Introduction and Commitment to Privacy

LAKE ROADS WILDLIFE REHAB (LRWR) is a non-profit organization dedicated to the rehabilitation of injured and orphaned native wildlife, public education, and conservation. In the pursuit of our critical mission, we interact with thousands of community members, donors, volunteers, and partners annually. We recognize that the trust placed in us—both by those who entrust animals to our care and those who support us financially—requires the highest level of responsibility and transparency regarding personal information. This Comprehensive Privacy Policy outlines in extensive detail how LRWR collects, utilizes, discloses, retains, and protects the personal data we receive across all operational facets, including emergency services, educational outreach, fundraising, and digital engagement. We are committed to processing all personal data lawfully, fairly, and transparently, adhering strictly to applicable US state and federal regulations concerning non-profit organizations and data security. By interacting with LRWR through our website, via phone, or in person, you acknowledge and agree to the practices described in this policy.

1. Data Controller Identification and Scope

Data Controller: LAKE ROADS WILDLIFE REHAB Address: 7180 NORTH CHASES LAKE ROAD, GLENFIELD, NY 13343 Email: info@lrwlr.site

This policy applies to all personal information collected or processed by LRWR through various channels, including, but not limited to, our emergency hotlines, official websites, social media platforms, physical forms used for intake or volunteering, and during educational or fundraising events. Personal information is defined as any data that can directly or indirectly identify an individual, such as a name, address, email, phone number, financial information, or emergency reporting details. The scope of this policy is intended to be exhaustive, covering both digital and physical data collection practices within the boundaries of our rehabilitation and conservation work. We ensure that our staff and volunteer network are trained in these protocols to guarantee consistent application of our commitment to your privacy.

2. Data Collection: The Four Primary Categories and Purposes

LRWR collects personal information only when strictly necessary and relevant to fulfilling our charitable mission, providing emergency services, or complying with legal and regulatory obligations. The necessity and purpose are rigorously evaluated for each data point collected. We categorize the data we collect into four primary areas, each with specific collection mechanisms and legal bases for processing.

I. Direct Engagement and Stewardship Data

This category encompasses information provided to us directly by individuals engaging in our fundraising, communication, or general information services.

Type of Data	Source of Collection	Purpose of Processing	Legal Basis
Contact Information (Name, Address, Phone, Email)	Donation forms, Mailing list sign-ups, General inquiries via info@lrwlr.site	Donor receipting, Acknowledgment of support, Sending newsletters and educational updates, Responding to general questions.	Consent (for marketing/newsletter), Legitimate Interest (donor stewardship, receipting), Contractual Necessity (event registration).
Financial/Transaction Data (Card type, Amount, Transaction ID)	Third-party payment processors (e.g., PayPal, credit card systems), Direct bank transfers	Processing and confirming donations, Issuing official tax receipts required by the IRS for 501(c)(3) status, Analyzing fundraising performance.	Contractual Necessity (processing payment), Legal Obligation (tax reporting).
Preferences & History (Communication preferences, Donation history, Event attendance)	Internal CRM system, Event registration forms	Personalizing communications, Tailoring outreach efforts, Recognizing dedicated donors and partners, Identifying appropriate funding opportunities.	Legitimate Interest (improving donor relations and operational efficiency).

Retention: Financial and donor history necessary for tax compliance (e.g., transaction records, receipts) is retained for a minimum of seven (7) years as required by U.S. law. Non-financial communication preferences are retained until the user explicitly requests removal or unsubscribes.

II. Operational and Rescue Data

This highly sensitive category is essential for the immediate execution of our core mission: saving and rehabilitating injured wildlife. Data collection is governed by urgency and regulatory reporting needs.

Type of Data	Source of Collection	Purpose of Processing	Legal Basis
Finder Information (Name, Phone number, Email, Home address/Emergency location)	Emergency Hotline calls, Dedicated Intake Email reports (info@lrwlr.site)	Coordinating immediate rescue, Dispatching transport volunteers, Follow-up for patient status or location clarification, Mandatory reporting to state/federal agencies (DEC, USFWS) regarding protected species intake location.	Legitimate Interest (lifesaving intervention), Legal Obligation (regulatory reporting).
Patient Progress Tracking (Patient ID, Species, Injury cause, Release location, Post-release sighting data)	Internal patient records (EHR), Citizen science sighting reports	Monitoring patient recovery and success, Validating and improving rehabilitation protocols, Contributing to regional wildlife health research, Providing patient updates to finders (with strict privacy controls).	Legitimate Interest (scientific research and mission optimization), Legal Obligation (tracking compliance).

Retention: Operational and rescue data, particularly that tied to legally required species reporting and patient outcome tracking, is retained indefinitely or for the duration mandated by the relevant regulatory bodies to maintain historical records and contribute to long-term conservation databases. Finder contact information is retained for up to three (3) years after the case is closed, unless the finder opts into general communications.

III. Volunteer and Personnel Data

Information collected from individuals seeking to formally engage with LRWR in a capacity that involves direct interaction with animals, finances, or children (educational programs).

Type of Data	Source of Collection	Purpose of Processing	Legal Basis
Application Data (Resume/CV, Professional references, Emergency contact details, Background check results)	Volunteer applications, Employment forms, Internship agreements	Assessing suitability for roles, Vetting for safety and ethical compliance (especially for roles handling protected species or engaging with the public), Emergency notification.	Contractual Necessity (managing the volunteer/employment relationship), Legal Obligation (state/federal background checks).
Training & Compliance Records (Certifications, Training completion dates, Licensing details)	Internal compliance system, Training log sheets	Ensuring compliance with state/federal licensing requirements (e.g., licensed rehabilitator status), Maintaining a record of required professional development, Assigning appropriate tasks.	Legal Obligation (licensing and regulation), Legitimate Interest (operational safety and quality control).

Retention: Volunteer and personnel data is retained for the duration of the individual’s active engagement and for a statutory period (typically up to seven years) following the conclusion of their service for liability, reference, and auditing purposes. Background check records are handled with heightened security and destroyed promptly after the statutory retention period.

IV. Digital and Analytical Data (Automated Collection)

Data collected automatically when you interact with our digital platforms, including the LRWR website and social media channels.

Type of Data	Source of Collection	Purpose of Processing	Legal Basis
Usage Data (IP address, Browser type, Operating System, Referring/Exit Pages, Visit duration)	Website hosting logs, Google Analytics, Server-side tracking	Analyzing website traffic and performance, Improving user experience and site functionality, Diagnosing technical issues and security threats, Understanding geographical interest in our mission.	Consent (via cookie banner), Legitimate Interest (website security and performance optimization).
Cookie Data (Tracking pixel data, Session IDs, Behavioral data)	Cookies and similar tracking technologies (pixels, beacons)	Personalizing website content, Remembering user preferences (e.g., language selection), Measuring the effectiveness of fundraising appeals, Facilitating payment processing security.	Consent (via cookie banner).

Retention: Usage data, when anonymized, may be retained indefinitely for trend analysis. Detailed cookie data is typically retained for periods ranging from 30 days to 1 year, depending on the cookie type and purpose, subject to user consent preferences.

3. Data Sharing and Disclosure Protocols

LRWR is fundamentally opposed to selling, renting, or leasing your personal information to third parties for commercial purposes. Data is only shared under strictly controlled circumstances, either when legally mandated, necessary for core operations, or with your explicit consent.

A. Legal and Regulatory Disclosure (Mandatory)

We may disclose certain personal data when required to do so by law or in the good faith belief that such action is necessary to:

• Comply with Government Agencies: We are legally obligated to report all wildlife intake incidents, particularly those involving federally protected species (e.g., Bald Eagles, migratory birds) and state-protected species, to the New York State Department of Environmental Conservation (DEC) and the U.S. Fish and Wildlife Service (USFWS). This reporting often includes the location of the rescue and, in some cases, the finder’s contact details, which are used by the agencies for record-keeping and population health monitoring.
• Enforce Compliance: We may share data to protect and defend the rights or property of LRWR, including the enforcement of our terms of use or to investigate potential breaches.
• Prevent Harm: We may disclose information if required to protect the personal safety of LRWR users, employees, the public, or our patients in an emergency, or to prevent a crime.

B. Third-Party Service Providers (Operational Necessity)

We utilize trusted third-party service providers to perform functions on our behalf, and these entities are only provided with the minimum personal information necessary to deliver the specific service. All providers are subject to strict non-disclosure agreements and are prohibited from using your personal data for their own purposes. These services include:

• Payment Processors: Handling secure, encrypted processing of all financial transactions (donations). We never store sensitive credit card data directly on our servers.
• Email Marketing Platforms: Managing our donor stewardship communications and educational e-newsletters, ensuring compliance with anti-spam regulations (CAN-SPAM Act).
• Cloud Hosting and IT Support: Storing our secure patient records, donor management systems (CRM), and website data.
• Professional Services: Accountants for auditing and tax preparation, or lawyers for legal counsel, who require access to financial or personnel records.

C. Partnerships and Citizen Science (Controlled Disclosure)

When participating in collaborative research or public health initiatives with universities or conservation partners, all data shared is first anonymized or aggregated wherever possible. Personal identifiers (names, addresses) are stripped from ecological data (e.g., post-release sightings, population health observations) before sharing, ensuring that the valuable scientific contribution does not compromise individual privacy. If a specific research project requires the sharing of identifiable information, we will obtain explicit, documented consent from the individuals concerned prior to disclosure.

4. Data Security and Protection Measures

The security of your personal information is a core priority for LRWR, reflecting our commitment to integrity. We implement rigorous, multi-layered security measures to protect against unauthorized access, alteration, disclosure, or destruction of data, encompassing physical, technical, and administrative safeguards.

Technical and Digital Security

• Encryption: Our website utilizes Secure Socket Layer (SSL) technology for data transmission, encrypting all communication between your browser and our servers. All sensitive operational and financial data stored in our databases is protected with industry-standard encryption protocols.
• Access Control: Access to sensitive internal systems (patient records, donor CRM, volunteer vetting databases) is restricted via multi-factor authentication, strong password requirements, and granted strictly on a “need-to-know” basis, tied to an individual’s role and responsibilities.
• Network Security: We employ firewalls, intrusion detection systems, and regular vulnerability scanning to monitor and protect our internal networks from external threats.

Physical and Administrative Security

• Physical Security: The LRWR facility houses physical records related to patient intake, finance, and personnel. These records are stored in locked, secure areas with restricted key card access, adhering to the same high security standards as our rehabilitation areas, preventing both unauthorized viewing and biosecurity risks.
• Staff Training: All LRWR employees and core volunteers receive mandatory privacy and security training upon onboarding and annually thereafter, covering data handling best practices, recognizing phishing attempts, and the absolute necessity of maintaining patient and donor confidentiality.
• Incident Response: We maintain a formal data breach response plan to ensure that in the unlikely event of a security incident, we can promptly identify, contain, assess, and notify affected parties and regulatory bodies in accordance with legal timelines.

5. Your Data Rights

LRWR respects your control over your personal data. Depending on your location and the data collected, you may be entitled to exercise certain rights regarding the processing of your information. To exercise any of these rights, please submit a formal request to our designated contact email: info@lrwlr.site, using the subject line “DATA RIGHTS REQUEST.” We commit to responding to all legitimate requests within thirty (30) days.

1. Right of Access (The Right to Know): You have the right to request confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and the legal basis for that processing.
2. Right to Rectification (Correction): You have the right to request the correction of inaccurate or incomplete personal data we hold about you (e.g., an outdated mailing address or incorrect spelling of your name).
3. Right to Erasure (The Right to be Forgotten): You have the right to request the deletion or removal of your personal data where there is no compelling reason for its continued processing. Please note that we are legally required to retain certain financial and rescue reporting data, and this right is subject to overriding legal or regulatory obligations.
4. Right to Restrict Processing: You have the right to request that we cease processing your data for certain purposes, such as limiting the types of communications you receive or restricting processing while a data accuracy dispute is resolved.
5. Right to Object: You have the right to object to the processing of your personal data where we are relying on a legitimate interest as the legal basis (e.g., objecting to fundraising communications based on donor history analysis).
6. Right to Data Portability: Where technically feasible and when processing is based on consent or contract, you have the right to request a copy of your personal data in a structured, commonly used, and machine-readable format.
7. Right to Withdraw Consent: Where processing is based on your consent (e.g., subscribing to a newsletter), you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6. Cookies and Tracking Technologies Policy

Our website utilizes cookies and similar tracking technologies to enhance user experience, analyze site performance, and support our fundraising efforts. Cookies are small text files placed on your device by websites that you visit.

Types of Cookies Used

1. Strictly Necessary Cookies: Essential for the basic functioning of the website (e.g., securing payment pages, managing session information). These cannot be disabled.
2. Performance/Analytical Cookies: Used to collect anonymous, aggregated data on how visitors use our website (e.g., which pages are most popular, time spent on site). This helps us improve website design and content to better serve our mission.
3. Functionality Cookies: Used to remember choices you make (such as language or region) and provide enhanced, more personal features.
4. Targeting/Advertising Cookies: Used to track user activity across different websites to display relevant conservation or fundraising appeals. LRWR strives to minimize the use of these cookies and ensures they comply with our non-commercial commitment.

Managing Your Cookie Preferences

Upon your first visit to our website, you will be presented with a clear and functional cookie consent banner. This banner allows you to accept all cookies, reject non-essential cookies, or manage your preferences individually. You can modify your consent settings at any time via a link prominently displayed in the website footer. Furthermore, you have the ability to accept or decline cookies by modifying the settings in your web browser. Please note that disabling strictly necessary cookies may prevent the proper functioning of secure donation pages or other essential site features.

7. Children’s Privacy (COPPA Compliance)

LAKE ROADS WILDLIFE REHAB is deeply committed to youth education. We do not knowingly collect personal information online from children under the age of 13 without verifiable parental consent, in compliance with the Children’s Online Privacy Protection Act (COPPA). Our online educational resources and general website content are not directed at children under 13.

If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will promptly take steps to delete that information from our servers and contact the parent or guardian for clarification or removal. We instruct all parents and legal guardians to monitor their children’s Internet usage and to help enforce this policy by instructing their children never to provide personal information without permission. Our educational program bookings, while intended for youth audiences (schools, scout groups), require that all bookings and communications be handled by an adult representative (teacher, group leader, parent).

8. Changes to This Privacy Policy

LRWR reserves the right to update or modify this Comprehensive Privacy Policy at any time to reflect changes in our operational practices, regulatory requirements, or technological advancements. When we make material changes to the policy, we will revise the “Effective Date” at the top of this page. For significant changes, we will provide a prominent notice on our website homepage and, where appropriate, notify registered users directly via email prior to the change becoming effective. We encourage you to review this policy periodically to stay informed about how we are protecting your information and fulfilling our privacy commitments.

9. Contact for Privacy Concerns and Data Requests

If you have any questions or concerns regarding this Comprehensive Privacy Policy, the data we hold about you, or if you wish to exercise any of your data rights, please contact our dedicated Privacy Compliance Team using the information below. We are committed to addressing all inquiries with the utmost seriousness and diligence.

Designated Privacy Compliance Contact: LAKE ROADS WILDLIFE REHAB 7180 NORTH CHASES LAKE ROAD, GLENFIELD, NY 13343 Email: info@lrwlr.site Subject Line: DATA RIGHTS REQUEST or PRIVACY INQUIRY

If you are not satisfied with our response to a privacy inquiry or believe that we have not complied with applicable data protection laws, you may have the right to lodge a complaint with your local data protection authority. We encourage you to contact us first so that we may attempt to resolve your concern directly and efficiently.