Kayana Aid homeKayana Aid

Legal

KAYANA AID PRIVACY POLICY

You are contracting with Kayana World Limited (12782000)

Effective Date: 19 October 2026 · Version 3

KAYANA AID

GLOBAL PRIVACY POLICY


Effective Date: 19.10.2026

This Privacy Policy explains how Kayana World Limited and the other Kayana entities listed in Schedule 1 (Kayana Group Entities) to the Kayana Aid Terms and Conditions (collectively, "Kayana", "we", "us" or "our") collect, use, store, share, transfer and protect personal data in connection with the Kayana Aid platform (the "Platform"). This Policy forms part of, and should be read together with, the Kayana Aid Terms and Conditions.

The Kayana entity acting as data controller for a given User is the entity identified in Schedule 1 of the Terms and Conditions for that User's country of residence or registration; where no entity is listed for a User's country, Kayana World Limited acts as data controller.

1. WHO THIS POLICY APPLIES TO

This Policy applies to Donors, Merchants, beneficiaries, Vulnerable Individuals referenced in campaign content, website and app visitors, and any other individual whose personal data Kayana processes in connection with the Platform (together, "you").

2. PERSONAL DATA WE COLLECT

We collect the following categories of personal data, depending on how you use the Platform:

  • Identity data: name, date of birth, government ID or passport details, photographs submitted for verification, and similar identifiers, collected for KYC/KYB checks under Section 5 of the Terms and Conditions.

  • Contact data: email address, phone number, postal address.

  • Account data: username, password (stored in hashed form), account preferences, campaign and donation history.

  • Financial data: donation amounts, billing details, and limited payment metadata passed to us by our PSPs (full card and bank account details are held by PSPs, not by Kayana, except where a PSP shares masked or tokenised references with us for reconciliation and fraud-prevention purposes).

  • Verification data: sanctions-screening and AML-review results, fraud-risk scores, and supporting documents submitted during verification.

  • Campaign content: text, images, video and other content submitted by Merchants about a Cause, which may include personal data about beneficiaries or Vulnerable Individuals.

  • Communications data: correspondence with our support team, and records of consents and preferences you give us.

  • Technical and usage data: IP address, device identifiers, browser type, operating system, pages visited, and similar data collected through cookies and similar technologies (see Section 9).

  • Special category and sensitive data: where a Cause relates to health, disability, ethnicity, religion or a similar sensitive matter, campaign content may include special category data about beneficiaries. Merchants are responsible for obtaining a valid legal basis (such as explicit consent) for including such data in campaign content, and for ensuring beneficiaries' and Vulnerable Individuals' dignity and safety are protected, consistent with Section 21A (Safeguarding) of the Terms and Conditions.

3. HOW WE USE YOUR DATA

We use personal data to:

  • operate and maintain the Platform;

  • process donations and campaigns;

  • carry out KYC, KYB, sanctions screening, AML reviews, fraud assessments and document verification;

  • prevent and investigate fraud, money laundering and other financial crime;

  • communicate with you about your account, donations or campaigns;

  • provide customer support;

  • comply with legal and regulatory obligations, including charitable-fundraising, AML, sanctions and tax laws;

  • enforce the Terms and Conditions; and

  • where you have agreed, send you marketing communications.

4. LEGAL BASES FOR PROCESSING

Where the UK GDPR, EU GDPR or a similar law applies, we rely on one or more of the following legal bases:

  • performance of a contract with you, for example processing a donation;

  • compliance with a legal obligation, for example AML and sanctions screening;

  • our legitimate interests, for example fraud prevention, platform security, and improving the Platform, balanced against your rights;

  • your consent, for example for marketing communications, or special category data included in campaign content; and

  • exceptionally, protection of the vital interests of a beneficiary or Vulnerable Individual.

In jurisdictions with a different legal framework for processing, we rely on the closest equivalent basis available under that framework.

5. HOW WE SHARE YOUR DATA

We may share personal data with:

  • PSPs, to process donations and payments;

  • Partners, who provide verification, fraud-screening, hosting, analytics, communications or similar services on our behalf, under contracts that restrict their use of your data to those services;

  • Merchants, where a Donor chooses to make a donation visible or provides information directly to a Cause;

  • other Kayana Group entities listed in Schedule 1, for the purposes described in this Policy;

  • regulators, law enforcement, courts and government authorities, where required by law or to protect the rights, safety or property of Kayana, Users or the public; and

  • a buyer or successor, in the event of a merger, acquisition, reorganisation or sale of assets.

We do not sell personal data to third parties for their own marketing purposes.

Our current PSPs include providers such as Stripe and Ryft, and our Partners include providers of identity verification, fraud-screening, hosting, analytics and communications services. A current list of our key sub-processors is available on request at info@kayanaforbusiness.com.

5A. THIRD-PARTY LINKS

Causes may include links to their own websites, social media pages, or other third-party services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing them with personal data.

6. INTERNATIONAL DATA TRANSFERS

Because the Platform operates across the entities listed in Schedule 1 of the Terms and Conditions, personal data may be transferred to, and processed in, countries other than the one in which you are located, including the United Kingdom, Ireland, the European Economic Area, Australia, Canada, the United States and the United Arab Emirates. Where we transfer personal data out of the UK, EEA or another jurisdiction with restrictions on international transfers, we use appropriate safeguards, such as the UK International Data Transfer Agreement, the European Commission's Standard Contractual Clauses, an applicable adequacy decision, or another lawful transfer mechanism recognised in the exporting jurisdiction.

7. DATA RETENTION

We retain personal data for as long as needed for the purposes described in this Policy, including to comply with legal, accounting, AML and tax obligations, to resolve disputes, and to enforce our agreements. Verification and transaction records are generally retained for the periods required by applicable AML and financial-services record-keeping laws in the relevant jurisdiction, which are typically five to seven years from the end of the relationship, and may be longer where required by law or an ongoing legal or regulatory matter.

8. DATA SECURITY

We maintain technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration. No system is completely secure, and we cannot guarantee absolute security of data transmitted to or stored on the Platform.

9. COOKIES AND SIMILAR TECHNOLOGIES

We and our Partners use cookies and similar technologies to operate the Platform, remember your preferences, measure usage, and (where you consent) deliver relevant marketing. Where required by law, we will ask for your consent before setting non-essential cookies, and you can manage your preferences through your browser settings or any cookie-preference tool we make available on the Platform.

We use the following categories of cookies and similar technologies:

  • Essential cookies: required for the Platform to function, such as maintaining your session and processing donations. These cannot be switched off.

  • Analytics cookies: help us understand how the Platform is used, so we can monitor performance and improve it.

  • Marketing cookies: used, where you have consented, to measure and deliver relevant marketing.

9A. DO NOT TRACK

Some browsers offer a "Do Not Track" signal. Because there is no common industry standard for responding to such signals, the Platform does not currently respond to Do Not Track signals. You can still manage cookies through your browser settings or any cookie-preference tool we make available on the Platform, as described in Section 9.

10. CHILDREN AND VULNERABLE INDIVIDUALS

The Platform is not directed at children, and Donors and Merchant account holders must be at least 18 years old, save for the limited exception in Section 3 of the Terms and Conditions where a minor's campaign is registered and supervised by a responsible adult. Where campaign content depicts or references a beneficiary or Vulnerable Individual (including a minor), the Merchant is responsible for obtaining appropriate consents and for ensuring that content is handled in a way that protects that individual's dignity, safety and wellbeing, as set out in Section 21A (Safeguarding) of the Terms and Conditions. If you believe content on the Platform raises a safeguarding concern, please contact us at info@kayanaforbusiness.com.

10A. CHILDREN UNDER 13

The Platform is not directed at, and we do not knowingly collect personal data from, children under the age of 13 (or the equivalent minimum age under applicable local law), except where a minor's campaign is registered and supervised by a responsible adult as described in Section 10. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete that data, save where retention is required by law. If you believe a child has provided us with personal data, please contact us at info@kayanaforbusiness.com.

11. MARKETING COMMUNICATIONS

Where you have agreed to receive marketing communications, you may opt out at any time by using the unsubscribe link in any marketing message or by contacting us at info@kayanaforbusiness.com. You will continue to receive non-marketing communications necessary for your account, donations or campaigns.

12. AUTOMATED DECISION-MAKING

We may use automated tools to support fraud and AML risk-scoring and sanctions screening. Any resulting suspension, rejection or escalation of a donation, campaign or account is reviewed by a member of our team before being treated as final, and you may contact us to request a review using the details in Section 16.

13. YOUR RIGHTS

Depending on where you are located, you may have some or all of the following rights:

  • to access the personal data we hold about you;

  • to request correction of inaccurate data;

  • to request erasure of your data;

  • to restrict or object to our processing of your data;

  • to request a portable copy of your data;

  • to withdraw consent at any time, where processing is based on consent; and

  • to lodge a complaint with a supervisory authority.

  • United Kingdom and Ireland/EEA: you can exercise these rights under the UK GDPR, the EU GDPR and applicable national implementing law, and complain to the Information Commissioner's Office (ICO) at www.ico.org.uk or the Data Protection Commission (Ireland) at www.dataprotection.ie.

  • Australia: you have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

  • Canada: you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, and may complain to the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca.

  • United States: depending on your state of residence, you may have rights under applicable state privacy laws, including (in California) the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), such as the right to know, delete, correct and opt out of the sale or sharing of personal information. We do not sell or share personal information as defined under the CCPA/CPRA. You may also contact the Federal Trade Commission (FTC) at www.ftc.gov or your state Attorney General with concerns.

  • United Arab Emirates: you have rights under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"), and may complain to the UAE Data Office.

To exercise any of these rights, contact us using the details in Section 16. We may need to verify your identity before responding, and may decline or limit a request to the extent permitted by applicable law.

14. DATA BREACH NOTIFICATION

If we become aware of a security incident affecting your personal data, we will notify affected individuals and the relevant supervisory authority or authorities without undue delay, where required by applicable law, and will take reasonable steps to describe the nature of the incident, its likely consequences, and the measures taken or proposed to address it.

15. CHANGES TO THIS POLICY

We may update this Policy from time to time. Where changes are material, we will take reasonable steps to notify you in advance, such as by email or an in-app notice. The "Effective Date" at the top of this Policy shows when it was last updated.

16. CONTACT US

If you have questions about this Policy, or wish to exercise any of your rights, please contact us at info@kayanaforbusiness.com. A list of Kayana Group entities and their registered offices is set out in Schedule 1 to the Kayana Aid Terms and Conditions; you may also direct correspondence to the specific Kayana entity that is the data controller for your country, at its registered office listed there.

17. GOVERNING LAW

This Policy is governed by the same governing law and dispute-resolution provisions as the Kayana Aid Terms and Conditions (see Sections 27 and 27A of those Terms), without prejudice to any mandatory data-protection or consumer-protection rights you have under the law of your country of residence.


Payment security

Card details are handled by our PCI DSS compliant payment partners; Kayana Aid never stores your card number.