Last updated: 1 January 2025
This Privacy Policy explains what personal information IVA CROWD ("we", "us") collects when you use ivacrowd.com and our services, why we collect it, who we share it with, and the choices and rights you have. It applies to organisers, backers, and visitors to the site.
1. Information we collect
1.1 Information you give us
- Account details: name, email address, password, and optionally a profile photo, phone number and country.
- Verification information: where you fundraise or withdraw funds, a government-issued identity document, date of birth, address, and for organisations, registration documents and details of authorised representatives.
- Campaign content: the text, images, video and budget details you publish, plus updates and replies to comments.
- Contribution details: the amount, currency, campaign, any message you attach, and whether you chose to contribute anonymously.
- Payout details: bank account or payout method identifiers needed to send you funds.
- Communications: messages you send through our contact form, support requests, and reports about campaigns.
1.2 Information we collect automatically
- Device and browser type, operating system, and screen characteristics.
- IP address and approximate location derived from it.
- Pages viewed, referring pages, and actions taken on the site.
- Cookies and similar technologies as described in section 7.
1.3 Information from third parties
Our payment providers confirm to us whether a payment succeeded, the last four digits and brand of the card used, and any dispute status. Identity verification providers return a pass or fail result and the data needed to record the check. We do not receive full card numbers.
2. How we use your information
- To create and operate your account and display your campaigns.
- To process contributions, issue receipts and send payouts.
- To verify identity, prevent fraud and money laundering, and enforce our Terms of Service.
- To provide support and respond to your messages.
- To send service messages: receipts, payout notices, security alerts and campaign updates you have opted into.
- To send marketing communications where you have consented, which you can withdraw at any time.
- To measure and improve the service, using aggregated and where possible anonymised analytics.
- To meet legal, tax, accounting and regulatory obligations.
3. Legal bases for processing
Where data protection law requires a legal basis, we rely on: contract, to provide the service you signed up for; legal obligation, for identity, tax and anti-money-laundering requirements; legitimate interests, for security, fraud prevention, and improving the service, balanced against your rights; and consent, for marketing communications and non-essential cookies, which you may withdraw at any time.
4. What is public
Campaign pages, including their title, story, images, goal, amount raised and updates, are public. Comments you post are public and shown with your display name. Contributions show your display name, amount and message unless you contribute anonymously, in which case your name is hidden from public view but remains visible to us and to the campaign organiser for accounting and receipt purposes. Verification documents are never public.
5. How we share information
- Campaign organisers receive the name, email address, amount and message of people who contribute to their campaign, so they can issue thanks, deliver on commitments and keep records. Organisers must use this only for campaign purposes.
- Service providers who process payments, verify identity, host our infrastructure, send email and provide analytics, under contracts restricting their use of the data.
- Legal and regulatory disclosure where we are required by law, court order or a valid request from a competent authority, or where necessary to investigate fraud or protect the rights and safety of users.
- Business transfers in the event of a merger, acquisition or sale of assets, subject to the acquirer honouring this policy.
We do not sell your personal information, and we do not share it with third parties for their own independent marketing.
6. International transfers
We and our providers may process data in countries other than your own. Where personal information is transferred out of a jurisdiction with data-transfer restrictions, we rely on recognised safeguards, including standard contractual clauses and adequacy decisions.
7. Cookies
We use cookies that are strictly necessary to keep you signed in, secure your session and prevent fraud; preference cookies to remember settings such as language and currency; and, with your consent, analytics cookies to understand how the site is used. Strictly necessary cookies cannot be turned off without breaking the service. You can manage the rest through the cookie banner or your browser settings.
8. How long we keep information
- Account and profile data: while your account is active, and up to 24 months after closure.
- Contribution, payout and fee records: retained for the period required by tax and accounting law in the relevant jurisdiction, typically 6 to 10 years.
- Verification records: retained for the period required by anti-money-laundering rules, typically 5 years after the relationship ends.
- Support messages: 24 months.
- Server logs: 90 days.
Published campaign pages may remain visible after a campaign closes so that backers retain a record of what they supported.
9. Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, restrict or object to certain processing, receive a portable copy, and withdraw consent. You also have the right to complain to your local data protection authority.
To exercise any of these, contact us using the details in section 12. We will respond within the period required by applicable law, normally within 30 days. We may ask you to verify your identity first. Some data cannot be deleted on request where we are legally required to keep it, such as completed financial records.
10. Security
We encrypt data in transit, restrict internal access to personal information on a need-to-know basis, log administrative access, and require our payment providers to maintain PCI DSS compliance. No system is perfectly secure; if a breach affects your personal information and the law requires notification, we will inform you and the relevant authority without undue delay.
11. Children
The service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.
12. Contact us
Questions about this policy or about your personal information can be sent to [email protected], or through our contact form. Postal address and, where applicable, the details of our data protection officer and EU or UK representative are available on request.
13. Changes to this policy
We may update this policy as the service changes. We will post the revised version here with a new "last updated" date, and where changes are significant we will notify account holders by email before they take effect.