Privacy Policy
Last updated: August 2026
This privacy policy explains how NordBridge Aid collects, uses, stores, and protects your personal data when you interact with our website, make donations, or contact us. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and Swedish data protection law.
1. Data Controller
The data controller responsible for the processing of your personal data is:
NordBridge Aid
Organisational number: 802553-2568
Gamla Infartsvagen 3c, Karlskrona, Sweden
Email: info@nordbridgeaid.org
Phone: +46 72 012 52 31
NordBridge Aid is a registered Swedish non-profit organisation (ideell förening) working with international development cooperation, health & wellbeing, and education.
2. What Data We Collect
We collect personal data only when necessary and through the following channels:
Contact Form (via Cloudflare Workers)
When you submit our contact form, we collect:
- Your name
- Your email address
- Your message content
This data is processed by a Cloudflare Worker running on Cloudflare's global edge network. Cloudflare has a strong EU presence and offers data localisation services. No third-party form services outside our infrastructure are involved.
Donations via Donorbox / Stripe
When you make a donation through our online donation form (powered by Donorbox), the following data is collected:
- Your name
- Your email address
- Your billing address
- Payment card details (handled entirely by Stripe — we never see or store your full card number)
- Donation amount
- Donation frequency (one-time or recurring)
Donations via Swish
When you donate via Swish, we receive:
- The phone number linked to your Swish account
- The donation amount
Donations via Bank Transfer (Plusgiro 217 27 18-5)
When you donate via bank transfer, we receive:
- The name on your bank account
- Your bank account details (as included in the transfer)
- The donation amount
Website Usage Data
When you visit our website, the following data may be collected automatically through Cloudflare's analytics and security systems:
- Your IP address
- Browser type and version
- Pages visited and time of visit
This data is collected by Cloudflare for security and performance purposes. We do not use personal tracking cookies or third-party analytics tools that build individual user profiles.
3. Legal Bases for Processing (Article 6 GDPR)
We process your personal data only where we have a lawful basis under the GDPR. The following table maps each processing activity to its legal basis:
| Processing Activity | Legal Basis |
|---|---|
| Processing donations and providing donation receipts | Contract performance — Article 6(1)(b). Processing is necessary to fulfil the donation transaction you have initiated. |
| Tax receipts and bookkeeping records | Legal obligation — Article 6(1)(c). We are required to maintain accounting records under the Swedish Bookkeeping Act (Bokföringslag 1999:1078). |
| Communication about our work and activities | Legitimate interest — Article 6(1)(f). We have a legitimate interest in informing donors and supporters about our humanitarian work. You can opt out at any time. |
| Responding to contact form submissions | Consent — Article 6(1)(a). By submitting the contact form, you consent to us processing your data to respond to your enquiry. |
| Website security and protection against attacks | Legitimate interest — Article 6(1)(f). We have a legitimate interest in maintaining the security and availability of our website. |
4. Data Retention Periods
We do not keep your personal data longer than necessary. The specific retention periods are:
| Data Category | Retention Period | Reason |
|---|---|---|
| Donation records (all channels) | 7 years | Required by the Swedish Bookkeeping Act (Bokföringslag 1999:1078) |
| Contact form submissions | 12 months | Deleted after 12 months unless an ongoing conversation requires longer retention |
| Website analytics data | 30 days | Automatically purged by Cloudflare |
| Marketing communications data | Until consent is withdrawn | Deleted promptly when you unsubscribe or withdraw consent |
5. Third-Party Processors & Sub-processors
We use the following third-party service providers to operate our website and process donations. Each provider acts as a data processor (or, where noted, as an independent controller) and is bound by appropriate agreements:
Stripe Payments Europe, Ltd. (Ireland / EU)
- Purpose: Payment processing for card donations (via Donorbox)
- Role: Acts as both a data processor on our behalf and as an independent data controller for its own fraud prevention and compliance obligations
- EU processing: Payments from EU-based donors are processed by Stripe Payments Europe, Ltd., registered in Ireland. Payment data for EU transactions is handled within the EU through Stripe's European infrastructure.
- Data processed: Payment card details, billing address, transaction information
- Privacy policy: stripe.com/privacy
Donorbox Inc. (USA — payments processed in EU via Stripe)
- Purpose: Online donation platform and form processing
- Role: Data processor — a Data Processing Agreement (DPA) is in place
- Data processed: Donor name, email, billing address, donation amount and frequency
- Note on data flows: While Donorbox is a US-based company, all payment card processing is handled by Stripe's EU infrastructure (Stripe Payments Europe, Ltd., Ireland). Donorbox does not directly process or store payment card data.
- Safeguards: EU-US Data Privacy Framework and EU Standard Contractual Clauses (SCCs)
- Privacy policy: donorbox.org/privacy
Cloudflare Inc. (EU and global infrastructure)
- Purpose: Website hosting, content delivery network (CDN), contact form processing (Cloudflare Workers), DDoS protection, and security
- Role: Data processor
- EU processing: Cloudflare operates data centres across the EU, including in major European cities. Our website is served from Cloudflare's edge network, which includes extensive EU infrastructure. Cloudflare offers EU data localisation capabilities through its Data Localisation Suite. Our contact form is handled by a Cloudflare Worker within this infrastructure.
- Data processed: IP addresses, browser information, pages visited, security logs, contact form submissions
- Privacy policy: cloudflare.com/privacypolicy
6. International Data Transfers
We prioritise keeping your data within the EU/EEA wherever possible:
- Payment processing is handled by Stripe Payments Europe, Ltd. (Ireland) — EU card payments are processed within the EU.
- Website hosting and contact form processing is handled by Cloudflare, which operates extensive EU infrastructure including data centres across Europe.
- Swish and bank transfer donations are processed entirely within Sweden by Getswish AB and Nordea Bank respectively — no international transfers occur.
Donorbox is a US-based company, and some donor account data (name, email, donation history) may be transferred to and processed in the USA. However, actual payment card processing for EU donors is handled within the EU by Stripe's Irish entity.
Where data is transferred outside the EU/EEA, the following safeguards are in place:
- EU-US Data Privacy Framework: Our US-based processors participate in or rely on the EU-US Data Privacy Framework, which has been recognised by the European Commission as providing an adequate level of data protection.
- EU Standard Contractual Clauses (SCCs): Where applicable, our processors have adopted the EU Standard Contractual Clauses approved by the European Commission, providing contractual guarantees for data protection.
- Processor-specific security measures: Each processor implements technical and organisational measures including encryption, access controls, and regular security audits to protect your data.
7. Cookies and Tracking
Our website does not set any first-party cookies. We do not use Google Analytics, Facebook Pixel, or any other personal tracking tools.
However, third-party services embedded in our site may set limited cookies:
- Donorbox donation form: The embedded donation form may set functional cookies that are strictly necessary for processing your payment. These are not used for tracking or advertising.
- Cloudflare (__cf_bm): Cloudflare may set a security cookie called
__cf_bmto identify and mitigate bot traffic. This cookie is essential for protecting our website against automated attacks and expires after 30 minutes of inactivity.
Because these cookies are either strictly necessary for security or for completing a transaction you have initiated, they do not require separate consent under GDPR and the ePrivacy Directive.
8. Data Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
- TLS/SSL encryption: All data transmitted between your browser and our website is encrypted using TLS (Transport Layer Security). Our website is served exclusively over HTTPS.
- PCI DSS Level 1 compliance: All payment card data is handled by Stripe, which is certified to PCI DSS Level 1 — the highest level of security certification in the payment card industry. We never see, store, or have access to your full card number.
- Access controls: Access to personal data within our organisation is restricted to authorised personnel who require it for legitimate purposes.
- No storage of payment card data: Payment card details are processed and stored entirely by Stripe. No card data is ever stored on our servers or systems.
- DDoS protection: Cloudflare provides enterprise-grade protection against distributed denial-of-service attacks.
- Static architecture: Our website is a static site with no server-side code, no database, and no user login system — significantly reducing the attack surface.
9. Your Rights Under GDPR
Under the EU General Data Protection Regulation, you have the following rights regarding your personal data:
- Right of access (Article 15): You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed.
- Right to rectification (Article 16): You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
- Right to erasure (Article 17): You have the right to request that we delete your personal data, subject to legal retention obligations (e.g., bookkeeping records that must be kept for 7 years).
- Right to restriction of processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of your data.
- Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
- Right to object (Article 21): You have the right to object to processing based on legitimate interest. We will cease processing unless we have compelling legitimate grounds that override your interests.
- Right to withdraw consent: Where we process your data based on consent (e.g., contact form submissions), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
How to Exercise Your Rights
To exercise any of the above rights, please contact us at:
Email: info@nordbridgeaid.org
Phone: +46 72 012 52 31
Post: NordBridge Aid, Gamla Infartsvagen 3c, Karlskrona, Sweden
We will respond to your request within 30 days. If we need to extend this period (e.g., due to the complexity of the request), we will inform you within the initial 30-day period. We may ask you to verify your identity before processing your request.
10. Right to Lodge a Complaint
If you believe that our processing of your personal data violates the GDPR or Swedish data protection law, you have the right to lodge a complaint with the Swedish supervisory authority:
Integritetsskyddsmyndigheten (IMY)
Swedish Authority for Privacy Protection
Box 8114, 104 20 Stockholm, Sweden
Email: imy@imy.se
Website: www.imy.se
We encourage you to contact us first at info@nordbridgeaid.org so that we can try to resolve any concerns directly.
11. Children's Data
Our website and services are not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe that we have inadvertently collected data from a child under 16, please contact us immediately at info@nordbridgeaid.org and we will promptly delete the data.
12. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices, services, or legal requirements. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
For significant changes that materially affect how we process your personal data, we will make reasonable efforts to notify affected individuals directly where possible.
Contact Us
If you have any questions about this privacy policy or how we handle your personal data, please contact us:
NordBridge Aid
Gamla Infartsvagen 3c, Karlskrona, Sweden
Email: info@nordbridgeaid.org
Phone: +46 72 012 52 31