Privacy policy

Door to Digital ("D2D", "we", "us") provides an operating system for door-to-door charity fundraising and commercial field sales. For data we process on behalf of a client organisation, that organisation is the controller and we act as the processor under their instructions and our agreement.

From visitors to this website:

• Details you submit through the contact form — your name, email, organisation and message.
• Limited technical data needed to serve the site securely (such as IP address and request metadata).

Through the platform, on behalf of client organisations, we may process donor and customer contact details, consent records, signatures, and transaction information. That processing is governed by the client agreement, not by this website policy.

• To respond to your enquiry and, if relevant, discuss working together.
• To operate, secure and improve the website and the platform.
• To meet legal, regulatory and audit obligations — including the fundraising, consent and record-keeping rules that govern door-to-door activity.

We do not sell personal information, and we do not share contact-form submissions with third parties for their own marketing.

Sensitive fields are encrypted at rest using envelope encryption with region-pinned keys. Access to plaintext personal data uses just-in-time, dual-control unmasking, and every reveal is written to an immutable audit trail. Tenant and region isolation are enforced at multiple independent layers.

Data is pinned to a region — United States, Australia or Singapore — at the time an organisation is created, and is not replicated across regions. Australian personal information stays in Australia; United States data stays in the United States. This is enforced in the database, not just by policy.

We keep contact enquiries only as long as needed to follow up and to maintain reasonable business records. Platform data is retained per the client agreement and the applicable fundraising and financial record-keeping laws, which can require multi- year retention. Audit records are retained for seven years.

Depending on where you live, you may have rights to access, correct, delete, or limit the use of your personal information, and to object to certain processing. We support deletion (right-to-be-forgotten) workflows in the platform. To exercise a right, or if you are a donor or customer of an organisation that uses D2D, contact us at the address below and we will route the request appropriately.

We use a small set of vetted infrastructure and communications providers (such as cloud hosting, email delivery and payment processing) under data-processing terms. A current list is available to clients on request.

We may update this policy as the product and our obligations evolve. We will revise the date above when we do, and we will not weaken our commitments quietly.

Questions about privacy, or to make a request, email [email protected].