Privacy Policy

Last updated: 11 July 2026

Givio is a charity CRM platform operated by CharityOS. This policy explains what personal data we collect, why we collect it, and the rights you have over it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Two roles: controller and processor

Givio handles personal data in two distinct capacities, and it matters which one applies:

• Your platform account data — the details you give us when you register and use Givio (your name, work email, charity details, billing information). For this data, Givio is the data controller and this policy describes how we use it.
• Donor data inside your charity's CRM — the donors, volunteers, donations, and Gift Aid declarations your charity records in Givio. For this data, your charity is the data controller and Givio is a data processor acting only on your charity's instructions, under our Data Processing Agreement. If you are a donor with a question about how a charity uses your data, please contact that charity directly — they decide how the data is used, not us.

The rest of this policy covers the data for which Givio is the controller.

What we collect

When you register

• Your name and work email address
• Your charity's details — name, registration number, and organisation type
• A password (stored only as a secure hash — we never see or store the plain text)

When you use the platform

• Billing details when you subscribe — handled by Stripe; we never store your card number
• Usage information such as sign-in times and the features you use, to keep the service secure and improve it
• Support correspondence when you contact us

Why we process it (lawful bases)

• Performance of a contract — creating and running your account, providing the CRM, processing subscription payments, and providing support.
• Legitimate interests — keeping the platform secure, preventing fraud and abuse, understanding how the product is used so we can improve it, and sending service emails about your account.
• Legal obligation — keeping accounting and tax records we are required to hold.
• Consent — optional marketing emails, which you can opt out of at any time.

Emails we send

We send transactional and lifecycle emails through Resend, our email provider. These include things like email verification, password resets, billing receipts, trial expiry reminders, and the final warning before a paused account's data is deleted. These emails are part of running your account, so you receive them while you have one — they are not marketing.

Where your data lives

Your data is hosted in the United Kingdom and the European Union. Where a subprocessor involves a transfer outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum with appropriate safeguards.

How long we keep it

• While your account is active, we keep the data needed to run it.
• If your trial expires without a subscription, or you close your account, your data is retained for 90 days so you can change your mind, then permanently deleted after a final warning email.
• We keep billing and accounting records for as long as UK tax law requires, even after an account is deleted.

Who we share it with (subprocessors)

We use a small number of carefully chosen service providers to run Givio. We share only what each provider needs to do its job, and each is bound by a data processing agreement:

We do not sell personal data, and we never share it with advertisers.

Your rights

Under UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to certain processing, including direct marketing;
• receive your data in a portable, machine-readable format; and
• withdraw consent at any time, where consent is the basis for processing.

To exercise any of these rights, email support@giviocrm.com. We will respond within one month.

Complaints

If you are unhappy with how we have handled your data, please contact us first — we will do our best to put it right. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113.

Changes to this policy

If we make a material change to this policy, we will email the account owner and update the "last updated" date at the top of this page.

Contact

Data protection questions can be sent to support@giviocrm.com.