Privacy Policy

Last updated: 13 October 2026 · Effective from: 13 October 2026

1. Introduction

Givora is a community impact platform that helps people discover verified local organisations, donate to them, and follow their work.

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to our website at https://givora.app and any related services we operate (together, the "Service").

We are committed to processing your personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Swedish data protection law.

Please note: Givora is currently in a pre-launch phase. At present, the personal data we process is the information you provide when joining our waiting list (Section 4.1), account and identity data used to create and secure your access (Section 4.2), and technical data generated when you visit our website (Section 4.6). Other platform features, such as donations, will apply once they become available.

2. Who we are (data controller)

Givora is operated by Alria Group AB, which is the data controller responsible for processing your personal data under this Privacy Policy.

Alria Group AB — Company registration number: 559533-9366. Registered address: Gamla Lillebyvägen 18, 423 54 Torslanda, Sweden. Email: privacy@givora.app. Website: https://givora.app

We have not appointed a Data Protection Officer. For all privacy matters, please contact us at the email address above.

Where a nonprofit organisation listed on Givora receives your personal data (for example, because you donated to them or applied to volunteer with them), that organisation acts as an independent controller for its own use of that data, and its own privacy policy applies. Our card payment provider, Stripe, also acts as an independent controller for its payment processing activities, as do Getswish AB and the banks involved in Swish payments.

3. Key definitions

• Personal data — any information relating to an identified or identifiable person.
• Processing — anything done with personal data, including collecting, storing, using, sharing and deleting it.
• Controller — the party that decides why and how personal data is processed.
• Processor — a party that processes personal data on a controller's instructions.

4. What personal data we collect

4.1 Waiting list data. When you join the Givora waiting list, we collect:

• your email address;
• your organisation name, if you apply on behalf of an organisation;
• the language you used the site in;
• the fact, date and time of your sign-up and consent to receive updates.

4.2 Account data. When you create access to the Service, and as full accounts become available, we collect the information you provide when registering and maintaining a profile, such as your name, email address, password (stored only in hashed form), profile photo, interests or cause preferences, and the town or area you want to see organisations for.

4.3 Donation data. Card donations on Givora are processed by Stripe and paid directly into the receiving organisation's own Stripe account. Swish donations are paid directly to the organisation's own Swish number. We do not receive, process or store your full card number, CVC or bank credentials.

We do receive and store transaction records, which may include: the donation amount and currency, the date and time, the recipient organisation, a Stripe transaction or customer reference, the last four digits and brand of the card, for Swish payments the Swish payment reference and the mobile number linked to Swish, the outcome of the payment, and any message, dedication or "keep me anonymous" preference you choose to attach to the donation. Stripe's own processing of your payment data is governed by Stripe's privacy policy: https://stripe.com/privacy. Swish payments are also governed by the privacy terms of Getswish AB and your bank.

4.4 Organisation data. If you apply to list a nonprofit on Givora, we collect information about the organisation (legal name, registration number, address, cause categories, description, logo and images, website and social links, and bank, Stripe and Swish payout details) and about the individuals representing it (name, role, email address, phone number, and identity or authority verification documents where needed to verify the organisation).

Some of this information, including the organisation's name, location and description, is published publicly on the Service. Verification documents, payout details and the contact details of individuals representing the organisation are never published.

4.5 Volunteering and engagement data. If you follow an organisation, register interest in a volunteering opportunity, or contact an organisation through the Service, we process your name, contact details, availability, any message or application content you submit, and a record of the organisations you follow.

4.6 Technical and usage data. When you use the Service we automatically collect: IP address, device type, browser type and version, operating system, language settings, referring page, the pages you view and actions you take, timestamps, and error and diagnostic logs.

4.7 Location data. The Service displays organisations on a map. To show relevant results we may use an approximate location derived from your IP address. We only use precise device location (GPS) if your browser or device asks you and you grant permission; you can withdraw that permission at any time in your browser or device settings.

4.8 Communications. We keep a record of messages you send us (for example, via our contact page or by email), including their content and any attachments, together with our replies. We also record whether marketing emails were delivered, opened and clicked.

4.9 Cookies and similar technologies. See our Cookie Policy for details.

We do not deliberately collect special categories of personal data (such as health, religious or political data). Please avoid including such information in free-text fields, donation messages or volunteering applications unless it is necessary. Where you do, we process it with your explicit consent, or where you have manifestly made it public.

5. Why we process your data and our legal bases

We rely on the following legal bases under Art. 6 GDPR, depending on purpose:

• Managing the waiting list and sending pre-launch updates — waiting list data — Consent (Art. 6(1)(a))
• Creating and administering your account — account data — Performance of a contract (Art. 6(1)(b))
• Processing donations and issuing receipts and confirmations — donation data — Performance of a contract (Art. 6(1)(b))
• Reviewing, verifying and approving organisation listings — organisation data — Performance of a contract; legitimate interests in ensuring listed causes are genuine (Art. 6(1)(b), (f))
• Connecting you with organisations you follow or volunteer for — volunteering data — Performance of a contract; consent where you opt in to updates (Art. 6(1)(a), (b))
• Operating, securing and improving the Service; preventing fraud and abuse — technical, account and donation data — Legitimate interests (Art. 6(1)(f))
• Showing organisations near you on the map — location data — Legitimate interests; consent for precise device location (Art. 6(1)(a), (f))
• Responding to your enquiries and providing support — communications — Legitimate interests; performance of a contract where relevant (Art. 6(1)(b), (f))
• Sending marketing and platform updates — name, email, engagement data — Consent; legitimate interests for updates to existing users (Art. 6(1)(a), (f))
• Analytics and product measurement — technical and usage data — Consent where cookies are used; otherwise legitimate interests (Art. 6(1)(f))
• Meeting accounting, tax and other legal obligations — donation and organisation data — Legal obligation (Art. 6(1)(c))
• Establishing, exercising or defending legal claims — relevant data — Legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have assessed those interests against your rights and freedoms and concluded that our processing does not override them. You can ask us for more detail on that assessment, and you have the right to object (Section 9).

Where we rely on consent, you can withdraw it at any time, by using the unsubscribe link in any email, adjusting your settings, or contacting us. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

6. Who we share your data with

We do not sell your personal data. We share it only in the following circumstances:

With organisations you support. If you donate to or apply to volunteer with a listed organisation, that organisation receives the information necessary to acknowledge your donation, issue receipts, comply with its own legal obligations, and respond to your application — typically your name, email address, and the donation amount and date. If you choose to donate anonymously, we do not disclose your name to the organisation, although the organisation may still receive limited transaction data directly from Stripe or, for Swish payments, from Swish. Each organisation is an independent controller of the data it receives.

With service providers acting as our processors, under written data processing agreements, including:

• Payment processing: Stripe Payments Europe, Ltd. (also acting as an independent controller for payments) (not yet active)
• Mobile payments: Swish, provided by Getswish AB together with the banks (independent controllers for payments) (not yet active)
• Website hosting, content delivery and security: Cloudflare, Inc.
• Database and storage: Microsoft (Azure), EU data regions (not yet active)
• Authentication and identity: Clerk, Inc. (not yet active)
• Waiting list and email delivery: Brevo (Sendinblue SAS)
• Maps: Mapbox (not yet active)
• Analytics: Google (Google Analytics) (not yet active)
• Error monitoring: Sentry (not yet active)
• Email and customer support: Google (Google Workspace / Gmail)
• Crisis alert data on the map page: GDACS (Global Disaster Alert and Coordination System), which your browser contacts directly when you open the map
• Delivery of open-source code libraries used by the website: unpkg (served via Cloudflare), which your browser contacts directly

With professional advisers — accountants, auditors and lawyers — where necessary and subject to confidentiality.

With authorities where we are legally required to disclose data, or where disclosure is necessary to establish, exercise or defend legal claims.

In a business transfer. If Alria Group AB is involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred as part of that transaction. We will notify you if this happens and if it materially changes how your data is handled.

7. International transfers

We aim to keep personal data within the EU/EEA. Some of our providers may process data outside the EEA (for example in the United States).

Where that happens, we ensure an appropriate transfer mechanism is in place under Chapter V GDPR — normally an adequacy decision by the European Commission (including the EU–US Data Privacy Framework where the recipient is certified) or the European Commission's Standard Contractual Clauses, combined with additional technical and organisational safeguards where our assessment shows they are needed.

You may request a copy of the relevant safeguards by contacting us.

8. How long we keep your data

• Waiting list data — until launch and for 6 months afterwards, or until you unsubscribe or ask us to delete it, whichever comes first
• Account data — for as long as your account is active, then deleted or anonymised within 90 days of closure
• Donation and transaction records — 7 years from the end of the relevant financial year, as required by the Swedish Accounting Act (bokföringslagen)
• Organisation listings and verification records — for the duration of the listing plus 3 years, and longer where accounting rules require
• Volunteering applications and messages — 24 months from the last interaction
• Marketing consent records — for as long as the consent is active, plus 3 years as evidence of consent
• Server and security logs — 12 months
• Support correspondence — 24 months from the case being closed

Where a longer period is required to comply with a legal obligation or to defend a legal claim, we retain the data for that period only and then delete or anonymise it.

9. Your rights

Under the GDPR you have the right to:

• Access — obtain confirmation of whether we process your data and receive a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted where one of the grounds in Art. 17 applies. This right is limited where we must retain data by law, such as donation records kept for accounting purposes.
• Restriction — have processing limited in certain circumstances.
• Data portability — receive data you provided to us, based on consent or a contract, in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Object — object at any time to processing based on legitimate interests, on grounds relating to your particular situation. You may object to direct marketing at any time, and we will stop without exception.
• Withdraw consent — at any time, without affecting processing carried out beforehand.
• Not be subject to automated decision-making producing legal or similarly significant effects. We do not carry out such decision-making.

To exercise any of these rights, contact us at privacy@givora.app. We respond within one month, which may be extended by two further months for complex or numerous requests — we will tell you if that applies. We may need to verify your identity before acting on a request. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

Complaints. If you believe we have handled your data unlawfully, you may lodge a complaint with the Swedish Authority for Privacy Protection: Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden. Email: imy@imy.se. Phone: +46 (0)8-657 61 00. Web: https://www.imy.se

You may also complain to the supervisory authority in your EU country of residence or workplace. We would appreciate the chance to address your concern first.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS) and at rest, hashed password storage, role-based access controls and the principle of least privilege, logging and monitoring, regular backups, vetting of subprocessors, and internal procedures for handling data breaches.

No system is completely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, and we will notify IMY within 72 hours where required under Art. 33 GDPR.

11. Cookies and similar technologies

We use cookies and similar technologies as follows: strictly necessary cookies required to run the Service, keep you signed in, secure forms and balance load (these do not require consent); preference cookies that remember optional settings such as your map view or that you joined the waiting list; and analytics cookies that help us understand how the Service is used.

Under the Swedish Electronic Communications Act and the ePrivacy Directive, we obtain your consent before setting any non-essential cookie. You can change or withdraw your choices at any time via the cookie settings link in the site footer, and you can block or delete cookies through your browser settings, though doing so may affect how the Service works.

For a full list of the cookies we set — including each cookie's name, provider, purpose and duration — please see our Cookie Policy.

12. Children

The Service is not directed at children. You must be at least 18 years old to join the waiting list, create an account or make a donation. We do not knowingly collect personal data from children below that age. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Third-party links

The Service links to websites operated by listed organisations and other third parties. We are not responsible for their content or privacy practices, and we encourage you to read their privacy policies before providing personal data to them.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last revised. If we make material changes, we will notify you by email or through a prominent notice on the Service before the changes take effect. Where a change requires your consent, we will ask for it.

15. Contact us

Questions, requests or complaints about this policy or your personal data: Alria Group AB, Gamla Lillebyvägen 18, 423 54 Torslanda, Sweden. Email: privacy@givora.app. Contact form: https://givora.app/contact