Privacy policy

Who we are

CSA Volunteers (Care, Support, Action) is the data controller for information submitted through this website. You can reach our data compliance lead at hello@csavolunteers.com.

What data we collect

• Donors: Name, email address, payment verification (processed via Stripe or direct bank transfer), and transaction records.
• Applicants: Name, verified identity, contact information, financial emergency context, and IBAN for grant payout.
• Volunteers & Partners: Contact details, organization name, and communication history.

Why we process your data

• To evaluate emergency grant applications fairly and rapidly.
• To disburse funds directly to recipient bank accounts.
• To provide mandatory donation receipts and maintain accountable, audited books.
• To answer inquiries and coordinate volunteer and partner assistance.

Data retention periods

• Approved grant records: Kept for 7 years as required by standard European accounting and auditing regulations.
• Declined applications: Kept for 12 months for record consistency and appeal review, then securely destroyed.
• Medical/health details: Never stored permanently; deleted immediately once a situational case evaluation is concluded.

Third-party sharing

We never sell, monetize, or share your personal data with advertisers or data brokers. Data is shared exclusively with our audited bank/payment processors (such as Stripe) solely to complete payouts.

Your rights under GDPR

You have the complete legal right to request a copy of your personal data, request corrections, or request deletion of information where statutory accounting retention does not apply. Email hello@csavolunteers.com with "Data Request". We respond within 30 days.

Cookie policy

Our website uses strictly essential session cookies to allow basic site functionality and security. We do not use third-party behavioral ad trackers or invasively monitor your browsing activity across the web.

Security practices

All communications are secured via modern HTTPS TLS encryption. Application databases are access-restricted via two-factor authentication, with access strictly limited to authorized review leads.