Use of donor info by external parties?

Tanna Lewis

Hi all!

Hoping to collect a few examples from the Community here of how you handle “sharing” information externally and explaining upfront to donors how external parties may use their info (for example, in a privacy policy.)

For a little background, we are currently doing a project to revamp some of our documentation and rules for when “external" parties have authorized access to donor information and how it is then allowed to be used. A good example is TeamRaiser participants who can access contact lists of their donors and teammates in the Participant Center - this is of course just available by default. But it gets a little murkier when a TeamRaiser team captain asks us for a list of all donors who supported their team in any way over the past 3 years in order to send a thank-you note, for example. We don't normally allow this type of access to donor information, but it can be awkward and difficult to try to explain to the person requesting it why we will not share a list like this.

This is just a minor example, but this issue also encompasses how we share information with fundraisers on our Board; or provide details to funding recipients; or allow a volunteer coordinator to have a list of all registrants to check in for an event; etc. These parties are not technically internal employees, so we want to tighten how they must agree to protect and use the information we share, and we also want to provide better transparency in donor-facing documentation.

Does your org have protocols in place to handle this type of “external” party who is still essentially authorized to act on behalf of your org? If so, could you please share your examples? We'd love to get some ideas on:

• How you explain this to donors, perhaps in a privacy policy?
• What do you require the “external” party to agree to?
• Do you require the “external” party to transmit or store the shared data in a certain way?
• Do you have a written guideline for your internal staff to help them understand when and how to share data?

THANK YOU SO MUCH FOR YOUR THOUGHTS!