1. Introduction and Scope

This Privacy Policy explains how Nizam Co. ("Nizam," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our Services.

"Services" means every product and service Nizam provides to help nonprofit organizations accept and manage donations and payments. This includes our websites, online donation platform, dashboards and portals, mobile applications, donation hardware (such as kiosks and handheld devices), and related software, APIs, and support. This policy applies to all of them, including products we launch in the future, unless a product comes with its own privacy notice.

In this policy, "Customers" means the nonprofit organizations that use our Services to collect donations. "Donors" means the individuals who give to those organizations through our Services.

This policy does not cover how our Customers handle personal information on their own, or the practices of third-party websites and services we link to.

2. Our Role

When we act for our Customers. When you donate to an organization through our Services, we process your information on that organization's behalf. The organization is the "controller" (or "business") of that data and decides how it is used. Nizam is its "processor" (or "service provider") and handles the data only to provide the Services, under our agreement with the organization.

If you have questions about how an organization uses your donation information, or want to exercise your privacy rights over it, please contact that organization directly. If you contact us instead, we will forward your request to the organization and help them respond.

Donor accounts. If you create a donor account to view your giving history or manage recurring donations, Nizam provides that account and is responsible for its login and profile information. One donor account can be used with every organization that uses our Services.

When we act for ourselves. Nizam is the controller of personal information we handle for our own purposes. This includes information about Customer account users, visitors to our websites and apps, and data we use for security, fraud prevention, billing, legal compliance, and improving our Services.

3. Information We Collect

We collect only the information we need to provide and protect the Services. What we collect depends on how you use them. You can often donate without creating an account or giving more than your payment information.

Information from others. We receive information from Customers (for example, supporter records they add or import), payment processors (for example, transaction status and card details listed above), mapping services (for address lookup and verification), matching-gift databases (for employer information), and tools a Customer connects to its account.

Information we infer. To help Customers keep accurate records, we may link donations to the same supporter (for example, by email address or by a card fingerprint from our processor), suggest households based on a shared address, and suggest a donor's employer from their email domain for matching-gift purposes.

Mobile and device permissions. Our apps and devices may ask for access to features such as location, Bluetooth, or notifications. We use these only for the feature you are using, and you can change permissions in your device settings.

Some in-person payment features need location services turned on, because our payment processor requires it to operate card readers. Our apps do not read or store your precise location.

4. How We Use Information

We do not sell personal information or use it to show you targeted advertising.

5. How We Share Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only as described below.

• With the organization you donate to. The Customer receives your donation details and the contact and profile information you provide, so it can acknowledge your gift, issue receipts, and keep its records.
• With tools a Customer connects. If an organization connects other tools to its account, such as a donor CRM, a matching-gift service, or its own systems through webhooks, we send the relevant information to those tools at the organization's direction. The organization and the tool provider are responsible for how that information is then used.
• Publicly, based on settings and your choices. Fundraising pages, supporter walls, and live displays may show supporter names, donation amounts, public comments, and general location (city and country). Fundraiser and team pages may show the fundraiser's name, photo, story, and amount raised. Organizations choose what is displayed. If you donate anonymously, your name and location are not shown publicly.
• With service providers. We use vendors for payment processing, cloud hosting and storage, email delivery, mapping and address lookup, error monitoring and logging, device management, and internal communication. They may use personal information only to perform services for us, under written contracts that require them to protect it. A current list of our subprocessors is available on request.
• For legal reasons. We may disclose information when we believe in good faith that the law requires it, such as in response to a valid subpoena, court order, or other legal process. We review each request, push back on requests that are overbroad or invalid, and disclose only what is required. Where the law allows, we notify the affected Customer before disclosing their data.
• To protect rights and safety. We may share information to prevent fraud, protect the security of the Services, or protect the rights, property, or safety of Nizam, our Customers, Donors, or others.
• In a business transfer. If Nizam is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. It will remain subject to this policy or one that is equally protective.
• With your direction or consent. We share information in other ways when you ask us to or agree to it.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

6. Payment Information

Card and bank payments made through our Services are processed by third-party payment processors that are certified to the Payment Card Industry Data Security Standard (PCI DSS). Whether you pay online, in an app, or on a Nizam device, your full card number, security code, and bank account number go directly to the processor in encrypted form. Nizam does not store them.

We receive only limited payment details from the processor: for cards, the brand, last four digits, expiration date, and a card fingerprint; for bank payments, the bank name, routing number, and last four digits of the account. We use these to show receipts, manage recurring donations, handle refunds and disputes, and recognize when the same card is used again so donations can be linked to the right supporter record. Digital wallets such as Apple Pay and Google Pay work the same way.

If a Nizam device takes a payment while offline, the processor's software keeps the encrypted payment data on the device and submits it once the connection returns, usually within 24 hours.

The processor's own privacy policy also applies to the information it handles.

7. Cookies and Similar Technologies

Our websites, donation pages, embedded donation forms, and apps use cookies, local storage, software development kits (SDKs), and similar technologies to:

• keep you signed in and remember your preferences;
• secure the Services and prevent fraud;
• measure how pages are used, such as pages viewed, time on page, and scrolling, so we and our Customers can improve them;
• understand which campaigns and referral sources lead to donations.

We run our own analytics on donation pages rather than third-party analytics services, and we do not place third-party advertising pixels on them. Our analytics cookies last up to 13 months.

When you donate, we may record campaign information from the page address (such as UTM tags and ad click identifiers) and identifiers that other analytics or advertising services have already set in your browser (such as Google Analytics or Meta). We share this attribution information with the organization so it can see which outreach led to your gift.

Emails we send may contain a small image or tracked links that tell us whether the email was opened or a link was clicked. Pages may also load content from other providers, such as web fonts or videos an organization embeds (for example, YouTube or Vimeo), and those providers may receive your IP address.

You can block or delete cookies in your browser settings, but some features, such as staying signed in, may stop working. We treat a Global Privacy Control signal as a request to opt out of analytics and attribution tracking. Where required by law, we ask for your consent before setting non-essential cookies.

8. Data Retention

We keep personal information only as long as we need it for the purposes in this policy, our agreements with Customers, or the law. In general:

• Transaction and donation records: generally kept for at least 7 years to meet tax, accounting, and payment-network requirements.
• Account and profile information: kept while the account is active. After an account is closed, we delete or de-identify it unless we need it for the records above or a legal obligation.
• Technical data, such as IP addresses, request details, and logs: kept only as long as needed for security, fraud prevention, and troubleshooting. Device status logs are typically kept for about two weeks.
• Data we process for Customers: kept as the Customer directs, and returned or deleted when our agreement ends, subject to legal requirements.

When we no longer need information, we securely delete it or de-identify it so it can no longer be linked to you.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information. These include:

• encryption in transit (TLS) and at rest;
• role-based access controls, with access limited to personnel who need it and logged;
• payment card data handled only by PCI DSS-certified processors;
• remote device support sessions that only authorized staff can start and that end automatically;
• secure configuration and regular updates of our software and devices;
• vendor security reviews and periodic security assessments.

No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a security breach affecting your personal information, we will notify affected Customers and individuals, and regulators where required, without undue delay and as required by law.

10. International Data Transfers

Nizam is based in the United States, and we store and process personal information in the United States. Our service providers may process it in other countries. If you use the Services from outside the United States, your information will be transferred to countries whose data protection laws may differ from yours.

When we transfer personal information from the European Economic Area, the United Kingdom, or other regions with transfer rules, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and get a copy;
• Correct information that is inaccurate or incomplete;
• Delete your personal information, subject to legal and record-keeping requirements;
• Port your information to another service in a structured, machine-readable format;
• Object to or restrict certain processing, including processing based on legitimate interests;
• Withdraw consent at any time, where we rely on consent;
• Opt out of marketing emails using the unsubscribe link in each message;
• Not be discriminated against for exercising any of these rights.

Self-service options. If you have a donor account, you can view your donations and receipts, manage recurring gifts, and update your profile and communication preferences in the donor portal at any time.

How to make a request. For information about a donation you made to an organization, contact that organization first (see Section 2). For anything else, email us using the contact details in Section 14. We will verify your identity before acting on a request. An authorized agent may submit a request for you with proof of authority.

We respond within the time required by law, usually within 30 days (45 days under some U.S. state laws), and will tell you if we need more time. If you are not satisfied with our response, you may complain to your local data protection authority.

12. Children

The Services are not directed to children under 13, or under 16 where local law sets a higher age. We do not knowingly collect personal information from children without verifiable parental consent. If you believe a child has given us personal information, please contact us and we will delete it.

13. Changes to This Policy

We may update this policy as our Services, practices, or legal requirements change. We will post the updated policy with a new effective date. If we make material changes, we will notify Customers by email or through the Services before the changes take effect, and we will get consent where the law requires it.

14. Contact Us

For questions about this policy or to make a privacy request,

contact: Nizam Co.

Email: [email protected]

Mailing address: 5905 Atlanta Hwy, Ste 101, Unit 66, Alpharetta, GA 30004, USA

We will respond to all legitimate requests as required by applicable law.