Your Data Rights
How to access, correct, export, or delete the personal data we hold about you — through one of two verified paths.
1. Your rights
Under the GDPR (and the UK-GDPR for UK residents) you have the right to:
- Access (Art. 15) — obtain a copy of the personal data we hold about you;
- Rectification (Art. 16) — correct inaccurate or incomplete personal data;
- Erasure (Art. 17) — have your personal data deleted, subject to legal retention obligations;
- Restriction (Art. 18) — limit how we process your data;
- Portability (Art. 20) — receive your data in a structured, machine-readable format;
- Objection (Art. 21) — object to processing based on legitimate interest;
- Withdrawal of consent — for any processing carried out on the basis of consent.
California residents enjoy comparable rights under the CCPA/CPRA — see the California Privacy Notice for specifics.
2. Two ways to exercise these rights
3. Path A — if you have an account
Sign in and visit /account/data. Your active session is proof of identity. From there you can:
- Export your data as a downloadable JSON / ZIP bundle.
- Request account deletion (typed-email confirmation; 30-day soft-delete grace period before permanent purge).
In progress: this UI ships as part of Phase 2 of the legal infrastructure rollout. Use Path B below in the meantime.
4. Path B — if you cannot sign in
Use this path if you have forgotten your password, deleted your account, or never had one but appear in our records as a former donor or contributor.
- Go to /donor/data and submit the email you used.
- We respond identically whether or not we have records — to prevent email enumeration. If we do have records, a single-use, time-limited token is emailed to you.
- Click the link in your email to view your data, request export, or request deletion.
5. Response time
We respond within 30 days as required by Art. 12(3) GDPR. The deadline may be extended by two further months for complex requests, in which case we will tell you why.
6. Right to lodge a complaint
You may lodge a complaint with a supervisory authority. In Germany, the competent authority depends on the controller's registered office.