Blackbaud Privacy Shield Certification Notice
Blackbaud’s participation in the Privacy Shield applies to all personal data that is subject to the Privacy Shield Principles and is received from the European Union, European Economic Area, and Switzerland. Blackbaud will comply with the Privacy Shield Principles in respect of such personal data. Blackbaud also maintains an affirmative commitment to the U.S.-Swiss Safe Harbor Framework and its principles, which will not be affected by our participation in the Privacy Shield.
For purposes of this Notice, “Personal Data” means information that (i) is transferred from the EEA and Switzerland to the United States, (ii) is recorded in any form, (iii) is about, or relates to, an identified or identifiable job applicant, consumer, customer, supplier or other individual (excluding Blackbaud employees), and (iv) can be linked to that job applicant, consumer, customer supplier or other individual. This Notice outlines our general policy and practices for implementing the Privacy Shield principles for Personal Data.
Privacy Shield Principles
Blackbaud’s practices regarding the collection, storage, transfer, use and other processing of Personal Data comply with the Privacy Shield principles of notice, choice, onward transfer, access, security, data integrity, and enforcement and oversight.
We notify our job applicants, consumers, customers, suppliers and others located in the EEA and Switzerland about the purposes for which we collect and use Personal Data, the types of third parties to which we disclose the information, the choices job applicants, consumers, customers, suppliers and others have for limiting the use and disclosure of their information, and how to contact us about our practices concerning Personal Data.
When we receive Personal Data from our subsidiaries, affiliates or other entities in the EEA and Switzerland, we will use and disclose such information in accordance with the notices provided by such entities and the choices made by the individuals to whom such Personal Data relates.
Purpose of Collection and Use of Personal Data
Blackbaud collects certain Personal Data such as name, email address, postal address and telephone number. We do not collect sensitive Personal Data of consumers, customers or suppliers, such as information about medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or other sensitive information as defined by the Privacy Shield framework.
We use Personal Data of consumers, customers, suppliers and others (i) to respond to their requests, (ii) to evaluate the quality of our products and services, (iii) to communicate with them about our products, services and related issues, (iv) to notify them of and administer offers, contests, sweepstakes and other promotions, and (v) for internal administrative and analytics purposes, and (vi) to comply with our legal obligations, policies and procedures.
Blackbaud shares Personal Data with its service providers and among Blackbaud’s parent, subsidiaries and affiliates. With respect to Personal Data we share with other third parties, we provide job applicants, consumers, customers, suppliers and others located in the EEA and Switzerland with an opportunity to opt-out of such sharing. Click here if you would like to opt-out. We do not use Personal Data for purposes incompatible with the purposes for which the information was originally collected without notifying the relevant consumers, customers, suppliers and others of such uses and offering an opportunity to opt-out.
In addition, we may disclose Personal Data (i) if we are required to do so by law or legal process, (ii) to law enforcement authorities or other government officials based on an enforceable government request or as may be required under applicable law, or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity.
Onward Transfer of Personal Data
We may share Personal Data with service providers we have retained to perform services on our behalf. We now require service providers to whom we disclose Personal Data and who are not subject to laws based on the European Union Data Protection Directive or the Swiss Federal Act on Data Protection, as applicable, to either (i) subscribe to the Privacy Shield principles or (ii) contractually agree to provide at least the same level of protection for Personal Data as is required by the relevant Privacy Shield principles. If the third party does not comply with its privacy obligations, Blackbaud will take commercially reasonable steps to prevent or stop the use or disclosure of Personal Data. In the context of an onward transfer, Blackbaud has responsibility for the processing of personal information it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf. Blackbaud shall remain liable under the Principles if its agents that it engages to process such personal information do so in a manner inconsistent with the Principles, unless Blackbaud proves that it is not responsible for the event giving rise to the damage.
Access to Personal Data
Blackbaud provides job applicants, consumers, customers, suppliers and others with reasonable access to the Personal Data maintained about them. We also provide a reasonable opportunity to correct, amend or delete that information where it is inaccurate. We may limit or deny access to Personal Data where providing such access is unreasonably burdensome or expensive under the circumstances, or as otherwise permitted by the Privacy Shield principles. To obtain access to Personal Data, job applicants, consumers, customers, suppliers and others may contact Blackbaud as specified in the “How to Contact Us” section of this Policy.
Blackbaud maintains reasonable administrative, technical and physical safeguards to protect Personal Data from loss, misuse and unauthorized access, disclosure, alteration and destruction.
Blackbaud takes reasonable steps to ensure that Personal Data collected by Blackbaud is relevant for the purposes for which it is to be used and that the information is reliable for its intended use and is accurate, complete and current. We depend on our job applicants, consumers, customers, suppliers and others to update or correct their Personal Data whenever necessary.
Your Rights to Access, to Limit Use, and to Limit Disclosure
EU individuals have rights to access personal data about them, and to limit use and disclosure of their personal data. With our Privacy Shield certification, Blackbaud has committed to respect those rights. Because in some circumstances Blackbaud personnel have limited ability to access data our customers submit to our services, if you wish to request access, to limit use, or to limit disclosure, please provide the name of the Blackbaud customer who submitted your data to our services. We will refer your request to that customer, and will support them as needed in responding to your request.
Blackbaud may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Inquiries and Complaints
If you believe Blackbaud maintains your personal data in one of the services within the scope of our Privacy Shield certification, you may direct any inquiries or complaints concerning our Privacy Shield compliance to firstname.lastname@example.org. Blackbaud will respond within 45 days. If we fail to respond within that time, or if our response does not address your concern, you may contact ICDR/AAA (https://www.icdr.org), which provides an independent third-party dispute resolution body based in the United States. The services of ICDR/AAA are provided at no cost to you. If neither Blackbaud nor ICDR/AAA resolves your complaint, you may have the possibility to engage in binding arbitration through the Privacy Shield Panel. Also, Blackbaud’s commitments under the Privacy Shield are subject to the investigatory and enforcement powers of the United States Federal Trade Commission.
With respect to human resources data, Blackbaud will cooperate and comply with the EU DPA’s with respect to human resources data transferred from the EU in the context of the employment relationship. If you do not receive timely acknowledgement of your complaint from Blackbaud, or if we have not addressed your complaint to your satisfaction, you may contact the EU DPA’s for more information or to file a complaint. The services of the EU DPA’s are provided at no cost to you.
How to Contact Us
You may address any questions or concerns regarding our Privacy Shield Policy or our practices concerning Personal Data by:
Contacting us through our website: Click here, or
Attention: Law Department
2000 Daniel Island Drive
Charleston, SC, 29492-7541
The Blackbaud Privacy Shield Notice may be amended from time-to-time in compliance with the requirements of the Privacy Shield principles. Appropriate notice will be given concerning such amendments.
This Privacy Shield Notice is effective as of August 1, 2016.