Privacy Policy

Introduction

This Privacy Notice for The Grid Project, Incorporated (“we,” “us,” or “our”) describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”), including when you:

• Visit our website at thegridproject.org, or any website of ours that links to this Privacy Notice.
• Use The Grid Project website. The Grid Project is a registered 501(c)(3) nonprofit organization that installs solar panels and battery storage systems at community-serving buildings. This website provides information about our mission and partnership model, and accepts charitable donations through a third-party payment processor. No products or services are sold directly through this site.
• Engage with us in other related ways, including any marketing or events.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at contact@thegridproject.org.

Summary of Key Points

This summary provides key points from our Privacy Notice; you can find more detail about any of these topics in the full sections below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information? Some information may be considered “special” or “sensitive” in certain jurisdictions, for example racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.

Do we collect any information from third parties? We do not collect any information from third parties.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

What are your rights? Depending on where you are located geographically, applicable privacy law may mean you have certain rights regarding your personal information.

How do you exercise your rights? The easiest way to exercise your rights is by visiting our contact page, or by contacting us directly. We will consider and act upon any request in accordance with applicable data protection laws.

What Information We Collect

Personal Information You Provide

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our Services, when you participate in activities on the Services, or otherwise when you contact us.

The personal information we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. It may include:

• Names
• Email addresses

We do not process sensitive information (such as racial or ethnic origin, sexual orientation, or religious beliefs).

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such information.

Payment Data

We may collect data necessary to process a donation, such as your payment instrument number and the security code associated with it. All payment data is handled and stored by Stripe and GiveButter, not by us. You can review their privacy policies at stripe.com/privacy and givebutter.com/privacy.

How We Process Your Information

We process your personal information for a variety of reasons, depending on how you interact with our Services, including to:

• Deliver and facilitate delivery of the Services you request.
• Respond to your inquiries and offer support.
• Protect our Services, including fraud monitoring and prevention.
• Identify usage trends so we can better understand and improve how the Services are used.
• Save or protect an individual’s vital interest, such as to prevent harm.

We only process your information for other purposes with your prior explicit consent.

What Legal Bases We Rely On

We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law, such as with your consent, to comply with laws, to fulfill our contractual obligations to you, to protect your rights, or to fulfill our legitimate business interests.

If You Are Located in the EU or UK

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on to process your personal information:

• Consent. We may process your information if you have given us permission to use it for a specific purpose. You can withdraw your consent at any time (see “Withdrawing Your Consent” below).
• Performance of a contract. We may process your information when necessary to fulfill our contractual obligations to you, including providing our Services.
• Legitimate interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests, such as analyzing how our Services are used so we can improve them, or diagnosing problems and preventing fraudulent activity.
• Legal obligations. We may process your information where necessary for compliance with our legal obligations, such as cooperating with a law enforcement body or regulatory agency, or exercising or defending our legal rights.
• Vital interests. We may process your information where necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to safety.

If You Are Located in Canada

We may process your information if you have given us specific permission (express consent) to use it for a specific purpose, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including for investigations and fraud detection and prevention, for certain business transactions, where disclosure is required to comply with a subpoena or court order, or where the information is publicly available and specified by regulation.

When and With Whom We Share Your Information

We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with these third parties that are designed to safeguard your personal information; they cannot use it for anything other than what we’ve instructed and will not share it with any other organization.

The third parties we may share personal information with are:

• Netlify: website hosting, functionality, and infrastructure.
• Stripe and GiveButter: donation processing and billing.

We may also share or transfer your information in connection with a merger, sale of company assets, financing, or acquisition of all or a portion of our organization.

Is Your Information Transferred Internationally

Our servers are located in the United States. Regardless of your location, your information may be transferred to, stored by, and processed by us and the third parties we share it with in facilities in the United States and other countries.

If you are a resident of the European Economic Area (EEA), United Kingdom (UK), or Switzerland, these countries may not have data protection laws as comprehensive as those in your country. We take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law, including using the European Commission’s Standard Contractual Clauses for transfers of personal information between us and our third-party providers. Our Standard Contractual Clauses can be provided upon request.

How Long We Keep Your Information

We keep your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law. No purpose in this notice requires us to keep your personal information for longer than 2 years.

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymize it, or, if that isn’t possible, securely store it and isolate it from further processing until deletion is possible.

How We Keep Your Information Safe

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Transmission of personal information to and from our Services is at your own risk; you should only access the Services within a secure environment.

Do We Collect Information From Minors

We do not knowingly collect, solicit, or market to data from children under 18 years of age (or the equivalent minimum age in your jurisdiction), nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18, or that you are the parent or guardian of a minor and consent to their use of the Services.

If we learn that personal information from a user under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete the data from our records. If you become aware of any data we may have collected from a child under 18, please contact us at contact@thegridproject.org.

Your Privacy Rights

Depending on your state of residence in the US, or in regions such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. These may include the right to request access to and a copy of your personal information, request rectification or erasure, restrict processing, request data portability, and, in some cases, object to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review.

You can make any such request by contacting us using the details in “Contact Us” below. We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your Member State data protection authority or the UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing Your Consent

If we are relying on your consent to process your personal information, you have the right to withdraw it at any time by contacting us using the details in “Contact Us” below. This will not affect the lawfulness of processing before the withdrawal, nor the processing of your information conducted in reliance on lawful grounds other than consent.

Do-Not-Track Signals

Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature you can activate to signal your preference not to have your online browsing activity monitored and collected. No uniform technology standard for recognizing and honoring DNT signals has been finalized, so we do not currently respond to DNT signals or similar mechanisms. If a legal standard for online tracking is adopted that we must follow, we will update this Privacy Notice accordingly.

US State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you, correct inaccuracies, obtain a copy of, or delete your personal information, and to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law.

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the past twelve months.

Category	Examples	Collected
A. Identifiers	Real name, postal address, phone number, unique online identifier, IP address, email address, account name	Yes
B. California Customer Records	Name, contact information, employment history, financial information	Yes
C. Protected classifications	Gender, age, race and ethnicity, national origin, marital status, and similar demographic data	No
D. Commercial information	Transaction information, purchase history, financial details, payment information	No
E. Biometric information	Fingerprints and voiceprints	No
F. Internet or network activity	Browsing history, search history, interactions with our and other websites	No
G. Geolocation data	Device location	No
H. Audio, electronic, sensory information	Images, audio, video, or call recordings	No
I. Professional or employment information	Business contact details, work history, professional qualifications	No
J. Education information	Student records and directory information	No
K. Inferences	Inferences drawn from the categories above to create a profile or summary	No
L. Sensitive personal information	N/A	No

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail, such as through customer support, surveys, or delivery of the Services.

We retain Category A information for 1 year and Category B information for 24 months.

We have not sold or shared any personal information with third parties for a business or commercial purpose in the preceding twelve months. We have disclosed Category A (Identifiers) and Category B (California Customer Records) information to our service providers for a business or commercial purpose in the preceding twelve months, under written contract; see “When and With Whom We Share Your Information” above for the categories of third parties involved.

Your Rights

You have rights under certain US state data protection laws, though these rights are not absolute and we may decline a request as permitted by law. These include the right to know whether we are processing your personal data, access it, correct inaccuracies, request deletion, obtain a copy of what you’ve shared with us, and not be discriminated against for exercising your rights. You may also have the right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or certain profiling.

Depending on your state, you may also have the right to access the categories of personal data being processed, obtain a list of the categories or specific third parties to which we’ve disclosed personal data, and, in some states, review, question, or correct how your personal data has been profiled.

How to Exercise Your Rights

To exercise these rights, contact us by visiting our contact page, by emailing contact@thegridproject.org, or by using the contact details at the bottom of this document. Under certain US state laws, you can designate an authorized agent to make a request on your behalf; we may deny a request from an agent who cannot provide proof of valid authorization.

Request Verification

Upon receiving your request, we will need to verify your identity to confirm you are the person about whom we hold information. We will only use information provided in your request for this verification, though we may request additional information if we cannot verify your identity from what we already maintain. If a request is submitted through an authorized agent, we may need additional information to verify your identity, and the agent will need to provide written, signed permission from you.

Appeals

Under certain US state data protection laws, if we decline to act on your request, you may appeal by emailing contact@thegridproject.org. We will inform you in writing of any action taken or not taken in response, including a written explanation of our reasoning. If your appeal is denied, you may submit a complaint to your state attorney general.

California “Shine the Light” Law

California Civil Code Section 1798.83 permits California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes, and the names and addresses of those third parties, in the immediately preceding calendar year. To make such a request, submit it in writing using the contact details in “Contact Us” below.

Do Other Regions Have Specific Privacy Rights

Australia and New Zealand

We collect and process your personal information under the obligations and conditions set by Australia’s Privacy Act 1988 and New Zealand’s Privacy Act 2020. This Privacy Notice satisfies the notice requirements of both Acts, including what personal information we collect, from which sources, for which purposes, and other recipients of your information.

At any time, you have the right to request access to or correction of your personal information by contacting us using the details in “Contact Us” below. If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner, or a breach of New Zealand’s Privacy Principles to the Office of the New Zealand Privacy Commissioner.

Republic of South Africa

At any time, you have the right to request access to or correction of your personal information by contacting us using the details in “Contact Us” below. If you are unsatisfied with how we address a complaint regarding our processing of personal information, you can contact The Information Regulator (South Africa) at enquiries@inforegulator.org.za for general enquiries, or PAIAComplaints@inforegulator.org.za and POPIAComplaints@inforegulator.org.za for POPIA/PAIA complaints.

Charitable Donations

Donation transactions are processed exclusively by GiveButter and its payment processor, Stripe. The Grid Project does not receive, store, or process payment card information. Donor information collected by GiveButter is governed by GiveButter’s privacy policy. The Grid Project may receive donor name and email address from GiveButter for the purpose of issuing tax receipts and donor acknowledgment communications.

Changes to This Notice

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised effective date at the top of this page. If we make material changes, we will notify you by prominently posting a notice of the changes or by sending you a direct notification. We encourage you to review this Privacy Notice periodically.

Contact Us

If you have questions or comments about this notice, you may email us at contact@thegridproject.org or contact us by post at:

The Grid Project, Incorporated California, United States

How to Review, Update, or Delete Your Data

You have the right to request access to the personal information we collect from you, details about how we’ve processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law. To make a request, please visit our contact page.