GDPR for donations
Donations are particularly sensitive from a GDPR perspective — they often reveal religious affiliation, political conviction or health concerns, depending on the recipient organization. Processing this data therefore requires even more careful handling than classic orders.
Three duties are indispensable: a clear privacy notice on the form (not hidden in the footer), purpose limitation ("processing for donation handling and tax receipt") and a documented legal basis. For the donation itself, Art. 6(1)(b) (contract fulfillment) applies; for later advertising or newsletter, separate consent is needed.
Critical: if the recipient organization belongs to a religious community (church, religious association), the donation alone to this organization can count as sensitive data. An additional notice and explicit consent help here. Anonymous donations without tax receipt sidestep the problem — but are not attractive for many donors because tax deductibility is lost. Retention: 10 years for tax-relevant documents (AO § 147), then mandatory deletion.