Privacy Policy
Effective Version — September 18, 2026
Previous Version
In this privacy policy, "Dataro," "we," "us," or "our" means Dataro Ops Pty Ltd (ACN 623 149 173) (Australia), Dataro Limited (UK), and Dataro Inc (USA), and our related bodies corporate.
We are committed to respecting the privacy of your personal information. This Privacy Policy explains how we collect, use, store, and disclose your personal information and how to contact us if you have any queries or wish to make a complaint about personal information we hold about you.
By providing personal information to us, you acknowledge you have read and understand this Privacy Policy and any other agreement or arrangement that applies between us.
This Privacy Policy applies to personal information that we collect or receive through:
our online properties, platforms, and applications (including app.dataro.io and www.dataro.io);
third parties, including our clients and service providers; and
any other means through which we lawfully collect personal information about you (including from publicly available sources).
Where we have collected or received personal information from a third party, such as one of our clients or service providers, we rely on that third party to provide notice to, and obtain individual consents from, the individuals to whom that personal information relates (where required by law).
We have developed and implemented this policy with regard to the requirements of the Privacy Act 1988 (Cth) and the European Union's General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018, and applicable United States privacy laws including the California Consumer Privacy Act (CCPA), where applicable.
We may revise this Privacy Policy from time to time. When we make changes to this Privacy Policy, we will change the date at the beginning of this Privacy Policy. If we make material changes to this Privacy Policy, we will notify you by prominent posting on this website or through other appropriate communication channels. All changes shall be effective from the date of publication unless otherwise provided.
You may contact us with any queries you may have in respect of this Privacy Policy or your personal information by contacting our privacy officer via:
Email: privacy@dataro.io
Mail: The Privacy Officer, Dataro, 535 Mission Street, 14th Floor, San Francisco, California 94105
What Is Personal Information
Throughout this Privacy Policy, we refer to your "personal information," which means information relating to an identified or identifiable natural person, including information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not. Your full name, date of birth, address, telephone number, and email address are examples of information which may constitute personal information. Personal information may also include information we may collect about your individual preferences.
How We Process Data: Dataro as Processor and as Controller
Dataro as Data Processor (Client Donor and Supporter Data)
A significant part of Dataro's business involves processing data, which may include personal information, on behalf of our nonprofit clients. This data typically relates to our clients' donors or prospects. In these circumstances, Dataro acts as a data processor (or "service provider" under applicable US law) and our clients act as the data controller (or "business" under applicable US law) in respect of that personal information. This means that:
We process such data in accordance with the instructions of our clients and the terms of our written agreement with each client, which may include model training. We do not use our clients' donor, supporter, or prospect data for any purpose other than those set out in that agreement;
Our clients are responsible for ensuring that they have a lawful basis for providing donor, supporter, or prospect data to us, for providing any necessary notices to, and obtaining any necessary consents from, the individuals to whom that data relates, and for responding to any requests from those individuals to exercise privacy rights in relation to such data; and
The categories of individuals whose personal information we process as a data processor on behalf of clients (i.e., "data subjects") include: donors, supporters, and prospects of the client; other contacts of the client; and the client's employees and contractors (typically limited to user account information such as name and email address). The categories of personal information we process in this capacity typically include: unique constituent or customer identifiers (such as Constituent IDs); personal details such as name, contact information (including address, email address, and telephone number), age, date of birth, and gender; and information about transactions and communications between the client and the data subject.
If you are a donor, supporter, or prospect of one of our clients and you have questions about how your personal information is used by or on behalf of our clients, or you wish to exercise your privacy rights, you should contact the relevant client organization directly.
Dataro as Data Controller (Employees, Platform Users, Website Visitors and U.S.-Based Prospects)
Dataro also processes personal information for which it is the data controller. This includes personal information collected from:
(a) our employees, contractors and job applicants;
(b) users of our platform and applications; and
(c) visitors to our websites.
Solely in the United States, Dataro may also choose to act as the data controller in relation to prospect data it makes available to its clients in connection with Dataro's ProspectAI offering (see the "Your Privacy Rights" section below for more information).
This Privacy Policy describes how we collect, use, store, and disclose personal information in respect of these categories of individuals. Where Dataro is the data controller, individuals may exercise their privacy rights directly with Dataro as set out in the "Your Privacy Rights" section below.
In Australia, if you are or become an employee, the handling of your personal information may be exempt from the Australian Privacy Principles under the Privacy Act, if it is directly related to your current or former employment relationship with us.
Kinds of Personal Information That We Collect
We collect and hold a range of personal information in carrying out our business and functions as a provider of an AI platform and related services for not-for-profit organizations. The kinds of personal information we collect and hold about you will depend upon the nature of our relationship with you (including whether we are acting as a "processor" or a "controller" as described above), and the circumstances of a collection.
We may collect the following kinds of personal information:
If you are a donor, supporter, or prospect of one of our clients:
your name;
your contact details including your address, email address and telephone number;
your age or date of birth;
your gender;
information regarding your education, qualifications and employment history;
information regarding your associations, affinities, personal interests, and background;
financial information including capacity to give and giving history;
information about your preferences, interests and experiences;
information about your interactions with our client including transaction history, past communications with you, campaigns you supported, and similar; and
insights and other information we generate through data analytics, propensity modeling, or prospect research activities.
If you are an employee, platform user, website visitor, or otherwise engage with us:
your name and contact details;
more detailed contact preferences;
your age or date of birth;
for employees, information regarding your education, qualifications and employment history;
if you have an account with Dataro, your account information including account credentials and login information;
payment or credit card information to facilitate payments to us;
information about your interactions with us and use of our platform;
any other personal information which you provide directly to us or that may be required in order to facilitate your dealings with us.
We may also collect details of the interactions you have with us.
When you use one of our websites, platforms or applications, we may also collect personal information about you in the following general categories:
Usage and preference information: such as the pages you visit, your interactions with such pages, your preferences, and the settings that you choose;
Device and network information: such as the type of device you use, operating system, preferred language, unique device identifier and mobile network; and
Other information: such as your IP address, access dates and times, browser type, pages visited and standard web log information.
We may do this through the use of cookies and other similar automatic data collection technologies that uniquely or probabilistically identify you. This information may be combined with other personal information we collect directly from you or receive from other sources. For more information, please read our Cookie Policy (available at dataro.io).
Children
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal information from children under the age of sixteen (16) years old. If an individual is under the age of 16, they should not use our services or otherwise provide us with any personal information. If a child under the age of 16 has provided personal information to us, we encourage the child's parent or guardian to contact us to request that we remove the personal information from our systems. If we learn that any personal information we collect has been provided by a child under the age of 16, we will promptly delete that personal information.
Sensitive Information
We do not seek to collect sensitive information (or "special categories" of information under the GDPR). If we do collect sensitive information, we will only do so in accordance with applicable law.
Where you or one of our clients provide us with any sensitive information about you (including, but not limited to, information about your sexual orientation, religious beliefs, medical and/or criminal history), we will collect and handle this information for the purposes for which it was shared with us or otherwise in accordance with our legal obligations.
How Dataro Collects and Holds Personal Information
We may process personal information:
collected directly from you, including as a result of you using our products and services;
that has been provided to us by third parties, including our clients who use our products and services (including our machine learning & data analytics products); and
from online and publicly available sources.
We may collect personal information when you:
communicate with us directly through correspondence, chats, email, or otherwise, including sending us inquiries;
sign-up and/or register for any of our products or services including online tools;
subscribe to any newsletters, updates or alerts or request information from us;
submit any forms or applications to us;
participate in any offers, promotions or marketing activities;
interact with or browse our websites, applications, products or services; or
apply for employment with us.
In addition, we may collect your personal information from legitimate third-party sources including online or publicly available sources, social media channels, list brokers and other data providers or organizations that share data in circumstances where it is lawful for them to do so. We may use artificial intelligence services to facilitate the collection of personal information from online or publicly available sources.
We may collect personal information from you in a passive manner including through the use of cookies and other automatic data collection technologies on our website, apps, direct marketing communications and platforms such as Internet tags, tracking pixels, web beacons, and unique device identifiers. Further information about how we collect personal information through the use of these technologies is outlined in the section headed "Our Websites" below and in our Cookie Policy (available at dataro.io).
We may also generate inferences or predictions about you and your interests and preferences based on the other personal information we collect and the interactions we have with you.
Purposes for Which Dataro Collects, Holds, Uses and Discloses Personal Information
We may collect, hold, use and disclose your personal information for the following purposes:
to enable you to access and use our websites, products and services;
to consider and respond to your employment applications;
to operate, protect, improve and optimize our products and services (where permitted by law and under contract), to improve business and user experience, to perform analytics, to conduct research and for advertising and marketing purposes;
to allow us to provide our products and services to our clients;
to maintain our relationship with you and our clients, including responding to inquiries and providing information, products, or services requested by you;
to send you any technical, administrative, or legal notices about our products and services;
to provide you with information about your transactions and use of our content, products, and services;
to provide you with direct marketing materials and other information that may be of interest to you, including information sent by or on behalf of our business partners and clients. Such materials may be provided electronically, including via email;
to show you personalized or targeted advertising on websites and social media platforms;
to respond to inquiries, complaints, and complaints handling;
to improve website and system administration;
to obtain opinions or comments about our or our clients' products and/or services and to conduct other research and development;
to record statistical data for marketing and other analysis;
to detect, prevent, investigate, or provide notice of security incidents or other illegal activity;
to comply with our legal obligations, to defend or establish legal claims, or to cooperate in any law enforcement or regulatory investigation or an investigation on a matter of public safety;
to protect our property and that of our clients, our employees or related bodies corporate, or any member of the public, and/or to protect the integrity of the website or services, to fulfill your requests;
to take part in or be involved with a business transaction or reorganization (such as a merger, acquisition, joint venture, or financing or sale of company assets, as well as in the unlikely event of our bankruptcy, receivership, or insolvency); and
to share personal information with our group companies, promotional partners, and other trusted third parties (including our clients).
We may collect, use, hold and disclose personal information about you for other purposes required or authorized by or under law (including purposes for which you have provided your consent).
For individuals in the United Kingdom or European Union, we rely on the following legal bases to process your personal information for the purposes described above:
our legitimate interests as set out in this Privacy Policy, including provision of our product and services to clients;
your consent, as granted to us and to our clients, for purposes relating to the use of cookies (and other tracking technologies) and direct or targeted advertising;
to comply with EU or UK laws to which we are subject;
to enter into a contract or to perform our contractual obligations to provide you with goods and services (such as for account creation, invoicing and service delivery) and/or employment; and
where the information is relevant to legal action relating to Dataro or the exercise of our legal rights.
Consequences of Not Providing Information
No one is obligated to provide personal information to us. However, failure to do so may result in us being unable to provide you with information, products, or services requested by you or otherwise to provide our products or services.
How We May Share Your Personal Information
For the purposes described above, personal information may be shared with third parties. These third parties include, where appropriate:
our related bodies corporate;
our clients, where that personal information was originally supplied to us by that client, generated by us in the provision of our services for that client, we collected that personal information on their behalf, or that information relates to their relationship with us;
our marketing providers and certain ad networks and advertising partners, where that personal information is relevant and permitted for our marketing practices;
third parties that help us facilitate targeted advertising online and on social media;
our suppliers and service providers who assist us in the delivery of our products and services and who have a need to know;
our professional advisors, business partners and agents who have a need to know; and
specific third parties authorized by you to receive information held by us;
in the case of a sale of our business (in whole or in part) to the purchaser (as an asset of the business);
if you are a job applicant, referees whose details you provide to us;
other third parties and for other purposes where we are required or authorized by or under law to do so (including where you have provided your consent).
Suppliers and service providers may be engaged by us to perform a variety of functions in connection with our business, such as legal and accounting services, data storage, fulfilling orders, conducting market research, processing payments, marketing and email services, and providing technical services for our websites. These companies may have access to personal information if needed to perform such functions.
We recognize the trust with which you provide personal information, and except as stated in this Privacy Policy or as is otherwise lawful, such information will not be used or disclosed for any other purposes without a valid legal basis.
Our Websites, Cookies, and Targeted Advertising
We may collect information that tells us about visitors to our websites and platforms. For example, we may collect information about the date, time and duration of visits and which pages of a website are most commonly accessed.
As you navigate through our websites and platforms, certain information can be collected using various automatic data collection technologies, such as Unique Device Identifiers (UDI), cookies, tracking pixels, tags or web beacons, and navigational data collection (e.g., log files and server logs). In certain circumstances, this information may be considered anonymous information, or it may be considered personal information. This is dependent on the device used and the method by which an individual connects to the website or platform, as well as the specific technology used to collect the information. This information may include the URL of the website you just came from, pages you visit, duration of visit, your IP address, your location, the UDI (if applicable) and the browser version your device is currently using.
You can use the cookie preference manager linked in the footer of our website (under the "Cookie Settings" link) to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
You may also be able to utilize third-party tools and features to restrict our use of automatic data collection technologies. For example, you may be able to set your browser to notify you when a cookie is sent or to refuse cookies altogether, but certain features of a website might not work without cookies and this may limit the services provided by a website. Cookies and other automatic data collection technology methods may involve the transmission of information either directly to us or to another party authorized by us to collect information on our behalf.
Our websites may use and combine such passively collected information and/or information from various third-party sources, including as described above, and may combine this information with other personal information collected from you to provide better service to website visitors and users, customize a website based on your preferences, compile and analyze statistics and trends, provide you with relevant advertising when you visit a website or a third-party website, and otherwise administer and improve our websites and platforms for your use.
Where we engage third parties to help us facilitate (including through tracking pixels and other technologies on our website) targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal information we maintain and personal information our third-party partners obtain from your activity over time and across nonaffiliated websites and services, in addition to taking the steps outlined above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt-out of ads personalization feature). Please refer to your device manufacturer's user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The Digital Advertising Alliance allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at optout.aboutads.info for browser-based advertising and youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance's self-regulatory program.
Network Advertising Initiative: The Network Advertising Initiative also provides individuals instructions for further controlling how information is used for online advertising. Please follow the instructions at thenai.org/how-to-opt-out to exercise these controls.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider's user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties' opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Contacting You
Dataro, our service providers, and/or our clients may contact you, including electronically (such as via email) for the purposes stated above.
We may send advertising and marketing information to you. If you receive communications from us which you do not wish to receive, you may opt out of such communications in the manner indicated in the communication, including by utilizing the opt-out facility or by contacting us at the contact details in this Privacy Policy. The opt-out may take a period of time before taking effect, where permitted by law.
Despite opting out of advertising and marketing communications, we may continue to send you non-commercial communications, such as "Administrative Emails." Administrative Emails relate to user accounts and may include administrative and transaction confirmations, requests and inquiries or information about a particular account.
Your Privacy Rights
Depending on where you are located, you may have rights in respect of your personal information (see below for targeted disclosures based on location). These rights may include:
Transparency: to be informed generally about the collection and use of your personal information, including where we intend to further process your personal information for additional purposes other than as discussed above;
Access & portability: to obtain confirmation of whether we are processing personal information about you, access to and a copy of the personal information we are processing about you (including in a structured, commonly used, and machine-readable format that allows for your transmission of such personal information to another controller without hindrance), and information relating to this processing, including the categories of personal information being processed; the purposes of the processing; the categories of the sources of the personal information; the categories of personal information disclosed to third parties (if any) and the categories of recipients to whom the personal information has been or will be disclosed; the envisaged period for which the personal information will be stored, or the criteria used to determine that period; any automated decision-making or profiling performed in connection with your personal information; and the safeguards relied upon for the transfer of personal information to any third party;
Correction: to request that we correct or update your personal information;
Restriction: to limit the purposes for which we process your personal information, such as where the continued processing of the personal information is no longer justified;
Objection: to object to processing based on our legitimate interests where there are grounds relating to your particular situations;
Opt-out of sales: to direct us not to sell personal information to third parties;
Opt-out of targeted advertising: to direct us not to use or share personal information for certain targeted advertising purposes;
Control over sensitive information: while we do not seek to collect sensitive information (or "special categories" of information under the GDPR), if we do you have the right to exercise control over the collection and processing of such information;
Withdrawing consent: to withdraw your consent for us to use your personal information. Please note that you can also opt out of online marketing communications at any time by using the opt-out feature in each electronic commercial message. Withdrawing your consent will not affect the lawfulness of our use of your personal information before your consent was withdrawn, nor our processing of personal information pursuant to a different lawful basis for processing;
Complaint: to complain about a breach of applicable privacy law or principles, including the Australian Privacy Principles, to us or a supervisory / regulatory authority;
Deletion: you may also request that we delete your personal information (subject to certain exceptions). Deletion of information may result in Dataro and its service providers or partners being unable to facilitate or provide you with information about certain transactions and other products and services. Unless required by applicable law, we are not responsible for removing your personal information from the databases of any third party who has previously been provided your information in accordance with this policy.
We have set out below the rights available in certain jurisdictions where Dataro conducts business. To exercise these rights, please email us at privacy@dataro.io. Please allow for a reasonable amount of time for us to process your request, which will generally be up to 30 days except in the case of specific opt-out rights which are typically handled in a shorter timeframe.
Please note that before processing your request to exercise certain rights (including the rights to access & portability, correction, and deletion), we may need to verify your identity and confirm you are eligible to exercise the applicable right. In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or where you are not eligible for the applicable right.
In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf where we can verify the authorized agent's authority to act on your behalf. In order to verify the authorized agent's authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and where you are located, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.
Where rights are available to you under applicable law, you also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the available rights. However, please note that if the exercise of the rights available to you limits our ability to process personal information, we may no longer be able to engage with you in the same manner. Lastly, if we deny your request, you may be able to appeal the decision we made. All appeal requests should be submitted by replying to the communication resolving your original request.
Australia
This section applies where personal information we hold is governed by the Privacy Act 1988 (Cth).
You have a right to request access to personal information we hold about you and request its correction if it is inaccurate, out of date, incomplete, irrelevant or misleading. You may do so by contacting our Privacy Officer at the details below.
We will respond to all requests for access to or correction of personal information within a reasonable period (usually 30 days). We will generally provide you with access to your personal information (subject to some exceptions permitted by law) but may charge an access fee to cover the cost of retrieving the information and supplying it to you.
In addition to unsubscribing from direct marketing emails or text messages we send you, where we use or disclose personal information about you for our direct marketing, or to facilitate direct marketing by others (such as our clients), you can request not to receive those communications and you can ask us to provide you with the source of the information (unless it is impracticable or unreasonable for us to do so). We won't charge you for this request and we will process it within a reasonable period.
You can contact us (using the contact details at the end of this policy) if you have any concerns or complaints about our handling of your personal information. We will inquire into your complaint and respond within a reasonable period (usually 30 days). If you are not satisfied with our response, you can contact us to discuss your concerns or lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.
Note that Dataro will generally collect and handle personal information on behalf of its clients, for client-held donor, supporter, and prospect data. If your access or correction request, or privacy inquiry or complaint, relates to the handling of personal information by one of our clients, please direct your request or complaint to the relevant client organization.
UK and EU / EEA Residents If you are located in the UK or EU/EEA, you have the following rights under the GDPR or UK GDPR (as applicable), where Dataro is the data controller of your personal information:
Access: to obtain confirmation of whether we are processing personal information about you, access to and a copy of the personal information we are processing about you, and information relating to its processing;
Portability: in certain circumstances, to obtain a copy of the personal information we have collected about you in a structured, commonly used, and machine-readable format, and the right to transmit that personal information to another controller without hindrance;
Rectification: to have inaccurate or incomplete personal information corrected or updated;
Erasure: to request deletion of your personal information subject to certain exceptions;
Restriction: to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you;
Objection: in some cases, to object to processing;
Withdraw consent: to withdraw your previously provided consent to our processing of your personal information. Please note withdrawing your consent will not affect the lawfulness of our use of your personal information before your consent was withdrawn, nor our processing of personal information pursuant to a different lawful basis for processing; and
Complaint: to lodge a complaint with the Information Commissioner's Office (ICO) in the UK, or the relevant supervisory authority in your EU member state.
Note that for donor, supporter, or prospect data held on behalf of our clients as described above, Dataro acts as a processor only and you should contact the relevant client organization to exercise these rights.
US Residents (California and Other States) If you are located in the United States, you may have rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) and other similar state laws, including:
Knowledge: to confirm whether we are processing personal information about you and, for residents of certain states, to obtain certain personalized details about the personal information we have collected about you, including:
The categories of personal information collected;
The categories of sources of the personal information;
The purposes for which the personal information were collected;
The categories of personal information disclosed to third parties (if any), and the categories of recipients to whom this personal information were disclosed (or, in certain states, a list of the specific third parties to whom this personal information was disclosed);
The categories of personal information shared for targeted advertising purposes (if any), and the categories of recipients to whom the personal information were disclosed for these purposes;
The categories of personal information sold (if any) and the categories of third parties to whom the personal information were sold;
Access & portability: to obtain access to the personal information we have collected about you and, where required by law, the right to obtain a copy of the personal information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another entity without hindrance;
Correction: to correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information;
Opt-out of targeted advertising: to direct us not to use or share personal information for certain targeted advertising purposes;
Opt-out of sales: to direct us not to sell personal information to third parties, including the right to opt out of the disclosure of personal information to third parties for the third-parties' direct marketing purposes under California's "Shine the Light" law;
Control over sensitive information: while we do not seek to collect sensitive information, if we do you have the right to exercise control over the collection and processing of such information;
Deletion: you may also request that we delete your personal information.
Note About Personal Information Categories
California law requires we provide disclosures to you about what personal information we collect by reference to the enumerated categories of personal information set forth within California law. To address this obligation, we have identified the relevant enumerated California personal information category for the personal information identified and described in this Privacy Policy below:
Category | Examples |
|---|---|
Identifiers | Full name, alias, account credentials, IP address and other unique personal identifiers |
Customer records | Mailing address, telephone number, email address, date of birth and credit card details |
Protected classification characteristics | Age and gender |
Commercial information | Capacity to give, giving history, and product or service interests and orders |
Internet / network information | Information about your device and network, and information about the way you use our sites and other online platforms and how you otherwise interact with us |
Geolocation data | General geographic location based on IP address |
Professional / employment information | Education, qualification and employment history |
Other personal data | Associations, affinities, personal interests, background, communication preferences and any inquiries, requests, or comments an individual chooses to send us |
Inferences | Deriving your interests and preferences from other personal information we have collected |
Note About Sales and Targeted Advertising
Solely in the United States, Dataro may choose to act as a data controller in relation to prospect data it makes available to its charitable organization / non-profit clients in connection with Dataro's ProspectAI offering. More specifically, ProspectAI is an AI-enabled research service operated by Dataro that helps our clients identify and assess current and prospective donors. The tool leverages third-party AI agents to search, extract, compile, analyze and summarize relevant information to create individual donor profiles, which Dataro's clients use to target donor engagement. The tool is initiated when a client provides the prospective donor's full name, city / town, state / region, and country to facilitate the search, and returns a profile on the relevant individual reflecting biographical information, giving history, contact information, associations, and a series of scores reflecting the individual's fit with the relevant charitable organization / non-profit client.
Typically, Dataro performs this search solely by referencing available resources at the request of its client, returns the results of this search solely to the relevant client making the request, and only handles such data in its capacity as a processor conducting a search on behalf of its client. However, solely in the United States, Dataro may choose to populate a centralized database of individual profiles created using available information, and use this centralized database to facilitate searches and return search results across multiple clients. If Dataro chooses to create this database, Dataro's maintenance of this data as a controller, and its sharing of this data with multiple clients, may be considered a sale of personal information or the sharing of personal information for targeted / cross-contextual advertising under applicable U.S. privacy laws (and may qualify Dataro as a data broker in the future). To opt out of these potential sales or sharing for targeted / cross-contextual advertising purposes, please follow the opt-out instructions provided above.
In addition, as is common practice among companies that operate online, we also allow certain third-party providers to use cookies and other automatic data collection technologies to collect identifiers (such as IP address), internet / network information (such as information about the device you use to access our website and the actions you take on our website), and inferences (such as predictions or assumptions generated from your interactions with our website) directly through our website and other online services for purposes of analyzing and optimizing our services, delivering ads, providing content and ads that are more relevant, measuring statistics and the success of ad campaigns, and detecting and reporting fraud. Some of these practices may constitute the sale of personal information or the use or sharing of personal information for targeted / cross-contextual advertising.
In order to exercise your right to opt out as it relates to the use of cookies and automatic data collection technologies that involve the sale of personal information or the use or sharing of personal information for targeted / cross-contextual advertising, please click the "Cookie Settings" link in the footer of the website and adjust your preferences accordingly. If you are visiting our site with the Global Privacy Control enabled, cookies and automatic data collection technologies that constitute sales or are used for targeted / cross-contextual advertising should already be turned off automatically in our cookie preference manager. Please note this opt-out tool is website, device, and browser specific, so you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting.
Retention, Storage and Security of Personal Information
We retain personal information that we process as a data controller in accordance with the following principles:
Personal information is retained only for the period of time required to fulfill the purpose for which it was collected and processed, or such shorter time as required by applicable law and/or regulatory guidelines.
Retention periods may be extended if so required to enable us to assert or defend our legal rights.
For more information regarding the specific retention periods applicable to your personal information, contact our Privacy Officer at privacy@dataro.io.
We may hold personal information in either electronic or hard copy form. Dataro implements reasonable steps, including physical and electronic security measures, designed to protect personal information we hold from misuse, interference and loss, and from unauthorized access, disclosure, modification or destruction. We also take reasonable steps to keep personal information accurate, up to date, complete, relevant and not misleading. Our employees, data processors and other trusted third parties are obliged to respect the confidentiality of any personal information held by us. However, security of communications cannot be guaranteed, and therefore absolute assurance that information will be secure at all times cannot be given. Dataro will not be held responsible for events arising from unauthorized access to or disclosure of personal information.
Personal information (including employee data, platform user data and website visitor data) may be stored in Australia, the United Kingdom or the United States of America. Database files are encrypted and access is limited to those with a legitimate need. Dataro retains such information only for as long as necessary for the purposes set out in this Privacy Policy or as required by applicable law.
Dataro is a global company and so personal information may be stored and processed in Australia, the United Kingdom, the United States of America or any other country in which Dataro and its agents maintain operations or personnel.
Dataro takes reasonable steps to de-identify or destroy personal information that is no longer needed unless we are required to retain it by applicable law.
Disclosure of Personal Information to Overseas Recipients
In some cases, Dataro may disclose your personal information to overseas recipients in Australia, the United Kingdom, the United States, or other countries where we have operations, including to:
our group companies;
our service providers including cloud hosting providers; and
if our client with whom you have a relationship is based overseas, to that client.
Where personal information is transferred internationally, we ensure appropriate safeguards are in place in accordance with applicable law. For transfers of personal information from the EU or EEA to Australia or the United States of America, we rely on the standard contractual clauses approved by the European Commission. For transfers of personal information from the United Kingdom to Australia or the United States of America, we rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, as applicable. Please contact our Privacy Officer for further information about the safeguards applicable to any particular transfer.
Profiling
As part of our core service to clients, Dataro uses machine learning algorithms and artificial intelligence to analyze donor, supporter, and prospect data on behalf of our clients, acting as a data processor. This analysis constitutes profiling within the meaning of the GDPR and UK GDPR, as well as similar privacy laws (i.e., automated processing of personal data to evaluate certain personal aspects of an individual). Specifically, our models analyze transactional / giving history, communication history, campaign participation, associations and demographic information to generate propensity scores and predictions about the likelihood of individual donors, supporters, or prospects taking certain fundraising-related actions (such as donating in response to a campaign or increasing their giving level). The purpose of this profiling is to help our clients communicate with donors, supporters, and prospects more efficiently and relevantly, in a manner that benefits both the client organization and the individual.
Dataro's models are built from transactional and behavioral data (such as donation history, communication and engagement records, and demographic information such as age and location). Contact details such as full names, postal addresses, email addresses and telephone numbers are never used as inputs to our machine learning models and we never match individuals across different client datasets as part of our modeling processes. Contact details may be held by Dataro for operational purposes (such as delivering platform functionality, supporting fundraising campaign generation by clients, and reporting) but play no role in the profiling analysis itself.
The profiling carried out by Dataro is conducted on behalf of our clients (who are the data controllers in relation to their donor, supporter, and prospect data). However, as described in the Your Privacy Rights section above, solely in the United States, Dataro may choose to act as a data controller in relation to prospect data it makes available to its charitable organization clients in connection with Dataro's ProspectAI offering – specifically by creating a centralized database that Dataro may leverage to facilitate searches for the same individuals by different clients.
If you are a donor, supporter, or prospect of one of our clients and you wish to object to or opt out of this profiling, please contact the relevant client organization directly. You may also contact us at the details below and we will direct your request appropriately or handle your request directly in accordance with law. Where the right to object to profiling applies under applicable law (including under the GDPR or UK GDPR), we and/or your client organization will assess and give effect to any valid objection.
Links to Other Websites
Our websites, platforms and plugins may, from time to time, contain links to or integrate with the websites or platforms of other organizations. Such links or integrations cannot be taken to imply any endorsement or validation by us of the content of the third-party website or platform. Linked websites and platforms are responsible for their own privacy practices and you should check those websites and platforms for their respective privacy statements, as this Privacy Policy does not apply to any privacy practices of such third parties. Dataro is not responsible, nor does it accept any liability, for the conduct of companies linked to or integrated with our website, platforms, or plugins.
Related Websites
All websites and platforms operated by us will adhere to this Privacy Policy. The policies on the websites of some members of our group may vary, however, because of local customs, practices, or laws.
Problems, Complaints and Queries
If you have any questions about our Privacy Policy, or any problems or complaints about how we have collected, used, stored, handled and/or disclosed your personal information, please contact our privacy officer via:
Email: privacy@dataro.io
Mail: The Privacy Officer, Dataro, 535 Mission Street, 14th Floor, San Francisco, California 94105
Please include your name, email address and/or telephone number and clearly describe your complaint.
