1. Additional Consent(s)
We may ask you to further consent to the terms of this Privacy Policy in different ways, depending on your relationship to the Site. The procedures for specific consent to this Privacy Policy are more formal if you are a Financial Supporter, contributing through our Site, or a Donor or Medical Professional, using our Site for potential donation and matching activities.
1.1. Consent by Financial Supporters. As a Financial Supporter, you may submit contact information, and other information (including your comments), to us via the Website, and you may also choose to make a financial contribution to us through the Site. You may also use the Website to send various e-greetings. When you submit information to us to identify yourself as a potential Financial Supporter, to make a financial contribution, or to send e-greetings via our Site, you will be prompted to click an "I Accept" button linked to this Privacy Policy. Clicking "I accept" confirms your agreement to be bound by this Privacy Policy.
1.2. Consent by Donors and Medical Professionals. If you register as a Medical Professional for license and access privileges to our MatchQuest™ software and database, or if you register as a potential Donor, you will similarly be prompted to click an "I Accept" button linked to this Privacy Policy during the registration process. Clicking "I accept" confirms your agreement to be bound by this Privacy Policy.
2. Scope of Privacy Policy
This Privacy Policy applies (i) to information we collect or you provide to us while using our Site or while participating in our services, and (ii) to personally identifiable information you provide to us as part of the process of registering online as a Financial Supporter, Medical Professional, or Donor. With regards to information collected when you visit our Site, we may automatically collect (x) technical information, including the Internet Protocol (IP) address used to connect your computer or device to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform; and (y) information about your visit, including the website you originated from before landing on our Site and the website you went to from our Site (including date and time); products or services you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.
Please note that Donors sign an offline Consent for Registry Participation, that governs the collection and use of information for determining a transplant match and for contacting the Donor in the event of a potential match (a "Registry Consent"). This Privacy Policy does not govern information collected under and governed by the Registry Consent, and the Registry Consent governs all such information.
3. The Information We Collect, Who is Responsible for the Information and How We Use the Information
All personally identifiable information we receive will be collected, accessed, and transferred in accordance with applicable laws, which include the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Virginia’s Consumer Data Protection Act (CDPA), Colorado Privacy Act (CPA), and other applicable U.S. State privacy laws and regulations. Personally identifiable information subject to international jurisdictions will be handled in accordance with the requirements set forth in the European Union’s General Data Protection Regulation (GDPR), Digital Services Act (DSA), and Digital Markets Act (DMA), as may be applicable.
We will not knowingly and intentionally share personally identifiable information you provide via the Website with any third party, other than as expressly disclosed in this Privacy Policy. By "personally identifiable information" we mean information that identifies you, such as your name, mailing address, and email address. As more fully described in Section 3.6, personally identifiable information does not include publicly available information, deidentified or aggregated consumer information, or information excluded from the scope of applicable law, such as Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; or Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.
With respect of personally identifiable information that is collected and processed by us through your use of our Site, we are a data controller for the purpose of data protection laws. If you have any questions regarding this Privacy Policy or the way we use your personal information, you may contact us as set forth in Section 12.
We collect information from you at different points on our Website, and use this information as follows:
3.1 Privacy of Registry Information. In order to join the Gift of Life Marrow Registry, personal information is collected including, but not limited to, a person's name, date of birth, postal and email address and phone number. In order to be a prospective donor that is eligible to join the registry, health screening information is also collected, including history of cancer and other medical conditions. To be part of the registry, prospective donors must provide a sample of cells from inside their cheeks (a buccal swab) which is tested at a Gift of Life contract laboratory for specialized cell surface markers, Human Leukocyte Antigens (tissue typing), blood group and Cytomegalovirus status. Gift of Life only identifies prospective donors by proprietary donor identification number to maintain anonymity and privacy, and conducts compliance reviews with contract laboratories to ensure compliance with standards. Security measures are taken to ensure safety and privacy of all information as described in this Privacy Policy.
This information is accessible on a need to know basis by authorized personnel only, and protected in accordance with the terms set forth in Section 6 ("Security") of this Privacy Policy. Donor identity is also protected through the use of a proprietary donor identification number, and donors are identified anonymously using that number (for example, via donor search conducted by transplant centers). Should a donor elect to withdraw from the registry, Gift of Life will deactivate the donor's information in a manner that protects the individual's confidentiality and complies with applicable laws. While in the registry, donors can expect that Gift of Life will communicate with them using a variety of methods, including, but not limited to, telephone, email and text message (with approval) in connection with their membership in the registry. Donors can obtain access to their personal information or obtain details about Gift of Life’s privacy practices by contacting its Privacy Officer in writing at 5901 Broken Sound Parkway NW, Suite 600, Boca Raton, Florida 33487.
In the event you wish to contact us to review your personal information that may have been collected and/or correct any information, please call 1-800-9-MARROW or complete our contact page.
3.2 Processing Requests and Transactions. When you make a request of us via our Website, we will use any personally identifiable information that you provide in connection with that request for the purposes of processing that request. For example, Financial Supporters are able to send e-greetings via our Site. When you request an e-greeting, we use personally identifiable information you provide in connection with that request solely for purposes of transmitting the e-greeting. In each instance where you make a request under our Website, we use the information you provide to us solely for the purpose of fulfilling your request.
3.3 Information concerning Third Parties. If you are a prospective Donor, during our registration process we may ask for certain personally identifiable information concerning one or more of your relatives or close acquaintances (your "Additional Contacts"). We use this information, in accordance with this Privacy Policy, in order to have further contact information for you on file, and in order to assist us in evaluating your eligibility for our Donor programs. We may verify certain information with your Additional Contacts, and discuss with them your interest in our Donor programs. By giving us contact information for these individuals, you are assuring us that they are willing to participate in this process, and that you are willing to allow them to participate.
3.4 Informational Notices and Bulletins. Periodically, we may choose to send news, bulletins, educational materials, marketing materials, or other information to you, and will use personally identifiable information to send such communications. If we choose to undertake such communications, you will have the ability to opt out of receiving these communications as provided in Section 5.
3.5 Information Exchanges with Other Users. The Website may allow users (i) to provide and receive a range of information on topics related to transplants and other matters, and (ii) to engage in other activity that may include, at the option of the user, an exchange of personally identifiable information. In these instances, we use personally identifiable information you provide to us in connection with any such exchanges strictly for the purposes for which you submit the information. If you share personally identifiable information -- via our Website or related discussions -- with persons other than Gift of Life staff or healthcare entities involved in the donation process, you should treat the exchange as you would any other exchange with a third party, and use appropriate discretion and caution. Such information exchanges are not governed by this Privacy Policy.
3.6 Anonymous, Aggregate Information. “Aggregate Information” is information that does not identify you, and may include statistical information that may range from statistical information and analyses concerning use of our Donor services, the number of successful matches coordinated through our Site or services, transplant-related information, and the pages on our Site that users visit most frequently. We use Aggregate Information to analyze the effectiveness of our services and our Site, to improve our services and our Website, and for other similar purposes. In addition, from time to time, we may undertake or commission statistical and other summary analyses of (i) the general behavior and characteristics of users participating in our services, (ii) the effect of our programs on, and the behavior of our Donors, Financial Supporters, Medical Professionals, and Site Visitors, and (iii) the general characteristics of visitors at our Site and participants in our services. We may share these analyses and Aggregate Information with third parties. Rest assured, though, that Aggregate Information provided to third parties will not allow anyone to identify you, or determine anything personal about you. We may collect Aggregate Information through features of the software that supports our services, through cookies, and through other means described below. If you do not wish your non-identified information to be included in the aggregated information, please do not use this Website. You may also contact us at 1-800-9MARROW with any concerns.
3.7 RESERVED.
3.8 Cookies. A cookie is a small amount of data, which often includes an anonymous unique identifier, which is sent to your browser from a website's computers and stored on your computer's hard drive. Cookies can be used to provide you with a tailored user experience and to make it easier for you to use a website upon a future visit. We may include cookies on our Website and use them to recognize you when you return to our Website. You may set your browser so that it does not accept cookies. Cookies must be enabled on your web browser, however, if you wish to access certain personalized features of our Services.
3.9 Extent of Information Collected. We do not knowingly collect any more personally identifiable information than reasonably necessary to provide our services, operate the Site, and respond to your requests.
3.10 Transfer of Personal Information. We will process your personal information both within and outside the United States (US). Where we transfer personal data outside of the US, we will implement appropriate and suitable safeguards to ensure that such personal information will be protected as required by applicable data protection law. Please contact us if you want further information on the specific mechanism used by us when transferring personal information out of the US.
3.11 How Long Will We Keep Your Personal Information. We will retain your personal information with us for as long as we need it to fulfill the purposes for which it was collected, including as may be required by applicable third-party retention policies. We may need to retain certain information for longer periods such as record-keeping / reporting in accordance with applicable law or for other legitimate reasons, including enforcement of legal rights, fraud prevention, etc. Residual anonymous information and aggregate information, neither of which identifies you (directly or indirectly), may be stored indefinitely. Please note that these retention periods may be extended where we need to preserve and use personal information for the purposes of bringing or defending a legal claim. In such cases, we will continue to hold and process your personal information for as long as is necessary to deal with the legal proceedings.
4. We Do Not Disclose Information to Unaffiliated Third Parties; Limited Exceptions
4.1 Gift of Life Site Vendors. We may employ other companies to perform functions on our behalf, such as maintaining the Website, providing services related to the Site, collecting information, responding to and sending electronic mail, or other functions necessary to our business. We may need to share your personally identifiable information with these companies (collectively, "Site Vendors"). We will provide Site Vendors with only that information necessary to perform their functions, and we will not allow them to use your personally identifiable information for any other purpose.
4.2 Imminent Harm. We may reveal your personally identifiable information to attorneys, private investigator organizations or law enforcement agencies if we believe (a) that you are in risk of harm from another, or (b) that you are harming or interfering (or will imminently harm or interfere) with others or violating (either intentionally or unintentionally) our Terms and Conditions of Use or otherwise violating legal rights.
4.3 Legal. Gift of Life will reveal your personally identifiable information, to the extent we reasonably believe we are required to do so by law. If we receive legal process calling for the disclosure of your personally identifiable information we will attempt to notify you via the email address you supplied during registration within a reasonable amount of time before we respond to the request, unless such notification is not permitted.
4.4 Transfer of Site. Gift of Life shall be entitled to transfer to a third party information it collects, including any personally identifiable information, in connection with a sale or transfer of all or substantially all of the assets of the business entity responsible for the information under this Privacy Policy, provided the acquiring third party has agreed to safeguard your personally identifiable information with protections that no less restrictive than those set out in this Privacy Policy.
5. Changing or Removing Information; Opting Out
5.1 Discretionary Account Information. To allow appropriate control over personally identifiable information, you can contact us at the address provided in Section 11 to access the personally identifiable information you have provided to us via the Website or to change or update discretionary information that you have previously submitted.
5.2 Opt-Out. If we choose to send to you bulletins, updates, or other unsolicited communications that are marketing-related materials, we will provide you with the ability to decline -- or “opt-out of” – receiving such communications. Instructions for opting-out will be provided if and when we determine to send you such a communication. Please understand that you will not be allowed to "opt–out" of formal notices concerning operation of this Website, and legal and other related notices concerning your relationship to the Site.
5.3 Deleting Information. Depending on the law that applies, you may have a right to access and rectify or erase your personal data or receive a copy of your personal data, restrict or object to the active processing of your data, ask us to share (port) your personal data to another entity, withdraw any consent you provided to us to process your data, a right to lodge a complaint with a statutory authority and such other rights as may be relevant under applicable laws. If you request, unless you have registered as a Donor, we will remove your name and all other personally identifiable information from our databases. Please understand, however, that it may be impossible to remove this information completely, due to backups and records of deletions. In addition, please understand that, if you request deletion of your information, you will be unable to utilize associated features of the Website and any associated services or information. You may not remove de-identified or Aggregate Information from our databases. Donor information is governed by the Registry Consent and may not be deleted, but may, at the Donor's request, be removed from the active registry list.
6. Security
We have put in place security systems designed to prevent unauthorized access to or disclosure of information you provide to us, and we take all reasonable steps to secure and safeguard this information. We store all personally identifiable information we receive on a separate system protected by firewalls, designed to be secure and isolated from direct connection to the Internet. All data exchange with the Internet is always encrypted via SSL employing certificates with at least 2048 bit encryption. Gift of Life employees (and employees of our Site Vendors) are required to acknowledge that they understand and will abide by our policies with respect to the confidentiality of personally identifiable information. Moreover, we provide access to our databases containing personally identifiable information on a need-to-know basis only. Access to our database is password protected and employs strict industry standard password policies including but not limited to
-
password complexity
-
limiting password reuse
-
password life span
-
one-way encryption
As an accredited member of the World Marrow Donor Association, Gift of Life must comply with recognized standards for electronic record keeping. Additionally, Gift of Life complies with FDA’s Title 21 CFR Part 11 that imposes standards on electronic records and electronic signatures.
Our security systems are therefore structured to deter and prevent hackers and others from accessing information you provide to us. We also use software programs to monitor network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage. Please understand, though, that we do not warrant as fail-proof the security of information provided by or submitted to Gift of Life. Due to the nature of Internet communications and evolving technologies, we cannot provide, and disclaim, assurance that the information you provide us will remain free from loss, misuse, or alteration by third parties who, despite our efforts, obtain unauthorized access.
7. Notice of Security Incident
If we detect, despite the safeguards set out above, an intrusion or other unauthorized access to or use of personally identifiable information (an "Intrusion"), we will (i) notify effected users of the Intrusion if the information at issue is sensitive, in our discretion, (ii) deliver this notice by the means we deem most efficient under the circumstances (such as, for example, first class mail or email); (iii) use contact information for each affected user that is current in our files; and (iv) use commercially reasonable efforts to accomplish these steps and effect this notice in a timely manner. To the extent applicable law requires steps in addition to those specified above, we will under all circumstances comply with applicable law.
8. Privacy Protection for Children
Our Website is not directed at children, and we will not accept or request personally identifiable information from individuals we know to be under 13. In accordance with the Children’s Online Privacy Protection Act ("COPPA"), if we learn that a child under 13 has provided personally identifiable information, we will either (i) delete this information from our databases, in accordance with our deletion policy, set out in Section 5.3, or (ii) obtain verifiable parental consent, in accordance with COPPA.
9. Notification of Changes
From time to time, Gift of Life may change its Privacy Policy. If we make any changes regarding disclosure of personally identifiable information to third parties, we will attempt to contact you prior to the date the modified policy is scheduled to take effect. We will post notice of the new Privacy Policy from the privacy link on our Website. With respect to Site Visitors and Patients, your use of our Site following any such change constitutes your agreement to follow and be bound by the Privacy Policy, as changed. With respect to Financial Supporters, Donors, and Medical Professionals, no such changes will take effect unless and until you have provided us with your consent to such changes, in accordance with Sections 1.2 or Section 1.3, above.
10. Relationships to Terms of Use and Other Contracts
This Privacy Policy must be read in conjunction with our Terms and Conditions of Use, and the provisions of our Terms and Conditions of Use are incorporated herein. To the extent the Terms and Conditions of Use conflict with the terms of this Privacy Policy, the terms of this Privacy Policy will control. This Privacy Policy should also be read in connection with the Registry Consent (for Donors), and the MatchQuest™ License (for Medical Professionals).
11. Retargeting Privacy Policy
Cookies and Tracking
Campusambassador.org use "cookies" to enable you to sign in to our services and to track your traffic patterns. A cookie is a text file that is placed on your computer's hard drive. Cookies help us personalize and make improvements to Gift of Life Marrow Registry so that you can have a pleasant and productive experience. You can set your browser to send a warning message before accepting cookies or to refuse cookies. Check your browser for instructions on how to handle cookies. If you choose to decline cookies, you may not be able to use all of the features of Gift of Life Marrow Registry Sites.
Online Behavioral Advertising by Gift of Life Marrow Registry and Others
Gift of Life Marrow Registry also works with third party advertising and personalization partners that use cookies to help us display personalized content and appropriate advertising during your visits to Gift of Life Marrow Registry Sites and other websites. These cookies identify the pages you view, the links and ads you click on, other actions you take on those web pages, and the site from which you came before arriving at a web page. This also helps us measure the performance of our advertising campaigns.
Similarly, third parties use cookies to deliver advertising for companies other than Gift of Life Marrow Registry to you on the Internet, whether you are on Gift of Life Marrow Registry Sites or other websites, based on your visits to Gift of Life Marrow Registry Sites and other websites. These cookies assist the third parties in identifying the pages you view, the links and ads you click on, other actions you take on those web pages, and the site from which you came before arriving at a web page.
If you would like to opt out of this program, please visit the Network Advertising Initiative opt-out page located at http://www.networkadvertising.org/choices.
"Do Not Track" Signals
Please note that while you may have the ability to opt-out of targeted advertising through the http://www.networkadvertising.org/choices link above and you may be able to control the use of cookies through your web browser as described in the "Cookies and Tracking" section above, some web browsers may give you the ability to enable a "do not track" setting that sends a special signal to the websites you encounter while web browsing. This is different from disabling certain forms of tracking by declining cookies in your browser settings, as browsers with the "do not track" setting enabled still have the ability to accept cookies. Gift of Life Marrow Registry does not respond to web browser “do not track signals” at this time. If we do so in the future, we will describe how we do so in this Privacy Policy.
Advertising Opt Out Links
DAA: http://www.aboutads.info/
NAI: http://optout.networkadvertising.org/?c=1
Europe only EDAA: http://www.youronlinechoices.com/
12. Contact Us
If you have any questions about this Privacy Policy, the practices of this Site, or your dealings with this Website, please contact us at:
Gift of Life Bone Marrow Foundation
Attention: Marti Freund, COO, Gift of Life Marrow Registry, 5901 Broken Sound Parkway NW Suite 600, Boca Raton, FL 33487
Phone: 1-800-962-7769
13. Effective Date
The effective date of this Privacy Policy is July 26, 2024
California Consumer Privacy Act (CCPA) Privacy Policy
This privacy notice section for California residents supplements the information contained in our Privacy Policy and it applies solely to all visitors, users, and others who reside in the State of California.
Categories of Personal Information Collected: we collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or Device. The following is a list of categories of personal information which we may collect or may have been collected from California residents within the last twelve (12) months.
Please note that the categories and examples provided in the list below are those defined in the CCPA. This does not mean that all examples of that category of personal information were in fact collected by us but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been collected. For example, certain categories of personal information would only be collected if you provided such personal information directly to us.
-
Category A: Identifiers. Examples: A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, driver's license number, passport number, or other similar identifiers.
Collected: YES. -
Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). Examples: A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.
Collected: YES. -
Category C: Protected classification characteristics under California or federal law. Examples: Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
Collected: YES. -
Category D: Commercial information. Examples: Records and history of products or services purchased or considered.
Collected: NO. -
Category E: Biometric information. Examples: Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.
Collected: YES. -
Category F: Internet or other similar network activity. Examples: Interaction with our Service or advertisement.
Collected: YES. -
Category G: Geolocation data. Examples: Approximate physical location.
Collected: YES. -
Category H: Sensory data. Examples: Audio, electronic, visual, thermal, olfactory, or similar information.
Collected: NO. -
Category I: Professional or employment-related information. Examples: Current or past job history or performance evaluations.
Collected: NO. -
Category J: Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). Examples: Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.
Collected: NO. -
Category K: Inferences drawn from other personal information. Examples: Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Collected: YES.
Under the CCPA, personal information does not include:
-
Publicly available information from government records
-
Deidentified or aggregated consumer information
-
Information excluded from the CCPA's scopre, such as:
-
Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data
-
Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA) and the Driver's Privacy Protection Act of 1994.
-
Sources of Personal Information. We obtain the categories of personal information listed above from the following categories of sources:
-
Directly from you. For example, from the forms you complete on our Service, preferences you express or provide through our Service, or from your purchases on our Service.
-
Indirectly from you. For example, from observing your activity on our Service.
-
Automatically from you. For example, through cookies we or our Service Providers set on your Device as you navigate through our Service.
-
From Service Providers. For example, third-party vendors to monitor and analyze the use of our Service, third-party vendors for payment processing, or other third-party vendors that we use to provide the Service to you.
Use of Personal Information for Business Purposes or Commercial Purposes. We may use or disclose personal information we collect for "business purposes" or "commercial purposes" (as defined under the CCPA), which may include the following examples:
-
To operate our Service and provide you with our Service.
-
To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our Service.
-
To fulfill or meet the reason you provided the information. For example, if you share your contact information to ask a question about our Service, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a product or service, we will use that information to process your payment and facilitate delivery.
-
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
-
As described to you when collecting your personal information or as otherwise set forth in the CCPA.
-
For internal administrative and auditing purposes.
-
To detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities.
Please note that the examples provided above are illustrative and not intended to be exhaustive. For more details on how we use this information, please refer to the section regarding how we use your Personal Information.
If we decide to collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes we will update this Privacy Policy.
Disclosure of Personal Information for Business Purposes or Commercial Purposes. We may use or disclose and may have used or disclosed in the last twelve (12) months the following categories of personal information for business or commercial purposes:
-
Category A: Identifiers.
-
Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).
-
Category D: Commercial information.
-
Category F: Internet or other similar network activity.
Please note that the categories listed above are those defined in the CCPA. This does not mean that all examples of that category of personal information were in fact disclosed, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been disclosed.
When we disclose personal information for a business purpose or a commercial purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.
Sale of Personal Information. As defined in the CCPA, "sell" and "sale" mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for valuable consideration. This means that we may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit. Please note that the categories listed below are those defined in the CCPA. This does not mean that all examples of that category of personal information were in fact sold, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been shared for value in return. We may sell and may have sold in the last twelve (12) months the following categories of personal information:
-
Category A: Identifiers
-
Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
-
Category D: Commercial information
-
Category F: Internet or other similar network activity
Share of Personal Information. We may share your personal information identified in the above categories with the following categories of third parties:
-
Service Providers
-
Payment processors
-
Our affiliates
-
Our business partners
-
Third party vendors to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.
Sale of Personal Information of Minors Under 16 Years of Age. We do not knowingly collect personal information from minors under the age of 16 through our Service, although certain third-party websites that we link to may do so. These third-parties have their own terms of use and privacy policies and we encourage parents and legal guardians to monitor their children's Internet usage and instruct their children to never provide information on other websites without their permission. We do not sell the personal information of Consumers we actually know are less than 16 years of age, unless we receive affirmative authorization (the "right to opt-in") from either the Consumer who is between 13 and 16 years of age, or the parent or guardian of a Consumer less than 13 years of age. Consumers who opt-in to the sale of personal information may opt-out of future sales at any time. To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by contacting us. If you have reason to believe that a child under the age of 13 (or 16) has provided us with personal information, please contact us with sufficient detail to enable us to delete that information.
Your Rights under the CCPA. The CCPA provides California residents with specific rights regarding their personal information. If you are a resident of California, you have the following rights:
-
The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
-
The right to request. Under CCPA, you have the right to request that we disclose information to you about our collection, use, sale, disclosure for business purposes and share of personal information. Once we receive and confirm your request, we will disclose to you:
-
The categories of personal information we collected about you
-
The categories of sources for the personal information we collected about you
-
Our business or commercial purpose for collecting or selling that personal information
-
The categories of third parties with whom we share that personal information
-
The specific pieces of personal information we collected about you
-
If we sold your personal information or disclosed your personal information for a business purpose, we will disclose to you:
-
The categories of personal information categories sold
-
The categories of personal information categories disclosed
-
-
-
The right to say no to the sale of Personal Data (opt-out). You have the right to direct us to not sell your personal information. To submit an opt-out request please contact us.
-
The right to delete Personal Data. You have the right to request the deletion of your Personal Data, subject to certain exceptions. Once we receive and confirm your request, we will delete (and direct our Service Providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:
-
Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
-
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
-
Debug products to identify and repair errors that impair existing intended functionality.
-
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
-
Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
-
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
-
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
-
Comply with a legal obligation.
-
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
-
-
The right not to be discriminated against. You have the right not to be discriminated against for exercising any of your consumer's rights, including by:
-
Denying goods or services to you
-
Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties
-
Providing a different level or quality of goods or services to you
-
Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services
-
Exercising your CCPA Data Protection Rights. In order to exercise any of your rights under the CCPA, and if you are a California resident, you can contact us using the contact information located within our Privacy Policy. Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable request related to your personal information. your request to us must:
-
Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
-
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with the required information if we cannot:
-
Verify your identity or authority to make the request
-
And confirm that the personal information relates to you
-
We will disclose and deliver the required information free of charge within 45 days of receiving your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary and with prior notice.
Any disclosures we provide will only cover the 12-month period preceding the verifiable request's receipt.
For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.
Do Not Sell My Personal Information. You have the right to opt out of the sale of your personal information. Once we receive and confirm a verifiable consumer request from you, we will stop selling your personal information. To exercise your right to opt-out, please contact us. The Service Providers we partner with (for example, our analytics or advertising partners) may use technology on the Service that sells personal information as defined by the CCPA law. If you wish to opt out of the use of your personal information for interest-based advertising purposes and these potential sales as defined under CCPA law, you may do so by following the instructions below.
Please note that any opt out is specific to the browser you use. You may need to opt out on every browser that you use. The same is true for Mobile Devices. Your mobile device may give you the ability to opt out of the use of information about the apps you use in order to serve you ads that are targeted to your interests.
Children's Privacy. Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under the age of 13 without verification of parental consent, we take steps to remove that information from our servers. If we need to rely on consent as a legal basis for processing your information and your country requires consent from a parent, we may require your parent's consent before we collect and use that information.
Your Rights under the EU General Data Protection Regulation (“GDPR”) and United Kingdom General Data Protection Regulation (“UK GDPR”)
—For residents from the United Kingdom (UK), or the European Economic Area (EEA) and Switzerland, this section allows you to exercise your rights under the European Union’s (EU) General Data Protection Regulation (GDPR) and the UK’s version of the GDPR (UK GDPR), as applicable. Although applicable data protection legislation in relevant jurisdictions may afford similar rights, there may be circumstances where some of these rights do not apply under or are modified by, local law. Gift of Life takes reasonable steps to allow you to correct, amend, delete or limit the use of your personal information, and exercise other rights available under applicable law. Gift of Life therefore informs you that, where applicable under relevant law, you are entitled to the following:
-
Right to Access / Disclosure: The right to have access to your personal data upon simple request – that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing.
-
Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete.
-
Right to Erasure / “Right to be Forgotten”: The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law.
-
Withdrawal of Consent to Processing: The right to withdraw your consent to the data processing without affecting the lawfulness of processing, where your personal data has been collected and processed based on your consent and not any other basis.
-
Right to Object: The right to object to the processing of your personal data under certain circumstances, in which case we may ask you to justify your request by explaining to us your particular situation.
-
Right to Restrict Processing: The right to request limits to the processing of your data, when allowed by and in circumstances set forth under applicable law, as well as to object to any direct marketing from us.
-
Right to Restrict Automated Individual Decision-Making (Profiling): The right to not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you.
-
Right to Data Portability: The right to have your personal data directly transferred by us to a third-party processor of your choice (where technically feasible; may be limited to situations when processing is based on your consent).
To exercise any of these rights, please contact us at the contact information listed in the “Contact Us” section. Note that we may ask you to verify your identity before responding to such requests.
If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.
Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.
Your Rights Under Australia’s Privacy Act of 1988
We intend to allow Australian residents to exercise their rights under the Privacy Act 1988 and associated Australian Privacy Principles. Although applicable data protection legislation in relevant jurisdictions may afford similar rights, there may be circumstances where some of these rights do not apply under or are modified by, local law. Gift of Life takes reasonable steps to allow you to correct and amend your personal information, and exercise other rights available under applicable law. We therefore inform you that, where applicable under relevant law, you are entitled to the following:
-
Right to Access / Disclosure: The right to have access to your personal data upon simple request – that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing.
-
Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete.
Your Rights Under Canada’s Personal Information Protection and Electronic Documents Act
We intend to allow Canadian residents to exercise their rights under the Personal Information Protection and Electronic Documents Act (“PIPEDA”). Although applicable data protection legislation in relevant jurisdictions may afford similar rights, there may be circumstances where some of these rights do not apply under or are modified by, local law. Gift of Life takes reasonable steps to allow you to correct, amend, and delete your personal information, and exercise other rights available under applicable law. We therefore inform you that, where applicable under relevant law, you are entitled to the following:
-
Right to Access / Disclosure: The right to have access to your personal data upon simple request – that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing.
-
Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete.
-
Right to Deletion: The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law.
Your Rights under various United Sates state data privacy laws, including but not limited to the Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, and Virginia Consumer Data Protection Act.
—For residents from the state of California, Colorado, Connecticut, Utah, and Colorado this section allows you to exercise your rights under the applicable state law.
-
Right to Access / Disclosure: The right to have access to your personal data upon simple request – that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing of your data.
-
Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete.
-
Right to Deletion: The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law.
-
Right to Opt-Out: The right to opt out of the processing of your personal data for targeted advertising, as defined by applicable law. This right also allows you to opt out of the sharing of your personal data for cross-context behavior advertising as defined by the California Privacy Rights Act.
-
Right to Appeal: You may also have the right to appeal the denial of any of these rights by submitting a form that will be provided to you if we deny a data request.