PRIVACY POLICY

Effective Date: July 31, 2026  ·  Last Updated: July 31, 2026

1. Scope of This Policy

This Policy applies to personal information we collect through the Site, through forms hosted on or linked from the Site, through our email newsletters, and through correspondence with us relating to the Site.

This Policy does not apply to:

• Information collected offline or through channels unrelated to the Site;
• Employment and volunteer applications, which are governed by our separate applicant and personnel privacy notice;
• Student educational records held by school districts, the Sonoma County Office of Education, or other educational agencies. Those records remain under the control of those agencies and are governed by the Family Educational Rights and Privacy Act (FERPA) and the California Education Code;
• Third-party websites, platforms, and services we link to, each of which has its own privacy policy (see Section 16).

A note on our nonprofit status. The California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), generally applies to entities organized or operated for the profit or financial benefit of shareholders or other owners. As a 501(c)(3) nonprofit corporation, CTE Foundation is not typically a “business” subject to the CCPA. We nonetheless voluntarily extend the protections, disclosures, and rights described in this Policy to all California residents, and we honor the requests described in Section 10 as a matter of policy. We also comply with the California Online Privacy Protection Act (CalOPPA), Cal. Bus. & Prof. Code §§ 22575–22579, and with the California laws protecting minors and students described in Section 13. Nothing in this Policy is an admission that any particular statute applies to us.

2. Notice at Collection

The table below is our notice at collection. It summarizes, at or before the point of collection, the categories of personal information we collect, why we collect them, how long we keep them, and whether they may be sold or shared.

We retain each category for the period stated above, or for as long as necessary to fulfill the purpose it was collected for, whichever is shorter, unless a longer period is required by law — for example, tax, audit, grant-reporting, or litigation-hold obligations. We do not retain personal information for any purpose that is incompatible with the purpose for which it was collected.

We have never received, and do not receive, money in exchange for personal information. California law defines “sale” and “sharing” broadly enough that ordinary analytics and social media technologies can fall within them even where no money changes hands. Rather than parse that question for you, we give you a direct way to turn those technologies off — see Section 8.

3. Information We Collect

3.1 Information you give us directly

Our forms — including contact, newsletter signup, grant inquiry, partner interest, event registration, and donation forms — may ask for:

• Your name
• Your organization or employer
• Your job title
• Your email address
• Your telephone number
• Any message, comment, or other content you choose to include

Fields marked as required are the minimum we need in order to respond to you. Everything else is optional and may be left blank.

3.2 Information collected automatically

When you visit the Site, we and our service providers automatically collect:

• Session and usage data — pages viewed, the page or search that referred you, date and time of your visit, time spent on each page, links and buttons clicked, and scroll depth.
• Device and browser data — browser type and version, operating system, screen resolution, device type, and language settings.
• Network data — your IP address and general connection information.
• Approximate geolocation — a city-, region-, or country-level estimate derived from your IP address. We do not collect precise geolocation. We do not use GPS, we do not request your device’s location permission, and we do not collect location data accurate to within 1,850 feet.
• Cookie and similar identifiers — see Section 7.

3.3 Information we do not collect

We do not knowingly collect Social Security numbers, driver’s license or state ID numbers, passport numbers, financial account numbers, precise geolocation, biometric or genetic data, health information, the contents of your mail or messages, racial or ethnic origin, religious or philosophical beliefs, union membership, sexual orientation, or immigration status through the Site. Please do not submit any of this information to us through a Site form. Donation payments are handled by a third-party payment processor; we do not receive or store full payment card numbers.

4. Sensitive Personal Information

We do not intentionally collect “sensitive personal information” as defined in Cal. Civ. Code § 1798.140(ae), and we do not use or disclose any such information for purposes beyond those permitted by Cal. Civ. Code § 1798.121. We do not use sensitive personal information to infer characteristics about you.

If you volunteer sensitive information to us in the free-text portion of a form or in an email — which we ask you not to do — we use it solely to respond to your message and delete it when it is no longer needed for that purpose. If our practices ever change, we will update this Policy and post a “Limit the Use of My Sensitive Personal Information” link before collecting sensitive personal information for any purpose requiring one. In the meantime, you may direct us to limit the use of any sensitive information you have given us by writing to us at the address in Section 11.

5. Sources of Information

• Directly from you — when you complete a form, subscribe, donate, register for an event, or email or call us.
• Automatically from your device — through cookies, tags, pixels, and server logs.
• From our service providers — our website platform and host, analytics provider, email platform, form and CRM tools, and payment processor, acting on our behalf.
• From partner organizations — schools, districts, the Sonoma County Office of Education, employer partners, and community organizations, when they refer a contact to us or co-host a program with us, and only where that organization has authority to share the information.
• From publicly available sources — such as an employer’s public website or a public professional directory, when we verify a partner organization’s details.
• From social media platforms — aggregate, non-identifying audience statistics about people who engage with our pages and posts.

6. How We Use Information

We use personal information only for the purposes below, each of which is reasonably necessary and proportionate to the purpose for which the information was collected:

• To respond to your questions, requests, and applications;
• To send newsletters, program announcements, event invitations, and impact reports you signed up for — each of which contains an unsubscribe link;
• To administer grants, internships, the STEM Kit Lending Library, Path to Purpose, and our other programs, including matching students with employer partners;
• To process, acknowledge, and record donations and to comply with charitable-solicitation, tax, and audit requirements;
• To measure our reach and program impact, and to report aggregate, de-identified statistics to funders, our board, and the public;
• To promote our programs and events, including through general-audience advertising and social media campaigns, and to measure whether those campaigns reached people;
• To operate, maintain, debug, and improve the Site;
• To protect the security and integrity of the Site and to detect and prevent fraud, spam, and abuse;
• To comply with legal obligations and to establish, exercise, or defend legal claims.

We do not use automated decision-making technology to make decisions that produce legal or similarly significant effects concerning you — such as decisions about employment, educational admission, or the provision of financial services — and we do not engage in profiling in furtherance of such decisions. We do not use your personal information to train artificial intelligence or machine learning models. If either practice changes, we will provide advance notice and, where required, a right to opt out and to access meaningful information about the logic involved.

7. Cookies, Analytics & Advertising Technologies

Cookies are small text files stored on your device. We and our providers also use related technologies such as tags, pixels, software development kits, and local storage. We group them as follows:

Managing cookies. Use the consent banner when you first visit, and the Manage consent / Cookie preferences control available on every page, to accept, deny, or fine-tune every non-essential category at any time. You may also block or delete cookies through your browser settings; blocking strictly necessary cookies may cause parts of the Site to stop working.

Google Analytics. We use Google Analytics to understand how the Site is used. Google acts as our service provider and is contractually restricted from using the information for its own purposes. You can opt out of Google Analytics on every website by installing the Google Analytics Opt-out Browser Add-on. Google’s practices are described in Google’s Privacy Policy.

Social media platforms. Where we promote our programs on platforms such as Meta or LinkedIn, those platforms may set cookies or receive event data from our Site. In some cases they act as independent controllers of that data under their own policies. Opting out of marketing cookies in our consent tool stops us from sending them Site event data; to control what the platform itself does with information it already holds about you, use the ad and privacy settings in your account with that platform.

We do not knowingly permit any third party to use information collected on our Site to build advertising profiles of minors, and we do not run advertising directed at individuals based on their status as students.

8. Your Privacy Choices

8.1 Do Not Sell or Share My Personal Information

We do not sell personal information for monetary consideration, and we have not done so in the preceding 12 months. However, because California law defines “sale” and “sharing for cross-context behavioral advertising” broadly, certain analytics and advertising technologies described in Section 7 may constitute a sale or sharing of the cookie identifiers and Site activity associated with your browser. Out of an abundance of caution, we offer you the ability to opt out. You may do so in any of these ways:

• Use the cookie preferences control on this Site and decline the Analytics and Marketing categories. This is the fastest method and takes effect immediately.
• Turn on the Global Privacy Control in your browser or browser extension (see Section 8.2). We treat this as a valid opt-out request without requiring you to identify yourself.
• Email us at admin@ctesonomacounty.org with the subject line “Do Not Sell or Share My Personal Information,” or call (707) 708-7080.

We will process an opt-out request within 15 business days and will not ask you to create an account in order to submit one. We will not ask you to reaffirm your choice for at least 12 months. Opting out will not affect your access to any part of the Site or to any of our programs.

8.2 Opt-out preference signals and Do Not Track

Global Privacy Control. We recognize and honor the Global Privacy Control (GPC) and other frictionless opt-out preference signals. When your browser or extension transmits such a signal, we treat it as a valid request to opt out of any sale or sharing of the personal information associated with that browser, and we apply it to any account we can associate with the signal. You can learn more or install GPC at globalprivacycontrol.org. If you would like written confirmation that we processed your signal, email us and we will provide it.

Do Not Track (CalOPPA § 22575(b)(5)–(7)). Some browsers transmit a “Do Not Track” (DNT) signal. There is no industry or legal consensus on how operators must respond to DNT, and our Site does not respond to DNT signals differently from the way it responds to your cookie preference choices. Where you decline non-essential cookies or transmit a GPC signal, we do not permit third parties to collect personally identifiable information about your online activities over time and across different websites through our Site.

8.3 Email and phone

Every email we send contains an unsubscribe link and a link to update your preferences. You may also email us at any time to be removed from a list or to ask us not to call you. We honor these requests within 10 business days.

8.4 Not a data broker

CTE Foundation is not a data broker and is not registered as one under the California Delete Act, Cal. Civ. Code § 1798.99.80 et seq. We do not collect and sell personal information about consumers with whom we have no direct relationship.

9. How We Disclose Information

In the preceding 12 months, we disclosed the following categories of personal information to the categories of recipients listed below.

We may also disclose aggregate or de-identified information that cannot reasonably be used to identify you. Where we hold de-identified information, we maintain it in de-identified form, do not attempt to reidentify it, and contractually require recipients to do the same.

10. Your California Privacy Rights

Whether or not the CCPA legally obligates us, we voluntarily provide every California resident with the following rights:

• Right to know. Request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting or sharing it, the categories of third parties to whom we disclosed it, and the categories disclosed for a business purpose. You may request this for the 12 months preceding your request or, if you ask, for the period beginning January 1, 2022, unless doing so would be impossible or involve disproportionate effort.
• Right to delete. Request that we delete personal information we collected from you, subject to the exceptions in Cal. Civ. Code § 1798.105(d) — for example, information we must retain to complete a transaction, comply with a legal obligation such as charitable tax reporting, detect security incidents, or exercise or defend legal claims. We will direct our service providers to delete it as well.
• Right to correct. Request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing. Direct us not to sell or share your personal information. See Section 8.
• Right to limit the use of sensitive personal information. See Section 4.
• Right to data portability. Receive the personal information you provided to us in a readily usable, portable format, where technically feasible.
• Right to non-discrimination and freedom from retaliation. We will never deny you goods or services, charge you a different price, provide a different level or quality of service, or retaliate against you — including as an employee, applicant, or independent contractor — because you exercised a privacy right. We offer no financial incentives in exchange for personal information.
• Right to information about automated decision-making. We do not use automated decision-making technology to make significant decisions about you. If that changes, we will provide a pre-use notice, an opt-out, and access to meaningful information about the logic involved.

Residents of other states with comprehensive privacy laws, and individuals in the European Economic Area or the United Kingdom, may contact us using the details in Section 11 to request comparable rights, and we will honor those requests to the extent the applicable law provides.

11. How to Exercise Your Rights

Verification. To protect your information, we verify your identity before acting on a request to know, delete, or correct. We will ask for at least two data points matching information already in our records — typically the email address you gave us plus one other detail, such as your organization or the approximate date of your last interaction with us. For requests seeking specific pieces of personal information, we require a higher degree of certainty and may ask you to sign a declaration under penalty of perjury that you are the person whose information is requested. Information you provide for verification is used only for that purpose and deleted as soon as practicable afterward. Opt-out requests do not require verification.

Authorized agents. You may designate an authorized agent to submit a request for you. We will ask the agent for written permission signed by you, and we may ask you to verify your own identity directly with us and confirm that you granted the agent permission. An agent holding a valid power of attorney under Cal. Prob. Code §§ 4000–4465 need not provide additional written permission.

Timing. We confirm receipt within 10 business days and describe how we will process your request. We respond substantively within 45 calendar days. If we need more time, we will notify you in writing and may take up to 90 calendar days total. Opt-out requests are honored within 15 business days. There is no charge for up to two requests in any 12-month period; we may charge a reasonable fee or decline a request that is manifestly unfounded or excessive, and we will explain why if we do.

If we decline. We will explain in writing why and identify the exception we relied on, and we will delete or correct any portion of the information not covered by that exception. If we cannot verify your identity, we will tell you.

Appeals and complaints. If you are dissatisfied with our response, reply to our decision and ask for review by our Executive Director; we will respond within 45 days. You may also contact the California Privacy Protection Agency at cppa.ca.gov or the California Attorney General at oag.ca.gov/privacy.

Reviewing or changing your information yourself. Consistent with CalOPPA § 22575(b)(2), you may review and change the personal information you have given us at any time by emailing us at the address above or, if you are a newsletter subscriber, by using the “update your preferences” link at the bottom of any email from us.

12. California “Shine the Light” Rights

California Civil Code § 1798.83 permits California residents to request information about personal information disclosed to third parties for those third parties’ own direct marketing purposes. CTE Foundation does not disclose personal information to third parties for their own direct marketing purposes. To request written confirmation, email admin@ctesonomacounty.org with the subject line “Shine the Light Request.” We respond within 30 days.

13. Minors and Students

CTE Foundation exists to serve students, and we take particular care with their information.

13.1 Children under 13 (COPPA)

The Site is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 through the Site. If we learn we have collected personal information from a child under 13 without verifiable parental consent, we delete it promptly. A parent or guardian who believes we may hold such information should contact admin@ctesonomacounty.org; we will delete the information and confirm the deletion.

13.2 Minors under 16

Some of our programs are designed for high school students, and some visitors to the Site may be between 13 and 15 years old. For any individual we know to be under 16:

• We do not sell or share their personal information, and we will not do so without first obtaining affirmative authorization — opt-in consent from the minor if they are 13 to 15, or from a parent or guardian if they are under 13 — as required by Cal. Civ. Code § 1798.120(c). Silence, inaction, or continued use of the Site is never treated as consent.
• We do not permit marketing or advertising cookies to be used to build a profile of a minor, and we do not serve advertising targeted to individuals based on their status as students.
• A parent or guardian may exercise any right in Section 10 on the minor’s behalf and may direct us to delete the minor’s information, using the contact details in Section 11. We will not require the minor to be identified beyond what is necessary to locate the information.

13.3 Right to remove content (Cal. Bus. & Prof. Code § 22581)

If you are a registered user of the Site who is under 18 and a California resident, you may request removal of content or information you have publicly posted on the Site. Email admin@ctesonomacounty.org with the subject “Minor Content Removal Request” and tell us where the content appears. We will remove it or render it invisible to other users. Removal may not be complete or comprehensive — for instance, if others copied or reposted the content, or if the law requires us to retain it.

13.4 Student information (SOPIPA and related laws)

Where we operate a site, service, or application used for K–12 school purposes, we comply with the California Student Online Personal Information Protection Act (SOPIPA), Cal. Bus. & Prof. Code §§ 22584–22585, and the Early Learning Personal Information Protection Act. Specifically, we do not:

• Engage in targeted advertising to students, parents, or guardians based on information acquired through a K–12 program;
• Use information acquired through a K–12 program to amass a profile about a student, except in furtherance of school purposes;
• Sell or rent student information;
• Disclose covered student information except as permitted by SOPIPA — for example, to further school purposes, to comply with law, to respond to a judicial order, or to protect the safety of students or others.

Student educational records held by a school district or by the Sonoma County Office of Education remain the property of and under the control of that agency. Questions about a student’s educational record should be directed to the student’s school district.

14. Data Retention

Retention periods for each category are stated in the table in Section 2. We set them using these criteria: how long we need the information to provide the service or program you requested; the length of any ongoing relationship with you; legal, tax, audit, and grant-reporting requirements; the applicable statute of limitations for potential claims; and the sensitivity of the information. When a retention period ends, we securely delete or de-identify the information. Residual copies may persist in backup systems for a limited period before being overwritten in the ordinary course.

15. Data Security

We implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information we hold, as required by Cal. Civ. Code § 1798.81.5. These include encryption of data in transit using TLS, access controls limiting personal information to staff who need it for their role, multi-factor authentication on administrative accounts, vendor due diligence and written data-protection terms, prompt software updates, and staff privacy training.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of unencrypted personal information occurs, we will notify affected California residents in the most expedient time possible and without unreasonable delay, consistent with Cal. Civ. Code § 1798.82.

16. Third-Party Sites and Services

The Site links to and embeds content from third parties, including YouTube (career exploration videos), Mailchimp (newsletter signup), our donation platform, and our pages on Facebook, Instagram, LinkedIn, and YouTube. When you follow a link to, or interact with embedded content from, these services, the third party may collect information about you under its own privacy policy, and in some cases acts as an independent controller of that information. We do not control and are not responsible for the privacy practices of third parties. We encourage you to read their policies before providing information to them.

17. Users Outside California

The Site is operated in the United States and is intended for individuals located in the United States, primarily in Sonoma County and the surrounding region. If you access the Site from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Site, you understand that this transfer will occur.

18. Accessibility & Alternative Formats

We want this Policy to be usable by everyone. It uses proper heading structure and semantic markup for screen readers, and the Site offers accessibility adjustments and machine translation into a number of languages. If you need this Policy in an alternative format — large print, plain text, or read aloud — or in a language in which we ordinarily provide information to our community, contact us at admin@ctesonomacounty.org or (707) 708-7080 and we will provide it free of charge.

19. Changes to This Policy

We review this Policy at least once every 12 months and update it when our practices change. When we make a material change, we will post the revised Policy on this page, update the “Last Updated” date at the top, and — for changes affecting how we use information you have already given us — post a prominent notice on the Site homepage for at least 30 days and, where we have your email address, notify you by email. We will not use previously collected personal information for a materially different purpose without first providing notice and, where required, obtaining your consent. Your continued use of the Site after the effective date of a revised Policy constitutes acceptance of it.

20. Contact Us

We respond to privacy questions within 10 business days.