Donorbox

What Donorbox is

Donorbox is a fundraising platform that embeds a donation form into a website so that nonprofits and causes can collect one time and recurring gifts. The form captures donor details and routes payments to processors such as Stripe and PayPal, while Donorbox stores the donation records and donor information.

Donorbox is a US based provider, so donor data is processed on servers in the United States. Because the form handles personal and financial data and sets cookies, it carries a higher risk profile and engages both the GDPR and the ePrivacy Directive for EU and EEA donors.

What data and cookies it collects

The donation form collects identity and contact details such as name, email and address, the donation amount and frequency, and any message or campaign reference. Card details are entered into and processed directly by Stripe or PayPal, so cardholder data does not reside within Donorbox itself.

Donorbox and the payment processors set cookies to support the form, prevent fraud and maintain the session. Donor records are personal data and, given the financial context, should be handled with strong security and clear retention limits.

GDPR and ePrivacy implications

For purposes of the GDPR your organization is typically the controller of donor data and Donorbox acts as a processor under its data processing addendum, while the payment processors act as separate controllers for the payment. Donation and payment processing rely on contract necessity and legal obligations, whereas marketing opt ins require consent.

Non essential cookies set by the embedded form require prior consent under the ePrivacy Directive, while strictly necessary cookies that secure the transaction do not.

Consent requirements

Strictly necessary cookies that complete a donation may load without consent, but any analytics or marketing cookies must be blocked until the donor agrees. Keep newsletter and mailing list opt ins separate, unticked by default, and never bundled with the act of donating.

Provide a clear privacy notice on the form explaining who receives the data, including the US transfer and the role of Stripe or PayPal.

International data transfers

Donorbox processes donor data in the United States, and Stripe and PayPal also operate internationally, so donations from the EEA involve transfers outside the EEA. These require a valid mechanism such as Standard Contractual Clauses, supported by a transfer impact assessment and supplementary measures where appropriate.

Record these transfers in your records of processing and confirm the safeguards in the Donorbox data processing addendum and the payment processor terms.

Practical compliance steps

Sign the Donorbox data processing addendum, document the US transfer and the role of Stripe and PayPal, and complete a data protection impact assessment because of the financial and personal data involved. Gate non essential cookies behind consent and list them in your cookie policy.

Keep marketing opt ins separate and unticked, set retention periods for donation records, secure access to the donor data, and ensure you can fulfill access, rectification and erasure requests while respecting accounting obligations.