Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Donorbox is a US based donation form and fundraising platform embedded on websites that processes donor personal data and handles payments through Stripe and PayPal.
Donorbox is a fundraising platform that embeds a donation form into a website so that nonprofits and causes can collect one time and recurring gifts. The form captures donor details and routes payments to processors such as Stripe and PayPal, while Donorbox stores the donation records and donor information.
Donorbox is a US based provider, so donor data is processed on servers in the United States. Because the form handles personal and financial data and sets cookies, it carries a higher risk profile and engages both the GDPR and the ePrivacy Directive for EU and EEA donors.
The donation form collects identity and contact details such as name, email and address, the donation amount and frequency, and any message or campaign reference. Card details are entered into and processed directly by Stripe or PayPal, so cardholder data does not reside within Donorbox itself.
Donorbox and the payment processors set cookies to support the form, prevent fraud and maintain the session. Donor records are personal data and, given the financial context, should be handled with strong security and clear retention limits.
For purposes of the GDPR your organization is typically the controller of donor data and Donorbox acts as a processor under its data processing addendum, while the payment processors act as separate controllers for the payment. Donation and payment processing rely on contract necessity and legal obligations, whereas marketing opt ins require consent.
Non essential cookies set by the embedded form require prior consent under the ePrivacy Directive, while strictly necessary cookies that secure the transaction do not.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Strictly necessary cookies that complete a donation may load without consent, but any analytics or marketing cookies must be blocked until the donor agrees. Keep newsletter and mailing list opt ins separate, unticked by default, and never bundled with the act of donating.
Provide a clear privacy notice on the form explaining who receives the data, including the US transfer and the role of Stripe or PayPal.
Donorbox processes donor data in the United States, and Stripe and PayPal also operate internationally, so donations from the EEA involve transfers outside the EEA. These require a valid mechanism such as Standard Contractual Clauses, supported by a transfer impact assessment and supplementary measures where appropriate.
Record these transfers in your records of processing and confirm the safeguards in the Donorbox data processing addendum and the payment processor terms.
Sign the Donorbox data processing addendum, document the US transfer and the role of Stripe and PayPal, and complete a data protection impact assessment because of the financial and personal data involved. Gate non essential cookies behind consent and list them in your cookie policy.
Keep marketing opt ins separate and unticked, set retention periods for donation records, secure access to the donor data, and ensure you can fulfill access, rectification and erasure requests while respecting accounting obligations.
Websites using Donorbox must obtain user consent under GDPR regulations.
DPIA considerations
Donorbox processes donor personal data and financial transactions, so a data protection impact assessment is strongly recommended given the higher risk. Assess the categories of donor data collected, the role of payment processors Stripe and PayPal, retention of donation records, the transfer of data to the United States, and the controller and processor responsibilities between your organization and Donorbox.
Sample consent text
We use Donorbox to process donations on this site. Donorbox sets cookies and sends the information you enter, including payment details handled by Stripe or PayPal, to servers in the United States. Optional cookies load only with your consent, which you can change at any time.
Third-party domains contacted
donorbox.orgapi.donorbox.orgjs.stripe.comwww.paypal.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| donorbox_session | Strictly necessary | Session | Maintains the donation form session so a donor can complete a gift securely. |
| donorbox_csrf | Strictly necessary | Session | Protects the donation form against cross site request forgery during submission. |
| donorbox_prefs | Functional | 6 months | Remembers form preferences such as currency or recurring selection for the donor. |
| __stripe_mid | Strictly necessary | 1 year | Set by Stripe to support fraud prevention and secure payment processing on the form. |
| donorbox_analytics | Analytics | 1 year | Measures form performance and donation funnel behavior, requiring prior consent. |
Donorbox uses cookies for user preferences — inform visitors with a consent banner.
Donorbox sets cookies to operate the donation form, maintain the session and help prevent fraud, and the embedded Stripe or PayPal elements set their own cookies for secure payment. The cookies that are strictly necessary to complete a donation can run without consent, while any analytics cookies require consent.
Strictly necessary cookies that complete the donation do not require consent, but non essential analytics or marketing cookies do. Marketing and newsletter opt ins must be separate, unticked by default and never a condition of donating, and donors should be told about the US transfer before they submit.
Processing the donation and payment relies on the necessity to perform the transaction the donor requested, together with legal obligations such as accounting and tax records. Any further use for marketing requires separate consent under Article 6(1)(a) GDPR, kept distinct from the donation itself.
Yes. Donorbox is US based and processes donor data in the United States, while Stripe and PayPal also operate internationally, so EEA donations involve transfers outside the EEA. You need Standard Contractual Clauses or another valid mechanism, plus a transfer impact assessment.
A DPIA is strongly advisable because Donorbox involves financial and personal donor data and a US transfer, which together raise the risk. Assess the data categories, the processors, retention, security and the transfer safeguards, and consult your supervisory authority if high residual risk remains.
Sign the Donorbox data processing addendum, document the US transfer and the role of Stripe and PayPal, and complete a DPIA. Provide a clear privacy notice on the form, keep marketing opt ins separate and unticked, gate non essential cookies behind consent, and set retention periods for donation records.
Alternatives include other donation and fundraising tools such as iRaiser, HelloAsso, GiveWP, Donation Pop and Stripe powered custom forms. When comparing them, weigh hosting location, whether an EU option exists, the cookies set, the data processing terms and how payment data is handled.
Add entries for the Donorbox form cookies and the Stripe or PayPal payment cookies, describing their purpose and duration and marking which are strictly necessary. Note that optional cookies load only after consent, explain the US transfer, and review the policy whenever the form or processors change.