Privacy Policy

Last updated: 28 August 2026

Grass Roots Company Pty Ltd ABN 38 610 840 376 ("Grassrootz", "we", "our" or "us") is committed to the protection of your personal information. This Privacy Policy covers how we collect, use, disclose and protect the personal information we hold.

We may update this Privacy Policy from time to time. The most current version will be located on our website, and is also available by contacting us at the details provided below.

By using our website or platform, or by providing any personal information to us, you consent to the collection, use and disclosure of your personal information as set out in this Privacy Policy.

If you are located in the United Kingdom or the European Economic Area, please also see our UK & EU Privacy Notice below for additional information specific to your rights under UK GDPR and EU GDPR.

You may access other websites through links on our website. We are not responsible for the privacy practices of other sites, and recommend that you review the privacy policy of each site you visit.

Types of Information Collected

The types of personal information we collect and hold will vary depending on your dealings with us and may include:

  • your name, email address, telephone or mobile number, and physical address;

  • payment information (last four digits of your card number and expiry date — full card details are collected and processed entirely by our payment provider, Stripe, and never enter our systems);

  • donation and transaction details, including amounts, dates, and pledge status;

  • fundraising page content and campaign activity;

  • activity data from connected fitness platforms (such as Strava or Fitbit), where you choose to link your account, including activity type, distance, duration, and steps;

  • information you provide when contacting us for support;

  • where required in relation to your participation in a particular event, additional information such as dietary requirements or emergency contact details.

You do not have to provide us with any personal information, however if you do not do so you may not be able to make a donation or participate in a particular event, and we may not be able to provide you with the services you have requested.

Where you choose to connect a third-party account (such as Facebook, Strava, or Fitbit), we collect only the information necessary to provide the relevant platform functionality. You can disconnect a linked account at any time through the third-party platform's settings or by contacting support@grassrootz.com.

How We Collect Personal Information

Generally, we collect personal information directly from you, such as when you:

  • make a donation;

  • create a fundraising page using the Grassrootz platform;

  • register for or participate in an event;

  • purchase a ticket (including free tickets) or associated merchandise in a campaign or event;

  • connect a third-party account such as Facebook, Strava, or Fitbit;

  • contact us for support; or

  • otherwise interact with us or our platform.

We may also collect personal information from:

  • organisations or individuals who fundraise through Grassrootz;

  • charity partners on whose behalf fundraising is conducted;

  • event registration platforms, where you register for an event and choose to donate or create a fundraising page as part of that process;

  • third-party platforms you have chosen to connect to your account;

  • our service providers, such as our payment processor.

From time to time, another person may provide us with your personal information — for example, where someone registers family members or a team for a fundraising event. Where you provide us with personal information about someone else, it is your responsibility to ensure that those persons are aware of this Privacy Policy, consent to you providing information on their behalf and understand how their information will be handled.

Our Use and Disclosure of Personal Information

We will use the personal information we collect for the purpose disclosed at the time of collection, or otherwise as set out in this Privacy Policy. We will not use your personal information for any other purpose without first seeking your consent, or where authorised or required by law.

We use your personal information for the following purposes:

  • to allow you to fundraise for your selected organisation or cause;

  • to collect and process your donation and provide it to your selected organisation;

  • to provide the services you have requested from us;

  • to establish and maintain your relationship with us;

  • to communicate with you about your account, campaigns, and platform activity;

  • for internal analysis, reporting, and platform improvement;

  • to monitor and improve the quality of our services and user experience, including through session recording and analytics tools such as Microsoft Clarity;

  • to protect our platform and users from fraud, spam, and automated abuse

  • to answer any enquiry you make; or

  • to comply with our legal and regulatory obligations.

Grassrootz does not sell, rent, or trade your personal information.

Disclosure to Charity Partners

We will disclose your personal information to the organisations that you have donated to or fundraised for. This is a core function of the platform — when you donate or fundraise, the relevant charity receives your information so that it can manage its fundraising activities and communicate with you.

Once your personal information has been provided to a charity partner, that organisation is responsible for handling it under its own privacy obligations and privacy policy. We are not responsible for a charity's use of your personal information after it has been disclosed to them. If you have any concerns about a charity's handling of your information, please contact them directly.

Disclosure to Service Providers

We use third-party service providers to help us deliver our platform and services, including for payment processing, email communications, cloud hosting, and analytics. These providers are contractually required to protect your information and may only use it for the purpose of providing services to us.

We use automated tools, including AI-based systems, to assess fundraising pages and submissions for fraud and spam risk. This may involve sharing page content and associated submission data with trusted third-party AI service providers, who are contractually required to handle it in accordance with this policy.

Other Disclosures

We may also disclose your personal information where required or authorised by law, regulation, or legal process, or if we are involved in a merger, acquisition, or sale of all or part of our assets.

When you make a donation, you can choose how your name is displayed publicly, or for the donation to appear as anonymous. If you create a fundraising page, you can choose to customise your page name. These display choices do not affect the personal information we collect and hold as described in this policy.

Direct Marketing

We may use your personal information to send communications to you from us and from the organisation or individual you have donated to or fundraised for.

You may opt out of receiving marketing communications at any time through the unsubscribe function included in each communication, or by contacting support@grassrootz.com. Please note that even if you opt out of marketing communications, we may still send you transactional or service-related messages (such as donation receipts, campaign updates, and system notifications) where these are necessary to provide our services.

How We Store and Protect Personal Information

We store personal information in secure cloud-hosted environments and take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

Our security measures are designed in alignment with recognised information security standards and include access controls, encryption, and regular review of our security practices.

We take reasonable steps to destroy or permanently de-identify personal information when it is no longer needed for the purposes described in this policy or as required by applicable legal and regulatory obligations.

We cannot and do not accept responsibility for the security of information you send to or receive from us over the internet, or for any unauthorised access or use of that information.

Do We Send Personal Information Overseas?

Some of the service providers we use to deliver our platform are located overseas, including in the United States. We are also likely to disclose personal information to organisations you have donated to or fundraised for who may be located outside Australia.

Where we disclose personal information to overseas recipients, we take reasonable steps to ensure that the recipient handles your information in accordance with the Australian Privacy Principles, including through contractual obligations and the use of service providers with recognised security certifications.

Accessing and Correcting Your Personal Information

You may request access to the personal information we hold about you, or ask us to correct information that is inaccurate, incomplete, or out of date. We will respond to your request within 30 calendar days.

We may need to verify your identity before providing access or making corrections. In some circumstances, we may decline a request for access in accordance with the Privacy Act 1988, in which case we will provide you with reasons.

If your personal details change, you may also need to update your information with us in order to continue accessing our services.

Can I Request My Data Be Deleted?

You may request that we delete your personal information. We will take reasonable steps to do so, unless we are required to retain it to comply with our legal or regulatory obligations. To make a deletion request, please contact support@grassrootz.com.

If you are located in the United States or New Zealand, you may have additional rights under applicable local privacy laws. Please contact us to discuss how these may apply to your request.

Data Breach Notification

In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988.

Cookies and Analytics

Our website and platform use cookies and similar technologies to improve your experience and help us understand how our services are used. Cookies are small data files stored on your device when you visit a website.

We also use analytics and session recording, and security tools to monitor site performance, understand usage patterns, and improve our services. These tools may record interactions such as page visits, clicks, and scrolling behaviour.

You can disable cookies through your browser settings, however some features of our platform may not function properly without them.

Complaints

You may send a complaint to us at support@grassrootz.com. We will promptly acknowledge and investigate any complaint about the way we manage personal information. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (www.oaic.gov.au).

How to Contact Us

If you have any questions about this Privacy Policy, or if you wish to make a request or complaint regarding your personal information, please contact us:

Privacy Officer

Email: privacy@grassrootz.com

You may also contact us at any time about any aspect of the Grassrootz service at support@grassrootz.com.

UK & EU Privacy Notice

Last updated: 28 August 2026

This notice applies specifically to data subjects resident in the United Kingdom or the European Economic Area.

Who is the Controller of Your Personal Data

Grass Roots Company Pty Ltd ABN 38 610 840 376 ("Grassrootz", "we", "our" or "us"), trading as Grassrootz, is the controller of the personal data described in this notice.

Our Representatives

Grassrootz has appointed a representative under UK GDPR Article 27 to act as your local point of contact for data protection matters, in addition to Grassrootz itself. 

UK Representative: Can be contacted at privacy@grassrootz.com

What Personal Data We Collect, and Where It Comes From

The categories of personal data we collect are described in full in the main Privacy Notice. In summary, this includes your name and contact details, payment information (processed by Stripe; full card details never reach Grassrootz), donation and transaction details, fundraising page content and campaign activity, connected fitness-platform activity data (where you choose to link an account), support correspondence, and, for certain events, dietary or emergency contact details.

Some personal data is collected about you from someone else rather than directly from you (Article 14). This includes:

  • where another person registers you as part of a team or family fundraising entry;

  • where a charity partner provides us with information about a fundraiser or donor for the purpose of administering a campaign;

  • where an event registration platform passes on your details as part of your event registration;

  • where you have connected a third-party account (such as Facebook, Strava, or Fitbit) and that platform shares activity data with us.

In each case, the purposes and legal basis for our use of that data are the same as set out below, regardless of whether we collected it from you directly or from a third party. None of this data comes from publicly accessible sources and it comes from the specific third party named above in each case.

Where we receive your data from a third party rather than directly from you, we provide the information in this notice within a reasonable period after receiving it (at the latest, within one month), or when we first communicate with you, or when we disclose your data to another recipient, whichever happens earliest.

Is Giving Us Your Data Required?

Providing certain personal data is necessary to enter into or perform our contract with you. Grassrootz cannot process a donation, issue a ticket, or set up your account without your contact and payment details. If you do not provide this data, we will not be able to provide the relevant service.

Some other data is optional like connecting a fitness platform, subscribing to marketing communications, or providing details before creating an account. You are not required to provide this, and choosing not to will not affect your ability to donate, fundraise, or otherwise use the core platform.

Purposes and Legal Basis for Processing

Grassrootz relies on the following lawful bases under Article 6, grouped below with the purposes each one covers.

Consent (Art 6(1)(a)) 

  • Connecting a third-party fitness platform (such as Strava or Fitbit) to your account, where you choose to

  • Following up with you before you have created an account (for example, if you registered interest in fundraising or donating)

  • Sending you marketing, social media, and newsletter communications (see the Cookies and Marketing Consent section below)

Performance of a contract (Art 6(1)(b)) 

  • Operating the platform and providing the fundraising, ticketing, and account services you request

  • Settling your donation or ticket payment and reconciling the transaction with the charity partner you supported

Legal obligation (Art 6(1)(c))

  • Verifying a charity partner's identity and regulatory compliance status (where you are a charity administrator)

Legitimate interests (Art 6(1)(f))

  • Recording and honouring your marketing and communications consent choices

  • Internal analysis and reporting, including aggregated campaign reporting provided to charity partners

  • Operating, monitoring, and securing our technical infrastructure, including preventing fraud and abuse

  • Sending you service-related updates about your fundraising page or event (for example, progress updates, and event logistics)

Grassrootz does not use your personal data to make decisions with legal or similarly significant effects on you without human involvement. If this changes, you will be told how the logic works, its significance, and how to ask for human review.

Who We Share Your Data With (Recipients)

We disclose your personal data to:

  • the charity partner you have donated to or fundraised for, who becomes an independent controller of your data once it is disclosed to them;

  • our payment processor (Stripe), email and messaging providers (Mailchimp/Mandrill, Vero), and cloud hosting providers (AWS, Azure, GCP), each acting as our processor under a data processing agreement;

  • regulators, law enforcement, or other parties where required or authorised by law.

International Transfers

Some of the recipients above are located outside the UK/EEA, including in the United States and Australia. Before transferring your data outside the UK/EEA, we rely on one of the following:

  • An adequacy decision, where the destination country is recognised by the UK/EU as providing an adequate level of protection;

  • Appropriate safeguards, principally the UK International Data Transfer Agreement (or UK Addendum to the EU Standard Contractual Clauses) and the EU Standard Contractual Clauses, supported by a Transfer Risk Assessment for each destination; or

  • Exceptionally, a derogation (for example, your explicit consent, or necessity for performing a contract with you), used only for occasional, non-repetitive transfers.

How Long We Keep Your Data

We keep your personal data only for as long as necessary for the purposes described above, and for any period required to meet legal, tax, accounting, or regulatory  obligations. Retention periods vary by data category. Where data is retained to meet a legal obligation, this is generally up to seven years. 

Your Rights

As a UK/EEA individual, you have the following rights in relation to your personal data:

  • Access (Article 15) -  ask us to confirm whether we process your data and provide a copy of it, along with the purposes, categories, recipients, retention criteria, and your rights. We will respond within one calendar month, extendable by a further two months for complex or numerous requests (we will tell you within the first month if this applies).

  • Rectification (Article 16) - ask us to correct inaccurate or incomplete data.

  • Erasure (Article 17) - ask us to delete your data. We comply without undue delay, within one calendar month, except for data we must retain for a legal obligation (for example, financial/tax records or Stripe's payment records). Where your data was disclosed to a charity partner or made public, we erase our own copy and notify other recipients where required.

  • Restriction (Article 18) - ask us to pause active use of your data while continuing to store it, including while a dispute about its accuracy or an objection is being assessed.

  • Portability (Article 20) - ask for the data you gave us in a structured, machine-readable format, or ask us to send it directly to another organisation, where this is technically feasible. This applies only to data you provided, not data we have derived or inferred.

  • Objection (Article 21) - object to processing based on our legitimate interests; we will stop unless we can show compelling grounds that override your interests. If you object to direct marketing, we will stop immediately, with no override.

  • Withdraw consent - where we rely on your consent (for example, certain cookies or marketing), you can withdraw it at any time, as easily as you gave it.

  • Complain (Article 77) - see the Complaints section below.

Where we correct, erase, or restrict your data following a valid request, we will also tell any recipient we shared it with, unless this proves impossible or takes disproportionate effort. To exercise any of these rights, contact us using the details at the end of this notice. We may need to verify your identity before acting on a request.

Children's Personal Data

Grassrootz does not knowingly collect account information from a UK/EEA individual under 18. Images appearing in fundraising page content remain the personal data of any minor shown; removal requests are treated as a priority erasure request (see above).

Cookies and Marketing Consent

Cookies: If you are located in the EEA, we obtain your consent before setting any cookie that is not strictly necessary for the website to function, including analytics, advertising, and tools that record how the site is used, such as Microsoft Clarity. If you are located in the UK, the same requirement applies, except for cookies used solely to measure basic site performance or maintain security, which may be set without prior consent. All other cookies still require your consent.

Marketing emails: In both the EEA and the UK, we obtain your consent before sending marketing emails, with one exception: if you are in the UK and have previously made a purchase or donation through us, we may email you about similar offerings without seeking fresh consent, provided you were given the option to opt out when your details were first collected, and each subsequent email includes an option to unsubscribe.

You may withdraw your consent at any time, for cookies, through our preference settings; for emails, through the unsubscribe link or by contacting support@grassrootz.com. 

Data Breach Notification

If a breach affecting your personal data is likely to result in a risk to your rights and freedoms, we will notify the ICO or the relevant EU supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you specifically, we will also notify you directly without undue delay.

Complaints

You may send a complaint to us at privacy@grassrootz.com. We will acknowledge your complaint within 30 days, investigate it reasonably and proportionately, and tell you the outcome and your right to complain to a supervisory authority regardless of that outcome.

You may also complain directly to the ICO (if you are in the UK) or your local EU supervisory authority at any time, in addition to complaining to us.

How to Contact Us

If you have any questions about this Privacy Policy, or if you wish to make a request or complaint regarding your personal information, please contact us:

Privacy Officer

Email: privacy@grassrootz.com

You may also contact us at any time about any aspect of the Grassrootz service at support@grassrootz.com.