Privacy policy

The short version

• Donor records belong to the mosque you donated to, not to us. For donor data, the mosque is the data controller and BarakahPay is its processor.
• We do not sell personal data, to anyone, ever.
• Card details never touch our servers — they go to Stripe.
• Gift Aid law requires some records to be kept for six years; we retain those on the mosque's behalf even if you ask the mosque to erase your other details.

1. Who does what

For mosque staff accounts and visitors to this website, BarakahPay is the data controller. For donor and Gift Aid records created when you donate to a mosque, that mosque is the controller and BarakahPay processes the data on its instructions under a data processing agreement. Requests about your donor record should go to the mosque; we help mosques answer them.

2. What we collect

• Donors: name, email address, home address (needed for Gift Aid declarations), donation history, and — where you opt in — a payment-method fingerprint from Stripe that lets a kiosk recognise you as a returning donor. We never see or store full card numbers.
• Mosque staff: name, email, role and sign-in records.
• Visitors: basic server logs. We aim to run this website without third-party advertising trackers.

3. Why we use it (legal bases)

Processing donations and issuing receipts (contract / legitimate interests); preparing Gift Aid and GASDS claims (legal obligation and legitimate interests of the charity); service emails such as receipts (legitimate interests); marketing emails only with consent, which you can withdraw in one click.

4. Where it lives and who sees it

Data is stored with our hosting providers (Supabase and Netlify) in UK/EU regions where available. It is shared with Stripe to process payments, with Resend to deliver email, and with HMRC when your mosque submits a claim. Each provider acts under its own compliance programme; we list sub-processors and will keep that list current.

5. How long we keep it

Gift Aid declarations and related records: six years after the last donation they cover, as HMRC requires. Other donor records: for as long as the mosque's account needs them. When a mosque closes its account, it can export everything first (see our terms — the data-portability guarantee), after which we delete or anonymise on a published schedule.

6. Your rights

You have the usual UK GDPR rights: access, correction, erasure, restriction, portability and objection. Note the Gift Aid exception: where the law requires a record to be retained, erasure applies to everything except that record until the retention period ends. To exercise a right, contact the mosque you donated to, or email us and we will route the request.

7. Contact

Privacy questions: pay@barakahpay.co.uk. You can also complain to the Information Commissioner's Office (ico.org.uk).