processors in light of the GDPR requirements? Fundraise Up ensures that our sub-processors are subject to contract terms that ensure that these service providers process personal data only for the purposes of providing services to Fundraise Up and in accordance with our commitments to our business users and applicable data protection laws. We work with our vendors to make sure that all processes and contracts are compliant with GDPR and other privacy & data transfer regulations.
- How long does Fundraise Up retain client data? While your account is active, our current process is to retain records indefinitely unless required otherwise. In certain cases, where our clients require a definite time frame for deletion, we can agree on a specific time limit for the retention of all donation records. At the moment, we have a five year minimum retention period that we can agree on, but this is currently under review.
- What happens to my data if I decide to close my Fundraise Up account? When an account is closed, we revoke access to our client-facing teams and if requested we can delete client PII data after the account is closed out. We would still retain client transaction-related data points in accordance with applicable laws (these data fields include name, email, donation amounts, payment method, and in certain jurisdictions mailing address). These would be stored in an encrypted format with limited access permissions and would only be accessed if needed for regulatory purposes.
- As donor data records are stored within the Fundraise Up platform, how does Data Residency affect the storage of these records? Fundraise Up utilizes cloud computing infrastructure to create an elastic, robust, and dependable platform for our clients. Fundraise Up operates SOC2 and PCI-DSS Level 1 compliant data servers in the US, EU, and Canada to store donor data for EU & UK organizations. In that respect, we execute a Data Processing Agreement (DPA) which includes the UK International Data Transfer Addendum and EU standard contractual clauses documentation. This enables our data transfers to comply with the UK & EU data privacy frameworks and ensures the security of your data.
The details provided above are subject to change based on internal and audit reviews and any changes in applicable laws and regulations. We are constantly reviewing our processes as part of our compliance updates and would welcome your feedback.