Last Updated: 5 November 2026
At People's Fundraising, we want your experience to be safe, transparent, and compliant with UK laws and regulatory guidance. This page gives you a simple overview of how we protect you, your data, and your fundraising activity. It should be read alongside our Terms and Conditions and Privacy Policy.
- Overview
- Your privacy & data protection
- Data protection responsibilities for organisations
- Fundraising & regulatory compliance
- Payments, security & Gift Aid
- Platform safety & fraud prevention
- Your responsibilities as a user
- Fees & transparency
- Complaints, support & regulatory escalation
Overview
People's Fundraising is operated by Golden Giving Limited, a company registered in England and Wales. We provide a digital fundraising platform that lets individuals, groups and Nonprofits raise money, run events, sell tickets and products, and manage campaigns in a way that is designed to be secure, compliant and user-friendly.
This summary explains, in plain language, how we:
- Protect your personal data and respect your privacy.
- Explain how organisations control their supporter data, how we protect it as processor, and how export, incidents and deletion work.
- Support compliance with UK fundraising, charity and gambling regulations.
- Handle payments and Gift Aid securely and responsibly.
- Work to prevent fraud and keep the platform safe.
- Explain what is expected from you when you use the platform.
Your privacy & data protection
We take your privacy seriously and follow UK data protection laws, including UK GDPR and the Data Protection Act 2018. Our Privacy Policy explains in detail what data we collect, why we collect it, how long we keep it, and how we keep it secure.
- We limit collection and handling of personal data to what is necessary for the services, lawful instructions and applicable legal obligations, depending on our role in each processing activity.
- We use strong security measures (such as encryption and access controls) to protect your data.
- We do not sell personal information or commercially exploit organisations' private supporter data.
- You can exercise your data protection rights (for example to access, correct or delete your data, or to object to certain uses).
- We give you clear choices about cookies and marketing communications.
Data protection responsibilities for organisations
Charities, schools, PTAs, clubs and other organisations need clarity about who controls supporter information held on the platform. These arrangements distinguish the organisation's data from the limited information People's Fundraising processes as an independent controller.
1. Contractual data protection responsibilities
The organisation is the Data Controller. The organisation determines why and how the personal information of its donors, supporters, members, participants and customers is collected and used for its own purposes, including communications, lawful bases, retention choices and rights requests.
People's Fundraising is the Data Processor when it hosts, stores, retrieves, secures and makes this organisation-controlled information available on the organisation's behalf. Holding data in our systems is itself legally a form of processing. We do not sell, on-sell, mine, profile, independently analyse or use organisations' private supporter data for our own marketing or unrelated commercial purposes.
We process organisation-controlled information only as needed to provide, maintain, secure and support the fundraising services the organisation has configured or instructed, or as required by law. We may separately act as an independent Data Controller for limited information processed for our own lawful purposes, for example direct account management, platform security, payment reconciliation, fraud prevention and statutory records.
The Data Processing Schedule within our Terms and Conditions sets out binding Article 28 processor responsibilities. These include documented instructions, confidentiality, appropriate security, sub-processors, assistance with rights requests, incident notification, data return or deletion, and audit rights. The Privacy Policy explains where each party acts as controller or processor.
2. Breach notification and incident response arrangements
We maintain incident response procedures for identifying, investigating, containing and remediating suspected security incidents and personal data breaches. These include protecting affected information, documenting action taken and supporting recovery.
Where a personal data breach affects organisation-controlled information processed by us, we notify the organisation as Data Controller without undue delay after becoming aware of the breach, and provide available information to support its assessment and any notifications it must make to the ICO or affected individuals. We will supply further relevant information as it becomes available, in accordance with the Data Processing Schedule.
Where People's Fundraising itself acts as Data Controller for affected information, we assess our own notification duties and, where required, notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a notifiable breach; affected individuals are informed where required by law.
Further details appear in our Security & Data Protection page and Privacy Policy.
3. Data export, retention and deletion provisions
Access and export: Organisations can access fundraising and supporter information through the functions available to their authorised users. Organisations requiring assistance with retrieval or export can contact our support team. The availability, scope and format of exports depend on the relevant service, records, access permissions and legal restrictions.
Retention: For information held on an organisation's behalf, we follow its documented instructions and applicable contractual terms, subject to legal obligations. We may separately retain records for which we are an independent Data Controller, including financial, Gift Aid, security and statutory records, for the periods and purposes described in our Privacy Policy. Our Security & Data Protection page explains backups and recovery.
Return and deletion: At the end of processor services, the organisation may choose the return or deletion of its organisation-controlled personal data, subject to legal retention requirements and the Data Processing Schedule. Information retained lawfully in backups is protected from routine use and removed in accordance with backup expiry and deletion arrangements. Records that we are legally required to retain in our independent-controller capacity are handled separately.
For questions about these arrangements, please contact support@peoplesfundraising.com.
Fundraising & regulatory compliance
We are committed to supporting good practice in fundraising and charity regulation. When you use People's Fundraising, you can expect that:
- We aim to work in line with relevant UK rules and guidance, including Charity Commission guidance and the Fundraising Regulator's Code of Fundraising Practice.
- We only list Nonprofits and organisations that meet our eligibility criteria and that have agreed to our Terms and Conditions.
- We make it clear when organisations are or are not eligible for Gift Aid.
If you run campaigns, raffles, lotteries, events or sales through the platform, you must make sure you follow the laws and guidance that apply to you. This may include:
- Charity fundraising rules and guidance.
- Gambling rules for raffles and lotteries where applicable.
- Consumer protection rules for tickets, products and services.
Our Terms and Conditions explain these responsibilities in more detail.
Payments, security & Gift Aid
We want donating and receiving funds to be straightforward and secure:
- Payments are processed through regulated, PCI-DSS compliant payment providers. We do not store full card or bank details on our systems.
- We use fraud checks and monitoring to help protect donors, Nonprofits and the platform.
- Where you confirm that you are a UK taxpayer and choose to add Gift Aid, we reclaim Gift Aid from HMRC on behalf of the benefiting Nonprofit in line with HMRC rules.
- Funds raised are usually transferred on a regular schedule (for example monthly), net of applicable fees and processing costs.
In some cases we may need to delay or withhold payments (for example while we complete verification checks or where we suspect fraud or other illegal activity). This is explained further in the Terms and Conditions.
Platform safety & fraud prevention
Keeping the platform safe is a shared responsibility. We:
- Monitor activity for signs of fraud, abuse, or misuse of the platform.
- Use technical measures (such as security logging, IP and device checks) to help detect suspicious activity.
- Have processes in place to respond to incidents, including data breaches.
- May suspend accounts, remove content, or withhold funds where we believe there is a risk of fraud, illegal activity or serious breach of our Terms and Conditions.
- May report concerns to relevant authorities (such as HMRC, the Charity Commission, the Fundraising Regulator or law enforcement) where appropriate.
Your responsibilities as a user
When you use People's Fundraising, you agree to:
- Provide accurate, up-to-date information when creating an account, making donations or running campaigns.
- Keep your login details secure and tell us if you suspect unauthorised access to your account.
- Respect the privacy and rights of others, and only upload content and personal data that you are allowed to use.
- Follow all applicable laws and regulations when running fundraising pages, raffles, lotteries, events, shops, memberships or crowdfunding campaigns.
- Comply with UK data protection laws when you access or use donor or supporter information provided through the platform.
You can find the full list of user obligations in our Terms and Conditions.
Fees & transparency
We believe in being clear about costs:
- We charge a transaction fee on payments made through the platform and our payment providers may charge their own fees.
- We explain these fees on our dedicated Fees page.
- Where possible, we show applicable fees before a donor completes a transaction.
Complaints, support & regulatory escalation
If you have questions or concerns, we encourage you to contact us so we can try to resolve them quickly.
We aim to handle complaints fairly and in line with relevant guidance from regulators.
If you are not satisfied with our response, you may also be able to raise your concerns with:
- The Fundraising Regulator for fundraising-related concerns.
- The Information Commissioner's Office (ICO) for data protection concerns.
Please see our Terms and Conditions and Privacy Policy for more detailed information about how we handle complaints and your rights.