What Sanad has provided
Liters of water 1,470,759
Meals served 58,351
Food parcels 45,852
Donate Now

Privacy policy

SANAD Association for Emergency Aid and Development
Privacy and Personal Data Protection Policy
Version 1.0 — Last updated: 23 October 2026

Introduction
We respect your privacy and are committed to protecting your data.
This policy explains what data we collect, why, how we protect it, and with whom we may share it.
It also sets out your rights and how to exercise them easily.
It complies with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and with the French Data Protection Act (Loi Informatique et Libertés, n° 78-17 of 6 January 1978).
In brief

1. Who we are
The data controller under this policy is the Association SANAD pour l'aide d'urgence et le Développement — in English, SANAD Association for Emergency Aid and Development (hereinafter “SANAD” or “the Association”).
SANAD is a French non-profit association governed by the French Law of 1 July 1901.
Together with its branches and partners, it operates under the Arabic name “مؤسسة سند للإغاثة والتنمية”.
Legal name (French): Association SANAD pour l'aide d'urgence et le Développement
Title registered in the French National Register of Associations: SANAD ASSOCIATION
RNA number: W751276287
SIREN number: 934 622 895
Registered office: c/o Sofradom, 142 rue de Clignancourt, 75018 Paris, France
Contact for personal data matters: info@sanadcharity.org
The Association is not legally required to appoint a Data Protection Officer (DPO).
However, a designated person within the Association handles and responds to your requests.
2. Scope of this policy
This policy applies to:

It does not apply to third-party websites and services, even if you reach them from our website. Each has its own policy.
Data relating to beneficiaries in the field is governed by separate internal procedures. Section 7 sets out the rules for any such data published on the website.
3. The data we collect and why
For each activity, we state the data collected, the purpose and the legal basis for processing. Retention periods are set out in Section 11.
Mandatory fields in our forms are clearly marked. If you do not complete them, we will not be able to process your request.
We collect most data directly from you. Some may be provided to us by the payment provider or by the workplace giving platform through which you donated.
3.1 Online donations, one-off or monthly
What we collect: first and last name, email address, country, donation amount, currency and date, frequency, the project you chose, transaction number and payment status. We may ask for your telephone number on an optional basis.
What we do not collect: your card number, security code or expiry date. These are entered directly on the payment provider’s secure payment page.
Why: to process your donation, send confirmation, manage, renew and stop monthly donations, handle failed payments, answer your questions and keep our accounts.
Legal basis: performance of your request and compliance with our legal accounting obligations (GDPR Art. 6(1)(b) and 6(1)(c)).
3.2 Tax receipts
French law allows donors to benefit from a tax reduction where the relevant conditions are met.
To issue a receipt, we need your full name and full postal address. For corporate donors, we need the company name, SIREN number and address.
Receipts for individuals are issued on the official French form (Cerfa n° 11580*05).
Receipts for companies are issued on the official form specific to them (Cerfa n° 16216).
If your address is incomplete, we may be unable to issue a receipt. Your donation is nonetheless recorded in our accounts in all cases.
Legal basis: compliance with our legal and tax obligations (GDPR Art. 6(1)(c)).
3.3 Donor account
An account may be created for you when you set up a monthly donation, or at your request.
What we collect: email address, password, history of your donations and subscriptions, and your receipts.
Your password is stored in encrypted form and cannot be seen by anyone at the Association.
Why: to let you track your donations, change or stop your monthly donation, and download your receipts.
Legal basis: performance of your request (GDPR Art. 6(1)(b)).
You can ask for your account to be deleted at any time. Data that the law requires us to keep is then held in a restricted-access archive.
3.4 Verification and protecting donations from misuse
We work in conflict zones.
We therefore apply, on a voluntary basis, verification procedures to protect donations against money laundering and terrorist financing.
We also comply with asset-freezing measures and international sanctions, a legal obligation that applies to everyone.
In specific cases, such as large or unusual donations and donations from companies and institutions, we may ask you for additional information or documents.
We may also screen the details of certain donors and partners against official sanctions lists, including those of the European Union, the United Nations and the French national asset-freeze register.
If verification cannot be completed, we reserve the right to decline or return the donation.
Legal basis: legal obligation to comply with asset-freezing measures (French Monetary and Financial Code, Art. L562-1 et seq.; GDPR Art. 6(1)(c)).
and our legitimate interest in protecting donors’ funds from any unlawful use (GDPR Art. 6(1)(f)).
This data is accessible only to a small number of authorised staff.
3.5 Keeping in touch with donors
Donation confirmations and receipts are always sent to you, as they are part of processing your donation.
However, we only send you news about our projects and new appeals with your consent, which we ask for in the donation form.
The consent box is not pre-ticked and your donation does not depend on it.
Every email, starting with the very first, includes a one-click unsubscribe link.
We do not contact you by SMS, WhatsApp or telephone for this purpose without separate consent for each channel.
We may group donors in a simple way by the number and dates of their donations, in order to tailor our messages (for example, thanking a regular donor or welcoming a new one). We make no automated decisions that have legal effects on you.
Legal basis: your consent, which you may withdraw at any time (GDPR Art. 6(1)(a) and 7(3)).
3.6 Newsletter
What we collect: email address, first name, preferred language and country if provided.
Why: to send our regular newsletter about our work in the field.
Legal basis: your consent (GDPR Art. 6(1)(a)).
The subscription box is never pre-ticked. You can unsubscribe at any time via the link in every message.
Our messages may contain tools that measure opens and clicks. We only use them to measure your individual engagement with your consent, which you may withdraw at any time.
3.7 Contact forms and enquiries
What we collect: name, email address, the content of your message and your telephone number if provided.
Why: to reply to your message and follow up on your request.
Legal basis: our legitimate interest in responding to people who contact us (GDPR Art. 6(1)(f)).
3.8 Volunteering and joining us
What we collect: name, contact details, country and city, skills, availability, motivation and your CV if attached.
Why: to review your application, contact you and organise your involvement.
Legal basis: steps taken at your request before any commitment, and our legitimate interest in selecting volunteers (GDPR Art. 6(1)(b) and 6(1)(f)).
Some roles, particularly field roles or those involving contact with children, may require additional information. We will inform you in advance where this applies.
3.9 Orphan sponsorship
Sponsor data: the same as donor data, plus the sponsorship status, payments and related correspondence.
Data about the sponsored child: we share only limited information with the sponsor: first name, age, general area, general schooling and family situation, and periodic photos and updates.
We never share with the sponsor the precise address of the child or their family, their contact details, or any health information.
We collect the child’s data with the agreement of their legal guardian or the body responsible for them.
Sponsor’s commitments: the sponsor undertakes to keep the child’s information confidential, not to publish the child’s photos or information online or on social media, and to contact the child or their family only through the Association.
Legal basis: performance of the sponsorship you requested, the best interests of the child, and the guardian’s consent for photos (GDPR Art. 6(1)(b), 6(1)(f) and 6(1)(a)).
3.10 Messaging via social media
When you message us via Messenger, Instagram or WhatsApp, we receive your account name and the content of your message. We may use an automated reply tool for frequently asked questions.
These platforms also process your data under their own policies and responsibility.
Please do not send card details or any sensitive information through these channels.
Legal basis: our legitimate interest in replying to your messages (GDPR Art. 6(1)(f)).
3.11 Browsing, cookies and advertising
Technical data: IP address, browser and device type, pages visited and server logs. We use this to run and secure the website and to prevent fraud.
Legal basis: our legitimate interest in website security (GDPR Art. 6(1)(f)).
Analytics and advertising tools: we use tools to measure website traffic and the effectiveness of our campaigns, including tools provided by Google and Meta (Google Analytics, Meta Pixel, Meta Conversions API).
These tools are only activated after you consent via the cookie banner. Refusing them is as easy as accepting them. You can change your choice at any time via the “Manage cookies” link at the bottom of every page.
When Meta’s tools are activated, we are joint controllers with Meta only for the collection and transmission of data to Meta. Meta alone is responsible for any subsequent use of that data.
We do not upload donor lists to advertising platforms without your consent.
Legal basis: your consent (French Data Protection Act, Art. 82; GDPR Art. 6(1)(a)).
Full details are set out in our Cookie Policy.
4. Sensitive data
We do not ask for data about your health, beliefs, political opinions or origin. Please do not send such data through our forms or messages.
Choosing a particular type of donation, such as zakat or udhiya (sacrifice), may reveal a religious belief. We therefore ask for your explicit consent in the donation form when you choose this type of donation.
We use this information solely to allocate and carry out your donation and issue its receipt. We never use it for advertising targeting or to build advertising audiences.
Legal basis: your explicit consent, for this purpose only (GDPR Art. 9(2)(a)).
5. Minors
Our website is intended for adults. Donating and creating an account are reserved for people aged 18 or over.
Children under 15 may only subscribe to the newsletter with the consent of a parent or guardian (French Data Protection Act, Art. 45).
If we learn that we have collected a minor’s data without valid permission, we will delete it as soon as possible.
6. Who can access your data
Within the Association: only authorised staff and volunteers, to the extent required by their duties. All are bound by confidentiality.
Service providers acting on our behalf and on our instructions:

They are bound by contracts requiring them to protect the data and not use it for their own purposes (GDPR Art. 28).
Their current names are listed in the annex.
Organisations processing your data under their own responsibility:

Our field teams and partners: we do not send them your data, unless you ask us to (for example, mentioning your name at the time of your udhiya sacrifice or in sponsorship correspondence). Even then, we send only the minimum, such as the name you choose.
7. Beneficiaries’ photos and stories
We publish photos and stories from the field to show you the impact of your donation.
We seek the consent of the people concerned or their guardians wherever possible.
We never publish full names, precise addresses or any information that could put people at risk.
We take particular care with children: we use only a first name or a pseudonym and blur faces where necessary. We may change some names and details for protection.
If you or a relative appear in published content and would like it removed, please contact us. We will review your request promptly and remove the content where the request is justified.
8. No selling, renting or exchanging
We do not sell your data, we do not rent it, and we do not exchange it with other charities, foundations or companies.
Should this ever change, it would only happen after informing you in advance and giving you the right to object.
9. Transfers outside the European Union
Some of our service providers are based in the United States or operate from outside the European Union. No transfer takes place without safeguards recognised under EU law:

You can request information about these safeguards at the contact address above.
We do not transfer donor data to our field locations except at your request, as described in Section 6. Such a transfer is then based on its necessity to carry out your request (GDPR Art. 49(1)(b)).
10. Data security
We take appropriate technical and organisational measures, including: encrypted connection to the website, two-factor authentication for administrator accounts, restricted access rights and backups.
Payments are handled by a provider that complies with the payment card security standard (PCI DSS).
If a data breach threatens your data, we will notify the French data protection authority (CNIL) within 72 hours where required, and inform you directly if the risk to your rights is high (GDPR Art. 33 and 34).
No online system is completely secure, so we cannot guarantee absolute security of data in transit over the internet. Please keep your account password confidential.
Important: we will never ask for your password or card details by email, phone or message. If you receive such a request in our name, do not respond and report it to us immediately.
11. Data retention
We keep data only for as long as necessary for its purpose. It is then deleted, anonymised, or moved to a restricted-access archive where the law requires us to keep it.
Type of data Retention period
Donor data and relationship with the Association For the duration of the relationship, then 3 years from your last donation or last contact
Donation records and copies of tax receipts At least 6 years (French Tax Procedures Code, Art. L102 E).
Accounting records 10 years in a restricted-access archive
Verification and sanctions-screening files 5 years from the end of the relationship, in a restricted-access archive
Donor account Until deleted, or after 3 years of inactivity with prior notice
Card details Not kept by us; kept only by the payment provider, under its terms
Consent to fundraising appeals Until you withdraw consent, or after 3 years without any interaction
Newsletter Until you unsubscribe, or after 3 years without any interaction
List of people who have unsubscribed For as long as needed to respect your choice, with minimal data
Contact messages and enquiries 1 year after the request is closed
Volunteer applications and CVs 2 years from last contact, unless you ask for earlier deletion
Sponsorship data For the duration of the sponsorship, then 3 years, subject to accounting obligations
Server logs 12 months maximum
Your cookie choice 6 months, after which we ask again
Cookies and trackers 13 months maximum
Analytics data 25 months maximum
Requests to exercise your rights 5 years, as proof of handling

12. Your rights
The law gives you the following rights:

How to exercise your rights: write to us at the dedicated email address or by post to our registered office. We will only ask for proof of identity if there is reasonable doubt about your identity.
We reply within one month. This may be extended by two further months for complex requests, in which case we will let you know (GDPR Art. 12(3)).
Exercising your rights is free of charge.
Limits to the right to erasure: it does not cover data that the law requires us to keep, such as tax receipts and accounting records. This data is held in a restricted-access archive until the legal period expires, then deleted.
Right to complain: you may lodge a complaint with the French data protection authority, the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.
We would ask you to contact us first, so that we can try to resolve the matter with you directly.
13. Cookies
Our Cookie Policy explains the tools we use, their purposes and how long they last. You can manage your choices at any time via the “Manage cookies” link at the bottom of every page.
14. External links and embedded content
Our website may contain links to other websites or content embedded from them, such as videos. We do not control these websites and are not responsible for their privacy practices.
Embedded content that places trackers is only loaded after your consent.
15. Your responsibility and ours
You are responsible for the accuracy of the data you provide to us.
If you provide another person’s data, for example when donating in their name or as a gift, you confirm that they are aware of it and do not object.
Payment providers and external platforms process your data under their own terms and responsibility.
Tax benefits are subject to the conditions of French law and the assessment of the French tax authorities. We do not guarantee any tax benefit in another country.
Nothing in this policy limits the rights you have under the law.
16. Updates to this policy
We may update this policy to reflect changes in the law or in our services. The date of the latest update appears at the top of the page.
For any significant change, we will inform you on the website, or by email if you have an account with us.
17. Language of this policy
This policy is published in Arabic, English and French. In the event of any discrepancy between versions, the French version prevails.
18. Contact us
For any question about your data or this policy:
Email: info@sanadcharity.org
Address: Association SANAD, c/o Sofradom, 142 rue de Clignancourt, 75018 Paris, France
Annex: current service providers
This list is updated whenever a provider changes.