Donation and Fundraising Forms
A donation record says what a person believes: the church, the party-adjacent cause, the refugee charity, the rare-disease foundation named after the illness in their family. Zewo forecasts around CHF 2.3 billion in Swiss donations for 2025, most of it collected through forms nobody treats as sensitive. Encrypted in the donor's browser, stored in Switzerland, in four languages — and honest that we never touch the payment.
Zewo forecasts around CHF 2.3 billion in donations to Swiss charitable organisations for 2025 — the sixth consecutive year above two billion — with private households remaining the single largest source at roughly CHF 760 million, and Zewo-certified organisations receiving about CHF 1.47 billion of the total. Nearly all of it arrives through a form: a donation page, a pledge card transcribed by a volunteer, a legacy enquiry, a standing-order signup. Almost none of those forms are treated as though they hold sensitive data. Most of them do.
Schweizerform is an encrypted intake layer for that traffic. Every answer is encrypted in the donor's browser before it leaves the device, and only a holder of the Vault key can decrypt it. We are a Swiss company, encrypted submissions are stored in Switzerland with Infomaniak, and we cannot read a submission — not for support, not for analytics, not under legal process, because we do not hold the key. One thing to say immediately, because it decides whether we are the right tool at all: we never process the payment. No card fields, no card data, no direct debit execution. The money moves where it already moves.
Who this page is for
Charitable foundations and Hilfswerke, parishes and religious organisations, associations running a member-funded appeal, patient and rare-disease organisations, animal-welfare and environmental groups, cultural and sports sponsorship bodies, and foundations that receive funding applications as well as donations. Foundations running open calls should also read the scholarship and grant application use case; associations collecting from members, the association and club use case.
A Donation Record Is a Statement of Belief, Not a Transaction Record
Art. 5 lit. c nFADP treats data on religious, philosophical, political or trade-union views and activities as sensitive personal data, alongside health data. A donor list is exactly that, by construction. Giving to a parish or a religious mission is a statement about religion. Giving to a campaigning NGO on migration, drug policy or climate is a statement about political conviction. Giving to a rare-disease foundation is, very often, a statement about somebody's health — the donor's own, or a child's, or a parent's. Nobody asked a sensitive question; the sensitivity is in the choice of recipient.
This is the same structural point as an association's membership list, and it is the reason a fundraising database deserves better handling than a marketing list. It is also why the most common architecture in the sector — a donation form on a general-purpose platform, an export into a CRM, a spreadsheet on somebody's laptop for the mailing, and an agency with access to all three — is the wrong shape for the data it carries.
| What fundraising forms collect | Status under Swiss law | Who genuinely needs to read it | What drives retention |
|---|---|---|---|
| The fact of a donation to a religious, political or campaigning organisation | Sensitive by recipient — religious, philosophical or political views (Art. 5 lit. c nFADP) | Fundraising and finance, not the whole office and not the agency by default | Ten years for the booked transaction under Art. 958f CO; the marketing profile around it has no such justification |
| Name, address and the amount pledged | Ordinary data — but combined with the recipient it becomes a profile | Whoever issues receipts and thanks the donor | The accounting duty, plus whatever the donor agreed to for future contact |
| Bank details for a standing order or direct debit mandate | Ordinary data with a high fraud value — the raw material of payment-redirection attempts | The finance function alone, and ideally your bank rather than you | Only as long as the mandate; delete on cancellation |
| A donation made in memory of, or in honour of, a named person | Reveals a bereavement, a relationship and often a health history — of a third party who never filled in your form | The person writing the acknowledgement | Delete once acknowledged; never carry into a segmentation list |
| Legacy and bequest enquiries | Ordinary data on its face; in substance, family circumstances, wealth, health and end-of-life intentions | One or two named people in legacy fundraising. Never a shared mailbox | The relationship's lifetime, with an explicit review date — this is the longest-lived file in fundraising |
| Hardship or fee-waiver requests from beneficiaries of the same organisation | Sensitive where a social-assistance measure is involved | The case-handling function, kept structurally apart from fundraising | Delete once the case closes; never merge into the donor database |
| Requests to be anonymous, to be removed, or not to be contacted | Ordinary data — and the most operationally important record you hold | Everyone who sends anything, which is why it must be a list and not a memory | Keep the suppression record itself; it exists precisely so the deletion is honoured |
The in-memoriam donation collects data about someone who never met you
«In memory of Anna» plus an address plus a date is a bereavement record about a third party, sometimes with an implicit cause of death attached to the recipient organisation. The donor consented for themselves; the deceased's family did not. Collect the name to write the acknowledgement, and keep it out of every segmentation, model and mailing list afterwards. This is the single most common quiet over-collection in Swiss fundraising.
Why the Payment Must Never Touch the Form
The most damaging thing an organisation can do with a donation form is put a card number in it. A free-text field labelled «card number» turns an ordinary form tool into a system holding cardholder data, with everything the card schemes' security standards attach to that, and it will not be covered by any contract you have signed. We do not offer card fields and would refuse to be the place cardholder data is stored: we are an encrypted intake layer, not a payment service provider.
- Collect the intent, not the instrument. The form takes who is giving, how much they intend to give, whether it is one-off or recurring, whether they want a receipt, and how they wish to be acknowledged. The payment happens at a payment provider, on a bank transfer, or through your existing donation platform.
- Use the QR-bill for the transfer. Since 1 October 2022 the Swiss QR-bill has fully replaced the old red and orange payment slips, and a reference number on it is what reconciles a payment to a donor without your form ever holding an account credential.
- Direct debit mandates belong with your bank. Where you collect an IBAN for a mandate, treat it as the highest-value field on the form, restrict who can decrypt it, and delete it when the mandate ends rather than when the donor lapses.
- Never accept a card number that a donor writes into a free-text box anyway. They sometimes will. Delete the submission, tell them what happened, and reissue the request — do not export it into a CRM «just this once».
What this means for us, stated plainly
We do not process payments, do not generate QR-bills, do not run recurring billing or dunning, and do not reconcile transactions. If what you need is a checkout, buy a donation platform or a payment provider — that is a real product category and it does a job we do not do. What we are good at is the part around the payment: the pledge, the legacy enquiry, the receipt request, the beneficiary intake, and every form whose content is more revealing than its amount.
Receipts, Tax Deductions and the Ten-Year File
Under Art. 33a DBG, voluntary contributions to legal entities domiciled in Switzerland that are tax-exempt for public-interest or charitable purposes are deductible at federal level where they reach CHF 100 in the tax year and do not exceed 20 % of income after deductions. Most cantons mirror that shape, but not all: Neuchâtel caps the deduction at 5 % of net income, Ticino allows up to 50 %, and Basel-Landschaft is the only canton with no upper limit at all. Legal persons deduct under their own provision. That is why the receipt matters to donors, and why a receipt request is a normal part of a donation form rather than an afterthought.
It is also why «anonymous donation» is usually a smaller promise than donors think. A donation that produces a tax receipt is, by definition, an identified donation: the organisation knows the name and the amount, and the accounting record has to survive. Art. 958f CO requires business books and accounting records to be kept for ten years from the end of the financial year. What you can honour is external anonymity — not naming the donor in the annual report, the donor wall or the press release — and internal minimisation, keeping the identified record in finance rather than replicating it across fundraising, communications and the agency.
Separate the two anonymity questions on the form
«Do you want a receipt for your tax return?» and «may we name you publicly?» are different questions with different answers, and a form that conflates them will annoy the donors who care most. Ask both, store both, and make the public-naming answer visible to the people who write the annual report — which is a different reader set from the people who issue receipts.
Where Fundraising Teams Use Schweizerform
Donation and pledge forms
The core case: an encrypted form that captures the donor, the amount pledged, the designation, the receipt preference and the acknowledgement preference — with the payment handled separately. For an appeal that runs in more than one language region, the same form in German, French, Italian and English removes the quiet filter that a single-language donation page applies to your own supporter base.
Recurring giving and mandate signup
Standing orders and direct debit mandates are the most valuable thing a fundraiser collects and the most sensitive field on the page. Encrypted intake means the IBAN is unreadable to the platform, to your web agency and to anyone administering the account — which matters more than usual here, because bank details plus a plausible sender address are exactly the raw material of the payment-redirection fraud that targets charities constantly.
Receipt requests and address corrections
The unglamorous form that generates the most goodwill. A donor who gave by bank transfer in December and needs a receipt in February should not have to email a scan of their statement to a general inbox. A short encrypted form with a reference number, routed to finance only, closes that loop without creating a second copy of the donor's banking relationship in a mailbox.
Legacy and bequest enquiries
The most sensitive file in fundraising, and usually the worst protected. A legacy enquiry contains family structure, wealth, health, marital history and end-of-life intentions, and the relationship can run for a decade. The inheritance-law revision in force since 1 January 2023 makes this line of work materially larger: the compulsory portion for descendants fell from three quarters to one half of the statutory entitlement, the parents' compulsory portion was abolished entirely, and where a testator leaves a spouse and descendants the freely disposable share rose from three eighths to one half of the estate. More room to give means more enquiries — and every one of them belongs in an encrypted form read by one or two named people, not in a shared legacy@ mailbox.
Sponsorship, partnership and corporate giving
Commercial intake with a confidentiality problem: a company exploring a partnership does not want its interest visible before the decision, and the contact person's own position inside their employer can be delicate. The B2B due diligence and vendor onboarding use case covers the wider pattern of confidential commercial intake.
Grant applications received by the foundation
Foundations sit on both sides of this page: they raise money and they give it away. The incoming side — funding calls, hardship funds, project applications — carries household finances, medical certificates and social-assistance attestations submitted by people with no power in the relationship, and it has its own page in the scholarship, grant and funding application use case.
Complaints, suppression and «please stop contacting me»
The most operationally important form on the list and the one nobody builds. Requests to stop receiving mail, to be removed, to correct a record or to give anonymously in future must reach a place where they are acted on, not a volunteer's inbox. Keeping the suppression record is not in tension with deletion — it is what makes the deletion stick.
Zewo, Donor Addresses and the Sub-Processor Question
The Zewo standards are explicit that certified organisations may not sell, rent or exchange the collected data and addresses of natural persons — donors above all, but also members, employees, volunteers, beneficiaries and other affected persons — and that donor address data remains the organisation's sole property, which must be stipulated in contracts with any party handling it. That is a commitment about the whole chain, not only about the organisation's own conduct.
Which turns into a procurement question worth asking of every tool in your fundraising stack, including us: who else can read this data, under what contract, and in which country? A conventional platform answers with a list of sub-processors and a set of controls. An end-to-end encrypted intake layer answers differently — the provider cannot read the submissions, so the question narrows to what the provider holds at all. What a processing agreement should say either way is set out in the DPA guide for form tools.
Public collections may need a permit
Fundraising in public space is regulated cantonally, not federally. In the Canton of Zurich, for example, collecting donations or recruiting members in public or door to door requires a permit under the cantonal market and itinerant trade legislation; every collector must carry a copy and produce it on request, and a cantonal permit covers collections across several municipalities while otherwise the municipality issues it. Rules differ by canton — check yours before a street campaign, and remember that the sign-up forms your collectors carry hold exactly the donor data discussed above.
What We Can Count Without Reading Anything
Fundraisers optimise, and the honest question is what optimisation survives encryption. Quite a lot of it: the public form page loads no analytics provider and no beacon, yet we still count how many people opened the form, how many completed it, how long the median completion took, and — per question — how many of those who saw a question answered it. For a donation form, the per-question answer rate is the whole conversion diagnosis: the field people abandon is almost always the one you added last.
What we cannot do is tie any of that to a person or an amount. Counters are flat and never cross-tabulated, receive-time and never decremented, with no retroactive backfill; there is no attribution of a donation to a campaign source inside our system, no donor-level funnel and no lifetime-value modelling. There is also, and this is the commercial half of the argument, no consent dialog between the click and the first question — because there is nothing on the page to consent to. The reasoning is in form analytics without tracking.
Getting Started With Donation Forms
Decide where the money moves before you design the form
Bank transfer with a QR-bill, an existing donation platform, or a payment provider. The form collects intent and preferences; the payment path stays outside it. Getting this order right prevents the card-number field that causes all the trouble.
Split the reader sets
Finance issues receipts and holds mandates. Fundraising writes acknowledgements. Communications decides who is named publicly. Legacy is one or two named people. Those are four different reader sets, and a workspace per set is what makes the split real rather than a policy sentence.
Cut the fields you cannot justify
Date of birth on a donation form is almost never necessary. Nor is a phone number, an employer, or a «how did you hear about us» box placed before the donation is even made. Art. 6 nFADP proportionality is cheaper at design time than in an audit.
Ask the two anonymity questions separately
Receipt for the tax return, yes or no. Public naming, yes or no. Store both answers where the people who act on them can see them.
Write the Art. 19 information text onto the form
Who the controller is, the purpose, whether an agency or a fulfilment house will see the data, how long the record is kept — and the ten-year accounting duty on the booked transaction, which donors are entitled to know about rather than discover.
Set the retention rules and diarise them
Accounting record: ten years under Art. 958f CO. Mandate details: the life of the mandate. In-memoriam names: until acknowledged. Legacy files: an explicit review date. Deletion is an action you take, individually or in bulk, so it belongs in a calendar. Form data retention sets out how to write these rules.
Running a Fundraising Year End to End
Publish the appeal in every language your supporters read
One form, four language versions — German, French, Italian and English. Starting from a form template makes this an afternoon. A small organisation fits in the free plan; Pro at CHF 19 and Business at CHF 49 per month cover the rest.
Collect pledges and preferences; let the payment run its own path
The donor states intent and receives a QR-bill or is sent to your payment provider. Your form holds the relationship data; your bank holds the money movement.
Acknowledge quickly, and honour the naming preference
Thanks first, receipt second, public naming only where it was agreed. The acknowledgement is also where in-memoriam names stop travelling any further.
Issue receipts from one reader set
Finance decrypts, issues, and exports what the bookkeeping needs — CSV on every plan, Excel, PDF and ZIP on the paid tiers — into the accounting system, rather than mailing extracts to whoever asks.
Handle suppression requests the week they arrive
Removal, correction and «no further contact» requests are the ones that generate complaints when they age. Run them before the next mailing is built, not after it is sent.
Close the year: report, then delete
Publish the annual report with only the donors who agreed to be named, then run the deletion rules for everything the ten-year accounting duty does not cover. The two belong in the same closing checklist.
Common Objections — and Realistic Answers
We already use a donation platform that takes the payment. Why add a form tool?
Then keep it for the checkout — that is the job it does and we do not compete with it. The gap is everything around the checkout: the legacy enquiry, the receipt request, the beneficiary application, the complaint, the sponsorship approach, the survey of major donors. Those forms are usually improvised on whatever is free, and they are the ones carrying health, family and financial detail rather than a transaction amount.
Our donors want to give anonymously.
Some do, and the honest answer distinguishes three different requests. Anonymous in public — easy, and you should offer it explicitly. Anonymous to the fundraising team but identified to finance — achievable with separated reader sets, and worth doing for major gifts. Anonymous to the organisation entirely — possible only where the donor forgoes a receipt and pays in a way that does not carry their identity, which for a bank transfer it usually does. Say which one you can honour rather than printing the word on a page.
Our CRM needs all of it anyway, so what has been gained?
Two things. First, the intake stops being a second permanent readable copy on a platform in another jurisdiction — the master record is unreadable to the provider, and the copy in your CRM is one you consciously exported. Second, the forms that do not belong in the CRM stop being pushed there by default: the hardship application, the complaint, the legacy enquiry at an early stage. Where a fundraising database is concerned, «what did we choose not to import» is a better question than «what can we sync».
We need conversion tracking on the donation funnel.
You get per-question answer rates, completion times and daily counts, which diagnose a form far better than most teams expect. You do not get donor-level attribution, campaign source tracking or lifetime-value modelling from us. If donor-level attribution is the core of your fundraising strategy, run the transactional funnel on your donation platform and use encrypted forms for the sensitive intake around it. Splitting the two is a legitimate architecture, not a compromise.
We are a parish with two hundred givers and a volunteer treasurer.
Then the risk is not a regulator, it is the leak of a list that says who in the village gives to the church and how much. Small organisations do not have smaller consequences, they have fewer people to notice. For a parish, this is one encrypted form, one Vault key held by two people, a suppression list and a deletion date — an afternoon's work, and the same architecture the large Hilfswerke need for the same reason.
Where Schweizerform Is Not the Right Answer
- We are not a payment provider. No card processing, no QR-bill generation, no recurring billing, no dunning, no reconciliation. Keep your donation platform or your bank for that.
- We are not a fundraising CRM. No donor records, no segmentation, no mailing tool, no campaign management, no lifetime-value reporting.
- No donor-level analytics. No attribution, no source tracking, no funnel by person. Counting only, and never cross-tabulated.
- No automatic per-form retention rule. Deletion is an action someone takes, individually or in bulk — which for a ten-year accounting duty and a one-year marketing record means two different diary entries.
- Key loss is unrecoverable, so custody — two named people, an offline copy, a handover step — has to be settled before the first appeal goes live.
The Bottom Line for Donation and Fundraising Forms
Swiss giving is a CHF 2.3 billion flow that runs almost entirely through forms, and the data those forms carry is sensitive under Art. 5 lit. c nFADP by virtue of who the money goes to. Around it sit a tax-deduction regime that makes receipts necessary and varies by canton, a ten-year accounting duty under Art. 958f CO, a Zewo standard that forbids selling, renting or exchanging donor addresses anywhere in the chain, cantonal permit rules for public collections, and an inheritance-law revision since 2023 that has made legacy fundraising materially larger and its enquiry files more sensitive still.
The part you can fix quickly is the intake. Encrypt in the donor's browser, keep the payment at the payment provider, split finance from fundraising from communications from legacy, ask the two anonymity questions separately, and write a deletion date next to every form that is not the accounting record. What we do not do — take the money, run the CRM, attribute the campaign — we would rather you knew before your next appeal than after it.
Start with the form you would least like to see leaked — the legacy enquiry, the hardship application or the major-donor conversation — on the free plan: encrypted in the donor's browser, stored in Switzerland, published in four languages, and readable only by the one or two people who should read it.
Disclaimer: this page is general information and marketing content, not legal, tax or fundraising advice. References to the nFADP/nDSG, Art. 33a DBG and cantonal deduction limits, Art. 958f CO, the inheritance-law revision in force since 1 January 2023, the Zewo standards, Zewo donation statistics and cantonal collection permits are summarised at a conceptual level, reflect the position as of July 2026, and are subject to cantonal variation and judicial interpretation. Responsibility for the lawful processing of donor data remains with the organisation. Consult a qualified Swiss tax or data-protection adviser before relying on any summary here.