Privacy

Change.org, PBC (“Change.org”) is a public benefit corporation registered in the State of Delaware, United States. Change.org is fully owned by The Change.org Charitable Foundation, a 501c3 nonprofit organization.

Change.org’s mission is to empower people everywhere to create the change they want to see. We want to build the best possible technology to show you relevant petitions that you can help win, and also protect your privacy and security online. Our Privacy Policy outlines how we obtain information from you and what we do with it. It also explains the choices you can make to control your privacy when you use Change.org.

Table of contents
  1. Key contacts
  2. Information we collect
  3. How we use your information
  4. Who may receive your information
  5. Your privacy choices
  6. Data retention and information security
  1. Cross-border transfers
  2. Links to other websites
  3. California Consumer Privacy Act
  4. CARU COPPA Safe Harbor Program (“CARU COPPA Safe Harbor”)
  5. Policy updates

1. Key contacts

Here’s how to reach us for data privacy, security, and other topics listed below. For all other questions, the best way to get in touch with us is through our Help Center or at help@change.org. Because email or postal communications are not always secure, please do not include credit card or other sensitive information in your emails or letters to us.

1. Your account, petitions, contributions: If you have any questions about managing your account, petitions, or contributions, please contact us through our Help Center or at help@change.org.

2. Data privacy

  • Data Controller: Change.org, PBC

    Post: 548 Market Street, #29993, San Francisco, CA 94104-5401, USA
    E-mail: Data Protection Officer, dpt@change.org
    For decision makers in the EU/UK: Our platform enables petition starters to designate specific people who they believe to be the “decision maker” empowered to act upon the subject of their petition. For decision makers located in the EU/UK, the petition starter’s inclusion of your data means that the petition starter is also a data controller. If you would like to make a data subject request, contact dpt@change.org with your contact details and the petition URL, and Change.org will process your request in compliance with applicable laws and our internal policies.

  • Regional and National Representatives

3. Law enforcement: If you are a law enforcement officer with a legal inquiry, contact us at dpt@change.org.

4. Decision makers: If you are a decision maker and want to get in touch with the petition starter, you can post a public response on the petition page on our platform, or contact us through our Help Center or at help@change.org and we will do our best to relay your message to the petition starter.

5. Account security: If you suspect someone else is using your account, or your account security has been compromised, contact us at dpt@change.org.

6. Platform security: If you believe you have discovered a vulnerability, bug, or other general security issue within the Change.org platform, contact the Change.org Information Security Team at security.help@change.org.

7. Other: For all other inquiries, please contact us through our Help Center or at help@change.org and we will do our best to assist you. Messages sent to the contacts listed above that are outside the scope of the corresponding topics will be routed back to the Help Center for assistance; please refrain from sending repeated messages or emailing multiple contacts, as this may slow down our response time!

2. Information we collect

For platform users, petition starters and petition signers

To provide our services and show you relevant content we need to know a little about you and your interests. Here we outline what information Change.org collects, and how we collect it.

When you sign or create a petition via our Change.org platform, an account is created for you; all of your activities on Change.org are then tied to this account. In the chart below, we’ve detailed the information we may collect about you, depending on your activities on the platform, and how we obtain this information.

What we collect How we collect it
Your name. We require you to provide a chosen name when you create a Change.org account.
Your email address. We require you to provide an email address when you create a Change.org account.
Your password. We require you to enter a password when you create a Change.org account.
Your IP address. Your “IP Address” is a designator that is automatically assigned to the computer that you are using by your Internet Service Provider (ISP). An IP Address may be identified and logged automatically in our server log files whenever you use our platform and services, along with the time of your visit and the specific page(s) that you visited.
We may use your IP Address to derive geolocation data.
Your postal address. You may choose to provide your postal address when you create a Change.org account. Providing this information is not required to use the service.
Your telephone number. You may choose to provide your telephone number when you create a Change.org account. Providing this information is not required to use the service.
Your city. We use the IP service Maxmind to suggest your city from your IP address, in order to show you local petitions that may be of interest. You can change this information if it is displayed incorrectly. We do not share your information with Maxmind. Providing a city is required to use the service.
Your state/province. We use the IP service Maxmind to suggest your state/province from your IP address, in order to show you local petitions that may be of interest. You can change this information if it is displayed incorrectly. We do not share your information with Maxmind. Providing a state/province is required to use the service.
Your country. As mentioned above, we use the IP service Maxmind to suggest your city from your IP address, in order to show you local petitions that may be of interest. This enables us to determine your country. We do not share your information with Maxmind. Providing a country is required to use the service.
Your profile picture. You may choose to upload a profile picture when you create an account, or at any time. Providing this information is not required to use the service.
Your specific activities on or connected to the Change.org platform. These might include petitions you have started or signed, shared, or promoted, or whether you decide to become a Change.org member. When you are signed in or identified as a particular Change.org user, your activities on or connected to the Change.org platform are automatically associated with your account.
Any other information you voluntarily submit. You may be offered the choice to provide other information to us. For example, we may collect information when you respond to user surveys, or when you provide information when we assist you by telephone. Providing this information is not required to use the service.
The name of the browser you use to access Change.org. Certain information is collected by most browsers or automatically through your device, such as your Media Access Control (MAC) address, computer type (Windows PC or Mac), screen resolution, operating system name and version, device manufacturer and model, language, Internet browser type and version, and the name and version of the Change.org platform you are using. Collecting this information helps us build and deliver the best possible version of Change.org to you.
Your social media account ID, and information shared with us via your social media account. Linking a social media account is not required to access the service. You have the option to add social media handles to your Change.org profile. If you sign a petition by logging into a third-party account, we receive your name and email address from the third party.
Information about the issues you care about based on your activities on the platform. As part of our efforts to connect people to causes that interest them, petitions you sign might be tagged by our users or by us as particular cause areas. For example, a petition may be tagged as “animal rights” or “women’s rights”. If you sign one petition tagged in a particular cause area, we may infer that you would be interested in other petitions tagged in the same way. We may also send you petitions that are relevant to your general geographic area.
Currently in the United States only, we use information available in public records, or other publicly available databases, such as civic data APIs which help match citizens with the elected officials who represent them in all levels of the government. In the United States, we receive data from the “Google Civic Information API” that contains lists of federal office holders and legislators, state legislators, and governors. That data is integrated into our platform to enable users in the United States to accurately identify the correct decision maker for their petition. We also use this data to match petitions from a particular district to the right political representative. We do not share any user data via the “Google Civic Information API.” In the future, we may carry out similar activities in other countries, subject to applicable law.
Information collected through cookies as disclosed in our Cookie Policy We, and/or our service providers, may use cookies, pixel tags (also known as web beacons and clear GIFs), and other similar technologies to understand user activities. Like other websites, Change.org will not function properly if cookies are not enabled. We use third-party analytics services like Google Analytics provided by Google Inc. (“Google”), the Amplitude service provided by Amplitude (“Amplitude”), the Optimizely service provided by Optimizely (“Optimizely”), and the Looker service provided by Looker Data Sciences, Inc. These analytics services may use cookies and similar technologies to analyze how people use our services and provide statistical reports about aggregated user behavior. Such services may also collect information about platform visitors’ use of other websites. Please review our Cookie Policy for detailed information on the cookies we use, and how you can manage these.
The currency of any contributions made through Change.org. We infer your currency based on your country.
The transaction amount you contributed or received through a refund or otherwise. Your payment information, including your credit card or bank number, expiration date, billing address and transaction amount is collected on our payment page by a third-party payment processor and will be subject to its privacy policy. We have no control over, and are not responsible for, the third-party’s collection, use, and disclosure of your personal information. We receive information on payment amount only; no other payment information is stored or saved within our systems.

For decision makers

Our platform enables petition starters to designate specific people who they believe to be the “decision maker” empowered to act upon the subject of their petition. If you are identified as a decision maker for a petition, we may process your personal information.

In the chart below, we’ve detailed the information we may collect about you.

Please note that if you create an account on our platform, the section above, “For platform users, petition starters and petition signers,” will also apply to you.

What we collect How we collect it
Your name. If you are identified as a decision maker, your name may be provided to us.
Your email address. If you are identified as a decision maker, your email address may be provided to us.
Your office, title, and/or organization If you are identified as a decision maker, your office, title, and/or organization may be provided to us.
Your profile picture. If you are identified as a decision maker, your public profile photo may be added.
Any other information you voluntarily submit. You may decide to respond to a petition that identifies you as a decision maker. Your response will be published on the petition page.
Currently in the United States only, we use information available in public records, or other publicly available databases, such as civic data APIs which help match citizens with the elected officials who represent them in all levels of the government. In the United States, we receive data from the “Google Civic Information API” that contains lists of federal office holders and legislators, state legislators, and governors. That data is integrated into our platform to enable users in the United States to accurately identify the correct decision maker for their petition. We also use this data to match petitions from a particular district to the right political representative. We do not share any user data via the “Google Civic Information API.” In the future, we may carry out similar activities in other countries, subject to applicable law.

Please note that if you are a prominent public figure, we may use the above-mentioned information to create a decision maker profile page for you, in order to enable petition starters to more accurately direct their petitions towards the public figures best positioned to respond to their request. As a decision maker, you and/or your designee can reach out to us to update the information on your profile by contacting our support team at help@change.org.

Some of the information above reveals your specific identity, or is directly tied to your specific identity, such as your name and email address. Some of this information does not reveal your specific identity, or does not directly relate to you, such as your browser and device information or information collected through cookies. If we ever combine non-personally identifiable information with personally identifiable information, the combined information will be treated by us as personally identifying information and protected accordingly.

Our services are not directed to people under the age of thirteen (13) or under the legal age of consent in your country of residence (for example, in some countries, you must be age 16 years or older), and we do not knowingly collect personal information from them, unless otherwise permitted by law.

3. How we use your information

For platform users, petition starters and petition signers

Here are the ways we might use your information to run our platform, provide our services, and serve you better content.

Where required by applicable law, we and our service providers will rely on your consent whether implied or express and may use your information for our legitimate business interests in providing a petition platform that enables people to connect with issues of interest. Our legitimate business interests are explained below, alongside examples of how your information may be used for these purposes.

Purpose Examples
Providing the functionality of our platform. We engage in these activities to manage our contractual relationship with you.
  • To send administrative information to you. For example, information regarding our services and changes to our terms, conditions, and policies.
  • To ensure that our site and apps function properly and are optimized for your computer or device, and to store your preferences and settings.
Fulfilling your specific requests through the platform. We engage in these activities to manage our contractual relationship with you.
  • To allow you to create petitions, sign petitions, join “topics” or “movements” (groups of similar petitions), follow their progress, and manage petitions (including publishing your name and/or signature). To allow you to participate in other activities on Change.org platforms, sites and apps, as well as to complete and fulfill your transactions with us.
  • To allow you to send email messages that you choose to send to your email contacts through our platform, such as to share a petition. By using this feature, you guarantee that you have the right to use and provide us the names and email addresses you submit.
  • To facilitate the social sharing functionality that you choose to use, such as sharing content and petitions through the Change.org platform and other social media platforms, like Facebook and Twitter.
Accomplishing our business purposes. We engage in these activities to manage our contractual relationship with you, to comply with a legal obligation, because we have a legitimate interest, and/or with your consent.
  • For data analysis: for example, to improve the efficiency of our services.
  • For audits, to verify that our internal processes function as intended and are compliant with legal, regulatory, or contractual requirements.
  • For fraud and security monitoring purposes: for example, to detect and prevent cyber-attacks or attempts to commit identity theft.
  • For developing new products, features, and services.
  • For enhancing, improving, or modifying our platform.
  • For identifying usage trends: for example, to understand which parts of our platform are of most interest to users.
  • For determining the effectiveness of campaigns.
  • For notifying decision makers of campaigns, if applicable.
  • For operating and expanding our business activities: for example, understanding which parts of our platform are of most interest to our users so we can focus our energies on meeting our users’ interests.
  • For legal compliance. In rare circumstances, we may have to use and disclose information we have about our users in order to exercise or protect legal rights or defend against legal claims under applicable law, or otherwise comply with applicable laws.
  • We use cookies and similar technologies detailed in our Cookie Policy to measure and improve our services and develop features and functionalities on our platform. For example, if we see that people using a certain device use the platform the most, we might decide to build an app specifically for that device.
Analyzing personal information for business reporting and providing personalized services. We provide personalized services either with your consent or because we have a legitimate interest.
  • To personalize your experience by presenting petitions, campaigns, and offers tailored to you based on information we have collected from you.
  • We may anonymize, de-identify, and/or aggregate information and use such information to better understand and serve our users or for optimization of our marketing and targeting efforts. For example, we may compile statistics like the percentage of our users in a state or country who care about animal rights, or the age range of those users, to analyze the performance of particular emails.
Sharing marketing communications that we believe may be of interest to you. We engage in this activity with your consent or because we have a legitimate interest.
  • Communications related to petitions you’ve signed, other petitions that may be of interest, or petitions relevant to your location.Editorial communications about specific issues or about Change.org.
  • Communications about contributions to causes or about crowdfunding for a specific petition.
  • Communications about becoming a member or subscriber of Change.org.
  • If you choose to provide your telephone number or postal address, which are not required, we may contact you by phone, SMS, or postal mail about the Change.org contribution program or other ways you can support campaigns. For more information on text messages and SMS, please refer to our Terms of Service [10. Text messaging].
  • Invitations to Change.org events.
  • To allow you to participate in events and similar promotions and to administer these activities. Some of these activities have additional rules, which could contain additional information about how we use and disclose information about you, so we suggest that you read these rules carefully.
  • Most marketing communications will be sent via email and sometimes via social media.
  • We might remind you about particular petitions or the Change.org contribution program, if you have not completed starting or signing or joining.
Sending communications about the service as required by our contractual relationship.
  • Communications to notify you of any aspect related to our contract with you, such as changes in terms and conditions, privacy policy, or to notify you of essential aspects of your requests, etc.

For decision makers

We may use your information for our legitimate business interests in providing a petition platform that facilitates the exercise of the right to petition and enables people to connect with issues of interest, as well as to inform you about petitions that identify you as a decision maker and the option to respond to such petitions.

Please note that if you create an account on our platform, the section above, “For platform users, petition starters, and petition signers,” will also apply to you.

Purpose Examples
Facilitating the exercise of the right to petition
  • To inform you about a petition that identifies you as a decision maker.
  • To provide you with the option to respond to a petition that identifies you as a decision maker.
  • To create a decision maker profile page for you.

4. Who may receive your information

Here we outline who may receive your information when it is shared either by you via the platform, or by us.

1. The Change.org community

  • All information you post on our platform (such as petitions you create, reasons for signing a petition, your posts on the Change.org Community message boards, your response to a petition that identifies you as a decision maker, etc.) will be visible to other users. When you provide information to us, you declare that such information is truthful and does not infringe upon the rights of any third party, that you have the legal right to share it, and that you are aware of the risks associated with sharing personal information concerning third parties.
  • If you choose to send messages or connect with others through our platform about petitions you have signed, shared, or that identify you as a decision maker, you disclose your personal information to the recipient of your message. Our platform provides an open forum for communication by users all around the world. We do not monitor, verify, or perform any background check on campaign starters, petition signers, or other users of Change.org.
  • Similar to traditional paper petitions, we consider an online petition to be a public expression of support for an issue. Therefore, your name, general geographic location (i.e., city, state, country), and a link to your Change.org user profile may be displayed on the landing page for any petition you sign, and on related areas of our platform. This information will be viewable to any visitor, including the media, search engines, and other organizations that provide archival internet activities. If you do not wish to have your support for a petition to be public, we recommend you do not sign or share the petition. If you do not wish to have your name displayed on a petition landing page, you may select the option not to display your name and comment publicly on the petition page.
  • Your first name, last name, city, country, and/or postcode, and the day that you signed will be shared with the person who initiated a petition you have signed, even if you select the option not to display your name and comment publicly. This is extremely important for petition starters to demonstrate the legitimacy of their signatures to the decision makers they are working to influence. If you do not wish to have this information shared with the person who initiated the petition, please do not sign the petition.
  • The petition starter may choose to share your name and general geographic location with the intended decision maker who is the recipient of their petition. For example, the intended decision maker may be your congressman/woman when the petition concerns an issue relevant to him or her. If you do not wish to have this information shared with the petition recipient, you should not sign the petition.

2. Your connected social media platforms

  • You may share your activities on Change.org with friends on other social media sites, for example, sharing a petition you signed on Facebook. In such a case, you authorize us to share your user id with your social media account provider, and you understand that the use of the information we share will be governed by the social media site’s privacy policy. If you do not want your information shared with other social media users or with your social media account provider, please do not connect your social media account with your Change.org account and do not use the social sharing features on the platform.
  • You may voluntarily share information on message boards, chats, profile pages, blogs, and other services to which you are able to post information and materials (including the Change.org pages on Facebook and other social media platforms). Please note that any information you post or disclose through these services will become public information, and may be available to other Change.org users, social media platform users and to the general public. We urge you to be very careful when deciding to disclose any information about yourself via the social sharing features of our platform. You also acknowledge that you will be subject to the terms and usage guidelines of these other platforms. For more details regarding posting content to our platform, please see our Terms of Service.

3. Our business entities and service providers

We may share your information with third parties for the following purposes:

  • Entities within the Change.org group. We may share your information with our affiliates, which are entities under common ownership or control of Change.org, to provide our services in different countries and for the purposes described in this Privacy Policy.
  • The Change.org Charitable Foundation and its local chapters that operate in certain countries. Local chapters may contact you if you are within their country, as part of The Change.org Foundation’s mission to build social movements that create transformational change.
  • Our suppliers, subcontractors, and business partners (“service providers”). We may share information about you with our service providers who process information to provide services to us or on our behalf. We have contracts with our service providers that prohibit them from sharing the information about you that they collect or receive with anyone else or from using such information for other purposes.

4. Legal and administrative obligations

We may use and disclose your personal information as necessary or appropriate, especially when we have a legal obligation or legitimate interest to do so:

  • Fraud prevention: We may use and disclose the information we collect from and about our users as we believe necessary to investigate, prevent, or respond to suspected illegal or fraudulent activity or to protect the safety, privacy, rights, or property of us, our users, or others.
  • Law enforcement purposes: If requested or required by government authorities such as law enforcement authorities, courts, regulators, other enforcement agencies with appropriate jurisdictions, or otherwise to comply with the law (which may include laws outside your country of residence), we may have to disclose information we have about our users. We also may use and disclose information collected about you in order to exercise or protect legal rights or defend against legal claims.
  • Sale or merger of our company: We have no plans to sell our business. In this unlikely event, we may use, disclose, or transfer your personal information to a third party if we or any of our company affiliates are involved in a corporate restructuring (e.g., a sale, merger, or other transfer of assets, including in connection with any bankruptcy or similar proceedings).

5. Your privacy choices

Here we outline your privacy and communication choices and what rights you may be able to exercise as a data subject.

Your profile

When you sign or create a petition via our Change.org platform, an account and user profile page are created for you. Any petitions that you sign will not appear on your user profile by default. Any petitions that you have started and published will appear on your user profile by default. If you would like to delete any petitions you have published, please contact our support team through our Help Center or at help@change.org.

Email marketing communications

If you no longer want to receive marketing-related emails from Change.org going forward, you may opt out of receiving these by (1) following the instructions contained in any such email; (2) logging in to your account, clicking on “Settings,” and selecting “Manage communications preferences”; or (3) contacting our support team through our Help Center or at help@change.org. We will comply with your request(s) as soon as reasonably practicable. Please note that if you opt out of receiving marketing-related emails from us, we may still send you important administrative messages (such as updates about your account or service changes), from which you cannot opt out.

Text message and SMS communications

For information on opting out of text messages, please refer to our Terms of Service [10. Text messaging].

Data protection rights

If you are a data subject in an applicable jurisdiction, such as the EU, UK, Brazil, and Canada, you may have the following rights under applicable laws:

  • Right of access: You can ask us to provide you with information about our processing of your personal information and give you access to your personal information.
  • Right to rectification: You can ask us to correct any personal information we hold about you that is inaccurate or incomplete.
  • Right to erasure: You can ask us to delete or remove personal information where there is no lawful reason for us continuing to store or process it, where you have successfully exercised your right to object to processing, where we may have processed your information unlawfully, or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons that you will be informed of, if applicable, at the time of your request.
  • Right to restrict processing: You can ask us to suspend the processing of your personal information if (i) you want us to establish the data’s accuracy; (ii) our use of the data is unlawful but you do not want us to erase it; (iii) you need us to retain the data, even if we no longer require it, because you need it to establish, exercise, or defend legal claims; or (iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
  • Right to object: You may object to the processing of your personal information in instances where we are relying on a legitimate interest (or that of a third party) if you feel the processing activity infringes upon your fundamental rights and freedoms.
  • Right to data portability: You may, in certain circumstances, ask us to provide you (or a third party you have chosen) with your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information that was processed based on your consent or a contract we have with you.
  • Right to withdraw consent at any time: You may withdraw your consent in instances where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out prior to the withdrawal of your consent.
  • Right to opt out from the use of cookies: Please see our Cookie Policy for more information.

Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the personal data or where certain exemptions apply.

If you have such rights and your request complies with the requirements under applicable laws, we will give effect to your rights as required by law.

To exercise any rights you may have under applicable privacy laws, reach out to the appropriate contact listed in our Privacy Policy [1. Key contacts] or get in touch with our support team via our Help Center or at help@change.org. If we are unable to identify you from your first communication, we may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Although we urge you to contact us first to find a solution for every concern you may have, you may have the right to lodge a complaint with your competent data protection authority. Contact details of EU Data Protection Authorities can be found here.

6. Data retention and information security

If you suspect someone else is using your account, contact our support team through our Help Center.

If you believe you have discovered a vulnerability, bug, or other general security issue within the Change.org platform, please contact the Change.org Information Security team at security.help@change.org.

We seek to use reasonable organizational, technical, and administrative measures to protect your personal information within our organization from loss, misuse, unauthorized access or disclosure, alteration and/or destruction. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify our Data Protection Team using the contact details listed in our Privacy Policy [1. Key contacts].

We will retain your personal information for as long as needed or permitted in light of the purposes for which it was obtained. The criteria used to determine our retention periods include the length of time we have an ongoing relationship with you and provide our services to you, our legal obligations or whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

7. Cross-border transfers

Change.org is a global organization with offices around the world, so your information may be transferred across borders when you use the platform. We have put in place measures to comply with laws regulating cross-border transfers.

Change.org is a global organization. Your personal information may be stored and processed outside of your place of residence in countries that are subject to different standards of data protection. In particular, you should be aware that your personal information may be shared with, and transferred to, Change.org PBC and affiliates and third-party business partners and service providers.

Some of these recipients may be located in countries outside the EEA and/or the UK for which the European Commission or UK Government (as and where applicable) has not issued adequacy decisions in respect of the level of data protection in such countries (“Restricted Countries”). For example, the United States is a Restricted Country. Where we transfer your personal data to a recipient in a Restricted Country, we will either:

  • enter into appropriate data transfer agreements based on so-called Standard Contractual Clauses approved from time-to-time under GDPR Art. 46 by the European Commission, the UK Information Commissioner’s Office or UK Government (as and where applicable); or
  • rely on other appropriate means permitted by the EU/UK GDPR, which establish that such recipients will provide an adequate level of data protection and that appropriate technical and organizational security measures are in place to protect personal data against accidental or unlawful destruction, loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing.

You may obtain a copy of these measures by contacting our Data Protection Team using the contact details listed in our Privacy Policy [1. Key contacts].

8. Links to other websites

Leaving our platform.

Our platform may contain links to other websites, which may have privacy policies or notices that differ from ours. We are not responsible for the collection, processing, or disclosure of personal information collected through other websites. We are also not responsible for any information or content contained on such websites. Links to other websites are provided solely for convenience. Your usage and browsing on any such website are subject to that website’s own policies; as such, please review the privacy notices posted on those websites. We may provide you with additional or different privacy notices in specific instances which describe how your personal information is collected and used for a specific service.

9. California Consumer Privacy Act

Here we provide information to California residents about our collection, use, disclosure, and other processing of their personal information.

We have worked to ensure our practice is compliant with the requirements of the California Consumer Privacy Act (CCPA). We are committed to being clear with our users about what personal information we collect, how we use it, and their rights relating to accessing or deleting it.

1. Categories and specific pieces of personal information collected about you

The following chart details which categories of personal information we collect and process, as well as which categories of personal information we disclose to third parties for our operational business purposes, including within the 12 months preceding the date this Privacy Policy was last updated.

Categories of personal information Disclosed to Which Categories of third parties for Operational Business Purposes
Identifiers, such as name, alias, postal address, unique personal identifiers, IP address that can reasonably be linked or associated with a particular consumer or household, email address, and account name affiliates; service providers; legal authorities; other parties in litigation
Personal information as defined in the California customer records law, such as name and contact information affiliates; service providers; legal authorities; other parties in litigation
Commercial information, such as transaction information and purchase history affiliates; service providers; legal authorities; other parties in litigation
Internet or network activity information, such as browsing history, search history and interactions with our online properties affiliates; service providers; legal authorities; other parties in litigation
Geolocation data, such as approximate location derived from IP address affiliates; service providers; legal authorities; other parties in litigation
Audio/video data. Audio, electronic, visual, and similar information, such as call and video recordings (for example, for user research purposes) affiliates; service providers; legal authorities; other parties in litigation
Inferences drawn from any of the Personal Information listed above to create a profile about, for example, an individual’s petition preferences affiliates; service providers
Sensitive personal information such as personal information that reveals an individual’s account log-in, or personal information collected from a known child affiliates; service providers

2. Categories of sources from which personal information is collected

Most of the personal information Change.org collects is provided by you when you access and use our service. Additionally, in order to show you local petitions that may be of interest to you, we use the IP service Maxmind to suggest your city from your IP address. For more information, please read the Your City and Your Location section in our Privacy Policy [2. Information we collect].

3. Business or commercial purpose of collecting or selling personal information

Change.org uses your information for our legitimate business interest of providing a petition platform that enables you to connect with issues that are important to you. Our Privacy Policy [3. How we use your information] gives a detailed description of why we collect your information and what we use it for.

4. Sale or sharing of personal information

Change.org does not sell the personal information of any of our users and we do not share or otherwise process personal information for purposes of cross-context behavioral advertising, as defined by the CCPA. We have not sold or shared personal information in the 12 months preceding the date this Privacy Policy was last updated. Without limiting the foregoing, we do not sell or share the personal information of those under 16 years of age unless required by law.

5. Use of Sensitive Personal Information

Subject to your consent where required by applicable law, we may use Sensitive Personal Information for purposes of providing goods or services as requested by you; ensuring security and integrity; short term transient use such as displaying first party, non-personalized advertising, in the form of suggested petitions and campaigns of potential interest; performing services for our business, including maintaining and servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of our business; and activities relating to quality and safety control or product improvement.

6. Individual requests

If you are a California resident you may, subject to applicable law, make the following requests:

  • You may request to know whether we process your personal information, and to access such personal information.
  • You may request that we disclose to you the following information covering the 12 months preceding your request:
    • The categories of personal information we collected about you and the categories of sources from which we collected such personal information;
    • The business or commercial purpose for collecting personal information about you; and
    • The categories of personal information about you that we otherwise disclosed, and the categories of third parties to whom we disclosed such personal information (if applicable).
  • You may request to correct inaccuracies in your personal information.
  • You may request to have personal information you provided to us deleted.
  • You may request to receive a copy of your personal information, including specific pieces of personal information, including, where applicable, request to obtain a copy of your personal information in a portable, readily usable format.
  • You may request to limit the use or disclosure of your Sensitive personal information to what is necessary for us to perform our services and provide goods as requested, as authorized by regulations, or as otherwise permitted under the CCPA.

We will not unlawfully discriminate against you exercising your rights under California law. You can contact us to make one of these requests through our Help Center or by emailing us at dpt@change.org. We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal information subject to the request. In some instances, we may decline to honor your request where the law or right you are invoking does not apply or where an exception applies. We may need to request additional personal information from you, such as a government-issued identification to verify your identity and protect against fraudulent requests. If you maintain a password-protected account with us, we may verify your identity through our existing authentication practices for your account and require you to re-authenticate yourself before disclosing or deleting your personal information. You may make a request on behalf of a child who is under 13 years old if you are the child’s parent or legal guardian. If you make a request to delete, we may ask you to confirm your request before we delete your personal information.

7. Authorized agents

If an agent would like to make a request on your behalf as permitted under the CCPA, the agent may use the submission methods noted in the section entitled “Individual requests.” As part of our verification process, we may request that the agent provide, as applicable, proof concerning his or her status as an authorized agent. In addition, we may require that you verify your identity as described in the section entitled “Individual requests” or confirm that you provided the agent permission to submit the request.

8. De-identified information

Where we maintain or use de-identified data, we will continue to maintain and use the de-identified data only in a de-identified fashion and will not attempt to re-identify the data.

10. CARU COPPA Safe Harbor Program (“CARU COPPA Safe Harbor”)

This Privacy Policy and the CARU icon shown on our website confirm that Change.org is a valid licensee and participating member in the CARU COPPA Safe Harbor Program (“CARU COPPA Safe Harbor”). To protect your privacy, we have voluntarily undertaken this privacy initiative.

Change.org CARU-COPPA confirmation seal

As part of the CARU COPPA Safe Harbor, we are subject to audits and frequent monitoring of our website and other enforcement and accountability mechanisms administered independently by CARU.

If you believe that we have not responded to your inquiry or your inquiry has not been satisfactorily addressed, please contact CARU at:

CARU COPPA Safe Harbor
Attn: Director
1676 International Drive, Suite 550
McLean, VA 22102
InfoCaru@bbbnp.org

PLEASE NOTE: CARU is not a data controller or a data processor for Change.org and cannot process personal information requests made pursuant to CCPA. Please direct your personal information request directly to Change.org, through the email as indicated in our Privacy Policy [9. California Consumer Protection Act].

11. Policy updates

This policy may change over time. If you have any questions, the best way to get in touch with us is through our Help Center.

We may change this Privacy Policy. The “Last updated” date at the top of this Privacy Policy indicates when it was last revised. Any changes will become effective when we post the revised Privacy Policy on our platform.

We welcome questions, concerns, and feedback about this policy. If you have any suggestions for us, let us know through our Help Center or at help@change.org. You can also write to the appropriate contact listed in our Privacy Policy [1. Key contacts].

Thanks for supporting change in your community — we can’t wait to see what you’ll change next!

Written by
jenlee
February 17, 2018 1:09 am