Privacy Policy

1. About This Policy and Who We Are

Community Fundraising Hub ('CFH', 'we', 'us', 'our') is a Charitable Trust Board incorporated under the Charitable Trusts Act 1957 (Incorporation No: 70000374, NZBN: 9429053669445). We operate the Community Fundraising Hub platform, which connects sports clubs with local businesses and individual donors for fundraising and sponsorship purposes.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and what rights you have. It applies to all users of our platform, including sports club contacts, business donors, individual donors, and website visitors.

By providing your information to us, registering with our platform, or using our website at cfh.org.nz, you confirm that you have read and understood this Privacy Policy. This Privacy Policy is governed by the laws of New Zealand.

2. The Privacy Act 2020 and Our Obligations

Our collection, use, disclosure, and storage of personal information is governed by the New Zealand Privacy Act 2020. The Act establishes 13 Information Privacy Principles (IPPs) that guide how we handle personal information. In summary, the Act requires us to:

• Only collect personal information that is necessary for a lawful purpose connected with our activities
• Tell individuals why we are collecting their information and how it will be used
• Take reasonable steps to ensure information is accurate and up to date
• Keep personal information secure against loss, unauthorised access, use, modification, or disclosure
• Allow individuals to access and correct their personal information on request
• Not disclose personal information to third parties except in limited circumstances
• Not use personal information for a purpose other than the purpose for which it was collected, unless an exception applies

3. What Personal Information We Collect

3.1 Club Contacts

When a sports club registers with CFH or contacts us for onboarding, we collect:

• Full name and role within the club
• Club name, sport, and suburb or region
• Email address and phone number
• Bank account details for campaign settlement payments — held securely and used only for settlement
• Information about the club's fundraising goals and campaign preferences
• Any correspondence between the club contact and CFH

3.2 Business Donors

When a business makes a donation through a CFH club campaign, we collect:

• Business name and the name of the person making the donation
• Email address (for tax receipt delivery)
• Donation amount, chosen sponsorship tier, and the club campaign supported
• Payment transaction reference only — CFH does not receive, store, or have access to card numbers. All card data is handled exclusively by Stripe
• Any optional message included with the donation
• Business logo or brand assets, if provided for sponsorship recognition

3.3 Individual Donors

• Full name
• Email address (for tax receipt delivery)
• Donation amount and the club campaign supported
• Payment transaction reference (via Stripe — we do not store card data)

3.4 Website Visitors

• IP address and general location (country/region level only)
• Browser type, device type, and operating system
• Pages visited, time spent, and navigation paths
• Referral source
• Email address and name, if you submit our expression of interest form

3.5 Information We Do Not Collect

• Full credit or debit card numbers — handled exclusively by Stripe
• Government-issued identification numbers such as IRD numbers from individual donors
• Information about children or minors (Phase 1 sports clubs only — club administrators are adults)
• Sensitive personal information such as health information, ethnicity, or criminal history

4. Overseas Transfer of Personal Information

Some of the third-party services CFH uses are based outside New Zealand. By providing your personal information to CFH, you acknowledge that it may be transferred to, stored in, or processed in countries other than New Zealand, including the United States, where the following providers operate:

• Google Workspace — email, file storage, and data management including Google Sheets
• Stripe — payment processing
• Netlify — website hosting and registration form processing
• Zapier — workflow automation connecting our registration forms to our club management systems

CFH selects reputable, internationally recognised service providers and relies on their published privacy policies and security certifications. CFH will not transfer your data to overseas parties beyond those named here without notifying you.

5. Why We Collect Your Information

We do not use your personal information for direct marketing without your consent. We do not sell your personal information to any third party, ever.

6. How We Use Your Information

• Providing and operating the CFH platform and services to sports clubs
• Processing donations and sponsorship contributions through our payment provider
• Issuing tax receipts to donors on behalf of CFH's charitable trust (once donee status is confirmed by IRD)
• Transferring campaign proceeds to clubs following weekly settlement
• Communicating with club contacts about their campaign setup, progress, and reporting
• Generating anonymised, aggregated data about community fundraising patterns
• Using contribution data in aggregate and anonymised form to generate platform-wide insights, improve matching between clubs and business sponsors, and develop community fundraising benchmarks. This data is never linked back to individual businesses or contacts in any external publication or product.
• Improving our platform, website, and services
• Complying with our legal and financial reporting obligations as a registered charitable trust
• Responding to your enquiries and providing support

7. Who We Share Your Information With

CFH does not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

7.1 Sports Clubs

When you donate to a specific club campaign, the club's designated contact receives your name, business name (if applicable), donation amount, chosen tier, and any optional message. Your email address is not shared with clubs for marketing purposes.

7.2 Payment Processor — Stripe

Donations are processed by Stripe (stripe.com/privacy). Stripe receives your payment card details. CFH receives only a transaction confirmation — we never receive or store card data.

7.3 IRD — Inland Revenue Department

CFH maintains donation records consistent with IRD requirements for registered donee organisations, and may be required to disclose these during compliance or audit processes.

7.4 Legal and Regulatory Disclosure

CFH may disclose personal information if required by New Zealand law, a court order, or a regulatory authority, including the Office of the Privacy Commissioner, Charities Services, or Inland Revenue.

7.5 Service Providers

• Google Workspace — email, file storage, and Google Sheets. US-based.
• Stripe — payment processing. US-based.
• Netlify — website hosting and registration form processing. US-based.
• Zapier — workflow automation connecting registration forms to club management systems. US-based.

8. How We Store and Protect Your Information

• Email and document systems are secured using Google Workspace with two-factor authentication
• Financial and donation records are maintained with access limited to authorised trustees and staff
• Payment card data is never stored by CFH — all card processing is handled by Stripe's PCI-DSS compliant infrastructure
• Club bank account details are stored securely, used only for settlement, and changed only upon written request
• Digital data is held in password-protected accounts with restricted access

In the event of a privacy breach that poses a risk of serious harm, CFH will notify affected individuals and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

9. How Long We Keep Your Information

10. Cookies and Website Analytics

Our website uses cookies to ensure it functions correctly and to remember your preferences between visits. We may also use analytics tools (such as Google Analytics) to understand how the website is being used and to improve it. Where analytics are in use, data is collected in an aggregated, anonymised way that does not identify you personally. We will update this policy to reflect when analytics tools are activated.

You can control cookie settings through your browser. Disabling cookies may affect some features of our website.

11. Your Rights Under the Privacy Act 2020

11.1 Right to Access

You may request access to any personal information CFH holds about you. We will respond within 20 working days.

11.2 Right to Correction

If you believe information we hold about you is incorrect, you may ask us to correct it. If we disagree, we will note your request alongside the information.

11.3 Right to Deletion

You may request deletion of your personal information where we no longer have a lawful basis for holding it. We cannot delete information subject to legal retention obligations (e.g. donation records required by IRD for 7 years).

11.4 Right to Object

You may ask us not to use your personal information for purposes beyond those directly necessary to the reason you provided it. You may withdraw consent for email communications at any time by contacting hello@cfh.org.nz.

11.5 Right to Complain

If you believe CFH has not handled your personal information correctly, contact our Privacy Officer first (see Section 13). If not resolved within 20 working days, you may complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal obligations. The current version will always be available at cfh.org.nz/privacy. Where changes are material, we will take reasonable steps to notify affected individuals.

13. Contact — Privacy Officer