Privacy Policy

Last updated: 2 June 2025

The Heracles Group (“THG,” “we,” “our,” or “us”) is a humanitarian non-profit organization registered in the United States and operating projects worldwide. We take your privacy seriously and are committed to protecting the Personal Data you share with us. This Policy explains how we collect, use, share, and safeguard information when you visit our websites, donate, volunteer, or otherwise interact with THG (collectively, the “Services”).

1. Scope

This Policy applies to Personal Data processed by THG in connection with:

Public websites(e.g., heracles-ngo.org) and any subsites we control
Donation portalsand payment processors acting on our behalf
Email, social-media, and SMS outreach
Program operations, including beneficiary and volunteer management
Events, surveys, or trainingswe host (online or in-person)

It does not cover third-party sites we merely link to; please review their privacy notices separately.

2. Personal Data We Collect

Category	Examples	Source
Identification	Name, postal address, phone, email, government ID (where required for grants or background checks)	You directly; partner referrals
Donation & Payment	Donation amount, currency, payment-card last 4 digits, billing address, gift-aid status	Payment processors (e.g., Stripe, PayPal), you
Program & Beneficiary	Demographic data, injury details (for prosthetics programs), professional skills (for volunteers)	You; field partners; publicly available sources
Technical / Usage	IP address, device type, log files, cookies, browsing actions, email-open rates	Your device/browser; analytics vendors
Media	Photos, videos, 3-D scans (e.g., damage assessments, prosthetic fittings)	You; THG field staff

We collect data only when we have a lawful basis—typically consent, legitimate interests (e.g., program delivery, fraud prevention), contractual necessity, or legal obligation.

3. How We Use Your Data

Process donationsand issue receipts or tax certificates
Deliver humanitarian programs, including beneficiary eligibility and follow-up
Communicate: newsletters, project updates, event invites, and urgent appeals (you can opt out anytime)
Recruit and vet volunteers & staff
Analyzesite traffic and campaign effectiveness to improve our Services
Comply with laws, anti-terror financing checks, or requests from regulators

We do not sell or rent your Personal Data.

4. Sharing & Disclosure

We disclose data only when necessary:

Service providers: payment gateways, cloud hosting, email platforms, analytics tools—bound by confidentiality agreements
Field partners & contractors: to coordinate program delivery (only minimum data shared)
Regulators or law-enforcement: when required by law or to protect THG’s rights or those of our beneficiaries
Successors: in a merger or asset transfer involving THG, provided the successor upholds similar safeguards

5. Cookies & Tracking

Our sites use first- and third-party cookies and similar technologies to:

Keep you logged in
Remember language or region settings
Measure traffic (e.g., Google Analytics)
Serve donation pop-ups tailored to your visit history

You can block cookies via your browser settings; essential cookies, however, enable core functionality.

6. Data Retention

We retain Personal Data only as long as necessary:

Donor records: 7 years (for audit & tax)
Program beneficiary files: 10 years, unless longer retention is required by grant terms
Email lists: until you unsubscribe or after 2 years of inactivity
Website logs: 12 months

When retention periods lapse, data are securely erased or anonymized.

7. Security

We employ technical and organizational measures:

TLS encryption for all web traffic
PCI-compliant payment processing; THG never stores full card numbers
Role-based access and MFA for staff systems
Encrypted portable drives and laptops
Regular vulnerability scans and staff training

No system is 100 % secure, but we strive to minimise risks.

8. International Transfers

Our servers are located in the United States and, for redundancy, the European Economic Area (EEA). When we transfer data across borders—including to project countries with differing privacy laws—we rely on:

Standard Contractual Clauses (SCCs)
Data-processing agreements
Explicit consentwhen required

9. Children’s Privacy

Our Services are not directed to children under 13 (or local equivalent). When programs involve minors (e.g., prosthetic fittings), we collect data only with verifiable parental or legal-guardian consent.

10. Your Rights

Depending on your jurisdiction (e.g., GDPR, CCPA), you may have the right to:

Accessthe Personal Data we hold about you
Correctinaccurate or incomplete data
Deleteor restrict processing
Objectto certain uses (marketing, profiling)
Portyour data to another service
Withdraw consentat any time
Lodge a complaintwith a supervisory authority

To exercise these rights, contact us (see Section 12). We may need to verify your identity before fulfilling requests.

11. Changes to This Policy

We may update this Policy periodically. Significant changes will be posted on our website and, where feasible, notified by email. Continued use of our Services after such changes constitutes acceptance.

12. Contact Us

Questions, requests, or complaints?

Privacy Officer
The Heracles Group
TBD Address
Email: info@theheraclesgroup.org
Phone: +1-423-298-6275

By using our Services, you acknowledge that you have read and understood this Privacy Policy.