> How Donorbox processes donor data and payments, what the GDPR and ePrivacy require for embedded donation forms and how to fundraise on EU sites. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/donorbox E-commerce # Donorbox Preferences · [Official website](https://donorbox.org) Donorbox is a US based donation form and fundraising platform embedded on websites that processes donor personal data and handles payments through Stripe and PayPal. [Block Donorbox until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 5 - Third-party domains 4 - Servers United States Overview ## What does Donorbox do? ## What Donorbox is Donorbox is a fundraising platform that embeds a donation form into a website so that nonprofits and causes can collect one time and recurring gifts. The form captures donor details and routes payments to processors such as Stripe and PayPal, while Donorbox stores the donation records and donor information. Donorbox is a US based provider, so donor data is processed on servers in the United States. Because the form handles personal and financial data and sets cookies, it carries a higher risk profile and engages both the GDPR and the ePrivacy Directive for EU and EEA donors. ## What data and cookies it collects The donation form collects identity and contact details such as name, email and address, the donation amount and frequency, and any message or campaign reference. Card details are entered into and processed directly by Stripe or PayPal, so cardholder data does not reside within Donorbox itself. Donorbox and the payment processors set cookies to support the form, prevent fraud and maintain the session. Donor records are personal data and, given the financial context, should be handled with strong security and clear retention limits. ## GDPR and ePrivacy implications For purposes of the GDPR your organization is typically the controller of donor data and Donorbox acts as a processor under its data processing addendum, while the payment processors act as separate controllers for the payment. Donation and payment processing rely on contract necessity and legal obligations, whereas marketing opt ins require consent. Non essential cookies set by the embedded form require prior consent under the ePrivacy Directive, while strictly necessary cookies that secure the transaction do not. ## Consent requirements Strictly necessary cookies that complete a donation may load without consent, but any analytics or marketing cookies must be blocked until the donor agrees. Keep newsletter and mailing list opt ins separate, unticked by default, and never bundled with the act of donating. Provide a clear privacy notice on the form explaining who receives the data, including the US transfer and the role of Stripe or PayPal. ## International data transfers Donorbox processes donor data in the United States, and Stripe and PayPal also operate internationally, so donations from the EEA involve transfers outside the EEA. These require a valid mechanism such as Standard Contractual Clauses, supported by a transfer impact assessment and supplementary measures where appropriate. Record these transfers in your records of processing and confirm the safeguards in the Donorbox data processing addendum and the payment processor terms. ## Practical compliance steps Sign the Donorbox data processing addendum, document the US transfer and the role of Stripe and PayPal, and complete a data protection impact assessment because of the financial and personal data involved. Gate non essential cookies behind consent and list them in your cookie policy. Keep marketing opt ins separate and unticked, set retention periods for donation records, secure access to the donor data, and ensure you can fulfill access, rectification and erasure requests while respecting accounting obligations. Compliance ## Donorbox and the GDPR Donorbox is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent under Article 6(1)(a) GDPR for non essential cookies, with the donation and payment processing carried out to perform the donor requested transaction and to meet legal obligations - Risk level high - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) Donorbox processes donor personal data and financial transactions, so a data protection impact assessment is strongly recommended given the higher risk. Assess the categories of donor data collected, the role of payment processors Stripe and PayPal, retention of donation records, the transfer of data to the United States, and the controller and processor responsibilities between your organization and Donorbox. ### Sample text for your banner > We use Donorbox to process donations on this site. Donorbox sets cookies and sends the information you enter, including payment details handled by Stripe or PayPal, to servers in the United States. Optional cookies load only with your consent, which you can change at any time. Cookies and trackers ## What Donorbox sets and contacts - Tracking method Embedded donation form processing donor personal data and payments, setting cookies and connecting to payment processors - Server location United States - Data transferred outside the EU Donorbox is a US based provider and donor data is processed on servers in the United States, while payments are handled by Stripe and PayPal. Transfers from the EEA require safeguards such as Standard Contractual Clauses. ### Cookies set (5) | Name | Type | Duration | Purpose | | ------------------- | ------------------ | -------- | ------------------------------------------------------------------------------------ | | donorbox\_session | Strictly necessary | Session | Maintains the donation form session so a donor can complete a gift securely. | | donorbox\_csrf | Strictly necessary | Session | Protects the donation form against cross site request forgery during submission. | | donorbox\_prefs | Functional | 6 months | Remembers form preferences such as currency or recurring selection for the donor. | | \_\_stripe\_mid | Strictly necessary | 1 year | Set by Stripe to support fraud prevention and secure payment processing on the form. | | donorbox\_analytics | Analytics | 1 year | Measures form performance and donation funnel behavior, requiring prior consent. | ### Third-party domains contacted (4) - `donorbox.org` - `api.donorbox.org` - `js.stripe.com` - `www.paypal.com` Questions ## Frequently asked questions about Donorbox Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Donorbox set? Donorbox sets cookies to operate the donation form, maintain the session and help prevent fraud, and the embedded Stripe or PayPal elements set their own cookies for secure payment. The cookies that are strictly necessary to complete a donation can run without consent, while any analytics cookies require consent. ### Is consent required for Donorbox? Strictly necessary cookies that complete the donation do not require consent, but non essential analytics or marketing cookies do. Marketing and newsletter opt ins must be separate, unticked by default and never a condition of donating, and donors should be told about the US transfer before they submit. ### What is the legal basis for processing with Donorbox? Processing the donation and payment relies on the necessity to perform the transaction the donor requested, together with legal obligations such as accounting and tax records. Any further use for marketing requires separate consent under Article 6(1)(a) GDPR, kept distinct from the donation itself. ### Does Donorbox transfer data outside the EU, to the US in particular? Yes. Donorbox is US based and processes donor data in the United States, while Stripe and PayPal also operate internationally, so EEA donations involve transfers outside the EEA. You need Standard Contractual Clauses or another valid mechanism, plus a transfer impact assessment. ### Is a DPIA needed for Donorbox? A DPIA is strongly advisable because Donorbox involves financial and personal donor data and a US transfer, which together raise the risk. Assess the data categories, the processors, retention, security and the transfer safeguards, and consult your supervisory authority if high residual risk remains. ### How do I implement Donorbox compliantly? Sign the Donorbox data processing addendum, document the US transfer and the role of Stripe and PayPal, and complete a DPIA. Provide a clear privacy notice on the form, keep marketing opt ins separate and unticked, gate non essential cookies behind consent, and set retention periods for donation records. ### What are the alternatives to Donorbox? Alternatives include other donation and fundraising tools such as iRaiser, HelloAsso, GiveWP, Donation Pop and Stripe powered custom forms. When comparing them, weigh hosting location, whether an EU option exists, the cookies set, the data processing terms and how payment data is handled. ### How do I update the cookie policy for Donorbox? Add entries for the Donorbox form cookies and the Stripe or PayPal payment cookies, describing their purpose and duration and marking which are strictly necessary. Note that optional cookies load only after consent, explain the US transfer, and review the policy whenever the form or processors change. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [Conjured](https://www.flowconsent.com/en/services/ecommerce/conjured) [Conjured is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Conjured integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Conjured helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/conjured) [Preferences](https://www.flowconsent.com/en/services/ecommerce/conjured) · ### [Rapid Search](https://www.flowconsent.com/en/services/ecommerce/rapid-search) [Rapid Search is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Rapid Search integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Rapid Search helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/rapid-search) [Preferences](https://www.flowconsent.com/en/services/ecommerce/rapid-search) · ### [Oddle](https://www.flowconsent.com/en/services/ecommerce/oddle) [Oddle is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Oddle enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Oddle empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/ecommerce/oddle) [Preferences](https://www.flowconsent.com/en/services/ecommerce/oddle) · ### [Leaky Paywall](https://www.flowconsent.com/en/services/ecommerce/leaky-paywall) [Leaky Paywall is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Leaky Paywall offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Leaky Paywall empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/ecommerce/leaky-paywall) [Preferences](https://www.flowconsent.com/en/services/ecommerce/leaky-paywall) · ### [ThriveCart](https://www.flowconsent.com/en/services/ecommerce/thrivecart) [ThriveCart is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. ThriveCart supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, ThriveCart ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/thrivecart) [Preferences](https://www.flowconsent.com/en/services/ecommerce/thrivecart) · ### [AkoCommerce](https://www.flowconsent.com/en/services/ecommerce/akocommerce) [AkoCommerce is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. AkoCommerce integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, AkoCommerce helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/akocommerce) [Preferences](https://www.flowconsent.com/en/services/ecommerce/akocommerce) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)