Volk Donations

Volk Donations, Inc. ("Volk Donations," "we," "us," or "our") is a United States-based 501(c)(3) nonprofit organization registered in the State of Colorado, headquartered at 1840 Blake Street, Suite 300, Denver, Colorado 80202. We operate the website at volkdonations.website and related subdomains (collectively, the "Platform"), through which we solicit charitable donations, recruit volunteers and fundraisers, and publish information about our programs.

This Privacy Policy applies to all personal information we collect through our Platform, by email, telephone, mail, at in-person events, and through partner organizations when they share your data with us in connection with fundraising or program activities. It does not apply to third-party websites linked from our Platform.

2.1 Information You Provide Directly

2.2 Information Collected Automatically

When you visit our Platform, we automatically collect certain technical data through cookies, server logs, and similar technologies:

• Device & Browser Data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, time spent on pages, links clicked, referral URLs, and navigation paths within our Platform.
• Location Data: Approximate geographic location derived from your IP address (country and city level only). We do not collect precise GPS location.
• Cookie Data: Session identifiers, authentication tokens, and preference cookies. See Section 6 for full details.

2.3 Information from Third Parties

We may receive information about you from the following third-party sources:

• Payment Processors (Stripe): Transaction confirmation, payment method type, and fraud risk signals — not your full card number.
• Fundraising Platforms: When a fundraiser on a third-party platform directs donations to Volk Donations, we may receive your name, email, and gift amount from that platform.
• Partner Organizations: Our 180+ grassroots partner organizations may share program beneficiary data in aggregated, anonymized form for impact reporting only.
• Public Sources: Publicly available professional profiles, for major donor research purposes only (applicable to gifts above $10,000).

We use your personal information only for the purposes set out below. We will not use your data in any manner incompatible with the purpose for which it was originally collected without your consent.

For individuals in the EEA, United Kingdom, or jurisdictions with equivalent data protection laws, we process your personal data under the following GDPR legal bases:

• Performance of a Contract (Art. 6(1)(b)): Processing necessary to process your donation, manage your account, or provide services you have requested.
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with tax law, anti-money laundering regulations, charity law, and other applicable legal obligations.
• Legitimate Interests (Art. 6(1)(f)): Processing for fraud prevention, security, platform analytics, and communications with existing donors about program updates, where our interests are not overridden by your rights.
• Consent (Art. 6(1)(a)): Processing for marketing to non-donor individuals, or for any purposes where we have specifically sought your permission. You may withdraw consent at any time.

5.1 Service Providers

We engage trusted third-party service providers under written data processing agreements that prohibit them from using your data for any purpose other than providing services to us:

5.2 Legal Requirements

We may disclose your information when required by law, including to respond to valid legal process (subpoenas, court orders), comply with IRS charitable reporting requirements (Form 990), or respond to lawful requests from regulatory or law enforcement authorities.

5.3 Organizational Transfers

In the event of a merger, acquisition, dissolution, or transfer of our charitable assets to another nonprofit, your personal data may be transferred as part of that transaction. We will notify you via email and prominent website notice before your data is transferred and becomes subject to a different privacy policy.

Our Platform uses cookies and similar tracking technologies to provide functionality, analyze usage, and improve your experience. You may control cookies through your browser settings or our cookie preference center accessible via the "Cookie Settings" link in our website footer.

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, to comply with legal obligations, resolve disputes, and enforce our agreements.

We implement industry-standard technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3. Our website enforces HTTPS across all pages.
• Encryption at Rest: Sensitive data fields (including donor financial records) are encrypted at rest using AES-256 in our AWS-hosted infrastructure.
• Payment Security (PCI-DSS Level 1): We do not store full payment card numbers. All payment processing is handled by Stripe, certified to PCI-DSS Level 1 — the highest level of payment security certification.
• Access Controls: Access to personal data is restricted on a need-to-know basis, with role-based permissions, multi-factor authentication, and annual security training for all staff.
• Vulnerability Management: We conduct annual penetration testing and quarterly vulnerability assessments of our Platform and infrastructure.
• Incident Response: We maintain a documented Data Breach Response Plan. In the event of a breach, we will notify affected individuals and relevant authorities within 72 hours (GDPR) or as otherwise required by law.

Depending on your location, you may have some or all of the following rights regarding your personal information. To exercise any right, contact us at privacy@volkdonations.website or through your account settings. We respond within 30 days (or 45 days for complex requests).

Volk Donations is headquartered in the United States. If you are located in the EEA, UK, or another jurisdiction outside the US, your personal data may be transferred to and processed in the United States. Where we transfer personal data from the EEA or UK, we ensure appropriate safeguards are in place including:

• Standard Contractual Clauses: We use the European Commission-approved Standard Contractual Clauses (SCCs) for transfers from the EEA, and ICO-approved International Data Transfer Agreements (IDTAs) for transfers from the UK.
• Adequacy Decisions: Where the European Commission has determined that a third country provides adequate protection, we may rely on that adequacy decision.
• Binding Corporate Rules: For some service providers, we rely on approved Binding Corporate Rules (BCRs) governing data protection across their global operations.

You may request a copy of our Standard Contractual Clauses by contacting privacy@volkdonations.website.

Our Platform is not directed to children under the age of 13 in the United States, or under the age of 16 in the EEA and UK. We do not knowingly collect personal information from children below these ages without verifiable parental or guardian consent.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at privacy@volkdonations.website. We will promptly delete such information upon verification.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you specific rights regarding your personal information, in addition to those set out in Section 9:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions under California law.
• Right to Correct: Request correction of inaccurate personal information we hold about you.
• Right to Opt-Out of Sale / Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No opt-out is currently required, but you may submit a request to confirm this at any time.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights — including by denying services, charging different prices, or providing a different quality of service.

To submit a CCPA request, contact us at privacy@volkdonations.website with subject line "CCPA Request," or call +1 (720) 844-3920. We will verify your identity before processing and respond within 45 days.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or operational needs. When we make material changes, we will notify you by:

• Posting the updated policy on this page with a revised "Last Updated" date at the top.
• Sending an email notification to donors and registered account holders at least 14 days before the changes take effect.
• Displaying a prominent notice on our website homepage for 30 days following publication of the revised policy.

Your continued use of our Platform after the effective date of any revised Privacy Policy constitutes your acceptance of those changes. Prior versions are archived and available upon request.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact our Data Protection Officer. We aim to respond to all privacy inquiries within 5 business days.