This Privacy Policy covers our treatment of (1) personal information, as defined by the Massachusetts Office of Consumer Affairs and Business Regulation in 201 CMR 17.00 (the “MA Data Incident Regulation”), (2) personally identifiable information, as defined by numerous statutes in the United States (such statutes, the “PII Laws”), (3) information protected by the California Consumer Privacy Act (the “CCPA”), the California Privacy Rights Act (the “CPRA”), and the California Online Privacy Protection Act (“CalOPPA”), (4) personal information and private information, as defined by the New York Stop Hacks and Improve Electronic Data Security Act (the “SHIELD Act”), (5) personal information, as defined by Canada’s Personal Information Protection and Electronics Documents Act (“PIPEDA”), and (6)  personal information the confidentiality, availability, or integrity of which is protected by applicable law (such laws collectively with the MA Data Incident Regulation, PII Laws, CCPA, CPRA, CalOPPA, the SHIELD Act, and PIPEDA, the “Privacy Laws”) (collectively, “Personal Information”), which we gather when you are accessing, viewing or using any of our Websites and/or Services. This policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage.

ECCF does not collect Personal Information indiscriminately. We limit the type of Personal Information and the amount of Personal Information to what is necessary to fulfill the purposes identified in this Privacy Policy. With that in mind, we collect the following types of information:

A. Information You Provide to Us

We may collect Personal Information from you when you visit any of our Websites, register for or subscribe to any Services, contact us with questions or comments, complete any form or document for us that includes a link or reference to this Privacy Policy (“Community Foundation Form”), and/or otherwise interact with the Websites or Services. For example, when you register for our Services, we may collect your name and contact information. Similarly, when you donate money to ECCF, we will collect the payment information you provide (credit card number, debit card number, bank account number, etc.). Additionally, while interacting with the Services, we may collect (a) your website information, and (b) demographic information, including your zip code and information regarding your preferences and interests. You can choose not to provide us with certain information, although that may affect the functionality of the Services.

B. Information Collected Automatically

When you use our Services, certain information is passively collected (that is, gathered without your actively providing the information) using various technologies and means, such as Internet Protocol (IP) addresses and cookies. These are described in more detail below:

• • IP Addresses. The Services uses IP addresses. An IP address is a number assigned to your device by your internet service provider to access the internet. In most consumer cases an IP address is dynamic (changing each time you connect to the internet), and not static (unique to a particular user’s device).
  • Cookies are small text files that are placed on your device by websites that you visit. They are widely used to make websites work, or work more efficiently, and to provide information to the owners of the site. Most web browsers allow some control of cookies through browser settings. We may collect the following information via cookies when you visit a Website or interact with the Services: aggregate statistical information, information related to your use of our Services (including your password, the links you click on, your movement around the Websites and Services, the pages you visit, the number of times you open a page, and which information is consulted), your IP address, and your browser type. You may be able to change the preferences on your browser or mobile device to send “do not track” signals or to prevent or limit your computer or device’s acceptance of cookies, but this may affect the functionality of the Services or prevent you from using parts of the Services. If you click on a link to a third-party website or portal, such third party may also transmit cookies to you. This Privacy Policy does not cover the use of cookies by any third parties.

C. E-mail and Other Communications

We may contact you, by email or other means; for example, we may communicate with you about your use of any of the Websites. When we do this, we may receive a confirmation when you open an email from us. This confirmation helps us make emails more interesting and improve our service. If you do not want to receive email or other mail from us, please contact us at privacy@eccf.org. Please note that if you do not want to receive legal notices from us, those legal notices will still govern your use of the Websites, and you are responsible for reviewing such legal notices for changes.

D. Sensitive Personal Information

As part of receiving donations, we collect donors’ payment information, including credit card numbers, debit card numbers, and bank account information. With the exception of the information stated in the previous sentence, and except as otherwise stated in this Privacy Policy, we do not knowingly collect sensitive Personal Information, including: government identifiers (such as Social Security numbers and driver’s licenses); financial account and login information (such as credit or debit card number together with login credentials), except as described above; precise geolocation; race, ethnicity, religious or philosophical beliefs, or union membership; content of nonpublic communications (mail, email and text messages); genetic data; biometric or health information; and sex life or sexual orientation information. Where we collect and use such information as a contractor or service provider (as those terms are defined in the CCPA and CPRA), we rely on the business (as defined in the CCPA and CPRA) to obtain your informed consent.

ECCF collects and uses Personal Information:

• • To respond to inquiries and comments;
  • To fulfill your requests concerning events, the Websites, and the Services;
  • To contact you with administrative communications and changes to this Privacy Policy, the Terms of Use, and our other policies;
  • To provide you with information about events, products, or services that we believe will interest you;
  • To tailor content and recommendations we and third parties display to you on the Websites, through the Services, and elsewhere online;
  • To collect and maintain donations;
  • To operate, maintain, develop, and grow ECCF;
  • To operate, develop, maintain, and improve the Websites and Services;
  • To conduct market research;
  • To analyze how visitors use the Websites and Services;
  • To investigate and resolve disputes and security issues;
  • To comply with regulatory and legal obligations; and
  • For any other lawful, legitimate business purpose.

We may also share certain Personal Information with third parties (as described in this Section and in Section IV below).

We share your Personal Information with third parties as described below.

A. Affiliated Businesses and Third Party Websites We Do Not Control

In certain situations, businesses or third party websites we’re affiliated with may sell items or provide services to you through a website (either alone or jointly with us). You can recognize when an affiliated business is associated with such a transaction or service, and we will share your Personal Information with that affiliated business only to the extent that it is related to such transaction or service. We have no control over the policies and practices of third party websites as to privacy or anything else, so if you choose to enter into such transaction or to receive such service, please review the applicable third party websites’ policies.

B. Agents and Service Providers

We employ other companies and people to perform tasks on our behalf and may need to share your Personal Information with them to provide products or services to you. Unless we tell you differently, our agents and service providers do not have any right to use the Personal Information we share with them beyond what is necessary to assist us. We acknowledge our potential liability if our agents misuse your Personal Information.

C. Business Transfers

We may choose to buy or sell assets. In these types of transactions, customer information is typically one of the business assets that is transferred. Also, if we (or substantially all of our assets) are acquired, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information would be one of the assets transferred to or acquired by a third party.

D. Protection of ECCF and Others

We reserve the right to access, read, preserve, and disclose any information that we reasonably believe is necessary to comply with law or court order; enforce or apply our Terms of Use and other agreements; or protect the rights, property, or safety of ECCF, our employees, our users, or others. This includes exchanging information with other companies and organizations for fraud protection and credit risk reduction.

E. With Your Consent

Except as set forth above, you will be notified when your Personal Information may be shared with third parties, and will be able to prevent the sharing of this information.

F. Personal Information ECCF Has Sold in the Last 12 Months

ECCF does not sell Personal Information.

Except upon the request of an individual, as explained in Section VI below, and except as the law permits and requires, ECCF determines the retention period for Personal Information based on the following criteria:

1. 1. The nature of our relationship with you;
   2. The nature of the Personal Information in question; and
   3. Our business needs.

To the extent required by the Privacy Laws, except where permitted or required by law (including, but not limited to, compliance with a legal obligation, to further a public interest, and establishing and/or exercising a legal claim or defense), you have the following rights regarding ECCF’s collection and use of your Personal Information.

A. Requests to ECCF

You may request the following from ECCF with respect to your Personal Information:

1. 1. The correction, updating, deletion, or restriction of collection and use of your Personal Information;
   2. The categories of Personal Information ECCF has collected about you;
   3. The envisaged period for which the Personal Information will be stored, or, if not possible, the criteria used to determine that period;
   4. The business or commercial purpose(s) for collecting and disclosing your Personal Information;
   5. An account of how ECCF has used or is using your Personal Information;
   6. A copy of your Personal Information, including the specific pieces of Personal Information, in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format, which also may be transmitted to another entity at your request without hindrance;
   7. The categories of third parties with whom ECCF shares your Personal Information;
   8. The categories of your Personal Information that we have shared with third parties and the categories of third parties to which we have shared each particular category of Personal Information;
   9. The Personal Information ECCF collects, uses, discloses, shares, and sells; and
   10. A list of all third parties that have received your Personal Information from ECCF.

All requests may be sent to privacy@eccf.org.

If you request that your Personal Information be erased or deleted or that ECCF otherwise restrict its collection and use of Personal Information, ECCF may terminate or limit your access to the Websites and Services. If ECCF has not collected or used your Personal Information, or has not disclosed your Personal Information to another party, ECCF will inform you of that in response to any of the above requests. Some information may remain in ECCF’s backup media after erasure or deletion for a period of time. When you request that ECCF update information, ECCF may retain a copy of the unrevised information in ECCF’s records.

We will confirm receipt of all such requests, provide information about how ECCF will process the request, and substantively respond to all such requests consistent with the Privacy Laws. There may be a delay in processing a request while we verify that the request is valid and originates from you as opposed to an unauthorized third party. Our verification process varies based on the source and nature of the request, but may include: comparing data in the request against Personal Information we retain; contacting you using other contact information; requesting further information, although we will avoid doing so to the extent possible; and the consideration of certain factors, including the type, sensitivity, and value of your Personal Information, the risk of harm to you posed by an unauthorized request, the likelihood that fraudulent or malicious actors would seek your Personal Information, the manner in which we interact with you, the available technology, and whether the information you have provided to verify your identity is sufficiently robust to protect against fraudulent requests. To the extent permitted by the Privacy Laws, ECCF retains the right to deny any request if we cannot verify that it originated from you.

ECCF retains records of all of the above requests and our responses as required by the Privacy Laws.

When you update information, we may maintain a copy of the unrevised information in our records. Please note that some information may remain in our private records after your deletion of such information from your account.

ECCF may use any anonymized aggregated statistical data derived from or incorporating Personal Information after it is updated, erased, or deleted, but not in a manner that would identify you.

B. Withdrawal of Consent

To the extent that we process your Personal Information based on your consent, you may withdraw your consent at any time by contacting us at privacy@eccf.org.

Please be aware that such withdrawal does not affect the lawfulness of ECCF’s use of your Personal Information before such withdrawal. We reserve the right to terminate and/or limit your access to the Websites and Services in the event that you withdraw your consent.

C. “Do Not Sell My Personal Information” and Opting Out of Sharing Personal Information

ECCF does not sell Personal Information. You may opt out of the disclosure and sharing of your Personal Information by contacting us at privacy@eccf.org.

We will act upon any request to opt out of all disclosure and sharing of your Personal Information, including notifying all third parties to whom we have disclosed or shared your Personal Information and ceasing to disclose or share your Personal Information, consistent with the requirements of the Privacy Laws.

Please see Section VII for an explanation how opting out of the disclosure and sharing of your Personal Information may affect service differences offered by ECCF.

D. Object or Challenge

You may object to, or otherwise challenge, ECCF’s collection and use of your Personal Information by contacting us at privacy@eccf.org. ECCF will respond consistent with the requirements of the Privacy Laws.

E. Filing a Complaint

Regulatory authorities that oversee the Privacy Laws typically advise individuals to file an objection or challenge with the company before lodging a formal complaint with a regulatory authority. If an individual is dissatisfied with ECCF’s response to an objection or challenge filed under Section VI.E, or wishes to file a complaint with a regulatory authority first, the individual may do so, including as follows:

• • Massachusetts: Massachusetts Attorney General;
  • PIPEDA: Office of the Privacy Commissioner of Canada;
  • CCPA: California Attorney General; and
  • PII Laws: the relevant states’ Attorney General’s office.

F. Prohibit Automated Processing

At your request, ECCF will terminate any automated decision making, including profiling, that is the sole source of decisions that produce a legal effect concerning or similarly significantly affecting you. Consistent with Section XII, ECCF does not use any such automated decision-making or profiling at this time.

G. Accessibility for Users with Disabilities

If you are unable to review this Privacy Policy or any portion of this Policy, please contact us at privacy@eccf.org to request an alternative format.

H. Non-Discrimination

ECCF will not discriminate against you because you have exercised any of the rights above or any other rights you retain pursuant to Privacy Laws, including, but not limited to by:

1. 1. Denying goods or services to you;
   2. Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
   3. Providing a different level or quality of goods or services to you; and
   4. Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Consistent with Privacy Laws, ECCF: (i) retains the right to charge you a different price or rate, or provide a different level or quality of goods or services to you, if that difference is reasonably related to the value provided to ECCF by your Personal Information; (ii) may offer financial incentives, including payments to you as compensation, for the collection, disclosure, or deletion of your Personal Information; (iii) may enter you into a financial incentive program only if ECCF clearly describes the material terms of the financial incentive program, so long as you give ECCF prior opt-in consent, which you may revoke at any time; and (iv) shall not use financial incentive practices that are unjust, unreasonable, coercive, or usurious in nature.

ECCF does not offer any financial incentives for providing your Personal Information.

We employ appropriate administrative, organizational, technical, and physical measures to protect your Personal Information, which we regularly review and update as necessary. We endeavor to protect the privacy of the Personal Information we hold in our records, but we cannot guarantee complete security. Unauthorized entry or use, hardware or software failure, and other factors, may compromise the security of user information at any time. The Websites may contain links to other sites. We are not responsible for the privacy policies and/or practices on other sites. When following a link to another site you should read that site’s privacy policy.

We do not knowingly collect or solicit Personal Information from anyone under the age of 18 or knowingly allow such persons to register for the Services. If you are under 18, please do not attempt to register for the Services or send any information about yourself to us. No one under age 18 may provide any Personal Information to us or through the Services. In the event that we learn that we have collected Personal Information from a child under age 18 without verification of parental consent, we will delete that information as quickly as possible, except as provided below. If you believe that we might have any information from or about a child under age 18, please contact us at privacy@eccf.org.

Upon request, we will provide a parent or guardian who has provided proper identification with the following: (1) a description of the specific types of Personal Information collected from the child, (2) the opportunity to refuse or permit ECCF’s further collection and use of Personal Information from the child, and (3) a reasonable means for the parent or guardian to obtain any Personal Information collected from the child. If a parent or guardian does not permit ECCF’s continued collection and use of a child’s Personal Information, ECCF will delete the child’s Personal Information and unsubscribe child from the Services, as applicable.

Except as noted in this Privacy Policy or in contractual documents, ECCF’s collection and use of Personal Information is not a contractual or statutory requirement or a requirement necessary to enter into a contract.

You can always opt not to disclose information to us, but keep in mind some information may be needed to register with us or to take advantage of some of our special features.

ECCF does not rely on automated decision-making, including profiling, and will not subject you to decisions based solely on automated processing which will produce legal effects concerning you or similarly significantly affecting you.

We may amend this Privacy Policy from time to time. Use of information we collect now is subject to the Privacy Policy in effect at the time such information is used. If we make changes in the way we use Personal Information, we will notify you by posting an announcement on our Website or sending you an email. You are bound by any changes to the Privacy Policy when you use the Website or the Services after such changes have been first posted.

If you have any questions or concerns regarding our privacy policies, please contact us by sending detailed message to privacy@eccf.org.