Welcome to Warmshowers.org (“we,” “us,” or “our”), the web home of the Warmshowers.org Foundation. The Warmshowers.org Foundation is a non-profit organization registered in Colorado, USA. We are committed to protecting the privacy and personal data of our worldwide users and visitors. This Privacy Policy outlines how we process and protect personal data in accordance with applicable laws, including the General Data Protection Regulation (GDPR), and the laws of our home state of Colorado.

Within the context of the Warmshowers.org website and mobile app (“Service” or “Services”), this notice explains how we use and disclose data that is linked or reasonably linkable to an identified or identifiable individual (“personal data”). It also discusses your rights relating to your personal data. We will update this notice from time to time, or as our privacy practices change, to ensure it accurately describes how we use your information. When we do so, we will update the date above. We recommend that you review this notice from time to time for the latest information.

If you have any questions regarding this notice or our use of your information, please contact us using one of the methods detailed below.

1. How we process personal data

We process personal data as described below:

All Service users

• Categories of personal data: Activity information, such as IP address, browser type and version, operating system, date and time of visit, addresses of pages visited, and time spent on pages
• Purposes: To provide the Service; Service analysis and administration, including monitoring the security of the Service, determining Service effectiveness, and to further improve the Service
• Methods of collection: Indirectly by monitoring your activities or behavior
• Categories of third-party recipients: None
• Lawful bases for processing: Our legitimate interests

Service users who establish online accounts by joining as members

• Categories of personal data: Name and contact information, such as email address, postal address, telephone number, username, password, date of birth, and gender; User status and history; Communication preferences and records of communications; Precise location
• Purposes: To provide reciprocal hospitality opportunities; To process applications and renewals; To manage members’ accounts; To communicate with you according to your preferences; To facilitate communication between members; To administer and secure your online account and content restricted to members; To verify your age
• Methods of collection: Directly from you
• Categories of third-party recipients: Other members (however, other members are restricted from seeing your email address)
• Lawful bases for processing: Our legitimate interests; To comply with legal obligations

Service users who send messages to other users via the Services

• Categories of personal data: Identity of sender and recipient; Contents of messages
• Purposes: To facilitate communication between members
• Methods of collection: Directly from you
• Categories of third-party recipients: Other members
• Lawful bases for processing: Contract; Consent

Service users who make payments or donations

• Categories of personal data: Payment card information and billing address
• Purposes: To process the payment or donation
• Methods of collection: Directly from you
• Categories of third-party recipients: Our payment processor
• Lawful bases for processing: Contract; Our legitimate interests; To comply with legal obligations

2. How we share your personal data

In addition to the sharing with the third parties described in the table above, we may also share your information with:

• Service providers. We share your personal data with third parties that provide services to us. (These third parties are often referred to in privacy laws as processors.) We engage these kinds of third parties with contracts that require them to use your personal data only for the purpose of delivering the services for which we have engaged the third-party and as required by law. These kinds of third parties provide business, professional, administrative, or technical support functions for us, such as data storage, legal counsel, quality assurance, and marketing.
• Legal compliance recipients. We disclose personal data to the courts, the government, law enforcement agencies, litigants, and similar recipients when required by law, when needed to protect us from legal claims, or when relevant to our own legal claims.
• Successors. We may disclose personal data associated with a part of our organization to a buyer, potential buyer, or other successor to our organization.

We also may disclose personal data with third parties with your consent or at your direction.

3. Children’s privacy

We are very concerned about the safety of children using the Internet. Our Services are not directed to children and our Terms of Use do not allow children to use our Services. Accordingly, we do not knowingly collect any personal data from children. If we discover (or are informed) that we have collected personal data from a child, we will promptly delete such information.

4. Data retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable laws and regulations. When your personal data is no longer needed, we will securely delete or anonymize it.

5. Data sharing and disclosure

We do not sell, trade, or otherwise transfer your personal data to third parties for their marketing purposes. However, we may share your personal data with:

• Service Providers: We may engage third-party service providers to assist us in operating our website, conducting our business, and providing services to you. These service providers are bound by contractual obligations to handle your personal data securely and only for the purposes specified by us.
• Legal and Regulatory Authorities: We may disclose your personal data to comply with legal obligations, court orders, or government requests.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred as part of the transaction.

6. International data transfers

If you use our Services, we will process your personal data in the United States. Where required by law, we ensure your data remains protected in connection with any international transfers.

7. Your privacy rights

Depending on the jurisdiction in which you live, you may have certain rights regarding your personal data under the law. To request to exercise your rights, please submit a request by contacting us through any of the means outlined below.

For users in the European Economic Area or the United Kingdom

If you live in the European Economic Area or the United Kingdom, you may have the following rights regarding your personal data:

• Access/Data Export. You may have a right to access the personal data we process and to request it in a common portable format of our choice.
• Rectification. You may request that we correct any personal data that you believe is inaccurate.
• Deletion. You may request that we delete your personal data. We may delete your data entirely, or we may anonymize or aggregate your information such that it no longer reasonably identifies you.
• Restriction of Further Processing. You may request that we restrict the processing of personal data under certain circumstances. For example, you may make this request if you withdraw consent you gave us previously and we have no other legal basis for us to retain your personal data it, or where you object to our use of your personal data for particular legitimate business interests.
• Objection. You may have the right under applicable law to object to any processing of personal data based on our legitimate interests. We may not be required to cease or limit processing based solely on that objection, and we may continue processing where our interests in processing are appropriately balanced against individuals’ privacy interests. In addition to the general objection right, you may have the right to object to processing: for profiling purposes; for direct marketing purposes (we will cease processing upon your objection); and involving automated decision making with legal or similarly significant effects (if any).

For users in Australia or New Zealand

You have certain rights regarding your personal information under the law. To exercise your rights, please submit a request by contacting us through any of the means outlined below.

Your rights may include the following:

• the right to access your personal information in a reasonable and practicable way;
• the right to the correction of error or incompleteness in your personal information (and to have us provide notice of such correction to any third parties to which we have disclosed your personal information); and
• the right to attach a statement to your personal information if we decline to make a correction you request.

Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. We will verify that any requests from persons other than you have your legal authorization. If there will be a cost associated with your request, we will make every effort to minimize such cost and contact you to confirm that you wish to proceed with your request.

Your request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

You may also appeal the decision we make on your request by using the contact information below. If you contact us to appeal, please tell us why you believe we erred in responding to your request. We will respond to your appeal in accord with the timelines set forth in applicable law.

For users in the United States and Other jurisdictions

If you live in the United States or another jurisdiction not mentioned above, your rights may include the following:

• The right to opt-out of the use of personal data for targeted advertising, personal data sales, or profiling resulting in significant consequences
• The right to confirm whether we process your personal data and to access a copy (from which we may, for security purposes, exclude certain personal data), including a copy that is in a portable data format
• The right to the correction of inaccurate personal data
• The right to the deletion of your personal data

Although some jurisdictions provide individuals with rights to opt-out of the use of personal data for targeted advertising, the sale of personal data, or profiling resulting in significant consequences or the right to opt out of the processing of sensitive personal data, we do not engage in any of those practices. Accordingly, there is no need to contact us to request to exercise those rights.

Only you, or someone legally authorized to act on your behalf, may make a request related to your personal data. Depending on the nature of your request, we may need to request information to verify your identity for your protection. We will verify that any requests from persons other than you have your legal authorization. You may also make a request on behalf of your child.

Your request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal data or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Depending on the jurisdiction in which you live, you may have the right to appeal any decision we make in response to your request to exercise any of your other rights. You may make such an appeal by contacting us using any of the methods set forth below. In your contact, please tell us why you believe we erred in responding to your request. We will respond to your appeal in accord with the timelines set forth in applicable law.

8. Personal data security

We use reasonable administrative, technical, and physical safeguards to protect personal data in our possession. While we make every effort to help ensure the integrity and security of our network and systems, you should understand that no data storage system or transmission of data over the Internet or any other public network can be guaranteed to be completely secure, accurate, complete, or current. We cannot fully eliminate the risk of technical failure, security breaches, unauthorized access, unauthorized disclosure, theft, misuse or loss of information.

9. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please get in touch with us at:

Warmshowers.org Foundation
3980 N. Broadway
Suite 103, PMB 187
Boulder, CO 80304