Effective Date: April 2, 2025
The H. E. Butt Foundation (“we,” “us,” or “our”) is committed to protecting the personal information of individuals who interact with our organization, programs, websites, and services. This Privacy Policy describes how we collect, use, share, and protect your information, including when you interact with us online, submit data through forms, or opt into communications such as text (SMS) messages. We regularly review and update our privacy practices to remain in compliance with applicable laws, including the General Data Protection Regulation (GDPR) and evolving U.S. data protection regulations.
IN PLAIN ENGLISH: We gather data to serve our guests. We never sell data with outside entities.
1. INFORMATION WE COLLECT
We may collect the following types of personal information, depending on how you engage with us:
We do not knowingly collect personal information from children under the age of 13.
2. HOW WE USE PERSONAL INFORMATION
We use personal data only for legitimate purposes related to our mission and services, including:
3. WHO WE SHARE INFORMATION WITH
We do not sell, rent, or share your personal information with third parties or affiliates for marketing purposes.
We may share information only in the following circumstances:
4. SMS COMMUNICATIONS
If you opt into SMS communications from the H. E. Butt Foundation:
SMS consent is not shared with third parties or affiliates for marketing purposes. Any mobile data collected is stored securely and only used to facilitate the messaging service you opted into.
We use cookies and similar tracking technologies to improve website performance, analyze usage patterns, and deliver relevant content. We may also use third-party analytics providers (such as Google Analytics) that collect aggregated, non-personal information about visitors’ interactions with our website. You may manage cookie preferences through your browser settings.
6. MOBILE APPLICATIONS
If you access our services through a mobile application, we may collect technical and usage data from your device, such as device type, operating system, app version, and usage patterns. App-specific permissions (e.g., location, microphone, camera) are only activated with your consent and used solely to deliver relevant features or services.
7. DATA RETENTION
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, or enforce our policies. When personal data is no longer needed, we securely delete or anonymize it in accordance with our data retention schedule.
8. AUTOMATED DECISION-MAKING
We do not use your personal data to make decisions that produce legal or similarly significant effects based solely on automated processing, including profiling. Should this change in the future, we will update this policy and provide notice of your rights related to such processing.
9. HOW WE PROTECT YOUR DATA
The H. E. Butt Foundation already has a consistent level of data protection and security across our organization. Here are some of the ways we work to protect your data:
Information Audits – We conducted a company-wide information audit to identify and assess what personal information we hold, where it comes from, how and why it is processed, and if and to whom it is disclosed.
Policies & Procedures – We maintain data protection policies and procedures aligned with GDPR and other data protection laws, with an emphasis on privacy by design and individual rights.
Data Retention & Erasure – We apply data minimization and storage limitation principles, supported by a formal retention schedule and erasure mechanisms through our internal systems and third-party registrars.
Data Breaches – We maintain a breach communications plan and internal procedures to promptly identify, assess, investigate, and report personal data breaches.
International Data Transfers & Third-Party Disclosures – We store data in the United States and evaluate third-party vendors for adequate safeguards, data subject rights, and remedial protections.
Subject Access Requests (SAR) – Individuals may request access to their personal data, and we respond free of charge within 30 days. Requests are reviewed for validity and completeness.
Legal Basis for Processing – We maintain appropriate records of our processing activities and the legal grounds supporting them.
Consent Management – Consent for personal data collection is clearly requested and recorded. Individuals are provided with the purpose, scope, and use of the data before agreeing to share it.
Direct Marketing – All marketing messages contain an opt-in mechanism at the point of collection and an opt-out mechanism in every message.
Data Protection Impact Assessments (DPIAs) – We use DPIAs for high-risk processing involving special category or large-scale data.
Processor Agreements – All third parties who process personal data on our behalf are bound by data protection obligations under written agreements.
Special Category Data – We only collect and process sensitive data when necessary, with explicit, signed consent.
10. DATA SUBJECT RIGHTS
Individuals have the right to:
Requests may be submitted to info@hebfdn.org, and we will respond within 30 days.
11. INFORMATION SECURITY & TECHNICAL AND ORGANIZATIONAL MEASURES
We take privacy and information security seriously. Our controls include:
12. ROLES AND EMPLOYEES
We have appointed a Senior Director of IT and a technology steering committee responsible for data protection oversight. This team monitors compliance with privacy law, promotes awareness across the organization, and updates policies as needed.
All employees complete privacy training at onboarding and regularly thereafter as part of our ongoing commitment to data stewardship.
13. ACCESSIBILITY
We are committed to ensuring our website and communications are accessible to all individuals. If you encounter any accessibility issues or require information in an alternative format, please contact us at info@hebfdn.org.
14. POLICY UPDATES
We may update this Privacy Policy from time to time. When we do, we will post the updated policy to our website with a revised effective date. Continued use of our website or participation in our services after updates constitutes acceptance of the new terms.
15. CONTACT US
If you have any questions about this Privacy Policy or how your personal data is handled, please contact:
H. E. Butt Foundation
info@hebfdn.org
