Effective Date: 2/6/2023
Archived Versions can be found here.

OVERVIEW

At Classy, Inc. and Classy Holdings, Inc. (collectively, “Classy”, “us”, “we”, “our”), we value your privacy and are dedicated to safeguarding your personal information. Classy is a social enterprise that creates world-class online fundraising software for nonprofits, modernizing the giving experience to accelerate social impact around the world. Classy also hosts the Collaborative conference and the Classy Awards to spotlight the innovative work nonprofits are implementing around the globe.

In this Privacy Policy (“Policy”), we describe the personal information we collect from visitors to and users of our websites, including those webpages enabling donations to clients using our platform and webpages supporting Classy Live) (“Sites”); our mobile applications (“Applications”); and our online products and services, including application programming interface integrations and widgets that we offer (“Services”) and how we collect, use, share, and disclose personal information in the course of our business activities, including:

• OVERVIEW
• WHAT INFORMATION DO WE COLLECT ABOUT YOU AND WHY?
• HOW DO WE USE YOUR INFORMATION?
• WHEN AND HOW DOES CLASSY SHARE INFORMATION IT RECEIVES?
• HOW SECURE IS INFORMATION ABOUT ME?
• CAN I ACCESS AND MODIFY MY PERSONAL INFORMATION?
• WHAT CHOICES DO I HAVE REGARDING MY INFORMATION?
• INTERNATIONAL DATA TRANSFER
• CHILDREN UNDER 13 (AND UNDER 16 IN THE EU)
• TERMS OF SERVICE
• SPECIAL INFORMATION FOR CALIFORNIA RESIDENTS
• SPECIAL INFORMATION FOR VIRGINIA RESIDENTS
• CHANGES TO THIS POLICY
• CONTACT US

By visiting our Sites or using any of our Applications or Services, you agree that your personal information will be handled as described in this Policy, which is incorporated by reference into the Classy Terms of Service, available at https://www.classy.org/terms/. It is important to note that not all aspects of this Policy may apply to you, depending on the types of interactions you have with us and the categories of personal information that we collect from you. Those activities will determine which of the following applies to you and your personal information. If you have  questions or complaints regarding this Policy or our privacy practices, please contact us at [email protected].

If you are a resident of California, the California Consumer Privacy Act of 2018 provides you with additional rights. Please view the “Special Information for California Residents” section of this Policy to learn more. If you are a resident of Virginia, the Virginia Consumer Data Protection Act provides you with additional rights. Please view the “Special Information for Virginia Residents” section of this Policy to learn more.

WHAT INFORMATION DO WE COLLECT ABOUT YOU AND WHY?

We collect information from you so that you can log onto our Sites and use our Services and Applications. These activities provide you with the opportunity to, (1) if you are an individual consumer, donate to your favorite organizations and causes, create a peer-to-peer fundraising or team page, and/or register for or purchase tickets, events, reservations, merchandise, and/or other activities; and (2) if you are a client of Classy, set up peer-to-peer or crowdfunding efforts, create donation pages, set up registration on your own behalf or for your organization’s own supporters for events, tickets, transactions, sales, reservations, and/or activities (collectively, “Campaigns”). We also collect information from businesses, organizations, and individuals who request information from Classy or apply to Classy’s job postings.

Individuals (and agents of individuals) who provide us information directly or indirectly by donating to or participating in a Campaign or by otherwise using our Services in an individual capacity are referred to herein as “Consumers.” For example, Consumers may enter information in order to donate to a Campaign, or someone who has organized a team as part of a Campaign may enter your information on your behalf to register your entire team for an event. In addition, individuals or organizations can use our Services to set up Campaigns in order to provide Consumers the opportunity to donate, participate, create peer-to-peer fundraising campaigns, or otherwise interact with such Campaigns (those who use our Services to provide these opportunities to Consumers, primarily charities or other nonprofit organizations, are referred to as “Clients”). Relatedly, our Clients (including agents or representatives of our Clients) may provide us personal information about individuals who have registered for a Campaign being operated by our Client or who the Client wants us to contact or otherwise provide Services to on behalf of the Client.

When you participate in a Client’s Campaign, we provide your personal information to the Client. This Policy does not cover our Clients’ use of your personal information outside of our Services. We are not responsible for the privacy practices of our Clients, and as such we encourage you to read their respective privacy statements. Further, you may be presented with opportunities to purchase products or services offered by other parties or you may elect to participate in contests or sweepstakes offered or sponsored by third parties on the Site. We are not responsible for any such purchase you make, or participation you undertake, and as such any such purchase or participation will be subject to the relevant party’s terms and conditions. When Clients or Consumers contact us for support or other customer service requests, we maintain support tickets and other records related to the requests, including any information provided by such individuals related to such support or service requests. We may also collect call recordings related to support, customer service, and sales-related calls.

Information We Collect Directly from You and How It May Be Shared or Disclosed

Account Information for our Sites. You may browse our Sites without creating an online account or providing us with your information, but to use certain features or to participate in certain Campaigns, you may need to create an account or otherwise provide us with information. When you create an account with us or participate in a Campaign, we may ask you to provide the following:

• Your first and last name;
• Your physical address for billing purposes;
• Your email address and your desired password;
• Your display name (this is the name other people will see when you post items to one of our Sites, make a publicly visible donation, or engage in other similar activities on our site);
• Your date of birth;
• Your marketing preferences (whether and what types of information you would like us to send you);
• Information about your activities and interests;
• Other profile data, such as contact information, occupation, gender, and photos;
• Other data requested by Clients using custom question fields;
• The contact information of a friend, other members of your team, or your customers (when inviting them to visit the Site or when you are allowed to set up an account for them);
• Activity data such as your donation history, fundraising history, events attended, etc.;
• Your name, contact information, and financial information, when you participate in a Campaign;
• Your organization’s name, tax identification number, title, 501(c)3 or tax-exempt status, and other information about your organization, if you are a Client or prospective client;
• Credit reports, if you are applying for a sub-merchant account; and
• Payment information, such as credit card or financial account numbers (if applicable).

Creating a Client Account. We automatically create an account profile for each Client that registers with the Sites. This profile displays the Client’s active Campaigns. It also displays the total amount the Client has raised through the Sites and total number of supporters. Each account profile may include an activity feed that displays activity occurring on the Sites related to that Client (e.g., donations made, events posted, etc.). These account profiles may be publicly accessible using the search function within the Sites or by external search engines (unless, where the functionality is available, the account profile has been made “private” by the Client).

Consumer Transactions. When you make a transaction through the Sites, we automatically index it for you in an individual profile specific to you. That information remains hidden from the public. If you activate your profile, then you will be able to see your profile when you are logged in. The information in your profile remains inaccessible to the public after you activate it; in order to prevent unauthorized access to your profile, you should not disclose or share your login information with other people.

Donations. When you make a donation via the Sites, other Services, or a partner website that uses Classy’s donation processing services, you may be asked to share certain information with the recipient charity(ies), including your credit card/financial information and contact information. When a Consumer has asked to remain anonymous, this only hides your name from public activity feeds, not the underlying charitable beneficiary. If you make a donation to an individual fundraiser (i.e. via a peer-to-peer page) but do not donate anonymously, then the person who created the fundraising page will also have access to your personal information (except for your credit card number or financial information). If you make a donation through an individual fundraising page associated with a fundraising team, or directly to a team fundraising page, then the team fundraising captain will also have access to your personal information (again, except for your credit card number or financial information).

Login and Location Information for Our Mobile Applications for Consumers. When you first visit any of our mobile Applications, you may have the option of creating a user ID and password for subsequent visits. When you log into certain of our Applications, we may request your permission to obtain your current location (so-called “geolocation” information) so that we can identify Campaigns near you or to provide other location-related services. In the “settings” function on your phone, you will have the ability to manually permit or preclude us from recording your geolocation information for certain Applications or features of Applications.

Charitable Campaigns/Fundraising. If you are a Client, you may create a variety of different types of pages on our Sites in connection with your Campaigns (“Client Pages”). Likewise, if you are a Consumer, you may create one or more pages on certain of our Sites in connection with (i) your participation in a Campaign (e.g., you want to raise money for running in a marathon), (ii) your support of a particular charity, (iii) your registration to an event, or (iv) for other purposes (collectively, “Consumer Pages”). We may collect information from you in the process of your creation of these Client Pages or Consumer Pages, as well as in connection with your creation of, administration of, or participation in, a Campaign.

Public Campaigns. Any Campaign (including all associated Client Pages and Consumer Pages) will be publicly available unless it is set to “private” (or similar designation), where that functionality is made available, by the Client responsible for creating the Campaign (see below for an explanation of “Private Campaigns”). Unless set to “private” or similar designation, where that functionality is made available, all such Campaign pages created on the Sites are indexed by search engines and accessible to the public. Information that you post on event pages, campaign pages, personal fundraising pages, or other public pages on the Sites can be accessed by other people. You should exercise caution when deciding to disclose information on public pages. We cannot control who accesses disclosed information or how other parties will use that information.

Private Campaigns. If you, as a Client, create a Campaign on the Sites and select the “private” (or similar) setting, where that functionality is made available, this means that the Campaign link will not be displayed through the activity feeds on the Sites, the Campaign will not be available through the internal search function on the Sites, and neither it nor any associated Consumer pages will be indexed by external search engines like Google. It does not mean, however, that people cannot still wind up on these pages (e.g., if the link is shared with them).

User Profiles, Comments, and Posts. Some of our Sites and Applications allow users to create or post content, such as comments, blogs, and messages. If you provide content to our Sites, we may collect and use that information as described in this Policy. Please note that such information may be viewed, collected or used by other registered users and public visitors to our Sites. Once posted, we cannot control how such information is used and therefore cannot prevent such information from being used in a manner that may violate the law, or your personal privacy. As a Consumer, your user profile, however, may offer privacy settings within your account to help you manage how your content is displayed.

Social Impact Data. Some of our Sites and Applications allow Clients to post content about their nonprofit programs and performance, including data about program strategy, operations, financials, results, and growth tactics. If you provide content to our Sites, we may collect and use that information as described in this Policy. Please note that such information may be viewed, collected, or used by other registered users and public visitors to our Sites. Contests, Surveys, and Questionnaires. When you sign up for contests, including the Classy Awards, or complete questionnaires or surveys, we collect the information you submit to us. We use this information to administer the contest, or survey to analyze the results, for research purposes, to send you other information or offers we think may be of interest to you (pursuant to your consent if required by law), to comply with legal requirements, and for other purposes as discussed in this Policy. This information, such as impact and financial data, may be shared with Partners (as defined below) to appear on their websites and may also be published and used by Classy.

Job Site References. As part of applying for employment with Classy, we may ask you for information such as details regarding your education, employment history, qualifications, and the contact information of a former colleague’s name. This information is used for job reference purposes only and is not used for any other purpose.

Information We Collect from Facebook. We may provide you with the opportunity to connect via Facebook, through our Sites or Applications. For example, you can indicate that you are going to participate in a Campaign and invite your Facebook friends to join that Campaign. If you log into Facebook through our Sites or Applications, we will request permission to (i) access your basic information, which includes your name, profile picture, networks, Facebook user ID, list of friends and any other information that you have made public on Facebook; and (ii) manage your participation in Campaigns. For information about how Facebook may disclose your information, including any information you make public, please consult the Facebook Data Use Policy. We have no control over how Facebook uses or discloses the personal information you provide to it. We store the information that we receive from Facebook along with other information that we collect from you or receive about you.

Information We Collect About You from Third Parties. We also may collect information, including personally identifiable information, about you from our affiliates and non-affiliated third parties. For example, if you register for a race by clicking through our Sites, we may obtain your race time when the race is over.

Information We Collect Automatically. We may use cookies, web beacons, tags, scripts, and other automated devices to collect information, including personally identifiable information, about you when you visit our Sites and receive emails from us. Specifically, we may collect the following information about your use of our Sites via these technologies: your browser type and operating system; web pages you view; webpage interaction, including cursor movement and links you click; your Internet Protocol (“IP”) address; your approximate geographic location; your interaction with the Sites; length of time you are logged in to our Sites; your unique ID which is given to each visitor and expiration of date of the ID and websites visited before or after our Sites. In some of our email messages, we use a “click-through URL” linked to content on the Classy website. When Consumers click one of these URLs, they pass through a separate web server before arriving at the destination page on our Site. We track this click-through data to help us determine interest in particular topics and measure the effectiveness of our Consumer communications. If you prefer not to be tracked in this way, you should not click text or graphic links in the email messages. We also collect non-personal data (including, without limitation, of the type set forth above) from third parties. The information we collect from third parties may be combined with the information we collect directly. This information also may be associated with your username and combined with other information, including personally identifiable information that we collect about you.

This data allows our Sites and Applications to function properly, including, by ensuring the proper display of content; creating and remembering your account login details; interface personalization; improving our Sites; and securing our Sites and protecting against fraud. This data is also used to run statistics to avoid visitors being recorded twice, to understand users’ reaction to our advertising campaigns, to improve our offers, to provide a mechanism to share content on social media, to show online advertisements for products that may be of interest to you (based on your previous behavior), and/or ads and content on social media platforms or other sites. For more detailed information on our use of cookies and other tracking technologies, please see our cookie policy here.

Information Collected by Clients. Our Clients may place cookies or other tracking technologies on your computer, mobile phone, or other device to collect information about your use of the Sites related to that particular Client. Please refer to that party’s privacy policy if you have any questions about its use of your information.

Credit Card Information. As noted above, Classy collects credit card information through its payment processor when you enter into certain types of transactions requiring payment. Credit card information collected by Classy undergoes a tokenization process performed by our vendor and is not stored by Classy directly. The information is only used to perform the transaction and any recurring or guaranteed minimum transactions to which you have agreed.

HOW DO WE USE YOUR INFORMATION?

We may use the information that we gather about you for the following purposes:

• To provide our Services to you, to communicate with you about your use of our Services, and for other customer service purposes;
• To provide information that you have requested to receive from us in response to your opt-in requests;
• To provide our Services at the request of our Clients;
• To administer Campaigns;
• To administer your account;
• To send you receipts;
• To provide and post results of Campaigns;
• To respond to customer service inquiries;
• To improve our Sites and Services by providing personalized experiences, location customization, personalized help, and instructions;
• To provide you updates about our Sites and Services;
• For marketing and advertising purposes; for example, we may use your information to display targeted advertisements to you on our Sites and to assist us in advertising our Services on third party websites;
• To send you email, follow-up questions about your Campaign or your participation in a Campaign, news and newsletters, promotions, and/or invitations to visit the Site;
• To fulfill your request to participate in a webinar or Classy event;
• To conduct the Classy Awards or other promotions you have entered;
• To better understand how users access and use our Sites and Services, both on an aggregated and individualized basis, and for other research purposes;
• When you, if a Consumer, submit your contact information to sign up for or activate a Classy profile, you agree and consent that Classy may send you communications relating to our products, events, or recommended charities or Campaigns (unless such communication requires consent according to applicable law and subject to your ability to opt out of such communications); and
• When you, if a potential Client, submit your organization’s contact information to sign up for an account with Classy, you agree and consent that Classy may send your organization communication relating to our products, events, or other business information (unless such communication requires consent according to applicable law and subject to your ability to opt out of such communications).

Clients should note that we may use information we receive or collect regarding Consumers (including without limitation via a Campaign page) in accordance with the terms of this Policy, including in the manner set forth above.

Notwithstanding the foregoing, in certain contexts, we collect information on behalf of our Clients subject to contractual requirements that limit our ability to use and transfer your information in ways that are more restricted than those in this Policy (e.g., the information be only used as necessary to provide Services to the Client and/or for other specified purposes). In those limited circumstances, your information is subject to those contractual requirements to the extent that they conflict with this Policy, subject to enforcement by the applicable Client. If your information is collected on behalf of another party, such as a Client, it will be evident at the time that you provide such information. This Policy does not cover our Clients’ use of your information outside of our Services. You should contact the Client or other party directly to determine if your information is subject to such limitations on uses and to ascertain how the other party will make use of your information.

WHEN AND HOW DOES CLASSY SHARE INFORMATION IT RECEIVES?

Third Parties. We may share your information, including personally identifiable information, with unaffiliated and affiliated third parties.

Affiliates. We may disclose the information we collect from you to our affiliates or subsidiaries.

Campaign Sponsors or Partners. If you are using our Services to participate in a Campaign or to purchase another party’s product or service, Classy shares the personal information that you provide with the applicable parties in order to fulfill your request. You may receive communications, correspondence, emails, or direct mail from these entities; each such party operates independently from Classy and is not subject to this Policy but is subject to its own privacy policy. For example, if you donate to an organization, that organization may reach out to you to inform you how your donation was used or otherwise thank you. In some instances, we allow Clients to use our email system via the Services to contact Consumers for their current and past Campaigns, so you may receive emails from our system that originate with such Clients. Please refer to that party’s privacy policy if you have any questions about its use of your information.

Activity Feeds. Activity feeds are streamed displays of actions occurring on the Sites. Unless you select the option to participate in a Campaign anonymously, your name and the amount of your contribution (or ticket/registration purchase) will be publicly displayed through the relevant Client’s activity feed and the activity feed of a fundraising or team page.

Clients using the Sites also have access to certain widgets (widgets are small snippets of code we generate that the Client can then put into another website). These widgets allow Clients to display activity occurring on the Sites on the Clients’ own websites, blogs, or another website. Unless you donate anonymously, your name and the amount of your donation (or ticket/registration purchase) may be publicly displayed through the activity feed on a widget. If you become a supporter of a Client on the Sites, or fundraise for a Client on the Sites, your name and picture may also be displayed on a widget. Please keep in mind that we cannot control where a given Client will embed the widgets we make accessible to it.

Making a donation “anonymous” only hides your name from public activity feeds, not the underlying charitable beneficiary. If you donate anonymously through a personal or team fundraising page, your personal information will not be shared with either the individual fundraiser or the team fundraising captain. If you make a donation to an individual fundraiser (i.e., via a peer-to-peer fundraising Campaign) but do not donate anonymously, then the person who created the fundraising page will also have access to your personal information (except for your credit card number or financial information). If you make a donation through an individual fundraising page associated with a fundraising team, or directly to a team fundraising page, then the team fundraising captain will also have access to your personal information (again, except for your credit card number or financial information). Similarly, if you join a team to participate in a Campaign, such as a race or other event, then the team captain will also have access to your personal information (again, except for your credit card number or financial information). You consent to the foregoing and agree that we are not responsible for how these organizations or persons handle your personal information. You should visit their websites and/or contact them directly for their privacy policies and data usage practices.

Supporter Communications. As part of a Client’s use of the Services, Consumers may also send emails through the Services. For example, personal fundraisers may send messages to their contacts through the Services in order to ask people to visit their fundraising pages and donate. They may also send emails to update donors or to thank donors for their gifts.

APIs. We make certain application programming interfaces (“APIs”) available to Clients. An API (in non-technical terms) allows a Client to automatically retrieve certain information from our Sites, for use/display elsewhere (e.g., on the Client’s website). To give an example, a Client might use our API to retrieve the names and photos of the top five fundraisers for a Campaign; the Client could then display that information on a leaderboard on its own website. If you are fundraising for a Client, your name, picture, amount raised, and goal can be retrieved by the Client through our API. If you create a team fundraising page, then your name, the team goal, and the amount raised by the team can also be retrieved by the Client through our API. If you host an event for a Client, then your name, contact info, and the location of your event can be retrieved by the benefitting Client through our API. If you are a Consumer who donates to a Campaign, the Client who receives your donation may display your information, such as name, photo (as provided by you), and amount to the Client’s own donation appreciation wall or similar acknowledgment (which would be hosted outside of Classy’s Services). The foregoing examples are for illustrative purposes only. The Client with whom you engage has access to other information through our API such as tickets sold and number of attendees.

Service Providers. We may disclose the information we collect from you to vendors, service providers, contractors, or agents who perform functions on our behalf. For example, these providers may help us administer our Sites and Applications, manage and administer Campaigns, process credit card or other payments, de-duplicate data, verify identities for fraud prevention purposes, or provide analytics services by evaluating your use of the Sites. These vendors have agreed to maintain the confidentiality, security, and integrity of your information and may be located wherever the Sites or Services are available. Where required by law, these companies agree to only use such information for the purposes for which they have been engaged by us unless you expressly permit them to use your information for other purposes. We now require vendors to whom we disclose Personal Data (as defined below) and who are not subject to laws based on the European Union General Data Protection Regulation to enter into Data Protection Addendums containing, among other things, the Standard Contractual Clauses, as promulgated by the European Commission in order to provide protection for the Personal Data. If the other party does not comply with its privacy obligations, Classy will take commercially reasonable steps to prevent or stop the use or disclosure of Personal Data. For purposes of this Policy, “Personal Data” means information that (i) is transferred from the EU to the United States, (ii) is recorded in any form, (iii) is about, or relates to, an identified or identifiable consumer, customer, supplier or other individual, and (iv) can be linked to that consumer, customer supplier, or other individual.

Other Non-Affiliated Third Parties. We may disclose the information that we collect about you to non-affiliated third parties (with your consent, if consent is required by law), such as promotional partners and others with whom we have marketing or other relationships. An example would include a co-sponsored webinar in which you sign up to attend. In that case, we would provide your information to the co-sponsor. Those third parties may use your information for marketing purposes, such as to market products and services that they believe would be of interest to you. We also may combine the information that we collect about you with other information that we obtain from third parties. This information may help us to determine what advertisements to direct to you, to place on our website, and where to advertise our Services. As discussed in the advertising section below, you have the ability to opt-out of certain uses of your information. You also have the ability to opt-in to receiving certain information from us and non-affiliated third parties.

Supplemental Service Partners. By purchasing or registering for products or services offered by third parties as a result of your interaction with the Services or use of the Sites, electing to receive communications (such as emails) or electing to participate in surveys, contests, sweepstakes, or other programs offered or sponsored by third parties on the Site, you consent to our providing your personal information to those third parties, and you agree that we are not responsible or liable for any of their actions or omissions. When you provide your information in this manner, it will be apparent that you are providing it to another party. Those other parties may use your personal information in accordance with their own privacy policies. You will need to contact those third parties to instruct them directly regarding your preferences for the use of your personal information by them. Additionally, you agree that we will have the right to use and disclose all such information submitted by you to such third parties in the same manner in which we have the right to use and disclose all other information submitted by you directly to us.

Strategic Partners. Classy has integration relationships with third-party companies and individuals (“Partners”). These relationships extend the functionality of the Services and the Partner’s application or service (“Integrated Service”) by allowing the Services and the Integrated Service to exchange Consumer data among other things and to establish linked business processes between the two. Consumers or Clients who pay Classy for use of the Services and use an Integrated Service are considered customers of both Classy and the Partner. Classy and the Partner may share Consumer or Client contact, account, financial and billing information, and business data with respect to their integrated business relationship with the Consumer or Client. The sharing of this information allows Classy and the Partner to establish the identity of the shared customer and, in some cases, determine referral fees owed. This sharing may also allow the Partner to provide consolidated billing services to the shared customer and allow for the enhanced functionality of the Integrated Service. Those Partners may use your personal information in accordance with their own privacy policies. You will need to contact those third parties to instruct them directly regarding your preferences for the use of your personal information by them. Additionally, you agree that we will have the right to use and disclose all such information submitted by you to such third parties in the same manner in which we have the right to use and disclose all other information submitted by you directly to us.

Affiliate and Referral Partners. Classy has referral relationships with affiliates and third-party companies and individuals (“Referral Partners”) who refer customers to Classy. Classy and a Referral Partner may share certain information with respect to a Consumer or Client that is referred by Classy or a Referral Partner to allow Classy and the Referral Partner to establish the identity of the shared Consumer or Client and determine referral fees owed. We also may share your information for the following reasons:

• Business Transfers. If we are acquired by or merged with another company, if substantially all of our assets are transferred to another company, or as part of a bankruptcy proceeding, we may transfer the information we have collected from you to the acquiring company. You acknowledge and agree that any successor to or acquirer of Classy will continue to have the right to use your information in accordance with the terms of this Policy.
• In Response to Legal Process. We also may disclose the information we collect from you in order to comply with the law, a judicial proceeding, court order, or other legal process, such as in response to a subpoena.
• To Protect Classy and Others. We also may disclose the information we collect from you where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, or violations of our Terms of Service or this Policy.
• Aggregate and Anonymized Information. We may share aggregated or anonymized information about Clients and Consumers with third parties for marketing, advertising, research, or similar purposes. For example, if we display advertisements on behalf of another party, we may share aggregated, demographic information with that other party about the Consumers and/or Clients to whom we displayed the advertisements. In addition, we may publish long-form research reports and blog posts summarizing aggregated data describing behaviors of Clients and Consumers on our Sites, Applications, and Services. We may also publish datasets containing aggregated Client and/or Consumer data to support replication of the published research results.

Third Party Applications. Third party applications, such as Instagram, Facebook, Twitter, Pinterest, or Google buttons, may be available on our Sites. The owners or providers of those third party applications may collect personally identifiable information from you. Their collection of information is bound by their own information collection policies and practices. Your interactions with third party applications on our Sites may be shared with others within your social network. We are not responsible for the collection and use of your information by such third parties. You should review your privacy settings with these third party applications to be sure you are only sharing information you wish to share.

Our Sites include social media features, such as the Facebook “Like” button and widgets such as the “share this button” or interactive mini-programs. These features may collect your IP address, which page you are visiting on our Site, and may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on our Site. Your interactions with these features are governed by the privacy policy of the company providing such feature.

Network Advertisers. Network advertisers are third parties that display advertisements based on your visits to our Sites and other websites you have visited. This enables us and these third parties to target advertisements to you for products and services in which you might be interested. These third party services may use cookies, JavaScript, web beacons (including clear GIFs), and other technologies to measure the effectiveness of their ads and to personalize advertising content to you. These third party technologies are governed by each third party’s specific privacy policy, not this one. We may provide these third parties with information, including both personally identifiable and non-personally identifiable information, about your usage of our Sites and our Services. For more detailed information on the use of third party technologies and how to opt out of receiving targeted advertisements, please see our cookie policy here. If you would like to manage your consents to the cookies on our sites, click here.

We use Local Storage, such as HTML5, to store content information and preferences. Third parties with whom we partner to provide certain features on our website or to display advertising based upon your web browsing activity may also use HTML5 to collect and store information. Various browsers may offer their own management tools for removing HTML5.

Third Party Links. At times, our Sites and Applications may contain links to other third party websites. Any access to and use of such linked websites is not governed by this Policy, but, is instead governed by the privacy policies of those third party websites, and we are not responsible for the information practices of such third party websites.

HOW SECURE IS INFORMATION ABOUT ME?

We have implemented and maintain appropriate technical and organizational security measures, policies, and procedures designed to reduce the risk of accidental destruction or loss, or unauthorized disclosure or access to such information appropriate to the nature of the information, concerned, including,

• where appropriate, password protection, encryption, tokenization, and secure socket layering to protect our Sites;
• following strict security procedures in the storage and disclosure of your personal information to prevent unauthorized access to it; and
• placing confidentiality requirements on our employees and vendors.

Please be aware that despite our best efforts, no data security measures can guarantee 100% security all of the time. Please keep this in mind when disclosing any of your personal information via the Internet.

As the security of personal information depends in part on the security of the computer you use to communicate with us and the security you use to protect usernames and passwords, you should take steps to protect against unauthorized access to your password, computer, and web- enabled devices, among other things, by signing off after using a shared computer, inserting a password on your web-enabled device, choosing a password that nobody else knows or can easily guess, keeping your password private, and periodically changing your password. You should never share your login information with others. We are not responsible for any lost, stolen, or compromised passwords, or for any activity on your account via unauthorized password activity.

We endeavor to store your personal information for only as long as is reasonably necessary for the purposes for which it was collected, as explained in this Policy. Where your information is no longer needed, we will dispose of it in a secure manner in accordance with our Data Retention Policy. In some circumstances, we may store your personal information for longer periods of time, for instance where we are required to do so in accordance with legal, regulatory, tax, or accounting requirements.

In specific circumstances we may store your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.

CAN I ACCESS AND MODIFY MY PERSONAL INFORMATION?

Upon request, Classy will provide you with information about whether we hold, or process on behalf of another party, any of your personal information. To request this information please email us at [email protected].

If your personal information changes, or if you no longer desire our service, you may correct, update, delete/remove, or ask to have it removed from a public forum or testimonial by making the change within your account settings or by contacting us via one of the methods listed in this Policy. We will respond to your request in accordance with applicable law. Please note that copies of information that you have updated, modified, or deleted may continue to reside in our systems for a period of time. Also, you may not be able to remove your personal information from archived web pages that we no longer maintain, such as information related to a Campaign in which you participated, where that information is displayed by our Client or another party to whom the Client provided your information. In the event we are unable to complete your access request, we will let you know that we are unable to do so and why. We may decline to process requests that are unreasonably repetitive, require disproportionate technical effort, jeopardize the privacy of others, are extremely impractical, or for which access is not otherwise required by local law.

If your information has been shared or disclosed with another party, as described above, or collected on behalf of a Client, then such party has received their own copy of your data. If you have been contacted by one of these parties, or one of our Clients, and wish to correct or request they delete your information, please contact them directly.

WHAT CHOICES DO I HAVE REGARDING MY INFORMATION?

Classy may send you emails from time to time, for example, to ask you about a Campaign in which you participated. When you use our Services, you may have the option of signing up for news and offers from us or other third parties, which may include information about Campaigns, our newsletter, or other items that we (or third parties) believe may be of interest to you. If, at any time, you would like to stop receiving the information that you have requested to receive from us, you may follow the opt-out instructions contained in any such email. Please note that it may take up to 10 business days for us to process opt-out requests.

To opt out of products, programs, Services, or offers from our affiliates and trusted partners, please contact [email protected] or log into your account and update your subscription preferences, where that functionality is made available to you. If you opt out of receiving emails or promotions from us, we still may send you emails about your account or any Services you have requested or received from us, or for other customer services purposes, including sending you receipts. In addition, you may still receive emails sent by our Clients through means other than our system. Further, if you opt out of receiving information related to a particular Campaign, you will still receive Classy communications and communications from other organizations whose Campaigns you have participated in or who have otherwise obtained your email address. As a result, as a Consumer, you may have to unsubscribe from multiple emails before you stop receiving all communications related to Campaigns in which you have participated through our Services.

As a Client, by electing to stop receiving communications from us or through our system you will no longer receive any updates on your account or on Campaigns in which you are participating or have participated, including communications regarding receipts and refunds. We do not recommend that you do this unless you plan to no longer use the Services, have not participated in a Campaign for which you need a receipt, are not currently participating in a Campaign, or are not currently organizing a Campaign and will have no need to receive further communications from us or through our system. If you are a Client, note that you may not be able to unsubscribe from update communications about the Services unless you close your account.

Even after you opt out of all communications, we will retain your information in accordance with this Policy; however, we will no longer use it to contact you, unless required by law or unless you later provide your information to us. However, our Clients who have received your information in accordance with this Policy may still use that information to contact you in accordance with their own privacy policies, but they may not use our system to do so. If you would like to delete your account with us, you may do so by emailing us at [email protected] and specifying which account(s) to delete.

INTERNATIONAL DATA TRANSFER

The Services are hosted in the United States and are governed by United States law. If you are visiting the Sites or using the Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers and databases are located. The data protection and other laws of the United States and other countries might not be as comprehensive as those in your country.

By using the Sites and Services, you consent to your information being transferred to our facilities and to the facilities of those third parties with whom we share it as described in this Policy. We will take appropriate steps to cause those transfers of personal information are in accordance with applicable law, are carefully managed to protect your privacy rights and interests and limited to countries which are recognized as providing an adequate level of legal protection or where alternative adequate arrangements are in place to protect your privacy rights.

In certain situations, Classy may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

IF YOU ARE LOCATED IN THE EUROPEAN ECONOMIC AREA (EEA), UNITED KINGDOM OR SWITZERLAND

THIS SECTION ONLY APPLIES TO USERS OF OUR SERVICES THAT ARE LOCATED IN THE EUROPEAN ECONOMIC AREA, UNITED KINGDOM OR SWITZERLAND AT THE TIME OF DATA COLLECTION. WE MAY ASK YOU TO IDENTIFY WHICH COUNTRY YOU ARE LOCATED IN WHEN YOU USE SOME OF OUR PRODUCTS OR SERVICES, OR WE MAY RELY ON YOUR IP ADDRESS TO IDENTIFY YOUR COUNTRY LOCATION.

Classy processes Personal Data as a “processor,” “joint controller,” and as a “controller” under the European Union’s General Data Protection Regulation. A “controller” is an entity that determines the purposes for which and the manner in which any personal information is processed. Any third parties that act as our service providers are “data processors” that handle your personal information in accordance with our instructions. With respect to your personal data that you enter or that is received through our websites that is not directly related to a Customer’s Campaign, Classy is the controller. To the extent that Classy receives personal information from a Consumer through a Customer’s Campaign, Classy and its Customer are joint data controllers. This means that you may choose to exercise your rights, including as described below, with Classy or the relevant Classy Customer. Please do not hesitate to contact us if you are unsure who the relevant Classy Customer is for a given Campaign or would like their contact information at [email protected]. If you are in the EEA, United Kingdom or Switzerland, you have the following rights (where applicable):

• Access: You have the right to request a copy of the information we are processing about you;
• Rectification: You have the right to have incomplete or inaccurate information that we process about you rectified;
• Deletion: You have the right to request that we delete information that we process about you, except we are not obliged to do so if we need to retain such data in order to comply with a legal obligation or to establish, exercise, or defend legal claims;
• Restriction. You have the right to restrict our processing of your information where you believe such data to be inaccurate; our processing is unlawful; or that we no longer need to process such data for a particular purpose unless we are not able to delete the data due to a legal or other obligation or because you do not wish for us to delete it;
• Portability. You have the right to obtain information we hold about you, in a structured, electronic format, and to transmit such data to another data controller, where this is (a) information which you have provided to us, and (b) if we are processing that data on the basis of your consent or to perform a contract with you;
• Objection. Where the legal basis for processing your information is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have compelling legitimate grounds for the processing which override your interests, or if we need to continue to process the data for the establishment, exercise, or defense of a legal claim;
• Withdrawing consent: If you have consented to our processing of your information, you have the right to withdraw your consent at any time, free of charge. This includes where you wish to opt out from marketing messages.

You can make a request to exercise any of these rights in relation to your information by contacting us via the methods listed below under Contact Us. For your own privacy and security, at our discretion, we may require you to prove your identity before providing the requested information. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive. We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

You also have the right to lodge a complaint with the local data protection authority if you believe that we have not complied with applicable data protection laws. A list of local data protection authorities in European countries is available here.

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it. However, we will normally collect personal information from you only where we have your consent to do so, where we need the personal information to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect personal information from you.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information). Similarly, if we collect and use your personal information in reliance on our legitimate interests (or those of any other party), we will make clear to you at the relevant time what those legitimate interests are.

CHILDREN UNDER 13 (OR 16 IN THE EU)

Our Sites are for general audiences, and we do not knowingly market to, or solicit information, accept service or collect information from or about children or sell products to children under the age of 13 (or 16 in the EU). If you are under the age of 13 (or 16 in the EU), you must ask your parent or guardian to use our Sites directly, on your behalf. Furthermore, we may restrict entries to any contests, sweepstakes, or promotions to those who are at least 18 years of age. If we become aware that any person submitting information to the Sites is under the age of 13 (or 16 in the EU), we will attempt to delete the account and any related information as soon as possible. By using the Sites, you hereby represent that you are at least 13 years old (or 16 in the EU).

TERMS OF SERVICE

Your use our Sites or Services, as well as any dispute over privacy, are subject to this Policy and our Terms of Service, https://www.classy.org/terms/, including applicable limitations on damages and the resolution of disputes.

SPECIAL INFORMATION FOR CALIFORNIA RESIDENTS

California Consumer Privacy Act Rights. Under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act (“CPRA”) and collectively referred to as, “CCPA”) California residents have certain rights regarding their personally identifiable information. If you would like to exercise these rights, please contact us using the email address, toll free phone number, or mailing address listed within the Contact Us section below. For your own privacy and security, at our discretion, we may require you to prove your identity before providing the requested information. It may take us some time to respond to your request, but we will do so within the requirements of the CCPA. This Policy provides you disclosure regarding the personal information we collect from you and the purposes for doing so. This section of the Policy supplements our other privacy policies and notices. In the event of a conflict between any other policy, statement, or notice and this portion of our Policy, this portion of our Policy will prevail as to California consumers and their rights under California privacy law.

As used in this Special Information for California Residents section of the Policy, the term “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. Personal information does not include information that is publicly available, de-identified, or aggregated.

Please see WHAT INFORMATION DO WE COLLECT ABOUT YOU AND WHY? for the categories of personal information we may collect.

• We do not “sell” your personal information as provided under the CCPA. However, we may “share” your personal information under the definition provided in the CPRA based on processing your data for targeted advertising as further described in our cookie policy here.
• Right to request disclosure as to personal information Classy has collected about you:
  • Upon a verifiable request, made through one of the methods provided within the Contact Us section below, we will disclose to you the items listed below, one or more of which may be provided by reference to this Policy:
  • The categories of personal information it has collected about the you.
  • The categories of sources from which the personal information was collected.
  • The business purpose behind collecting the personal information.
  • The categories of third parties with whom Classy has shared the information.
  • The specific pieces of personal information Classy has collected about you.
• Right to request deletion: upon a verifiable request, made through one of the methods provided within the Contact Us section below, we will delete personal information we have regarding you and direct our vendors to delete your personal information from their records, to the extent provided by the CCPA.
• Right to be free from discrimination: Classy will not discriminate against you for exercising any of your rights under the CCPA. Please keep in mind that under certain circumstances, we may charge you a different price or rate, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to you by your personal information.

How Long We Keep Your Personal Information

We keep the categories of personal information described above for as long as is necessary for the purposes described in this section or as otherwise authorized or permitted by law. This generally means holding the information for as long as one of the following apply:

• The personal information is reasonably necessary to manage our operations, to manage your relationship with us, or to satisfy another purpose for which we collected the information;
• The personal information is reasonably necessary to carry out a disclosed purpose that is reasonably compatible with the context in which the personal information was collected;
• The personal information is reasonably required to protect or defend our rights or property; or
• We are otherwise required or permitted to keep your information by applicable laws or regulations.

Where information is used for more than one purpose, we will retain it until the purpose with the latest period expires.

SPECIAL INFORMATION FOR VIRGINIA RESIDENTS

This section of our Policy (“Virginia Notice”) is provided pursuant to the Virginia Consumer Data Protection Act (“VCDPA”) and describes how we process Personal Data of Virginia consumers. In the event of a conflict between any other section of this Policy, other policy, statement, or notice and this Virginia Notice, this Virginia Notice will prevail as to Virginia consumers and their rights under Virginia privacy law.

As used in this Virginia Notice, the term “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. Personal Data does not include information that is publicly available, de-identified, or aggregated.

A. Collection of Personal Data

When you use our Services, we may collect your name, email address, login details, phone number, zip code, country, and payment card information. We may also passively collect certain data when you interact with the Services such as your IP address and the type of Internet browser or mobile device.

We may process your Personal Data for targeted advertising. To opt out, please click here.

For more information on the categories of Personal Data that we collect and the purpose for processing such Personal Data, please visit the “WHAT INFORMATION DO WE COLLECT ABOUT YOU AND WHY?” section of this Policy.

B. Disclosure of Personal Data

We may disclose certain Personal Data described above among our affiliates and subsidiaries and with our agents, consultants and vendors. We may also disclose Personal Data with certain third parties such as social networking services that partner with us.

For more information on the categories of third parties that we disclose Personal Data, please visit the “WHAT INFORMATION DO WE COLLECT ABOUT YOU AND WHY?” section of this Policy.

C. Rights Under the VCDPA

If you are a Virginia resident, you have the following rights: to request access to certain Personal Data, correction of inaccuracies in Personal Data, and deletion of Personal Data, subject to certain exceptions. You will not be discriminated against because you exercised any of your rights under the VCDPA.

You also have the right to opt-out of Classy using your information for targeted advertising. To opt out of the use of your information for these purposes, please click here.

We may be unable to process your privacy rights request related to your Personal Data. If you are a resident of Virginia whose privacy rights request has previously been denied by us and you believe we denied it in error, you may appeal for reconsideration of your request by contacting us through one of the methods provided within the Contact Us section below.

In order to protect your privacy and security, we will authenticate your identity prior to responding to your request, by asking for information such as your name, email, and/or information already maintained by Classy about you or additional proof where necessary.

CHANGES TO THIS POLICY

We may change this Policy from time to time, so be sure to check back periodically. If we make any changes to this Policy that materially affect our practices with regard to the personal information we have previously collected from you, we will endeavor to notify you in advance of such change, by highlighting the change on the Sites or by sending an email to you at the email address that you have registered with us. Your continued use of the Services after any changes or revisions to this Policy will indicate your agreement with the terms of the revised Policy.

CONTACT US

Classy regularly reviews its practices regarding personally identifiable information and this Policy. If you have any questions, comments or concerns, please contact us at:

Attn: Classy Privacy
Classy, Inc.
PO BOX 121270
SAN DIEGO, CA 92112
Phone: (619) 961-1892
Email: [email protected]