Privacy policy
Last updated: October 10, 2026
This policy explains what personal data Pay It Forward collects on payitforward.international, what we use it for, and how you can exercise your rights.
1. Who we are
Pay It Forward International (org.nr. 938096406, Husabøryggen 102, 4083 Hundvåg, Stavanger, Norway) is the data controller. Contact: hi@payitforward.international.
2. What data we collect
- Contact: name, email, and message when you write to us.
- Donations: name, email, amount, date, and country. Donations are collected through Spleis (SpareBank 1), which processes the payment data; we never see or store card or bank account details.
- Volunteers and missions: name, email, phone (optional), country, availability, areas of support, and motivation and, if you travel to a mission, the data needed to arrange travel and insurance.
- Technical data: IP address, browser, and access logs generated by our hosting providers. We measure visits in aggregate, without cookies and without identifying you.
3. What we use it for and legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Processing donations | Performance of a contract |
| Meeting accounting and tax obligations | Legal obligation |
| Answering enquiries | Legitimate interest |
| Managing volunteers and missions | Performance of a contract / consent |
| Publishing photos and evidence from missions | Consent / legitimate interest in transparency |
| Security, operation, and aggregate statistics of the website | Legitimate interest |
4. Photos and evidence from missions
We publish photos and videos from missions to show transparently how donations are used. We ask for the consent of the people who appear and do not show minors in an identifiable way without their guardians' authorization. If you appear in an image and want us to remove it, write to hi@payitforward.international.
5. Who we share data with
We do not sell personal data. We only share it with providers who work for us under contract:
- Web hosting and database providers
- Email delivery provider
- Spleis / SpareBank 1 (donation collection)
We may also disclose data to authorities when required by law.
6. Transfers outside the EEA
Some providers may process data outside the European Economic Area, for example in the United States. In those cases we rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.
Part of our coordination team works from Venezuela and Colombia and accesses only the volunteer data needed to organize missions.
7. How long we keep it
- Donations and accounting: 5 years, under the Norwegian Bookkeeping Act (bokføringsloven).
- Volunteer applications: 12 months from the last contact; after that they are deleted. You can ask for deletion sooner.
- Enquiries: up to 12 months after the conversation is closed.
8. Your rights
You can access your data, correct it, ask us to delete it, and withdraw your consent at any time. How to exercise each right is explained on the Data protection page.
10. Changes
We may update this policy. We will publish the new version here with its date and notify you by email if the change is significant.