THE SHAMAAZI PROJECT LTD (“we”, “us” or “Shamaazi”) takes the privacy of your information very seriously.
This Privacy Notice explains how we collect, use, store and disclose personal information when you interact with any websites, applications, digital platforms, products or services operated by us (together, the “Services”). Personal information may be collected in person, via our Services, or through other means such as online forms, messaging platforms, email communications or other digital interactions.
This Privacy Notice applies to all personal data processed by Shamaazi in connection with any current or future Services we operate, unless a more specific privacy notice is provided.
This notice applies to the charitable donation and related services we provide and relates to any personal information provided by our users, customers and contacts (including donors, supporters, partners and other individuals whose data we process).
In this notice, “you” refers to any individual whose personal data we hold or process. This Privacy Notice is governed by the UK General Data Protection Regulation and the EU General Data Protection Regulation (together referred to as the “GDPR”).
Our Services are not directed at children and we do not knowingly collect personal data from individuals under the age of 18.
Below we set out the categories of personal data we collect, how we use that data, and the legal bases we rely on.
Contact information for donors who donate through the Services, as well as any individuals who sign up to our mailing lists or otherwise ask or agree to receive communications or information relating to our products and services, and users who contact us. This information may include names, email addresses, telephone numbers (including mobile numbers used for WhatsApp, SMS or similar messaging services), postal addresses, and communication or service preferences (“Contact Information”).
We process this information when we communicate with you or provide Services to you on the basis of the performance of a contract with you, or, where no contract exists, on the basis of our legitimate interests in providing and operating the Services, subject to your communication preferences and applicable law.
Information relating to donations made through the Services, which may include donation amounts, dates and times, recipient charities or organisations, and records of total donations (“Donation Information”).
We process this information to process and manage donations on the basis of the performance of a contract with you, or, where no contract exists, on the basis of our legitimate interests in providing and operating the Services.
We may collect information about how you interact with our Services, including charities and causes you view or support, products and features you use, content you view or interact with, searches you make, and your giving preferences and history (“Service Usage and Preference Information”).
We may use this information, together with Donation Information, to personalise and improve your experience across our Services. This may include tailoring the content, charities, causes, giving opportunities and features displayed to you based on your previous giving activity, preferences and interactions with our Services.
We process this information on the basis of our legitimate interests in providing, improving and personalising our Services, subject to your rights and applicable law.
Information provided in relation to comments or reviews submitted through the Services (“Comment Information”).
We process this information on the basis of our legitimate interests in operating the Services and displaying such content.
Information provided in relation to payment for donations, such as credit or debit card details (“Payment Information”). Payment Information may be supplied directly to third-party payment processors, who will process the data in accordance with their own privacy notices.
We process this information on the basis of the performance of a contract with you in providing the Services.
Records of correspondence or communications between you and us (“Communication Information”).
We process this information on the basis of the performance of a contract with you or, where no contract exists, on the basis of our legitimate interests in managing relationships with users and operating the Services.
Marketing information we may hold to provide information about our Services, which may include names, email addresses, postal addresses, telephone numbers and preference data (“Marketing Information”).
We process this information on the basis of our legitimate interests in communicating with you about our Services or, where required by law, on the basis of your consent. You will not receive electronic marketing communications via email, WhatsApp or SMS unless you have consented to receive them or we are otherwise permitted to do so under applicable law.
We may collect the above information directly from you or, in some cases, from third parties. Your rights under this Privacy Notice apply regardless of how we obtain your data.
Where you choose to receive messages from us, or otherwise communicate with us via messaging services such as WhatsApp, SMS or similar platforms, we may collect and process your telephone number, profile name, profile image, and the content of messages you send or receive (“Messaging Information”).
We process Messaging Information for the purposes of:
We process Messaging Information on the basis of:
This Privacy Notice also applies to personal data provided by our partner charities, their staff, and third-party suppliers whose data we process. We process such data on the basis of the performance of a contract with the relevant organisation or, where no contract exists, on the basis of our legitimate interests in operating the Services.
We retain personal data only for as long as necessary for the purposes for which it was collected, including:
For any personal data not specifically listed above, the default retention period is 7 years from receipt, unless otherwise required by law. Retention periods may be extended where legal proceedings or investigations apply.
We use cookies and other technologies that store information on, or access information from, your device. These include cookies, pixels, tags, scripts and browser storage. In this notice we refer to them together as storage and access technologies.
The categories we use are:
Strictly necessary. Required to operate and secure the Services and to deliver a service you have asked for. These do not require your consent.
Performance and analytics. Used to understand how the Services are used so that we can improve them.
Functionality. Used to enable enhanced features and to remember your preferences.
Targeting and advertising. Used to deliver advertising and to measure how it performs.
Other than strictly necessary technologies, we do not place or access these technologies on your device until you have given your consent. The controls available to you differ between our Services as we roll out a single consent experience across them. In every case you can refuse non-essential technologies, and you can change or withdraw your choices at any time using the consent controls in the Service you are using.
The third parties whose technologies we use include Stripe for payment processing and fraud prevention, Mixpanel and PostHog for product analytics, Customer.io for email and messaging, and Meta for advertising. Each processes data in accordance with its own terms.
We use product analytics tools, including Mixpanel and PostHog, to understand how our Services are used and to improve them. Where you consent to performance and analytics technologies, these tools may collect information about the pages you view, the features you use, and how you move through our Services.
Where you separately consent to session recording, PostHog may create a recording of your visit. This includes the pages as they appeared on your screen, page navigation, scrolling, clicks, pointer movement and the timing of your keystrokes. Values you enter into form fields are masked and are not recorded, and payment card fields are excluded entirely. Search terms you enter when looking for a charity or cause are recorded. Recordings can include information displayed to you, such as your name and donation amount on a confirmation or receipt page. We do not record the contents of network requests or responses.
We use Meta advertising technologies to deliver advertising and to measure how it performs. Where you consent to targeting and advertising technologies, information about your interactions with our Services may be shared with Meta. In relation to some of this processing, we and Meta act as joint controllers under Meta's controller addendum, and Meta processes that data in accordance with its own terms.
We do not rely on legitimate interests as an alternative to your consent for any of the technologies described in this section.
You can change or withdraw your choices at any time using the consent controls in each of our Services.
eserve the right to refuse, suspend or terminate registration at any time for any reason, subject to applicable law.
You are responsible for maintaining the confidentiality of your login details and for all activity carried out through your account.
We may process IP addresses to diagnose server issues, analyse aggregate usage, administer and improve the Services.
We may share personal data:
We rely on legitimate interests as the default legal basis for sharing data, subject to your consents, preferences and applicable law.
Your personal data may be transferred outside the United Kingdom. Where our providers offer data residency in the United Kingdom or the European Economic Area, we use it. Our Mixpanel, PostHog and Customer.io instances are hosted in the European Economic Area. Some providers, including Meta, process data in the United States. Separately from where data is stored, traffic between your device and our providers may be routed through content delivery and proxy infrastructure located outside the United Kingdom and the European Economic Area. This does not change where that data is subsequently stored
Where personal data is transferred to a country that is not covered by UK adequacy regulations, we rely on the International Data Transfer Agreement, or the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, together with a transfer risk assessment.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss or damage.
You have the right to:
You may withdraw consent for messaging communications by using any opt-out mechanism provided, adjusting your communication preferences, or contacting us directly.
We will respond to rights requests within one month, unless an extension is permitted by law.
We will notify the Information Commissioner’s Office (ICO) and affected individuals where required by law in the event of a personal data breach.
The Shamaazi Project Ltd is the data controller responsible for the personal data described in this Privacy Notice.
The Shamaazi Project Ltd
Company number 16665293
6-8 Great Eastern Street, London, EC2A 3NT, United Kingdom
Registered with the Information Commissioner's Office, registration number ZC125846
Responsibility for data protection compliance sits with our senior management team. If you have a question about this notice, about how we handle your personal data, or if you wish to exercise any of the rights set out in section 12, please contact us at privacy@shamaazi.com or write to us at the address above.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office.