Privacy Policy – HUJI Crowd

Introduction
Welcome to HUJI Crowd, the crowdfunding platform of The Hebrew University of Jerusalem (“HUJI,” “University,” “we,” “us,” or “our”).
HUJI Crowd enables users around the world to learn about and support fundraising campaigns for projects, initiatives, research, academic, student, public-interest, and other institutional activities that are reviewed, approved, and operated under HUJI’s framework. Campaigns may be presented by different schools, faculties, departments, clinics, centres, units, programs, projects, or authorized representatives of HUJI, but HUJI operates the platform itself.
This Privacy Policy outlines how we handle your personal information when you use the Platform, make donations, participate as an Ambassador, or communicate with HUJI about campaigns and Platform activity.
This Privacy Policy should be read together with the Platform’s Terms of Use.
Who Controls the Personal Information
For purposes of the Platform, HUJI is the primary and central operator of the Platform and the controller responsible for the personal information collected through it.
Campaigns may be submitted, managed, or promoted by different HUJI units or authorized personnel. However, for purposes of the Platform, such units act within HUJI’s institutional framework, and not as separate independent institutions operating separate crowdfunding platforms.
The Hebrew University of Jerusalem
Mount Scopus Campus, Jerusalem 9190500
You can click here to get in touch
Scope of This Policy
This Policy applies to personal information collected through the HUJI Crowd website and related webpages, donation forms and checkout flows, account registration and login areas for Ambassadors or other registered users, contact forms, support channels, and related communications, cookies, analytics, and similar tracking technologies used on the Platform.
How We Collect Personal Information
We collect personal information:
• directly from you;
• automatically through your use of the Platform, and where applicable through HUJI affiliates and authorized fundraising partners
• from payment processors and service providers involved in donation processing;
• from HUJI personnel, departments, schools, faculties, or campaign managers involved in campaign administration;
• from social media, referral links, or ambassador interactions where relevant;
• from third parties where disclosure is lawful and relevant to fraud prevention, donation administration, compliance, or support.
Categories of Personal Information We Collect
5.1 Information you provide directly
A. Donors
Donors are generally not required to create a formal user account in order to make a donation. However, when making a donation, a donor may be asked to provide information such as full name, billing address, email address, phone number, donation amount, campaign supported, information relating to tribute giving, comments, or donor messages, and where relevant, identity-related details needed for verification, fraud prevention, tax/receipt issuance, fulfilment, or donor servicing.
Depending on the donation flow and operational needs, HUJI may also collect limited transaction-related details, such as tokenized payment references or the last digits of the payment instrument, but HUJI does not store full payment card details on its own systems when a third-party payment processor processes payment.
B. Ambassadors
Ambassadors are users who help support, publicize, and encourage donations to HUJI campaigns through their own networks and contacts.
Unlike donors, Ambassadors must register and log in to use Ambassador-related functionality. In that context, we may collect full name, email address, authentication credentials, telephone number, country or location, profile details, affiliation to a campaign or HUJI initiative, referral, link-sharing, and outreach activity, and records of campaign advocacy or ambassador participation.
C. Users who contact us
When you contact us, including through a contact form, email, or other communication channel, we may collect your name, contact details, the contents of your inquiry, any information you choose to include in your message, any information reasonably needed to identify you and respond to your request.
5.2 Information collected automatically
When you use the Platform, we may automatically collect IP address, browser type and language settings, operating system, device identifiers, domain name, pages viewed, campaigns viewed, referral source, dates and times of access, session activity, interaction and navigation patterns, and records relating to donation flow interactions and campaign engagement.
5.3 Cookies and similar technologies
We may use cookies, pixels, tags, web beacons, SDKs, and similar technologies to operate and secure the Platform, remember preferences, understand traffic and usage patterns, improve campaigns and donation flows, measure the effectiveness of outreach and ambassador activity, support analytics and marketing functions, where permitted by law.
Why We Use Personal Information
We may use personal information for the following purposes:
6.1 To operate the Platform- Offer access to the Platform and its core functionalities, facilitate browsing and active participation in campaigns, manage and process donation transactions, issue confirmations, receipts, and other communications related to donations, enable login, authentication, and account management for Ambassadors and other registered users.
6.2 To manage campaigns and donor relationships – Conduct HUJI-approved campaigns, correspond with donors and prospective donors, oversee donor services, acknowledgements, fulfilment, and support; facilitate recurring contributions and donor engagement, and maintain records associated with fundraising activities.
6.3 To operate the Ambassador feature
Ambassador information may be utilized to establish and maintain Ambassador accounts, associate Ambassadors with designated campaigns, offer sharing and referral tools, and facilitate campaign advocacy features. We also use this information to assess engagement resulting from Ambassador activities, as well as to acknowledge, support, manage, or evaluate Ambassador contributions.
For clarity, the Ambassador feature is intended to support fundraising outreach. It is not intended to give Ambassadors general access to full donor databases. Unless expressly stated otherwise in the relevant interface or program rules, Ambassadors should receive only the level of information reasonably necessary for the Ambassador function, which may include aggregated or limited activity information rather than full donor-level visibility.
6.4 To communicate with you- respond to your questions and requests, send service messages, send campaign updates, send marketing, newsletters, and fundraising communications, where permitted by applicable law and your preferences.
6.5. To manage Campaign Benefits and Fulfilment (“Perks”)
Certain campaigns available on the Platform may offer donors non-monetary benefits, products, services, or other forms of recognition or rewards in connection with a donation (the “Perks”). Where such Perks are offered, HUJI may process personal information as necessary to determine donor eligibility for specific Perks, administer and manage Perk allocation, communicate with donors regarding fulfilment, coordinate delivery or provision of Perks (including digital or physical items), maintain records for operational, financial, and compliance purposes.
This may involve processing additional information such as shipping address, contact details, or fulfilment preferences. Where required, personal information may be shared with authorized HUJI personnel, campaign managers, or service providers involved in fulfilment (e.g., logistics providers, vendors, or service partners), strictly for the purpose of delivering the Perks.
Perks are provided as part of campaign engagement and do not constitute a sale of personal information.
6.6 To analyze and improve the Platform – troubleshoot and diagnose technical issues, improve usability and donation conversion, conduct analytics, surveys, research, and reporting, customize or refine content, campaigns, and user experience.
6.7 For security, fraud prevention, and legal compliance- verify transactions and detect suspicious activity, protect the security and integrity of the Platform, enforce our Terms and this Policy, comply with legal obligations, court orders, and lawful requests, and defend against claims or reduce harm to HUJI or others.
Ambassador Promotion
Ambassadors are responsible for ensuring that any third-party promotion is conducted through lawful and appropriate outreach methods. They must not upload, scrape, harvest, or misuse third-party personal information via the Platform unless such features are expressly permitted by the Platform and all applicable legal requirements are met. Ambassadors may not act outside the scope of authorization granted by HUJI.
When We Share Personal Information
We do not sell personal information for money. We may disclose personal information in the following circumstances:
8.1 Within HUJI (including internal units and departments)
We may share information internally within HUJI with authorized schools, faculties, departments, centres, campaign teams, development staff, alumni relations personnel, finance personnel, donor-relations personnel, support teams, and other authorized representatives or units, where reasonably necessary for campaign administration, donation processing, donor relations, ambassador administration, support, fulfilment, analytics, finance, security, compliance, or related institutional operations.
8.2. Affiliated Fundraising Entities
Personal information relating to donations may be accessed by authorized personnel of HUJI and, where applicable, affiliated fundraising organizations (including entities supporting HUJI in specific jurisdictions, such as the United States), solely for purposes including donation administration, donor relations, financial reporting and compliance, campaign management and support.
Such access is granted on a need-to-know basis and subject to appropriate confidentiality and data protection obligations.

8.3 Service providers and contractors
We may share information with third-party vendors and service providers that assist us with payment processing, hosting and cloud services, donor communications, email and messaging, analytics, customer support, security, fulfilment and delivery, technical maintenance, and campaign operations.
We require such parties to use personal information only as needed to provide services to HUJI and subject to appropriate confidentiality and data-protection obligations.
8.4 Payment processors
When you make a donation, payment information may be handled by third-party payment processors. HUJI may transmit the necessary transaction data to those processors, but does not itself store the full payment card data on its own systems.
8.4.1. Payment Processing via Stripe
Donations made through the Platform (including those originating from the United States) are processed via Stripe.
When you make a donation certain personal and transaction information (such as name, billing details, and payment information) is transmitted directly to Stripe. Stripe processes such data in accordance with its own privacy policy and applicable financial regulations. HUJI does not store full payment card numbers on its own systems.
Stripe may act as an independent controller for certain aspects of payment processing. For more information, please review Stripe’s privacy policy.

8.5 Legal and protective disclosures
We may disclose information if required by law, in response to a subpoena, court order, or lawful request. We may also disclose information to investigate fraud, security incidents, or illegal activity, to enforce our rights and to protect HUJI, users, donors, Ambassadors, or third parties from harm.
8.6 Business or organizational changes
If legally relevant in connection with a restructuring, reorganization, merger, asset transfer, or similar institutional transaction, information may be transferred as permitted by law.

International Transfers
Personal information may be transferred to and processed in multiple jurisdictions, including Israel and the United States.
In particular:
• payment-related data may be processed by service providers located in the United States (including Stripe);
• authorized personnel in different jurisdictions may access data for operational and fundraising purposes.
HUJI implements appropriate safeguards designed to ensure that such transfers are carried out in accordance with applicable data protection laws.
Data Retention
We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including donation administration, receipts, bookkeeping, and tax-related records, donor relations and fundraising records, Ambassador account administration, compliance, dispute handling, security, and legal defense, archival, historical, research, and institutional recordkeeping where permitted by law.
Data Security
HUJI uses reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, misuse, alteration, destruction, or loss. These may include role-based access restrictions, authentication controls, vendor due diligence, secure payment integrations, logging and monitoring, encryption in transit where appropriate and security and incident-management procedures.
At the same time, no internet transmission or storage system is completely secure, and absolute security cannot be guaranteed.
Your Rights and Choices
12.1 Communications preferences
You may opt out of marketing emails by using the unsubscribe mechanism in the message or by contacting us.
12.2 Access and correction
Depending on applicable law, you may request access to personal information we hold about you and request correction of inaccurate information.
12.3 US state privacy rights
Depending on your US state of residence, you may have some or all of the following rights, subject to applicable exceptions:
• to know/access categories or specific pieces of personal information;
• to correct inaccurate information;
• to delete certain personal information;
• to obtain information about disclosures;
• Data Portability- You may request a copy of your personal information in a portable and usable format.
• to appeal a denial of a request, where applicable;
• to opt out of certain targeted advertising or profiling activities, where applicable.
HUJI will not discriminate against you for exercising applicable privacy rights.
HUJI does not sell personal information and does not engage in targeted advertising or such profiling.
12.4 Exercising Your Rights
To submit a request, please contact the Data Protection Officer (DPO) via mail: privacy@savion.huji.ac.il
We may need to verify your identity before processing your request.
We will respond within the timeframe required by applicable law.
12.5 Appeals Process
If we decline to take action on your request, you may have the right to appeal our decision, depending on your state of residence.
Appeal requests may be submitted to the DPO.
12.6 Authorized Agents
Where permitted by applicable law (including in California), you may designate an authorized agent to submit requests on your behalf. We may require appropriate verification of identity and authorization.

12.7 Cookie choices
You may control some cookies through your browser settings and, where implemented, through cookie-consent tools on the Platform. Blocking some cookies may affect functionality.
13. Public Content and Social Sharing
If the Platform enables public comments, public messages, campaign testimonials, or content sharing through social or public-facing features, information you choose to post in such spaces may become public or widely visible.
14. Children
The Platform is not intended for children under 16, and HUJI does not knowingly collect personal information from children under 16 through the Platform without appropriate authorization.
If you believe a child has provided personal information improperly, please contact us so we can review and, where appropriate, delete the information.
15. Third-Party Sites and Services
The Platform may contain links to third-party websites, social-media services, campaign-related pages, or other external resources. HUJI is not responsible for the privacy, security, or information practices of those third parties. We encourage you to review their privacy policies before interacting with them.

REGIONAL PRIVACY DISCLOSURES
16.1. Residents of California
If you are a resident of California, you have certain rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
We collect personal information in several ways, including directly from you, automatically through your use of the Platform, and from service providers.
Categories of personal information collected may include the following:

Category of Personal Information Categories of Sources Purposes of Use Categories of Third Parties to Whom Disclosed
Identifiers (name, email, IP address) Users (donors, ambassadors), platform usage, service providers Providing the Platform; processing donations; communication; security; fraud prevention HUJI internal units; service providers; payment processors (Stripe); affiliated fundraising entities
Contact Information (email, phone) Users directly; ambassador registration Donor communication; receipts; campaign updates; support; ambassador management HUJI personnel; service providers; affiliated fundraising entities
Financial / Donation Information (amount, campaign supported) Users (donation forms); payment processors Processing donations; financial reporting; compliance; donor management Payment processors (Stripe); HUJI finance teams; affiliated fundraising entities
Payment Data (limited) (tokenized/payment reference data only) Payment processors (Stripe) Transaction verification; fraud prevention; recordkeeping Stripe; HUJI authorized personnel
Internet / Network Activity (IP, browsing behaviour, interaction with campaigns) Automatically collected via platform, cookies, analytics tools Platform operation; analytics; performance improvement; fraud detection; security Service providers (analytics, hosting); HUJI IT/security teams
Device & Technical Data (browser, OS, device type) Automatically collected Platform functionality; troubleshooting; analytics; security Service providers; HUJI IT
Communications (emails, inquiries, support messages) Users directly Responding to inquiries; support; legal compliance; recordkeeping HUJI personnel; service providers
Ambassador Data (account details, activity, referrals) Ambassador registration; platform activity Managing ambassador accounts; tracking campaign promotion; platform analytics; fraud prevention HUJI personnel; service providers
Campaign Interaction Data (donations, engagement, campaign views) Platform usage; users; ambassadors Campaign management; reporting; analytics; improving fundraising effectiveness HUJI units; service providers
Geolocation Data (approximate) (derived from IP) Automatically collected Security; fraud prevention; analytics; system optimization Service providers; HUJI IT/security
User-Generated Content (messages, comments, campaign interactions) Users directly Platform functionality; communication; moderation; legal compliance HUJI personnel; service providers
Account Credentials (Ambassadors only) Users (registration) Authentication; account security; access control Service providers (auth systems); HUJI IT
Fraud & Security Data (logs, verification signals) Platform systems; service providers Fraud detection; security monitoring; legal compliance HUJI security teams; service providers
Inferences (e.g., engagement patterns, donation behaviour trends) Derived from usage and donation activity Platform improvement; campaign optimization; analytics HUJI internal analytics teams; service providers

No Sale or Sharing- We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioural advertising.
California “Shine the Light” Disclosure
Under California Civil Code Section 1798.83 (the “Shine the Light” law), California residents may request information regarding the disclosure of their personal information to third parties for those third parties’ direct marketing purposes.
HUJI does not disclose personal information to third parties for their own direct marketing purposes, except where such disclosures are made to affiliated organizations or service providers acting on HUJI’s behalf and subject to appropriate contractual restrictions.
California residents may request further information by contacting the Data Protection Officer via contacting details below.

16.2. Residents of Colorado
If you are a resident of Colorado, you have certain rights under the Colorado Privacy Act (“CPA”).
Please refer to the table included in our California Privacy Notice above, which describes, the categories of personal information we collect, the sources of such information, the purposes for which we use it; and the categories of third parties with whom it is disclosed. This information applies equally to Colorado residents.
16.3. Residents of Nevada
If you are a resident of Nevada, you have the right under Nevada Revised Statutes Chapter 603A to request that a website operator not sell certain personal information that the operator has collected or will collect about you.
HUJI does not sell personal information to third parties for monetary consideration as defined under Nevada law.
16.4 Residents of Virginia
If you are a resident of Virginia, you have certain rights under the Virginia Consumer Data Protection Act (“VCDPA”).
Please refer to the table included in our California Privacy Notice above. This information applies equally to Virginia residents.
16.5 Additional U.S. State Privacy Rights
Residents of certain U.S. states, including Connecticut, Utah, Texas, and Oregon, may have additional privacy rights under applicable state laws.
Please refer to the table included in our California Privacy Notice above. This information applies equally to residents of these states.
16.6 Users in the European Economic Area (EEA), United Kingdom and Switzerland
If you are located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland (collectively, “Europe”), this section applies to you.
For the purposes of applicable data protection laws, including the General Data Protection Regulation and the UK GDPR, The Hebrew University of Jerusalem (“HUJI”) acts as the data controller of your personal data collected through the Platform.
You may contact us using the details provided in the “Contact Us” section of this Privacy Policy.
legal Bases for Processing
We process your personal data on the following legal bases:
Processing Activity Legal Basis
Providing the Platform and Services Contractual necessity
Donation processing and administration Contractual necessity
Fundraising campaign management Contractual necessity; legal obligation
Provision of campaign benefits (“Perks”) Contractual necessity
Ambassador account management and activity tracking Contractual necessity; legitimate interest
Identity verification Contractual necessity; legal obligation; legitimate interest
Fraud prevention and security monitoring Legitimate interest; legal obligation
Communication with users (service-related) Contractual necessity; legitimate interest
Marketing communications (newsletters, updates) Consent
Improving the Platform and user experience Legitimate interest
Analytics and performance measurement Legitimate interest (or consent where required)
Compliance with legal and regulatory obligations Legal obligation

International Data Transfers
As a global platform, your personal data may be transferred outside the EEA, including to Israel and other jurisdictions.
Where required, such transfers are carried out subject to appropriate safeguards, including contractual protections designed to ensure an adequate level of data protection.

Your Rights Under European Data Protection Laws
If you are located in Europe, you have the right to:
• access your personal data;
• request correction of inaccurate data;
• request deletion of your data;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests;
• request data portability;
• withdraw consent where processing is based on consent.
To exercise your rights, please contact the Data Protection Officer via contact details below.

Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged infringement has occurred.
A list of EU supervisory authorities is available via the European Data Protection Board:
https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
We encourage you to contact us first, and we will do our best to resolve your concern.

Cookies Policy
This Cookie Policy explains how The Hebrew University of Jerusalem (“HUJI”, “we”, “us”) uses cookies and similar technologies on the HUJI Crowd platform (the “Platform”). Cookies and similar technologies are used to ensure the proper operation of the Platform, enhance user experience, analyze usage, and support security and fraud prevention.
When you visit the Platform, you will be notified about the use of cookies and, where required, asked to provide your consent for the use of non-essential cookies.

17.1 What Are Cookies
Cookies are small text files that are stored on your device when you visit a website. We may use the term “cookies” to refer to all technologies that store or access information on your device, including cookies, web beacons, pixel tags, local storage technologies.

17.2 Types of Cookies We Use
A. Session Cookies- These are temporary cookies that remain on your device until you leave the Platform. They are used to maintain session integrity and enable core functionality.
B. Persistent Cookies- These cookies remain on your device for a defined period or until you delete them. They help remember your preferences and settings across visits.
C. First-Party and Third-Party Cookies-
• First-party cookies are set by HUJI.
• Third-party cookies are set by service providers that support the Platform.
Third-party cookies may be placed by providers such as:
• Stripe (for secure payment processing)
• analytics or infrastructure providers used to operate and improve the Platform

17.3 How We Use Cookies
We use cookies for the following purposes:
A. Strictly Necessary Cookies- These cookies are essential for the Platform to function properly. They enable you to access secure areas of the Platform, navigate between pages, complete donation transactions, maintain session state, ensure platform security and fraud prevention.
These cookies cannot be disabled.
B. Functionality Cookies- These cookies allow the Platform to remember your preferences and choices, such as language settings, regional preferences, and user interface customizations. They improve usability and personalization.
C. Analytics and Performance Cookies
These cookies help us understand how users interact with the Platform, including pages visited, campaign interactions, time spent on pages, and navigation patterns. This information is used to improve platform performance, enhance user experience, and optimize fundraising campaigns.
D. Security and Fraud Prevention
Certain cookies and similar technologies are used to detect suspicious activity, prevent fraud, protect user accounts and transactions, and ensure the integrity of donation processes.
17.4 Managing Your Cookie Preferences
A. Cookie Banner / Consent Tool
You can manage your cookie preferences through the cookie banner or settings tool available on the Platform.
B. Browser Settings
Most web browsers allow you to refuse cookies, delete existing cookies, and receive alerts when cookies are set.
Please note that disabling cookies may affect the functionality of certain parts of the Platform.

17.5 Email Tracking Technologies
We may use limited tracking technologies in emails (such as pixels) to determine whether messages have been opened and improve communication effectiveness. You can opt out of marketing communications at any time

Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be posted with a revised “Last Updated” date. If a change legally requires additional notice or consent, we will provide it as required by applicable law.
Contact Us
If you have questions, concerns, or requests regarding privacy or this Privacy Policy, please contact the Data Protection Officer via privacy@savion.huji.ac.il