Goodwill Industries International Privacy Policy

Effective as of September, 2023

Goodwill Industries International (“GII”, “we”, “us”, or “our”). respects your privacy and is committed to protecting it as set forth in this privacy policy (“Privacy Policy”). This Privacy Policy describes what personal information we collect about you, including how we collect it, how we use it, and with whom we may share it. This Privacy Policy applies to personal information collected on our website located at https://www.goodwill.org/ (the “Website”), as well as personal information collected in or through our services and programs, including Goodwill Exchange, Gateway, or otherwise through any interaction you have with us (collectively with the Website, the “Services”).

If users have questions about the types of information collected on this web site or would like to request a correction of any information collected, then please contact us at [email protected].

Changes to Our Privacy Policy

We may change this Privacy Policy at any time. The most recent version of the Privacy Policy is reflected by the effective date at the top of this Privacy Policy. All amendments to this Privacy Policy will be effective immediately upon notice thereof, which we may give by any means, including by posting a revised version of the Privacy Policy or other notice on the Website.

What Is Personal Information?

By using the term “personal information” in this Privacy Policy, we mean any information that can be used to directly or indirectly identify a specific individual.

What Personal Information Do We Collect?

GII collects personal information from a variety of sources, including information that you provide directly and information that we automatically collect when you access and use the Services.

  1. Personal Information You Provide. You may provide personal information to us and our third-party service providers through the Services, when you apply for or inquire about employment with us, make a donation, inquire about partnering with us or becoming a sponsor, or when you e-mail, call, or otherwise communicate with us. The types of personal information you provide differ depending on how you choose to interact with us, but may include name, email, phone number, address, and payment card or bank account information, etc., or any other personal information you choose to provide to us.
  2. Information Collected Automatically. We and our third-party service providers may collect information automatically from you when you access and use the Services. Such information may include personal information and includes the following:

Usage Information. We may collect information about how you interact with the Services. This may include information such as the dates and time you visit the Services, the page you view, referring / exit URLS, your browser type, and the domain name of your internet service provider. In some cases, we may collect this information through cookies and similar technologies. To learn more about these technologies, please see the “Cookies and Similar Technologies” section below.

Device Information. We may collect information about the devices you use to access the Services, including your device make and model, IP address, inferred geolocation information, operating system, and unique device identifiers.

Cookies and Similar Technologies

When you visit our Services, we may obtain certain information by automated means, such as cookies, web beacons, and other similar technologies and techniques. A “cookie” is a text file that websites send to a visitor’s computer or other Internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. A “web beacon”, also known as an Internet tag, pixel tag, or clear GIF, links web pages to web servers and cookies and may be used to transmit information collected through cookies back to a web server. The information that we and our third party service providers may track with cookies, web beacons, and similar technologies may include the type of browser (such as Google Chrome or Internet Explorer) and Internet-connected devices being used to access the Services, your IP address, your home domain or Internet service provider, your referrer URL (the URL for the website that you were viewing prior to visiting the Services), how you were directed to the Services, which specific pages you access on the Services, how long you view each page, the time and date you access our Services, and the total number of visitors to the Services and any portions thereof.

Most popular Internet browser applications will allow you to adjust the browser so as not to accept cookies. For mobile devices, you can manage how your device and browser share certain data by adjusting the privacy and security settings on your mobile device. However, making such adjustments may, in certain instances, prevent you from taking full advantage of the Services (or some portion thereof) and its capabilities, or cause some features of the Services to function improperly or more slowly.

Google Analytics

We may use Google Analytics, a web analysis service provided by Google, together with other analytics services, in order to better understand your use of the Services and how we can improve them. Google Analytics collects information such as how often users visit a website, what pages you visit when you do so, and what other websites you used prior to coming to such website. Google Analytics collects only the IP address assigned to you on the date you visit a website, rather than your name or other directly identifying information. We do not combine the information collected through the use of Google Analytics with your personal information. Although Google Analytics plants a persistent cookie on your web browser to identify you as a unique user the next time you visit a website, the cookie cannot be used by anyone but Google. Google Analytics uses its cookie(s) and the information Google Analytics collects to track your online activities over time and across different websites when you use our Services, and other websites. Google’s ability to use and share information collected by Google Analytics about your visits to the Services are governed by the Google Analytics Terms of Service and the Google Privacy Policy. Google may utilize the data collected to track and examine the use of the Services, to prepare reports on its activities, and share them with other Google services. To more fully understand how Google may use the data it collects through the Services, please review “How Google Uses Information From Sites or Apps That Use Our Services” (located here).

Session Replay Tools

Correspondence

We appreciate your questions and comments about the Services and welcome your messages through our “Contact Us” page. If you correspond with us, we may collect personal information, including the content of, and metadata regarding, any correspondence you may provide us. We may share your messages with those within our organization or with local member organizations to address the issues contained in your message.

How Can I Opt-Out of Promotional Correspondence?

We may send you e-mails with promotional offers. If you would no longer like to receive this information from us, please click the unsubscribe link at the bottom of any such e-mail you receive from us and follow the instructions. Please allow us a reasonable amount of time in order to satisfy your request, as some communications may already be in process.

How Do We Use The Personal Information That We Collect?

We collect and use personal information for reasons that include, but are not limited to:

  1. providing our Services to you;
  2. accepting and processing donations;
  3. operating and providing the Website;
  4. improving our Services, user experience, and our business/nonprofit mission;
  5. security purposes, including monitoring, risk assessment, addressing integrity and security issues related to the Services, and fraud and crime prevention/detention;
  6. sending information that you request from us, including responding to inquiries or requests for information about or from us;
  7. sending promotional or marketing materials;
  8. evaluating your qualifications for career positions with us;
  9. other business purposes, including, without limitation, verifying your identity, age, and/or payment details, investigating complaints about the Services, research and analysis, marketing, advertising, and dispute resolution;
  10. in connection with a merger or similar consolidation into or with another entity;
  11. complying with law enforcement, government agencies, or a governmental mandate;
  12. complying with or as permitted by any GII policies and any applicable legal requirements; and
  13. engaging in other activities discussed under this Privacy Policy or by GII in its discretion.

With Whom Do We Share Personal Information That We Collect?

In addition to the uses mentioned or described elsewhere in this Privacy Policy, we may add personal information to our database.

We may share personal information with third parties, such as local member organizations, trusted business partners and service providers, to help provide the Services, deliver our products and services, process payments, perform statistical analysis, protect against potential fraud, or perform any other functions consistent with the operation of the Services. We may also share personal information with professional advisors, such as lawyers, auditors, bankers, and insurers, in the course of the professional services they render to us.

We may also disclose personal information if we become subject to a subpoena or court order, or if we are otherwise legally required to disclose information. We may also use and disclose personal information to establish or exercise our legal rights, to assert and defend against legal claims, or if we believe such disclosure is necessary to investigate, prevent, or take other action regarding actual or suspected illegal or fraudulent activities or potential threats to the physical safety or well-being of any person.

As we grow and develop, it is possible that out organization might change or that it might merge or otherwise combine with another organization. In any such transactions, personal information generally is, and should be expected to be, one of the transferred business assets. Also, if any bankruptcy, liquidation or reorganization proceeding is brought by or against us, your personal information may be considered a company asset that may be sold or transferred to third parties.

How Do We Protect Personal Information Collected About You?

We take commercially reasonable measures to secure and protect personal information on the Services. We restrict access to personal information to employees, contractors, and agents who need to know that information in order to process it for us, and who are subject to appropriate confidentiality obligations. Nevertheless, no security system is impenetrable. We cannot guarantee that personal information that users of the Services transmit or otherwise supply will be secure.

How Long Do We Keep Your Personal Information?

We will only keep your personal information for so long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is permitted or required by law (such as tax, accounting, or other legal requirements).In some cases, your personal information is retained by third-party service providers subject to their privacy policies and retention periods.

Linked Websites

For your convenience, some hyperlinks may be posted on the Services that link to other websites not under our control. We are not responsible for, and this Privacy Policy does not apply to, the privacy practices of those websites or pages not under our control or of any companies that we do not own or control. We do not endorse any of those websites or pages, the services or products described or offered on such sites or pages, or any of the content contained on those sites or pages.

User-Provided Content

Except as expressly set forth in this Privacy Policy, any information, communications, or material that you submit to the Services is done at your own risk and without any expectation of privacy.

Social Media Platforms

Any information, communications, or material that you submit to any pages associated with GII on social media platforms is done at your own risk and without any expectation of privacy. All such submissions are subject to the terms of use and privacy policy of such social media platforms.

Children’s Personal Data

The Services are intended for a general audience and are not intended for use by children under 13 years of age. We do not knowingly collect information about children or sell products to children. Consistent with the Children’s Online Privacy Protection Act, we will not knowingly collect any information from children under the age of 13.

Visiting The Services From Outside The United States

If you are visiting the Services, or any part thereof, from outside of the United States, your personal information may be transferred to, stored and processed in the United States. The data protection and other laws of the United States may not be as comprehensive as those in your country. By using any portion of the Services, you consent to the transfer of your personal information to our servers and databases in the United States and those third parties with whom we share such personal information as described in this Privacy Policy.

European Economic Area (“EEA”) and the United Kingdom (“UK”)

This portion of our Privacy Policy applies to residents of the EEA and the UK only and applies only to the extent of any inconsistency with the information above. All terms not otherwise defined in this portion shall have the meanings as defined under the General Data Protection Regulation, the Data Protection Act 2018, or the UK General Data Protection Regulation, as applicable.

Contact Details and Data Protection Officer

The controller is: Goodwill Industries International, 15810 Indianola Drive, Rockville, Maryland, USA, 20855

You may contact Company’s Privacy Officer at [email protected].

Legal Basis for Processing Personal Data

Our legal basis for processing your personal data will depend on the personal data collected and the specific context in which we collect it. We process personal data from you when:

  • We have your consent to do so;
  • We have a contract with you and it is necessary to process your personal data to perform our contract with you, including to operate our business, provide our products and services, and provide you with the benefits of the Services;
  • The processing is in our legitimate interests, such as operating our nonprofit organization, providing our products and services, improving and developing the Services, communicating with you, marketing and advertising our organizational nonprofit mission, products and services, to identify and protect fraud, protect you, us, or others from security threats by enhancing the security of our network and information systems, and complying with applicable laws and industry regulations; and
  • To comply with legal requirements, including applicable laws and regulations.

International Data Transfers

If personal data is transferred outside of the EEA or the UK, we take commercially reasonable efforts to protect such personal data, such as by entering into certain Standard Contractual Clauses as approved by the European Commission or the International Data Transfer Agreement or the International Data Transfer Addendum to the Standard Contractual Clauses, as approved by the United Kingdom’s Information Commissioner’s Office.

Automated Decision-Making

We do not engage in any automated decision-making as a part of our services.

Exercising Your Rights

If you are a resident of the EEA or the UK, you have the following rights regarding your personal data:

  • Right to Access, Rectify, or Erasure. You may request to access, to rectify inaccurate personal data concerning you, or to delete your personal data. Please note that even if you request for your personal data to be deleted, certain aspects may be retained by us to meet our legal or regulatory compliance, exercise, establish or defend claims, and to protect against fraudulent or abusive activity on our Services.
  • Right to Object to Processing. In certain circumstances, you have the right to object to our use of your personal data, such as if we are using your personal data for direct marketing; for our or a third party’s legitimate interests or the public’s interest; or for scientific or historical research and statistics.
  • Right to Restrict Processing. Under some circumstances, you may request that we limit how we use your data or “Restrict Processing.” Simply a difference of opinion or view does not necessarily justify a restriction.
  • Right to Data Portability. At your request, you may request portability of your personal data. We are happy to provide your personal data to you in a machine-readable or “portable” format.
  • Right to Withdraw Consent. If we have collected and processed your personal data with your consent, you are free to withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of processing we conducted prior to such withdrawal, nor will it affect processing of your personal data conducted in reliance on a legal basis other than consent.
  • Right to File a Complaint. If you have a complaint about how we use your personal data, we hope that you will contact us according to the contact information below and we will promptly address your concern. However, you can always file a complaint with the supervisory authority in your jurisdiction. For more information, please contact your local data protection authority (contact details for data protection authorities in the EEA are available at https://edpb.europa.eu/about-edpb/board/members_en. Contact details for the data protection authority in the UK is available at https://ico.org.uk/.

How to Exercise Your Rights

You can exercise any of the rights described in the previous section by contacting us at [email protected].

LAST UPDATED: SEPTEMBER 22, 2023