Short surveys, minimal personal data.

Who is responsible

The NINOFF project decides why and how this validation data is used. Privacy questions, access or deletion requests can be sent to privacy@ninoff.org.

Donor survey

The donor survey records answers, completion time, and optional source/campaign labels from the survey link. It does not ask for a name, email address, donation amount or charities supported. Please do not put personal or sensitive information in free text.

Charity survey

The charity survey records structured concept value, disclosure, adoption, workload and pilot-interest answers, completion time, and optional source/campaign labels. Name, organisation and email are optional and stored only when a respondent actively asks for follow-up. Anonymous responses remain useful.

Validation outreach

NINOFF may store limited contact details and internal correspondence notes to organise donor and charity research. These records are restricted to authorised administration. If an invitation link contains a non-identifying outreach reference such as OUT-00037, NINOFF records that the survey link was visited and can associate a completed survey internally with that invitation. The survey page shows when this applies and provides a way to use an unlinked survey instead. Names and email addresses are never placed in the tracked URL or published with survey findings.

Link visits use a random session value stored only as a one-way hash, with first/latest visit times, a visit count and a coarse likely-human or automated/unknown classification. NINOFF does not store an IP address or raw browser user-agent with the link event. These events are removed after six months. This measures visits to the survey page, not whether the email itself was opened.

Contacts can be archived or deleted. A Do not contact request is visibly enforced and only the minimum information needed to honour it is retained.

Purpose and choice

Survey data is used only to evaluate and improve NINOFF and decide whether an early pilot is justified. Research answers are processed with the respondent’s consent. Optional follow-up details are used only with separate contact consent. You may stop before submitting; the form stores no partial response.

Retention and reporting

Free-text research answers are removed after six months and complete survey responses after 18 months. Optional charity contact details are deleted with the response unless an active conversation provides a continuing reason to retain them. Outreach response text is removed after 12 months and archived outreach contacts after 24 months. Minimum suppression information may be kept where necessary to honour a Do not contact request. Findings are reported in aggregate; identifiable contact details are not published.

Recruitment source and funnel measurement

A link may include simple source and campaign labels such as donor-email, direct-charity-email, LinkedIn or organic. NINOFF records whether an anonymous session viewed the homepage or demonstrator, opened a survey and completed it. A random session value is stored only as a one-way hash so repeat page loads are not counted as new visitors. No IP address, browser fingerprint or advertising identifier is stored with these events. Funnel events are deleted after six months.

Technical data

The service uses a necessary secure session cookie for form protection and administrator sign-in. Server security logs can include an IP address, requested page and browser information and are retained for 14 days for service security. Survey records do not store IP addresses or browser user-agent strings.

Financial transparency

The demonstrator uses example data and public pages do not expose donor identities. A future production service must continue to separate private financial and identity records from information explicitly approved for publication.