Privacy Policy

Protecting your privacy is important to AquaAction (“AquaAction,” “we,” “us,” or “our”). We take the confidentiality of the Personal Information (as defined below) of our donors, members, employees, volunteers, and users of our website, aquaaction.org (the “Website”), seriously, and we handle it in accordance with applicable U.S. federal and state laws. This privacy policy (the “Policy”) explains what we collect, how we use and share it, and the measures we take to keep it secure.

By using aquaaction.org, you acknowledge that you have read and understood this Policy.

1Scope of this policy

“Personal Information” means any information that identifies, relates to, or could reasonably be linked, directly or indirectly, with a particular individual or household. It does not include information that has been de-identified or aggregated so that it can no longer reasonably be linked to you.

This Policy applies to Personal Information that AquaAction collects, holds, or controls, including information collected through the Website, through our donation and application forms, and from contractors and partners interacting with AquaAction.

This Policy also applies to Personal Information AquaAction collects about its employees, volunteers, and applicants for employee or volunteer positions.

2Personal Information we collect

Information collected automatically

When you visit aquaaction.org, we and our analytics provider, Google Analytics, use cookies and similar technologies to automatically collect information about your device and how you interact with the Website. This includes:

IP address
Approximate location derived from your IP address
Browser, device, and operating system details
Pages and content viewed
Links clicked while navigating the Website

You can learn how Google uses this data and opt out at tools.google.com/dlpage/gaoptout. See “Cookies, Do Not Track and Global Privacy Control” in Section 5 for more choices.

Information you provide to us

Online participation form and newsletter

When you complete our online participation form or sign up for our newsletter, we collect:

First name
Last name
Email
Any other information you voluntarily provide

Donors

When you make a donation, we collect, as applicable:

First name
Last name
Mailing address
Email
Donation amount, date, and frequency

Online payments are processed by our payment service provider, Donorbox. AquaAction does not store your full credit card or bank account numbers. Your payment information is subject to Donorbox's own privacy policy and terms of use.

Entrepreneurs

We collect Personal Information about entrepreneurs and contractors interacting with AquaAction, through the “AquaEntrepreneur” application form or otherwise, including, as applicable:

First name
Last name
Mailing address
Email
Phone number
Business project descriptions
Résumés
Other information required to evaluate applications

Employees, volunteers and applicants

We collect Personal Information about our employees and volunteers, and about people applying for these positions, including, as applicable:

First name
Last name
Mailing address
Email
Phone number
Bank account details for payroll (employees only)
Information required for tax and employment eligibility forms (employees only)
Résumés submitted by applicants
Other information required to supervise employees and volunteers

Partners

We may also collect business contact information about representatives of our partner organizations from time to time.

Notice and consent

We provide notice of the purposes for which we collect Personal Information at or before the time of collection. When you voluntarily submit Personal Information through a form, online or otherwise, you consent to its use for the purposes described in this Policy and on that form. Where the law requires your opt-in consent, for example, before processing sensitive personal information, we will ask for it.

3How we use and share Personal Information

We collect only the Personal Information that is reasonably necessary for the purposes set out in this Policy. We will not use your Personal Information for a materially different purpose without first notifying you and, where required, obtaining your consent.

Purposes

We use Personal Information collected through the Website to:

Send you our newsletter and other communications you have signed up for;
Conduct statistical analyses to improve the Website;
Protect the security and integrity of the Website and of Personal Information;
Respond to your questions and requests.

We may also use Personal Information to:

Process your donations and issue donation receipts;
Evaluate and, if appropriate, fund your business projects;
Establish and maintain our relationship with you;
Process your job or volunteer application;
Detect and prevent errors, fraud, and other illegal activity;
Comply with our legal, tax, and reporting obligations.

If you are an AquaAction employee, we may also use your Personal Information to:

Supervise your work;
Process payroll and benefits;
Perform pre-employment checks, as permitted by law;
Verify documentation for leaves of absence;
Meet workplace health and safety and other employment-law requirements.

Email communications

Every marketing email we send includes an unsubscribe link. You can opt out at any time by clicking that link or by contacting us at the address in Section 5. Even if you opt out, we may still send you transactional messages, such as donation receipts.

Sharing with third parties

We share Personal Information only as described in this Policy:

Service providers. We share Personal Information with vendors that perform services on our behalf, such as website hosting, analytics, payment processing, email delivery, and IT support. They may use it only to provide those services to us.
Advisors to entrepreneurs. Occasionally, we share information about entrepreneurs with third parties, such as lawyers and accountants who advise them. We always obtain the entrepreneur's prior consent.
Legal requirements. We may disclose Personal Information when required by law, subpoena, or court order, or to protect the rights, property, or safety of AquaAction, our users, or others.

4Security, storage and retention

AquaAction maintains reasonable administrative, technical, and physical safeguards designed to protect Personal Information against loss, theft, and unauthorized access, disclosure, copying, use, and modification, taking into account its sensitivity and the purposes for which it is used.

We inform our employees about this Policy and train them in best practices for protecting Personal Information. We use current TLS encryption for information transmitted through the Website, and we protect our systems with access controls, including two-factor authentication.

We do not sell your Personal Information, and we do not share it for cross-context behavioral (targeted) advertising. We disclose Personal Information only as described in Section 3, and internally only to team members who reasonably need it for the purposes set out in this Policy.

Where your information is stored

Your Personal Information is stored and processed in the United States by AquaAction and its service providers, which are bound by contractual confidentiality and data-protection obligations.

How long we keep Personal Information

We retain Personal Information only as long as necessary for the purposes described in this Policy, or as required by law. Donation and financial records are generally kept for up to 7 years to meet tax and recordkeeping requirements. When Personal Information is no longer needed, we securely delete or de-identify it.

Data breaches

If we suspect a security incident affecting Personal Information, we take reasonable steps to contain it, reduce the risk of harm, and prevent similar incidents in the future.

If a breach of your Personal Information occurs, we will notify you and any required government authorities in accordance with applicable federal and state breach-notification laws.

5Your choices and rights

Your privacy rights

Depending on the state where you live, you may have some or all of the rights below. We honor these requests as required by applicable law, and we will not discriminate against you for exercising them.

KnowTo know what Personal Information we collect, use, disclose, and retain (this Policy is designed to tell you).

AccessTo confirm whether we process your Personal Information and to obtain a copy of it.

CorrectionTo correct Personal Information that is inaccurate or incomplete.

DeletionTo have your Personal Information deleted, subject to our legal retention obligations.

PortabilityTo receive your Personal Information in a portable, machine-readable format.

Opt outTo opt out of the sale of your Personal Information, targeted advertising, and certain profiling. We do not engage in these activities.

Withdraw consentTo withdraw consent you previously gave, for example, by unsubscribing from our emails.

AppealTo appeal our decision if we decline to act on your request.

To exercise these rights, contact our Privacy Officer using the details below. We will verify your identity before responding and will respond within 45 days, or within the time required by applicable law. You may also make a request through an authorized agent, who must provide proof of their authority to act on your behalf. If we deny your request, we will explain why and tell you how to appeal.

Privacy Officer

Soula Chronopoulos

Address: AquaAction
[U.S. mailing address]
Email: soula@aquaaction.org
Website: us.aquaaction.org

Keeping your information accurate

AquaAction takes reasonable steps to keep the Personal Information it uses or discloses accurate, complete, and up to date. Please let us know about any significant changes to your Personal Information by updating your account on our Website, where available, or by emailing us at the address above.

Cookies, Do Not Track and Global Privacy Control

You can browse our Website without identifying yourself. Most browsers let you block or delete cookies and use private browsing; some Website features may not work properly if you do. Our Website honors Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of Personal Information where applicable law requires it. Because there is no common industry standard for “Do Not Track” browser signals, we do not currently respond to them.

Children's privacy

Our Website is not directed to children under 13, and we do not knowingly collect Personal Information from children under 13 without verifiable parental consent, as required by the Children's Online Privacy Protection Act (COPPA). If you are a parent or guardian and believe your child has provided us with Personal Information without your consent, please contact us immediately and we will delete it.

External links

Our Website may contain links to other websites. We are not responsible for their privacy practices, and we encourage you to review their privacy policies.

Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the effective date at the top of this page and, if the changes are material, notify you by email or through a notice on our Website.