Privacy Policy - Appalachian Trail Conservancy

Overview

Appalachian Trail Conservancy (“ATC,” “we,” “us,” “our”) respect your privacy and are committed to protecting the personal data we hold about you. If you have questions, comments, or concerns about this Privacy Notice or our processing of personal data, please see the bottom of this Privacy Notice for information about how to contact us.

This Privacy Notice explains our practices with respect to personal data we collect and process about you. This includes information we collect through, or in association with, our websites with home pages located at https://appalachiantrail.org/; https://www.atctrailstore.org/; https://keepthetrailalive.org/; https://takeahikepetition.org/; https://volunteer.appalachiantrail.org/; https://atcamp.org/; and https://learn.appalachiantrail.org, our products and services that we may offer from time to time via our websites, our related social media sites, or otherwise through your interactions with us (the websites, products, services, and social media pages, collectively, the “Services”).

Please review the following to understand how we process and safeguard personal data about you. By using any of our Services, whether by visiting our website or otherwise, and/or by voluntarily providing personal data to us, you acknowledge that you have read and understand the practices contained in this Privacy Notice. This Privacy Notice may be revised from time to time, so please ensure that you check this Privacy Notice periodically to remain fully informed.

Personal Data We Collect

We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal data”). In addition, we may collect data that is not identifiable to you or otherwise associated with you, such as aggregated data, and is not personal data. To the extent this data is stored or associated with personal data, it will be treated as personal data; otherwise, the data is not subject to this notice.

How We Use Your Personal Data

We collect and process your personal data for the following purposes:

Maintaining or servicing accounts; providing customer service; processing or fulfilling orders, event registrations, volunteer sign-ups, and donations; verifying customer and donor information; and processing payments, including through third-party processors.
Administering our programs, services, and organizational activities, including volunteer management and training, A.T. hike registrations, event registrations and attendance, 2,000-miler applications, incident and safety reporting (including bear encounters and misconduct reports), and programmatic campaigns such as voting, sweepstakes, and surveys.
Managing applications and relationships, including job applications and employment-related processing, planned giving designations and notifications, stock and other non-cash gifts, license plate registrations, and constituent record maintenance.
Communicating with you by email, text message (SMS/MMS), direct mail, and other methods about services, programs, events, campaigns, and information tailored to your requests or inquiries.
Marketing our services to you, including sending you newsletters and other promotional messages and personalizing content and advertising based on your interactions with us.
Aggregating and de-identifying information, including demographic and engagement data, for analytics, research, visualization, and reporting to improve our programs, outreach, and operations.
Operating and improving our websites and digital platforms, including through the use of cookies, pixels, and analytics tools to understand usage, measure performance, and enhance user experience.
Complying with applicable laws, regulations, rules and requests of relevant law enforcement and/or other governmental agencies, or for other purposes, as permitted or required by law.
As necessary or appropriate to protect the rights, property, and safety of our users, us, and other third parties.

We will not use the personal data we collected for materially different, unrelated, or incompatible purposes without providing you with notice and obtaining your consent.

How We Obtain Your Personal Data

We collect your personal data from the following categories of sources:

Directly from you. When you provide it to us directly whether online, by email, phone, or in person.
Automatically or indirectly from you. For example, through logging and analytics tools, cookies, pixel tags, and as a result of your use of and access to the Services, or through your interactions with us on social media websites.
From our Service Providers. For example, Customer Relationship Management and form providers (e.g., Salesforce and FormAssembly) and event and registrations platforms (e.g., Eventbrite, ATCamp).
From Third Parties. We may receive personal data from third parties, such as ad networks (e.g., Google Ad Manager and Meta Business Suite), social media platforms, and fundraising partners.

Legal Basis for Processing

We process personal data for, or based on, one or more of the following legal basis:

Your Consent. We may process personal data with your consent such as when you opt-in to sharing it.
Performance of a Contract. We may process personal data to enter into or perform under the agreement between us and our service provider.
Legitimate Interests. We may process personal data for our legitimate interests, including improving service; providing information about our products and/or services; to the extent necessary and proportionate for the purposes of ensuring network and information security; and for administrative, fraud detection, and legal compliance purposes.
Compliance with Legal Obligations and Protection of Individuals. We may process personal data to comply with the law and our legal obligations, as well as to protect you and other individuals from certain harms.

Who We Share Your Personal Data With

We may share personal data with the following categories of third parties:

Other non-profit organizations. With your consent, we share donor information, including name and physical mailing address only, with similar non-profit organizations.
Government agencies or regulations when permitted or required to do so by law; in response to a request from a law enforcement agency or authority or any regulatory authority; and/or to protect the integrity of the Services or our interests, rights, property, or safety, and/or that of our users and others.

Your Rights Regarding Personal Data

You have certain rights regarding the collection and processing of personal data. You may exercise these rights, to the extent they apply to you, by contacting us as provided at the end of this Privacy Notice, or by following instructions provided in this Privacy Notice or in communications sent to you.

Your rights vary depending on the laws that apply to you, but may include:
The right to know whether, and for what purposes, we process your personal data;
The right to be informed about the personal data we collect and/or process about you;
The right to learn the source of personal data about you we process;
The right to access, modify, and correct personal data about you (see the “Accessing, Modifying, Rectifying, and Correcting Collected Personal Data” section below for more information);
The right to know with whom we have shared your personal data with, for what purposes, and what personal data has been shared (including whether personal data was disclosed to third parties for their own direct marketing purposes);
The right to withdraw your consent, where processing of personal data is based on your consent; and
The right to lodge a complaint with a supervisory authority located in the jurisdiction of your habitual residence, place of work, or where an alleged violation of law occurred.

See “Your California Privacy Rights”, “Your Nevada Privacy Rights”, “Your Other U.S. State Privacy Rights”, “Your European Union Privacy Rights” and “Your Canadian Privacy Rights” for more information about certain legal rights.

Accessing, Modifying, Rectifying, and Correcting Collected Personal Data

We strive to maintain the accuracy of any personal data collected from you and will try to respond promptly to update our records when you tell us the information in our records is not correct. However, we must rely upon you to ensure that the information you provide us is complete, accurate, and up-to-date, and to inform us of any changes. Please review all of your information carefully before submitting it to us and notify us as soon as possible of any updates or corrections.

Depending on the laws that apply to you, you may obtain from us certain personal data from you in our records. If you wish to access, review, or make any changes to personal data you have provided to us through the Services, please contact us as provided at the end of this Privacy Notice. We reserve the right to deny access as permitted or required by applicable law.

Your California Privacy Rights

California’s “Shine the Light” law permits our users who are California residents to request and obtain from us a list of what personal data (if any) we disclosed to third parties for their own direct marketing purposes in the previous calendar year and the names and addresses of those third parties. Requests may be made only once per year per person, must be sent to the email address below, and are free of charge.

Your Nevada Privacy Rights

Nevada law permits our users who are Nevada consumers to request that their personal data not be sold (as defined under applicable Nevada law), even if their personal data is not currently being sold. Requests may be sent to the email address below and are free of charge.

Your Other U.S. State Privacy Rights

If you are located in Colorado, Delaware, Maryland, Minnesota, New Jersey, Oregon or Texas, you have certain rights regarding your personal data. This section describes how we collect, use, and share your personal data under the Colorado Privacy Act (“CPA”), the Delaware Personal Data Privacy Act (“DPDPA”), the Maryland Online Data Privacy Act (“MODPA”), the Minnesota Consumer Data Privacy Act (“MCDPA”), the New Jersey Data Privacy Act (“NJDPA”), Oregon Consumer Privacy Act (“OCPA”) and the Texas Data Privacy and Security Act (“TDPSA”). Under these laws, you have some or all of the rights listed below. However, these rights are not absolute, and we may decline your request as permitted by law. You can ask to appeal any denial of your request in the same manner through which you may submit a request.

Right to Access and Portability. You have right to access your personal data and/or receive a copy of the Personal Data that we have collected about you.
Right to Correct. You have the right to correct inaccurate personal data that we have collected about you.
Right to Delete. You have the right to delete the personal data we have obtained about you or that you have provided to us with certain exceptions.
Right to Opt-out of Tracking for Targeted Advertising Purposes. You have the right to opt out of certain tracking activities for targeted advertising purposes.
Right to Opt-out of Profiling. If we process your personal data for profiling purposes, you can opt-out of such processing.
Right to Non-discrimination. You have the right to be free from discrimination for exercising your rights.

Your European Union and United Kingdom Privacy Rights

In addition to the above-listed rights, European Union (“EU”) and United Kingdom (“UK”) privacy laws provides individuals with enhanced rights in respect of their personal data. These rights may include, depending on the circumstances surrounding the processing of personal data:

The right to object to decisions based on profiling or automated decision making that produce legal or similarly significant effects on you;
The right to request restriction of processing of personal data or object to processing of personal data carried out pursuant to (i) a legitimate interest (including, but not limited to, processing for direct marketing purposes) or (ii) performance of a task in the public interest;
In certain circumstances, the right to data portability, which means that you can request that we provide certain personal data we hold about you in a machine-readable format;
In certain circumstances, the right to erasure and/or the right to be forgotten, which means that you can request deletion or removal of certain personal data we process about you; and
The right to complain with a supervisory authority. Your personal data may be blocked, anonymized, or deleted, as appropriate. If you are in the EU, you may find information about your supervisory authority here and if you are in the UK, you may lodge a complaint with the Information Commissioner’s Office here.

Note that we may need to request additional information from you to validate your request. To exercise any of the rights above, please contact us as provided at the end of this Privacy Notice.

Your Canadian Privacy Rights

Residents of Canada are permitted to request and obtain from us information respecting the existence, use, and disclosure of their personal data as well as access to that information (subject to certain exceptions pursuant to applicable laws). Without limiting the above, residents of Canada will, upon request:

Be informed of whether we hold personal data about you;
Be provided with an account of third parties to which we have disclosed your personal data;
Be able to challenge the accuracy and completeness of your personal data and have it amended as appropriate; and
Be provided with information about our policies and practices with respect to the management of personal data, including: the name or title, and address, of the person who is accountable for our privacy policies and practices; the means of gaining access to personal data; a description of the type of personal data held by us, including a general account of its use; a copy of any brochures or other information that explain our policies, standards, or codes; and what personal data is made available to related organizations.

Your Choices

You have choices about certain information we collect about you, how we communicate with you, and how we process certain personal data. When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services. In addition, it is possible to change your browser settings to block the automatic collection of certain information.

Communications Opt-Out. You may opt out of receiving marketing or other communications from us at any time through a given communications channel (such as email or telephone) by following the opt-out link or other unsubscribe instructions provided in any email message received, by contacting us as provided at the end of this Privacy Notice.Note that if you do business with us in the future, you may not, subject to applicable law, opt out of certain automated notifications, such as order or subscription confirmations, based on business transactions (e.g., e-commerce).
Location Information. If you want to limit or prevent our ability to receive location information from you, you can deny or remove the permission for certain Services to access location information or deactivate location services on your device. Please refer to your device manufacturer or operating system instructions for instructions on how to do this.
Cookies, Web Tracking, and Advertising. You may opt out of certain tracking technologies through your device’s or browser’s cookie and/or advertising settings (including by blocking, deleting, or restricting cookies, or resetting your device’s applicable advertising ID). Consult your device and/or browser documentation for more information about how to do this.Please note that blocking, deleting, or restricting cookies may negatively affect the performance or certain functionality of the Services, and opting out of online behavioral advertising will not prevent the delivery of ads, but rather may result in more repetitive and/or less relevant advertisements.To opt out of many online behavioral advertising mechanisms, including Facebook, Google, and others, you can use the Network Advertising Initiative’s Consumer Opt-Out service and/or the Digital Advertising Alliance’s Consumer Choice Tool.If you would like to opt out of Google Analytics, and certain Google advertising functionality, you may do so using Google’s opt-out tool.

Protecting Personal Data

We use reasonable and appropriate physical, technical, and organizational safeguards designed to promote the security of our systems and protect the confidentiality, integrity, availability, and resilience of personal data. Those safeguards may include, as appropriate: (i) the pseudonymization and encryption of personal data; (ii) access controls and authentication measures; (iii) backup, business continuity, and disaster recovery procedures; (iv) monitoring, logging, and incident response processes; and (v) periodic testing, assessment, and evaluation of the effectiveness of our safeguards.

However, no method of safeguarding information is completely secure. While we use measures designed to protect personal data, we cannot guarantee that our safeguards will be effective or sufficient. In addition, you should be aware that Internet data transmission is not always secure, and we cannot warrant that information you transmit utilizing the Services is or will be secure.

Retention of Personal Data

We retain personal data for as long as reasonably necessary to fulfill the purposes for which it was collected and as required or permitted by applicable law, as well as to the extent we deem necessary to carry out the processing activities described above, including but not limited to compliance with applicable laws, regulations, rules and requests of relevant law enforcement and/or other governmental agencies, and to the extent we reasonably deem necessary to protect our and our partners’ rights, property, or safety, and the rights, property, and safety of our users and other third parties.

Upon request, we will take steps to delete, anonymize, or archive personal data in accordance with our policies and applicable law.

Other Important Information About Personal Data and the Services.

Collection of Personal Data from Children. Children under 16 years of age are not permitted to use the Services, and we do not knowingly collect information from children under the age of 16. By using the Services, you represent that you are 18 years of age or older, or are 16 years of age or older and have valid parental consent to do so.
Third-Party Websites and Services. As a convenience, we may reference or provide links to third-party websites and services, including those of unaffiliated third parties, our affiliates, service providers, and third parties with which we do business. When you access these third-party services, you leave our Services, and we are not responsible for, and do not control, the content, security, or privacy practices employed by any third-party websites and services. You access these third-party services at your own risk. This Privacy Notice does not apply to any third-party services; please refer to the Privacy Notices or policies for such third-party services for information about how they collect, use, and process personal data.
Business Transfer. We may, in the future, sell or otherwise transfer some or all of our business, operations or assets to a third party, whether by merger, acquisition or otherwise. Personal data we obtain from or about you via the Services may be disclosed to any potential or actual third-party acquirers and may be among those assets transferred.
Do Not Track. We use analytics systems and providers and participate in ad networks that process personal data about your online activities over time and across third-party websites or online services, and these systems and providers may provide some of this information to us. We do not currently process or comply with any web browser’s “do not track” signal or similar mechanisms.
International Use. Your personal data will be stored and processed in the United States. If you are using the Services from outside the United States, by your use of the Services you acknowledge that we will transfer your data to, and store your personal data in, the United States, which may have different data protection rules than in your country, and personal data may become accessible as permitted by law in the United States, including to law enforcement and/or national security authorities in the United States. [For transfers of data into and out of the European Economic Area and the UK, we rely on the European Union Standard Contractual Clauses.]

Modifications and Updates to this Privacy Notice

This Privacy Notice replaces all previous disclosures we may have provided to you about our information practices with respect to the Services. We reserve the right, at any time, to modify, alter, and/or update this Privacy Notice, and any such modifications, alterations, or updates will be effective upon our posting of the revised Privacy Notice. Your continued use of the Services following our posting of any revised Privacy Notice will constitute your acknowledgement of the amended Privacy Notice.

Applicability of this Privacy Notice

This Privacy Notice applies regardless of the means used to access or provide information through the Services.

This Privacy Notice does not apply to information from or about you collected by any third-party services, applications, or advertisements associated with, or websites linked from the Services. The collection or receipt of your information by such third parties is subject to their own privacy policies, statements, and practices, and under no circumstances are we responsible or liable for any third party’s compliance therewith.