General Data Protection Regulation (GDPR)
This policy has been updated to reflect requirements of the General Data Protection Regulation (GDPR) which went into effect on May 25, 2018. Insofar as the general right to privacy includes anyone residing in an EU country whose data is in any way collected or maintained by Ipas, GDPR rights will apply; as a matter of policy, Ipas has elected to extend those rights to all Users, wherever their location. Ipas is committed to the seven key principles of GDPR:
- All personal data will be processed lawfully, fairly and transparently.
- Personal data will be collected only for specified and legitimate purposes.
- Personal data will be limited to that which is adequate, relevant and necessary.
- Personal data will be accurate and current, and corrected promptly when necessary.
- Personal data will be kept in identifiable form for no longer than is necessary for the purposes for which it was gathered and processed.
- Personal data will be processed and stored in a manner that ensures protection against unauthorized or unlawful processing, and against accidental loss, destruction or damage.
- The controller (Ipas) will be responsible for and be able to demonstrate compliance with GDPR.
Data Ipas collects
Personal data is defined as any information relating to an identified or identifiable natural person. Ipas collects personal data through the channels detailed below.
Data users provide:
Users may voluntarily provide personal data to Ipas through the Ipas website, mailed donation or pledge cards, checks, wire transfers, email subscriptions, third-party sites (including external fundraising, social media sites, recruiting site, or donation matching software), marketing or direct communication with Ipas staff. The personal data provided may include the user’s name, mailing address, email address, phone number, banking or credit account information, and employer name. If a user makes a donation in honor or celebration of someone, they may voluntarily provide information to Ipas about that person including their name, mailing address, and/or email address for acknowledgements of such transaction.
Ipas servers and third-party software collect data from visitors to the Ipas website, with their affirmative permission, that Ipas uses for statistical analyses of site traffic. If a user withholds permission, their data will not be collected.
The website data Ipas collects includes information about the pages a user visits and actions taken on the Ipas website, including page views, date and time of visits, publication downloads, link clicks, social shares, time spent on the Ipas website, referral websites, geolocation, and IP addresses for devices used to access the Ipas website. This information is aggregated and anonymized. The website data collected helps Ipas analyze audience trends and improve the experience for website visitors.
Other types of information
In some circumstances, Ipas may obtain personal data about users from public records and from third parties. This information may include updated mailing addresses or charitable causes a user has supported. This information helps Ipas use resources responsibly and helps provide the best experience for Ipas supporters. Ipas only receives publicly available information.
Use of information
Ipas collects personal data to communicate about our programs and fundraising campaigns, improve the website experience, conduct business and research operations, and comply with legal obligations. Users can request that their personal data be deleted from the system, and such requests will be respected, and the personal data promptly deleted.
Ipas uses the personal data a user provides when s/he agrees to donate in order to process payments and complete the donation. Ipas requires contact information to verify payments and to contact a user about his or her donation, including to issue a donation receipt.
Communicating with supporters
Ipas uses personal data provided to communicate with users, with their affirmative permission, via mail, email, and phone about Ipas programs, fundraising campaigns, and other news related to Ipas. If a user decides that s/he no longer want to receive any communications from Ipas, or if a user wants to limit the kinds of communications sent, s/he can indicate their preferences by selecting the “unsubscribe” option in Ipas’s emails or by contacting Ipas via email at [email protected]. Users can also request that their personal data be deleted from the system altogether.
Use of personal data
Ipas uses personal data provided by users and given permission to use for the following purposes:
- To deliver donation notifications to a user, or to another person when a user makes a gift in honor or celebration of that person.
- To communicate with an applicant about the submission of an Ipas job application.
- To send you Ipas email newsletters or other information a user has requested.
- To analyze and compile internal reports, including donation reports and website traffic reports, which helps Ipas understand and make decisions about the organization.
- To improve the experience of website visitors.
- To operate the Ipas website and complete essential business operations.
Disclosure of information
Ipas is the sole owner of information collected on the Ipas website.
Ipas also collects personal data from trusted third-party vendors and uses it to provide certain services, such as database hosting, recruitment, software maintenance, digital advertising, and donation processing, which are necessary for Ipas’s operations, including the operation of the Ipas website.
Other third parties
Ipas will never sell personal data to any third party. Ipas does not share personal data with any third party for commercial or research purposes, except where listed in this policy.
Ipas may use user personal data to meet legal requirements or obligations. Ipas may disclose personal Information where it is necessary, including to enforce its legal rights, in connection with a sale or transfer of some or all of the assets in the Ipas website, or when Ipas, in good faith, believes that the law or a regulatory authority requires it to do so.
Data transfer and storage
If a user is located outside of the United States, be aware that the information provided to us will be transferred to the United States. By providing personal data and giving permission for its use, the user consents to this transfer and to the collection, storage, processing, and use of their personal data in the United States. If a user is located in the United States, Ipas’s service providers may not be located in the user’s geographic area in the United States. By providing personal data to Ipas and giving it permission for its use, a user consents to the transfer of their personal data to these service providers.
Securing personal data
Ipas takes precautions to secure personal data, including physical safeguards to control access to its facilities and providing for secure destruction of media or materials containing personal data. Ipas also uses technological safeguards such as firewalls, password protection, anti-virus software, encryption, and intrusion detection. Ipas restricts access to non-public personal data. All electronic or computer files containing such data are secured and protected from access by unauthorized persons.
Ipas’s hosting service maintains its systems in accordance with reasonable industry standards to secure personal data.
However, no transmission over the Internet or method of storage can be guaranteed to be 100% secure. Therefore, users give Ipas permission to use their personal data at their own risk. They have the right to ask that their personal data be deleted, and in addition have the following rights:
- Right to access: Users may ask if Ipas stores personal data and why. They can also request a copy of the personal data that Ipas has collected by contacting us at [email protected].
- Right to data portability: Users have the right to receive their personal data in a structured, commonly used, and machine-readable format. To request a copy of this information from Ipas, please contact us at [email protected].
- Right to correct: Users can update or correct their personal data with Ipas at any time. For example, they may wish to update contact information from time to time. To request that Ipas update or correct personal data, please contact us at [email protected].
- Right to deletion: Users have the right to ask for data to be erased, if possible and when required under data protection laws. To request that Ipas remove personal data from our systems, please contact us at [email protected].
- Right to restrict processing: Users have the right to ask for processing of their personal data to be restricted, if possible and when required under data-protection laws. To request that Ipas restrict processing of personal data, please contact us at [email protected].
- Right to object: Users may object to Ipas’s processing of their personal data by contacting Ipas. Upon request, Ipas will stop processing their personal data unless it can demonstrate legitimate grounds for processing this information under applicable laws.
- Right to withdraw consent: If Ipas relies on a user’s consent to process their personal data, the user has the right to withdraw that consent at any time.
- Right to file a complaint: If a user has a concern about Ipas’s privacy practices, including how it handles personal data, a user can report it to the EU Information Commissioner’s Office (ICO) or other data protection authority that is authorized to hear those concerns.
Personal data breaches
Ipas takes every reasonable measure to prevent personal data breaches. When these do occur, Ipas will take swift action, including notice to those directly affected within 72 hours if appropriate. These actions will be consistent with the role Ipas has in relation to the products, services, or processes affected by the breach. In all cases, Ipas will work together with affected parties to minimize effects, to make all notifications and disclosures that are required by applicable law or otherwise warranted, and to act to prevent future breaches.
Donating to Ipas
Ipas is a registered 501(c)(3) nonprofit organization. All contributions to Ipas are tax deductible to the full extent allowed by law. Ipas will not trade, share or sell a donor’s personal data with anyone else, nor send donor mailings on behalf of other organizations. All information concerning donors or prospective donors is kept strictly confidential by Ipas and its staff unless permission is obtained from the donor to release such information, or unless disclosure is required by due legal process.
After a user makes an online donation, Stripe.com then provides information about the donation to Ipas. The only information Ipas receives is the user’s name, address, telephone number, e-mail address, the amount of the donation, and any additional message submitted along with the donation. Ipas uses this information to acknowledge the gift, and to keep records regarding donors for administrative and tax purposes.
Ipas recognizes that the operation of the organization requires the maintenance and management of extensive donor and prospect records. Donor records often contain sensitive information that has been shared with or developed by Ipas staff on a confidential basis. “Records” means all files, including electronic data, containing information on donors or prospective donors to Ipas. The use of donor information is limited to internal purposes, by authorized individuals, to better service existing donors, potential donors or partner relationships. Ipas makes every effort to ensure the security of this information. To prevent unauthorized access, maintain data accuracy, and ensure the proper use of information, Ipas has established and implemented appropriate physical, electronic, and managerial procedures to safeguard and secure the information it collects.
Ipas may publish lists of its donors in various donor publications, but not online. It may include the names of donors unless the donor indicates that they prefer to remain anonymous.
If a user indicates that their company has a matching gift program and provide the required form, Ipas will use that information to process the matching gift, to update its donor list, to acknowledge the company, and to include the company’s name on published lists of Ipas’s donors (unless it is notified that the company would prefer to remain anonymous). Ipas will not initiate any further contact with the company unless the user or the company requests that we do so.
Financial and other information about Ipas’s purpose, programs and activities can be obtained by contacting Ipas at P.O. Box 9990, Chapel Hill, NC 27515, phone number (800) 334-8446.
Ipas is a 501 c (3), headquartered in North Carolina. Ipas is registered or exempt, or has submitted registrations, for charitable solicitations in those states in which Ipas solicits contributions from the general public and which require such registration.
Florida: SC No.CH12851 a copy of the official registration and financial information may be obtained from the division of consumer services by calling toll-free, within the state, 1-800-HELP-FLA.
Maryland: For the cost of postage and copying, documents and information filed under the Maryland charitable organizations laws can be obtained from the Secretary of State, Charitable Division, State House, Annapolis, MD 21401.
Michigan: MICS No.25199.
Mississippi: The official registration and financial information of Ipas may be obtained from the Mississippi Secretary of State’s office by calling 1-888-236-6167.
New Jersey: information filed with the attorney general concerning this charitable solicitation and the percentage of contributions received by the charity during the last reporting period that were dedicated to the charitable purpose may be obtained from the attorney general of the state of New Jersey by calling (973) 504-6215 and is available on the internet at http://www.state.nj.us/lps/ca/charfrm.htm.
New York: Upon request, from the Attorney General Charities Bureau, 120 Broadway, New York, NY 10271.
North Carolina: Financial information about this organization and a copy of its license are available from the State Solicitation Licensing Branch at 1-888-830-4989 (within North Carolina) or (919) 807-2214 (outside of North Carolina).
Pennsylvania: The official registration and financial information of Ipas may be obtained from the Pennsylvania Department of State by calling toll-free, within Pennsylvania, 1-800-732-0999.
Virginia: From the State Office of Consumer Affairs in the Department of Agriculture and Consumer Affairs, P.O. Box 1163, Richmond, VA 23218.
Washington: From the Secretary of State at 1-800-332-4483.
West Virginia: West Virginia residents may obtain a summary of the registration and financial documents from the Secretary of State, State Capitol, Charleston, WV 25305.
Contributions are deductible for federal income tax purposes in accordance with applicable law. Registration in a state does not imply endorsement, approval, or recommendation of Ipas by the state.
Updates to this policy
To contact Ipas about our use of personal data or if there are any questions or comments about this policy, please email [email protected].