1. Categories of Personal Information We Collect:

The American Red Cross collects and stewards your personal information through a variety of channels, including as information you provide to us, information we automatically collect through our systems, and information we receive from others. The categories of personal information we collect through any of those channels may include any of the following:

• Personal or individual identifiers - First, middle, and last name, DBA or other alias, postal address, email address, phone numbers, Social Security number or other tax identification number, passport number, demographic information, driver's license number, military identification number, bank account number, credit card number, debit card number, signature, internet protocol address, account registration data (e.g., account username and password and associated information), and professional/employment-related information.

• Commercial or financial data - Deposit and credit account numbers, assets and liabilities, sources of income, products or services purchased, obtained, or considered, records of transactions (including records of interactions, such as purchase and donation history), other purchasing or consuming histories or tendencies, records of real property and personal property; other financial information such as assets and liabilities, financial statements, tax returns, other sources of income, and insurance policy numbers.

• Health data. We may seek information about your health when you donate blood (including blood type, donor eligibility screening responses, health history, and biometric data), when you receive disaster-related health services, when you enroll in or complete training courses that require health-related disclosures, or when you avail yourself of other Red Cross services that relate to promoting health.

• Internet or other electronic network activity - Information regarding how you interact with ARC’s internet websites (including, potentially, browsing history), applications, advertisements, devices and device identifiers, networks and other digital resources, information about your device and device usage while using our mobile apps, IP address or information that could be derived from it, and/or preferences you may have for how we communicate with you. ARC and authorized third parties may utilize technologies to automatically receive and record information when you interact with us online on our websites and/or through other digital technologies, such as email platforms, mobile applications, or over the phone. These technologies allow ARC to improve our digital services, create a better experience for our users, and protect against fraud.

• Audio or visual data. We may collect your image or voice, which may be captured when you attend an in-person or virtual event or activity, or leave us a voicemail.

• Geolocation data - If you provide express consent or enable location services on our mobile applications.

• Inferences Drawn from Any of the Foregoing - Certain inferences concerning an individual’s preferences and characteristics.

• Sensitive Data - Some of the categories above may include "sensitive data" as defined by the OCPA, including personal information revealing racial or ethnic background, national origin, religious beliefs, mental or physical health condition or diagnosis (including blood donor screening information), sexual orientation, status as transgender or nonbinary, status as a victim of crime, citizenship or immigration status, genetic or biometric data, precise geolocation data, and personal information of a child known to be under 13. The Red Cross processes sensitive data only with your consent, where consent is required by the OCPA, except where an applicable exception under the Oregon Consumer Privacy Act applies or as otherwise required by law.

2. Purposes of Personal Information Collection:

ARC collects your personal information to further our mission, and we aim to use only the information that is specific and necessary. Whenever we process, use, or share that information, we apply appropriate confidentiality and security requirements. When we collect personal information, we may use any of the categories of personal information we have collected for a range of legitimate business purposes, which will vary depending on the nature of your interaction with the American Red Cross. The American Red Cross may collect personal information for any of the following purposes:

• to communicate with you;

• to verify your identity;

• provide and manage donations or requests you have made;

• to process and complete transactions;

• to provide a secure and optimized experience engaging with our Sites and other Digital Services to improve our website and mobile applications, understand user preferences, and tailor our services to better meet the needs of our community

• to provide requested services, notifications, or informational resources.

• further ARC’s charitable, redevelopment and philanthropic efforts;

• protect against fraud, harm, or illegal activities, and manage risk;

• respond to an emergency which we believe reasonably requires us to disclose information to assist in preventing death or serious bodily injury;

• determine suitability of ARC offerings for you;

• better manage your relationship with us;

• comply with legal or regulatory requirements, or as otherwise permitted by law;

• communicate with you regarding ARC-related information and opportunities that may be of interest;

• better understand your needs as a financial donor, and better develop and tailor opportunities and communications to you; and/or

• respond to any questions you may have.

• If a new purpose for using your personal information develops that is unrelated or materially different from these purposes, we will identify that purpose.

3. With Whom and How We Share Your Information:

While we do not sell your personal information, we may share personal information with your consent, when you direct us to share it with others, as necessary to complete your transactions, or to provide the information and/or services you have requested or authorized. For example, when you provide credit card information to make a donation, we will share that data with payment card processors and other entities as necessary for the processing of your payment and to prevent or detect fraud. We also may share personal information with the other types of other parties as follows - the categories of personal information described in Section 1 may be disclosed to the categories of third parties described in this Section 3, depending on the nature of your interaction with the American Red Cross and the purposes described in Section 2:

• Service Providers - We may share personal information with service providers for a variety of reasons, such as to facilitate the operation of our Digital Services; support our fundraising, marketing, communications, and advocacy programs; better and more effectively and efficiently manage our information ecosystem; and deliver messages to you on other platforms. We require service providers and to agree to take reasonable security measures in the handling and storage of that information. When we share personal information about you with a service provider, we take steps to: (1) transmit it in a secure manner and (2) require the service provider to promise to keep that information confidential and use it only for the purpose of carrying out the activities we have directed them to perform.

• Affiliates and Business Partners - In certain cases, we may disclose personal information to affiliates or business partners in the normal course of business and/or to maintain, operate, or enhance our and/or our business partner’s operations. For example, we may share personal 

  information with another nonprofit organization with whom we are co-hosting an event or working as part of a broader coalition to advance ARC’s mission and goals.

• Third-Party Promotional Activities - We may share your personal information with third parties to serve targeted promotions or efforts at engagement and outreach to specific individuals, including you, or to display ads to people who are similar to specific individuals who have engaged with the American Red Cross. As a result, we may display targeted information, promotions, and other engagement or outreach materials to you outside the Digital Services, including on third-party websites, and social media sites, such as Facebook and Instagram, to fundraise and build support for our mission. These practices help us engage in effective fundraising, maintain and support our operations, and enable our teams to communicate more effectively with known and prospective supporters. If we share personal information shared with third parties, we take measures to protect your privacy, and only share personal information with third parties that agree to hold personal information confidentially and securely and promise not to use personal information for other purposes.

• As Required by Law - We may share personal information when required by law or necessary to protect the American Red Cross or others, such as in the following circumstances:

  • Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies;

  • Conduct litigation, including by disclosing information to counsel or other parties involved in the litigation process of claims by or against the American Red Cross;

  • In the event of exigent circumstances, to help prevent the loss of life or serious injury or to protect the personal safety of American Red Cross personnel, users of our Digital Services, our visitors, or the public;

  • Detect, investigate, prevent or otherwise address fraud or privacy issues;

  • Operate and maintain the security of our services, including to detect, investigate, prevent, stop, or remediate an attack on our computer systems or networks; or

  • Protect the rights or property of ourselves, or others, including by enforcing our agreements, terms, and policies.

4. Your Rights Under the Oregon Consumer Privacy Act:

If you are an Oregon resident, you have the following rights regarding your personal information:

• The right to confirm whether the Red Cross is processing your personal information, and to access categories of personal information we have collected.

• The right to obtain a list of specific third parties — other than natural persons — to which the Red Cross has disclosed your personal information. At your option, you may request the list either as it pertains to your specific personal information or as it pertains to personal information generally.

• The right to correct inaccurate personal information concerning you.

• The right to delete personal information about you, including personal information you provided to us, personal information we obtained from other sources, and personal information derived about you.

• The right to obtain a portable copy of your personal information in a portable and, to the extent technically feasible, readily usable format.

• The right to opt out of the processing of your personal information for purposes of (a) targeted advertising, (b) the sale of personal information, or (c) profiling in furtherance of decisions that produce legal effects or effects of similar significance. The Red Cross does not sell your personal information and does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects.

• The right to non-discrimination for exercising your privacy rights.

• Sensitive Data Consent. Where the OCPA requires consent for the processing of sensitive data, the Red Cross will obtain your consent before processing such data, except where another legal basis applies.
• Please note that your exercise of these rights is subject to certain exceptions and limitations that may apply to restrict the scope of a given right and our ability to respond to a given request. We may have to take certain steps to verify your identity in connection with any request related to exercising these rights to help ensure that we provide the information we maintain to the individuals to whom it pertains, and allow only those individuals or their authorized representatives to exercise these rights. We also have the right to take into account the interests of others in responding to any request.

5. How to Exercise Your Rights Under the Oregon Consumer Privacy Act:

To exercise your rights under the Oregon Consumer Privacy Act or if you have any questions or concerns about the American Red Cross's privacy practices, please send an email to PrivacyOfficer@redcross.org with the subject line “Oregon Privacy Act Request” that clearly specifies the nature of your request, and provides us with sufficient detail about you and your prior interactions with us to facilitate our processing of the request. To ensure we can process your request, please include the subject line “Oregon Privacy Act Request” and provide sufficient detail about your prior interactions with us. We will make reasonable efforts to process all requests that we can verify. You may also submit a request in writing by sending mail to:

American Red Cross
Office of the General Counsel
431 18th Street NW
Washington D.C. 20006
Attention: Privacy Officer
Re: Oregon Privacy Act – Request

Authorized Agents. You may designate an authorized agent to submit a request on your behalf. We may require the authorized agent to provide proof of your written authorization and may require you to verify your own identity directly with us before fulfilling the request.

Response Timeframe. We will respond to your request without undue delay, and in any event within 45 days of receipt. If reasonably necessary, we may extend the response period by an additional 45 days, in which case we will inform you of the extension and the reasons for it within the initial 45-day period.

Appeals. If we decline to take action on your request, we will notify you of our decision and the reasons for it. You may appeal our decision by emailing PrivacyOfficer@redcross.org with the subject line "Oregon Consumer Privacy Act Appeal" within a reasonable period after receiving our response. We will respond to your appeal in writing within 45 days of receipt, explaining the reasons for our decision. If we deny your appeal, you may contact the Oregon Attorney General to submit a complaint.

Universal Opt-Out Mechanisms. The Red Cross recognizes and honors universal opt-out mechanisms that meet the requirements of the OCPA, such as the Global Privacy Control (GPC), to the extent possible and depending on the manner in which you engage with the Red Cross, as a valid request to opt out of the sale of personal information and processing for targeted advertising purposes, when we can reasonably link the opt-out signal to you.

6. Other Important Information:

The American Red Cross is committed to protecting your personal information and privacy. We regularly review and, if appropriate, may update this Oregon Privacy Notice from time to time, and as our services and use of personal information evolves. If we make material changes to this Oregon Privacy Notice, we will notify you here, by email, or by means of a notice on our homepage. You can tell if this Policy has changed by checking the effective date that appears at the top of this Policy. We will update the date of this Policy each calendar year or each time it is changed.

7. Contact Us:

If you have any questions, comments, or concerns about this Oregon Privacy Notice or the American Red Cross's privacy practices, please contact us using the information provided above.