Privacy Policy

Introduction

God's Intelligent Fortified Talented and Educated Dreamers ("GIFTED," "we," "our," or "us") is a 501(c)(3) nonprofit organization registered in the State of Missouri (EIN: [REPLACE — EIN to be added at deployment]). We are committed to protecting the privacy and security of the information you share with us. This Privacy Policy describes how we collect, use, share, and protect your personal information when you visit our website, submit forms, or communicate with us.

By using our website, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our website or services.

1. Information We Collect

We collect the following categories of personal information:

• Identity Data: First name, last name
• Contact Data: Email address, phone number, mailing address
• Technical Data: IP address, browser type, device identifiers, operating system, referring URLs, pages visited, time on site
• Usage Data: How you interact with our website, which pages you visit, forms you complete
• Cookie Data: Data stored via cookies and similar tracking technologies (see Section 5)
• Communications Data: Content of messages, inquiries, or correspondence you send to us
• Donation Data: Donation amounts, frequency, and payment method details (processed by third-party payment processors; we do not store full card data)
• Consent Records: Records of SMS opt-in consent including timestamp, IP address, and form source

2. How We Use Your Information

We use your personal information for the following purposes:

• To respond to your inquiries and provide requested information
• To process donations and send donation receipts
• To enroll participants in programs and communicate program information
• To send SMS communications to individuals who have provided express written consent
• To send email newsletters and program updates (with your consent)
• To improve our website and services
• To comply with legal obligations
• To prevent fraud and ensure the security of our systems
• To apply for grants, including state and federal funding programs

3. Legal Basis for Processing (GDPR)

For individuals in the European Economic Area (EEA) or where GDPR otherwise applies, we process your personal data on the following legal bases:

• Consent: You have given clear consent for us to process your data for a specific purpose (e.g., SMS opt-in, newsletter signup)
• Contract Performance: Processing is necessary to fulfill a request you've made or to provide services you've requested
• Legitimate Interests: Processing is necessary for our legitimate interests (e.g., improving our website, preventing fraud), provided these are not overridden by your rights
• Legal Obligation: Processing is necessary to comply with a legal obligation (e.g., maintaining tax records for nonprofit compliance)

4. Data Sharing & Third Parties

We do not sell your personal information. We may share your information with the following categories of third-party service providers who assist us in operating our website and programs:

• Email Marketing: [REPLACE: e.g., Mailchimp / ActiveCampaign / GoHighLevel]
• SMS Provider: [REPLACE: e.g., Twilio / TextLink]
• Payment Processing: [REPLACE: e.g., Stripe / PayPal / Cash App]
• Website Analytics: Google Analytics 4 (GA4)
• Advertising: Meta (Facebook) Pixel — only if consent given
• Automation: n8n (workflow automation)
• CRM / Database: [REPLACE: e.g., Supabase / Notion / GoHighLevel]
• Scheduling: [REPLACE: e.g., Google Calendar / Calendly]

All third-party providers are contractually required to protect your information and use it only for the purposes for which it was shared. We do not authorize them to use or disclose your personal information except as necessary to provide services on our behalf.

We may also disclose your information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of GIFTED, our participants, or others.

5. Cookies Policy

Our website uses cookies and similar tracking technologies. Cookies are small text files placed on your device. We use the following types:

• Strictly Necessary: Required for the website to function (e.g., session management, security). These cannot be disabled.
• Functional: Remember your preferences (e.g., cookie consent choice).
• Analytics: Help us understand how visitors use our site (e.g., Google Analytics). Only activated with your consent.
• Marketing: Used to deliver relevant advertisements (e.g., Meta Pixel). Only activated with your consent.

You can manage your cookie preferences using the consent banner displayed when you first visit our site. You may also clear cookies via your browser settings; however, disabling certain cookies may affect website functionality.

6. Data Retention

We retain your personal information for the following periods:

• Contact inquiries: 3 years from date of submission
• Donor records: 7 years (required for nonprofit tax compliance)
• Program enrollment records: Duration of participation plus 3 years
• SMS consent records: 4 years from date of opt-in (A2P 10DLC compliance)
• Website analytics data: 26 months (Google Analytics default)
• Cookie consent records: 13 months from date of consent

After the applicable retention period, data is securely deleted or anonymized.

7. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data in certain circumstances
• Right to Restriction of Processing: Request that we restrict processing of your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of processing before withdrawal)

To exercise any of these rights, contact us at contactus@giftedorg.com or write to PO Box 1709, O'Fallon, MO 63366.

8. Your Rights (CCPA) — California Residents

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information collected about you in the preceding 12 months
• Right to Delete: Request deletion of personal information collected from you, subject to certain exceptions
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. If this changes, we will update this policy and provide an opt-out mechanism.
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use of Sensitive Personal Information: Request limitation on use of sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

Categories of personal information collected in the preceding 12 months: Identifiers (name, email, phone, IP address); Internet or other electronic network activity information (usage data, cookies); Commercial information (donation records); Inferences drawn from personal information to create a profile.

To submit a CCPA request, email contactus@giftedorg.com with "CCPA Request" in the subject line. We will respond within 45 days.

Do Not Sell or Share My Personal Information — GIFTED does not sell or share your personal information as defined under CCPA.

9. Do Not Sell My Personal Information

GIFTED does not sell personal information to third parties for monetary or other valuable consideration, and we do not share personal information for cross-context behavioral advertising purposes. If you have questions about data practices, contact us at contactus@giftedorg.com.

10. Children's Privacy

Our website is not directed to children under the age of 13 (or 16 for individuals in the European Economic Area). We do not knowingly collect personal information directly from children. GIFTED serves youth ages 5–21; however, program-related data for minors is collected from and with the consent of parents or legal guardians. If you believe we have inadvertently collected personal information from a child without proper consent, please contact us immediately at contactus@giftedorg.com and we will take steps to delete the information promptly.

11. Data Security

We implement industry-standard security measures to protect your personal information, including:

• SSL/TLS encryption for all data transmitted via our website
• Access controls limiting personal data access to authorized personnel only
• Regular review of data handling practices
• Secure storage of consent records including timestamps and IP addresses

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify affected individuals as required by applicable law.

12. Data Governance Statement

13. International Data Transfers

GIFTED is based in Missouri, USA. If you access our website from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where required, we rely on Standard Contractual Clauses approved by the European Commission to lawfully transfer data from the EEA to the United States. By using our website, you consent to this transfer.

14. Third-Party Links

Our website may contain links to third-party websites (e.g., Facebook, partner organizations). We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

15. Contact for Privacy Requests

For all privacy-related requests, questions, or concerns, please contact:

We will respond to all privacy requests within 30 days (or 45 days for CCPA requests).

16. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you via email. We encourage you to review this policy periodically.

Your continued use of our website after any changes indicates your acceptance of the updated policy.