Privacy Notice and Refund Policy

To fulfill its mission, it is important that the Foundation maintains a connection with individuals who have an affinity with Rutgers University. The Foundation obtains, holds, and processes Personal Information of alumni, friends, students, and current and potential donors and supporters of the university (”Constituents”) for the purpose of implementing and managing all advancement and fundraising services for the benefit of Rutgers University.

The Foundation processes the information outlined in this privacy notice in pursuit of its legitimate interest in:

• Communicating with its Constituents;
• Providing benefits and services to Constituents (e.g., alumni programs and activities, including events, alumni magazine or newsletters, the receipt and acknowledgement of charitable gifts, chartered alumni association activities, etc.); and
• Furthering our charitable mission of advancing Rutgers University.

In pursuing its legitimate interest, the Foundation may contact its Constituents by telephone, email or post. At any time, Constituents can request the Foundation no longer use their Personal Information to contact them. In addition, they may state their preferences in the way the Foundation contacts them and for what purposes. Constituents may opt out of a specific form of communication at any time. They may also opt out of specific categories of communications, for example, events or fundraising solicitations.

Constituents may contact the Foundation’s Privacy Compliance Officer by email at dataservices@rutgersfoundation.org or by phone at (848) 932-7777.

• Alumni—Rutgers University and predecessor schools
• Students
• Parents of students
• Faculty and staff
• Donors and potential future donors
• Friends—spouses, family members, and supporters of Rutgers University
• Employment applicants—individuals who apply for positions within the Foundation
• Patients of Rutgers Health—very limited information as permitted under the Health Insurance Portability and Accountability Act (HIPAA) as needed for the patient and family fundraising program

The Foundation collects the following information which may qualify as Personal Information under Privacy Laws:

• Contact information – Home and business addresses, phone numbers, email addresses, social media contact information, as well as wealth assessment information and indicators of interest in giving;
• Demographic information – Names, titles, gender, birth and death dates, religious affiliation, and ethnicity;
• Student information primarily obtained from university systems – Degrees, majors, organization involvement, activities, awards, and athletic participation (including only “Directory Information” as defined by the Family Educational Rights and Privacy Act (“FERPA”) ) ;
• Employment information – Company names, job titles, industry information, occupation codes, and veteran and military status;
• Family information – Spouse's name, children's names and birth dates, and familial relationships;
• Alumni information – Event attendance, volunteer interests and activities, organization affiliations, committee participation, awards and honors, attitudes, and preferences;
• Donor information – Giving information regarding any donation for which an individual receives legal or recognition credit;
• Employee Information – Information concerning the Foundation’s employees;
• Correspondence – Copies of correspondence, as well as records of individual discussions;
• Philanthropic interests – Interests directly expressed to the Foundation or collected through public donor information;
• Analytical information – Data related to web visitor activity and email marketing actions;
• Employment applications – Information provide as part of an employment application to the Foundation, as well as pre-employment screening;
• Patient – Billing and contact information from Rutgers Health.
  • For additional information, please refer to the Rutgers University HIPAA Ethics and Compliance Policies
  • You may opt out of contact from Rutgers Health for fundraising purposes by emailing the Foundation at rufoptout@rutgersfoundation.org or by calling us at 1-855-784-4722.

The Foundation collects information about its Constituents from a variety of sources. A significant portion of the information the Foundation maintains is that which has provided to us by Constituents updating their profile online, registering for an event, communicating with us, or making a donation. For students and alumni, Personal Information is transferred to the Foundation database from the Rutgers student record system.

Specific sources of such Personal Information include:

• Self-provided information online, via phone or through personal contact;
• Information provided to process and record a donation;
• Event registrations;
• Student records—university student record system;
• U.S. postal records;
• Foundation surveys and focus groups;
• Public social media profiles;
• Web-based analytic services;
• Responses to emails sent from the Foundation;
• Other publicly available information sources, such as news services, websites, professional directories, and service bureaus;
• Research data obtained through commercial agencies (third parties).

Collected information is used only for Foundation purposes to advance the mission of the Foundation and Rutgers University (“Legitimate Interests”), including:

• Contacting Constituents with updates and information from the University and the Foundation;
• Send invitations to events and activities;
• Contact Constituents to request donations for areas of interest at Rutgers University;
• Offer alumni benefits and programs;
• Personalize Constituents’ experiences and deliver the type of content and engagement opportunities in which they are most interested;
• Process event registrations and donations, including confirmations, receipts, and pre- and post-event emails;
• Connect Constituents with fundraising and alumni relations professionals, faculty, and sanctioned volunteers who raise funds and foster engagement with the university;
• Conduct research and analysis to better understand constituent attitudes, preferences; interests, so the Foundation can offer opportunities to donate to areas that are most relevant to specific philanthropic interests;
• Process applications for employment and aid in the employment process for applicants and employees.

• Foundation and contract employees;
• University faculty and employees working in conjunction with the Foundation, for example, a dean connecting with an alumnus or donor;
• Volunteers working on behalf of and under the supervision of the Foundation
• Select business partners who offer products, services, and benefits to Constituents;
• Law enforcement agencies, as required, to comply with Rutgers University, local, state and federal law;
• Vendors who perform services under contract with us, such as data research.

All Foundation employees, contract employees, university employees, volunteers, business partners, and vendors are required to comply with Privacy Laws and sign a confidentiality statement that governs their use and protection of Personal Information.

The Foundation has adopted administrative, technical, and physical security measures to protect the Personal Information of its Constituents. Only authenticated users with specific permissions and training may access the data (including the Personal information) in Foundation systems. The Foundation use firewalls and regular monitoring to evaluate any attempts at accessing the systems without permission. The Foundation performs periodic security audits and vulnerability scans of our systems. Cloud vendors undergo a security audit by the Foundation Systems and Technology department and the Rutgers University Department of Information Protection and Security.

Rights for individuals in the European Economic Area impact by the General Data Protection Regulation (GDPR), in Switzerland, under the Revised Swiss Federal Act on Data Protection or individuals in and the United Kingdom.

The “Data Controller” for your Personal Information is the Foundation. The owner of the Personal information is the “Data Subject” or “you.”

The Foundation is committed to the lawful, fair and transparent processing of your Personal Information, where we will only collect Personal Information for specific and legitimate purposes, ensure that processing is limited to what is necessary, update or remove inaccurate data and maintain policies and procedures to keep Personal Information safe and protected against unauthorized or unlawful processing.

In certain circumstances, you have the following data protection rights:

• Right to be Informed – through this Privacy Notice you are being informed about the collection and use of your Personal Information
• Right of Access – you have the right to ask us for a copy of your Personal Information
• Right of Rectification – you have the right to ask us to correct information you think is inaccurate or incomplete
• Right to Erasure (“the right to be forgotten”) – under certain circumstances, you have the right to ask us to delete your Personal Information
• Right to Restrict Processing – you have the right to limit the processing of your Personal Information
• Right to Data Portability – you have the right to ask that we transfer your Personal Information to another organization
• Right to Object – you have the right to object to the processing of your Personal Information
• Rights in Relation to Automated Processing and Profiling – you have the right not to be subject to solely automated decisions in the processing of your Personal Information

To the extent applicable, the EU’s General Data Protection Regulation provides further information about your rights. You also have the right to lodge complaints with your national or regional Data Protection Authority.

If you are inclined to exercise these rights, we request an opportunity to discuss with you any concerns you may have. To protect the Personal Information we hold, we may also request further information to verify your identity when exercising these rights. Upon a request to erase information, we will maintain a core set of Personal Information to ensure we do not contact you inadvertently in the future or subsequently add additional data about you during a periodic update. The Foundation may also need to retain some information for legal purposes, including U.S. IRS compliance. In the event of an actual or threatened legal claim, we may retain your information for purposes of establishing, defending against, or exercising our rights with respect to such claim.

If you provide information directly to the Foundation from the European Economic Area (EEA), Switzerland or the United Kingdom, you consent to the transfer of your Personal Information outside of the EEA to the United States. You understand that the current laws and regulations of the United States may not provide the same level of protection as the data and privacy laws and regulations of the EEA. You are under no statutory or contractual obligation to provide any Personal Information to us.

NOTICE TO CALIFORNIA RESIDENTS

To the extent any California data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the rights that California residents may have, and how they can exercise those rights. This notice applies solely to California residents. We provide the supplemental section below to comply with the California Consumer Privacy Act [as amended by the California Privacy Rights Act (referred to collectively hereinafter as “CCPA”)] and any terms defined in the CCPA have the same meaning when used below.

Your Rights under CCPA

1. Right to Know and Access Specific Information. You have the right to request that we disclose certain information to you about our collection and use of your Information over the past twelve (12) months. Once we receive and confirm a verifiable consumer request from you, we will disclose to you, to the extent permitted by law:
   1. The categories of Information we collected about you, and whether we sell or share your Information to third parties;
   2. The specific pieces of Information we hold about you;
   3. The categories of personal Information sold within the last twelve (12) months;
   4. The categories of sources from which Information about you is collected;
   5. Our business or commercial purpose for collecting, selling, or sharing your Information; and
   6. The categories of third parties with whom your Information is sold, shared, or disclosed for a business purpose.

You have the right to request that the Information described above be provided to you in a portable and readily useable format, to the extent technically feasible (“data portability”).

2. Deletion Request Rights. You have the right to request that we delete the Information that we collected from you, subject to certain exceptions. To the extent that we can delete your Information, once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Information, unless an exception applies.
3. Right to Correct Inaccurate Information. To the extent that we may maintain inaccurate personal Information, you have the right to request that we correct such inaccurate personal Information taking into account the nature of the personal Information and the purposes of the processing of the personal Information. Once we receive and verify your verifiable consumer request, we will use commercially reasonable efforts to correct your personal Information.
4. Sale and Sharing of Personal Information and the Right to Opt-Out. You have the right to opt out of the processing of your Information for the following purposes:
   1. Sale of your Information; and
   2. Sharing of your Information for cross-context behavioral advertising.

The use of online tracking technologies may be considered a “sale” or “sharing” under California law. To the extent that these online tracking technologies are deemed to be a “sale” or “sharing” under California law, you may opt-out of these online tracking technologies by broadcasting an opt-out preference signal, such as the Global Privacy Control (GPC).

5. Right to Limit Use and Disclosure of Sensitive Personal Information. You have the right to request that we limit the ways we use and disclose your sensitive personal Information (as defined by CCPA) to uses which are necessary for us to perform the Services, or deliver the goods reasonably expected by you, or and as authorized by law.
6. Right to Non-Discrimination. You have a right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights. We may not, and will not, treat you differently because of your data subject request activity. As a result of your data subject request activity, we may not and will not deny goods or Services to you, charge different rates for goods or Services, provide a different level quality of goods or Services, or suggest that we would treat you differently because of your data subject request activity.
7. Right to Disclosure of Direct Marketers. You have a right to the categories and names/addresses of third parties that have received personal Information for their direct marketing purposes upon simple request, and free of charge.

You may make an authenticated consumer request exercising your Right to Know and Access Specific Information including right to know what personal Information is being sold or shared under the CCPA twice within a twelve (12) month period.

NOTICE TO VIRGINIA RESIDENTS

To the extent any Virginia data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights guaranteed to Virginia residents and how to exercise those rights and applies solely to Virginia residents. We provide the supplemental section below to comply with the Virginia Consumer Data Protection Act (“VCDPA”) and any terms defined in the VCDPA have the same meaning when used below.

Your Rights under VCDPA

Subject to certain exceptions you may be entitled to the following rights:

1. Right to Access & Data Portability. You have the right to request that we disclose
   certain information to you about our collection and use of your Information at any
   time. Once we receive and confirm an authenticated consumer request from you,
   we will, subject to certain exceptions:
   1. Disclose whether or not we are processing your Information; and
   2. Provide you with access to your Information.

Where the processing is carried out by automated means, and subject to certain exceptions, you have the right to request and obtain a copy of your Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Information to another data controller without hindrance.

2. Right to Correct Inaccurate Information. To the extent that we may maintain inaccurate Information, you have the right to request that we correct such inaccurate Information taking into account the nature of the personal Information and the purposes of the processing of the personal Information. Once we receive and verify your authenticated consumer request, we will use commercially reasonable efforts to correct your Information.
3. Right to Delete. You have the right to request that we delete certain of your Information provided by or obtained about you. To the extent that we can delete your Information, once we receive and confirm your authenticated consumer request, we will delete (and direct our service providers to delete) your Information, subject to certain exceptions.
4. Sale of Personal Information, Targeted Advertising, Profiling, and the Right to Opt-Out. You have the right to opt out of the processing of your Information for the following purposes:
   1. Targeted advertising;
   2. Sale of your Information; and
   3. Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.
5. Right to Appeal. You have the right to appeal our denial of any request you make under this section. To exercise your right to appeal, please submit an appeal request via the contact information noted below. Within sixty (60) days of receipt of your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, you may contact the Virginia Office of the Attorney General by:
   1. Contacting Online: https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint
   2. Calling:
      1. If calling from Virginia, call the Consumer Protection Hotline at 1-800-552-9963.
      2. If calling from the Richmond area or from outside Virginia, call the Consumer Protection Hotline at 1-804-786-2042.
6. Right to Non-Discrimination. You have a right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights. We will not discriminate against you for exercising any of your rights in this section including denying goods or Services, charging different prices or rates for goods or Services, or providing a different level of quality of goods and Services. However, we may offer a different price, rate, level, quality, or selection of goods or Services, including offering goods or Services for no fee, if you have exercised your right to opt out or the offer is related to your voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.

You may make an authenticated consumer request under the VCDPA twice within a twelve (12) month period.

NOTICE TO COLORADO RESIDENTS

To the extent any Colorado data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights guaranteed to Colorado residents and how to exercise those rights and applies solely to Colorado residents. We provide the supplemental section below to comply with the Colorado Privacy Act (“CPA”) and any terms defined in the CPA have the same meaning when used below.

Your Rights under CPA

Subject to certain exceptions you may be entitled to the following rights:

1. Right to Access & Data Portability. You have the right to request that we disclose certain information to you about our collection and use of your Information at any time. Once we receive and confirm an authenticated consumer request from you, we will, subject to certain exceptions:
   1. Disclose whether or not we are processing your Information; and
   2. Provide you with access to your Information where we process it.

Where exercising your right to access, you have the right to request and obtain a copy of your Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Information to another data controller without hindrance (“data portability”).

2. Right to Correct Inaccurate Information. To the extent that we may maintain inaccurate personal Information, you have the right to request that we correct such inaccurate personal Information taking into account the nature of the personal Information and the purposes of the processing of the personal Information. Once we receive and verify your authenticated consumer request, we will use commercially reasonable efforts to correct your personal Information.
3. Right to Delete. You have the right to request that we delete certain of your Information provided by or obtained about you. To the extent that we can delete your Information, once we receive and confirm your authenticated consumer request, we will delete your Information, subject to certain exceptions.
4. Sale of Personal Information, Targeted Advertising, Profiling, and the Right to Opt-Out. You have the right to opt out of the processing of your Information for the following purposes:
   1. Targeted advertising;
   2. Sale of your Information; and
   3. Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.
5. Right to Appeal. You have the right to appeal our denial of any request you make under this section. To exercise your right to appeal, please submit an appeal request via the contact information noted section below. Within forty-five (45) days of receipt of your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions. If you have concerns regarding the results of your appeal, you may contact the Colorado Office of the Attorney General by:
   1. Contacting Online: https://complaints.coag.gov/s/contact-us
   2. Calling: (720) 508-6000

You may make an authenticated consumer request free of charge under the CPA once within a twelve (12) month period. We reserve the right to charge a reasonable fee for a second or subsequent request within the same twelve (12) month period.

6. Sensitive Data. We do not process sensitive data including sensitive data inferences. When we process sensitive data, we do so with your consent.
7. Authorized Agent. You may use an authorized agent to submit verifiable consumer requests on your behalf. An authorized agent is a natural person or a business entity that you have authorized to act on your behalf. If you use an authorized agent, we will require: (1) proof of written permission for the authorized agent to make requests on your behalf, and identity verification from you; or (2) proof of power of attorney. We may deny a request from an authorized agent that does not submit proper verification proof.

NOTICE TO CONNECTICUT RESIDENTS

To the extent any Connecticut data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights guaranteed to Connecticut residents and how to exercise those rights and applies solely to Connecticut residents. We provide the supplemental section below to comply with the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”) and any terms defined in the CTDPA have the same meaning when used below.

Your Rights under CTDPA

Subject to certain exceptions you may be entitled to the following rights:

• Right to Access & Data Portability. You have the right to request that we disclose
  certain information to you about our collection and use of your Information at any
  time. Once we receive and confirm an authenticated consumer request from you,
  we will, subject to certain exceptions:
  • Disclose whether or not we are processing your Information; and
  • Provide you with access to your Information where we process it.
  • Where the processing is carried out by automated means, and subject to certain exceptions, you have the right to request and obtain a copy of your Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Information to another data controller without hindrance.
• Right to Correct Inaccurate Information. To the extent that we may maintain inaccurate personal Information, you have the right to request that we correct such inaccurate personal Information taking into account the nature of the personal Information and the purposes of the processing of the personal Information. Once we receive and verify your authenticated consumer request, we will use commercially reasonable efforts to correct your personal Information.
• Right to Delete. You have the right to request that we delete certain of your Information provided by or obtained about you. To the extent that we can delete your Information, once we receive and confirm your authenticated consumer request, we will delete (and direct our service providers to delete) your Information, subject to certain exceptions.
• Sale of Personal Information, Targeted Advertising, Profiling, and the Right to Opt-Out. You have the right to opt out of the processing of your Information for the
  following purposes:
  • Targeted advertising;
  • Sale of your Information; and
  • Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.
• Right to Non-Discrimination. You have a right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights. We will not discriminate against you for exercising any of your rights in this section including denying goods or Services, charging different prices or rates for goods or Services, or providing a different level of quality of goods and Services. However, we may offer a different price, rate, level, quality, or selection of goods or Services, including offering goods or services for no fee, if you have exercised your right to opt out or the offer is related to your voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.
• Right to an Appeal. You have the right to appeal our denial of any request you make under this Section. To exercise your right to appeal, please submit appeal request to us by either:
  • Emailing us at dataservices@rutgersfoundation.org
  • Calling us at: (848) 932-7777.
    • Within sixty (60) days of receipt of your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, you may contact the Connecticut Office of the Attorney General by:
    • Contacting Online: https://www.dir.ct.gov/ag/complaint/e-complaint.aspx?CheckJavaScript=1
    • Calling: The Consumer Assistance Unit at 860-808-5420.

You may make an authenticated consumer request under the CTDPA once within a twelve (12) month period.

NOTICE TO UTAH RESIDENTS

To the extent any Utah data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights guaranteed to Utah residents and how to exercise those rights and applies solely to Utah residents. We provide the supplemental section below to comply with the Utah Consumer Privacy Act (“UCPA”) and any terms defined in the UCPA have the same meaning when used below.

Your Rights under UCPA

Subject to certain exceptions you may be entitled to the following rights:

• Right to Access & Data Portability. You may have the right to request that we disclose certain information to you about our collection and use of your Information at any time. Once we receive and confirm an authenticated consumer request from you, we will, subject to certain exceptions:
  • Disclose whether or not we are processing your Information; and
  • Provide you with access to your Information where we process it.
  • Where the processing is carried out by automated means, and subject to certain exceptions, you have the right to request and obtain a copy of your Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Information to another data controller without hindrance (“data portability”).
• Right to Delete. You have the right to request that we delete certain of your Information provided by or obtained about you. To the extent that we can delete your Information, once we receive and confirm your authenticated consumer request, we will delete (and direct our service providers to delete) your Information, subject to certain exceptions.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your rights in this section including denying goods or Services, charging different prices or rates for goods or Services, or providing a different level of quality of goods and services.
• Sale of your Personal Information, Targeted Advertising, and Right to Opt-Out. You have the right to opt out of the processing of your Information for the following purposes:
  • Targeted advertising; and
  • Sale of your Information

You may make an authenticated consumer request free of charge under the UCPA once within a twelve (12) month period. We reserve the right to charge a reasonable fee for a second or subsequent request within the same twelve (12) month period.

I will defer to you if it looks better to do separate headers for each state on the full list, subheaders for each state under the proposed new header, or just to write out the full text as printed here.

In 1998, Congress enacted the Children’s Online Protection Act (15 U.S.C. § 6501 – 6506) which has become known as “COPPA.” COPPA strictly limits the collection and use of the Personal Information (or “PII”) of children under the age of thirteen (13) years (“COPPA Users”) and gives their parents or legal guardians (“COPPA Parents”) control over the use of such PII. The Foundation has adopted the following policies to comply with COPPA.

While The Foundation does not purposely collect PII from children under the age of thirteen (13) years. Nevertheless, the Foundation may be provided with PII regarding COPPA Users. The Foundation must rely upon the viewers and program administrators to identify COPPA Users. Upon receipt of PII from a User that a viewer or program administrator has identified as a COPPA User, will verify that the COPPA Parents have consented to the use of the COPPA User’s PII. The viewer will also be asked to provide The Foundation with contact information (including an e-mail address) for the COPPA Parents.

Thereafter, and so long as the User is a COPPA User, the COPPA parent may access the PII of his or her COPPA User and PII regarding the COPPA User may be added, modified or deleted, in whole or part, only by the COPPA Parents or with the verifiable consent of the COPPA Parents (which may be obtained

by e-mail). At such time as the COPPA User’s age exceeds thirteen (13) years, such User shall succeed to the rights previously enjoyed by the COPPA Parents.

The Foundation reserves the right to use de-identified data that is derived from PII of COPPA Users to improve its services. The Foundation also reserves the right to contact COPPA Parents to verify their consent, tell them about new features, solicit their feedback, or just keep them up to date with developments at the Foundation and Rutgers University.

If you believe we may have inadvertently posted PII of a child under the age of thirteen years without proper consent and authorization, please contact us by email at dataservices@rutgersfoundation.org, and we will delete such information immediately.

By making a charitable gift to the Rutgers University Foundation, a 501(c)(3) organization, the donor understands that charitable donations are not refundable.