Colorado Privacy Policy & Notice

1. Categories of Personal Information We Collect:

The American Red Cross collects and stewards your personal information through a variety of channels, including as information you provide to us, information we automatically collect through our systems, and information we receive from others. The categories of personal information we collect through any of those channels may include any of the following:

• Personal or individual identifiers - First, Middle and Last Name, DBA or other alias, postal address, email address, phone numbers, Social Security number or other tax identification number, passport number, demographic information, driver’s license number, military identification number, bank account number, credit card number, debit card number, signature, internet protocol address, account registration data (e.g., account username and password and associated information) and professional/employment-related information.

• Commercial or financial data - Deposit and credit account numbers, assets and liabilities, sources of income, products or services purchased, obtained, or considered, records of transactions (including records of interactions, such as purchase and donation history), other purchasing or consuming histories or tendencies, records of real property and personal property; other financial information such as assets and liabilities, financial statements, tax returns, other sources of income, insurance policy numbers.

• Health data. For example, we may seek information about your health when you donate blood, or avail yourself of ARC services that relate to promoting health.

• Internet or other electronic network activity - Information regarding how you interact with ARC’s internet websites (including, potentially, browsing history), applications, advertisements, devices and device identifiers, networks and other digital resources, information about your device and device usage while using our mobile apps, IP address or information that could be derived from it, and/or preferences you may have for how we communicate with you. ARC and authorized third parties may utilize technologies to automatically receive and record information when you interact with us online on our websites and/or through other digital technologies, such as email platforms, mobile applications, or over the phone. These technologies allow ARC to improve our digital services, create a better experience for our users, and protect against fraud.

• Audio or visual data. We may collect your image or voice, which may be captured when you attend an in-person or virtual event or activity, or leave us a voicemail.

• Geolocation data - If you provide express consent or enable location services on our mobile applications.

• Inferences Drawn from Any of the Foregoing - Certain inferences concerning an individual’s preferences and characteristics.

2. Purposes of Personal Information Collection:

ARC collects your personal information to further our mission, and we aim to use only the information that is specific and necessary. Whenever we process, use, or share that information, we apply appropriate confidentiality and security requirements. When we collect personal information, we may use any of the categories of personal information we have collected for a range of legitimate business purposes, which will vary depending on the nature of your interaction with the American Red Cross. The American Red Cross may collect personal information for any of the following purposes:

• to communicate with you;

• to verify your identity;

• provide and manage donations or requests you have made;

• to process and complete transactions;

• to provide a secure and optimized experience engaging with our Sites and other Digital Services to improve our website and mobile applications, understand user preferences, and tailor our services to better meet the needs of our community

• to provide requested services, notifications, or informational resources.

• further ARC’s charitable, redevelopment and philanthropic efforts;

• protect against fraud, harm, or illegal activities, and manage risk;

• respond to an emergency which we believe reasonably requires us to disclose information to assist in preventing death or serious bodily injury;

• determine suitability of ARC offerings for you;

• better manage your relationship with us;

• comply with legal or regulatory requirements, or as otherwise permitted by law;

• communicate with you regarding ARC-related information and opportunities that may be of interest;

• better understand your needs as a financial donor, and better develop and tailor opportunities and communications to you; and/or

• respond to any questions you may have.

If a new purpose for using your personal information develops that is unrelated or materially different from these purposes, we will identify that purpose.

3. With Whom and How We Share Your Information:

While we do not sell your personal information, we may share personal information with your consent, when you direct us to share it with others, as necessary to complete your transactions, or to provide the information and/or services you have requested or authorized. For example, when you provide credit card information to make a donation, we will share that data with payment card processors and other entities as necessary for the processing of your payment and to prevent or detect fraud. We also may share personal information with the other types of other parties as follows:

• Service Providers - We may share personal information with service providers for a variety of reasons, such as to facilitate the operation of our Digital Services; support our fundraising, marketing, communications, and advocacy programs; better and more effectively and efficiently manage our information ecosystem; and deliver messages to you on other platforms. We require service providers and to agree to take reasonable security measures in the handling and storage of that information. When we share personal information about you with a service provider, we take steps to: (1) transmit it in a secure manner and (2) require the service provider to promise to keep that information confidential and use it only for the purpose of carrying out the activities we have directed them to perform.

• Affiliates and Business Partners - In certain cases, we may disclose personal information to affiliates or business partners in the normal course of business and/or to maintain, operate, or enhance our and/or our business partner’s operations. For example, we may share personal information with another nonprofit organization with whom we are co-hosting an event or working as part of a broader coalition to advance ARC’s mission and goals.

• Third-Party Promotional Activities - We may share your personal information with third parties to serve targeted promotions or efforts at engagement and outreach to specific individuals, including you, or to display ads to people who are similar to specific individuals who have engaged with the American Red Cross. As a result, we may display targeted information, promotions, and other engagement or outreach materials to you outside the Digital Services, including on third-party websites, and social media sites, such as Facebook and Instagram, to fundraise and build support for our mission. These practices help us engage in effective fundraising, maintain and support our operations, and enable our teams to communicate more effectively with known and prospective supporters. If we share personal information shared with third parties, we take measures to protect your privacy, and only share personal information with third parties that agree to hold personal information confidentially and securely and promise not to use personal information for other purposes.

• As Required by Law - We may share personal information when required by law or necessary to protect the American Red Cross or others, such as in the following circumstances:

  • Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies;

  • Conduct litigation, including by disclosing information to counsel or other parties involved in the litigation process of claims by or against the American Red Cross;

  • In the event of exigent circumstances, to help prevent the loss of life or serious injury or to protect the personal safety of American Red Cross personnel, users of our Digital Services, our visitors, or the public;

  • Detect, investigate, prevent or otherwise address fraud or privacy issues;

  • Operate and maintain the security of our services, including to detect, investigate, prevent, stop, or remediate an attack on our computer systems or networks; or

  • Protect the rights or property of ourselves, or others, including by enforcing our agreements, terms, and policies.

4. Your Rights Under the Colorado Privacy Act:

If you are a Colorado resident, you may have the following rights regarding your personal information:

• The right to access and obtain information about categories of personal information we have collected.

• The right to correct or to request deletion of certain personal information.

• The right to opt out of the sale of your personal information. Note We do not your sell personal information.

• The right to opt out of targeted advertising.

• The right to non-discrimination for exercising your privacy rights.

Please note that your exercise of these rights is subject to certain exceptions and limitations that may apply to restrict the scope of a given right and our ability to respond to a given request. We may have to take certain steps to verify your identity in connection with any request related to exercising these rights to help ensure that we provide the information we maintain to the individuals to whom it pertains, and allow only those individuals or their authorized representatives to exercise these rights. We also have the right to take into account the interests of others in responding to any request. We may charge a reasonable fee for processing if your request is clearly unfounded, repetitive, or excessive. If we determine your request warrants a fee, we will notify you of the fee and explain that decision before completing your request.

5. How to Exercise Your Rights Under the Colorado Privacy Act:

To exercise your rights under the Colorado Privacy Act or if you have any questions or concerns about the American Red Cross's privacy practices, please send an email to PrivacyOfficer@redcross.org with the subject line “Colorado Privacy Act – Request” that clearly specifies the nature of your request, and provides us with sufficient detail about you and your prior interactions with us to facilitate our processing of the request. You may also submit a request in writing by sending mail to:

American Red Cross
Office of the General Counsel
431 18th Street NW
Washington D.C. 20006
Attention: Privacy Officer
Re: Colorado Privacy Act – Request

6. Other Important Information:

The American Red Cross is committed to protecting your personal information and privacy. We regularly review and, if appropriate, may update this Colorado Policy from time to time, and as our services and use of personal information evolves. If we make material changes to this Colorado Policy, we will notify you here, by email, or by means of a notice on our homepage. You can tell if this Policy has changed by checking the effective date that appears at the top of this Policy. We will update the date of this Policy each calendar year or each time it is changed.

7. Contact Us:

If you have any questions, comments, or concerns about this Colorado Privacy Notice or the American Red Cross's privacy practices, please contact us using the information provided above.