INTRODUCTION
Desert Botanical Garden, Inc. (collectively, “DBG,” “we,” “our,” or “us”) appreciates your interest in our services and offerings and your use of our website.
This notice is for people who are located in the European Economic Area (“EEA”) and supplements our general Privacy Policy. Our processing of personal data of people who are in the EEA is governed by the General Data Protection Regulation (the “GDPR”), which applies from May 25, 2018. The GDPR requires us to provide certain information to you about your personal data, which we refer to in this notice as your personal information. This privacy notice is for information only, it is not a contractual agreement.
DEFINITION OF PERSONAL DATA
Personal data is information that can be used to identify a natural person, either directly or indirectly (hereinafter “personal data”). A “personal identifier” is a piece of information that can identify an individual. This definition covers a wide range of personal identifiers which make up personal data, such as names, addresses, email addresses, identification numbers, location data and online logins.
DATA CONTROLLER
We are a “data controller”. This means that we are responsible for deciding how we hold and use personal data about you. For our contact information, please see below.
CATEGORIES OF PERSONAL DATA COLLECTED
We collect and process the following information when provided voluntarily by our website visitors: name, telephone number, email address, city, state, country, zip code, credit and/or debit card number, bank account number, date of birth, education and employment-related information, and personal or professional interests. We also process automatically-gathered information, such as IP address, your use of cookies, your activity on our website, location information, and type of mobile device used. To learn more about our Cookie Policy, please see below.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data) unless you voluntarily provide us with that information. Nor do we collect any information about criminal convictions and offences.
METHODS OF COLLECTION
There are a number of circumstances in which you voluntarily supply us with personal information. The following lists the most common ways in which we collect your personal information:
- If you register for an account on our website;
- If you engage in certain transactions, such as making a donation on our website, which may require you to input other personal information such as credit card numbers, and bank account numbers;
- If you apply to volunteer, you may optionally enter other personal information such as date of birth, education and employment information, background, and emergency contact information;
- If you apply for a job with us, you may submit employment-related information 1) provided on job applications through the website or electronically, 2) as it relates to our Human Resources Department, and 3) for LinkedIn referrals. This information may include, for example, job preferences, work history, and other personal information;
- If you apply for membership, you may optionally enter certain personal information for those you include on your membership. We may ask you to provide us with information regarding your personal or professional interests, demographics, experience with our programs, and more detailed contact preferences;
- If you participate on social media accounts involving DBG;
- If you submit questions, comments, or feedback through the website, or otherwise;
- We may conduct surveys, contests, promotions on the website, and we may give you the opportunity to participate in these. Participation may require that you submit certain personally identifiable information to DBG, and we will collect and store this information. However, your participation is strictly voluntary and is not required to continue to use the website, applications, and services, so you have a choice whether or not to submit this information; or
- Any other place on the website where you knowingly volunteer personal information
PURPOSES OF THE PROCESSING
As explained in our Privacy Policy, the following are non-limiting examples of the purposes of our processing activities of your personal data:
- Provide you with the best customer experience possible;
- Help you complete and confirm a transaction, enable us to contact you if a problem arises with your transaction, and to communicate back to you;
- Provide you with personalized and customized services and products, including benefits, specials, offers, contests, invitations, and promotions;
- Respond to your requests or questions for information on membership, volunteering, events, or to any other requests or questions;
- Remember you when you visit our website;
- Measure the use of the website and improve the content of the website;
- Address network integrity and security issues;
- Perform internal marketing analyses with aggregated data; or
- Comply with applicable laws and as otherwise allowed by law.
DBG or third parties that it uses may contact you by email or other means at an address that you have provided to us. If you do not want to receive an email from us, please “unsubscribe” through the link that is included in our emails. If you do not want to receive mailings, simply tell us when you give us your personal information or follow the directions to remove your name from our mailing list.
We utilize email tracking systems that provide us with data such as who opened or forwarded an email, the time it was opened, and whether the reader clicked certain links within the email.
LAWFUL BASIS FOR THE PROCESSING
We process your personal data in accordance with the provisions set out in the GDPR and the relevant applicable data protection laws and regulations. The legal bases for processing your personal data are:
- To comply with contractual obligations. If you engage in any of the activities under “Methods of Collection,” the purposes of processing your personal data are primarily determined by that activity and our related service and we will process your information so that we can provide that service or content to you.
- As a result of your consent. When you have consented to the processing of your personal data by us for certain services through the website, you can withdraw this consent at any time by following the instructions provided in the subscription process or by contacting us at info@dbg.com For further information on the right of withdrawal, please refer to the “Obligation to provide personal data” section below.
- There is a legitimate interest. In certain situations, we may not need your consent to use your data as we will have a legitimate interest to do so, but we must inform you of this. Examples of such situations are:
- To analyze and optimize our website;
- To guarantee IT security and safeguard DBG’s IT operations; and
- To prevent and investigate criminal acts.
- DBG has legal obligations it must follow or there is a general public interest. As any other public-facing entity, DBG is subject to legal obligations and regulations. In some cases, the processing of your personal data will be necessary for DBG to fulfill these obligations.
If you are under 16 years of age and reside in the European Union, you must provide an email address for your parent or legal guardian, and before you can access or use our website. DBG must receive your parent’s or legal guardian’s express consent. You will not receive access or the ability to use the website, and we will not collect additional personal data from you, until we receive your parent’s or legal guardian’s consent. Your parent or legal guardian may revoke consent at any time, and DBG will take reasonable steps to delete all personal data collected from you. DBG will also provide your parent or legal guardian with the ability to request to review your personal data, prohibit further collection of your personal data, and delete, or instruct the deletion of, your personal data.
WHO RECEIVES YOUR PERSONAL DATA
- Service providers, such as our contractors, vendors, and distributors who help us manage or provide services offered on our website;
- Law enforcement or government authorities, if required to do so by law or in the good-faith believe that disclosing personal data is necessary to conform to applicable law, respond to requests, protect and defend our rights or property, act under emergency situations, or assist with identify verification and to prevent fraud and identity theft; and
- Entities that receive personal data in a merger, sale or bankruptcy of DBG
DISCLOSURE OF YOUR PERSONAL DATA TO COUNTRIES OUTSIDE THE EEA
Sometimes we may transfer your data outside the EEA, however, we will only do so where there are adequate safeguards in place. We may share information within our entity’s headquarters in the US. The appropriate safeguards are standard contractual model clauses, approved by the European Commission.
HOW LONG IS YOUR PERSONAL DATA STORED
We keep your personal information for as long as it is required in order to fulfill the relevant purposes described in this privacy policy, as may be required by law (including for tax and accounting purposes), or as otherwise communicated to you. How long we retain specific personal information varies depending on the purpose for its use, and we will delete your personal information in accordance with applicable law.
SECURITY
We use technical and organizational security measures to protect the data we have under our control against accidental or intentional manipulation, loss or destruction and against access by unauthorized persons. Our security procedures are continually enhanced as new technology becomes available.
YOUR RIGHTS AND HOW TO EXERCISE THEM
If you reside in the European Union, you have certain rights under the GDPR, including:
- The right to be informed of the personal data we collect and how we process and use that data;
- The right to request access to your personal data;
- The right to request that inaccurate personal data be rectified, or completed if incomplete;
- The right to request erasure of your personal data;
- The right to restrict our processing or use of your personal data;
- The right to obtain and reuse your personal data for your own purposes;
- The right to object to our processing or transferring your personal data;
- The right to withdraw your consent for us to use your personal data; and
- The right to lodge a complaint with a supervisory authority under the GDPR.
We have a legitimate interest in collecting and processing your information for the purposes we have outlined in this GDPR Notice and so that we can optimize your experience with our website.
In response to receiving a request for one of the rights set forth above, DBG will timely comply with the request within the time periods set forth in the GDPR for each right. Several of the above rights are not absolute and apply only in certain circumstances. DBG will comply with requests for those rights as set forth in the GDPR. We are intent on resolving any issues relating to our handling of your personal data, and you may contact us at any time regarding any questions or concerns
To exercise any of these rights, please contact us at:
By Mail: Desert Botanical Garden
1201 N. Galvin Parkway
Phoenix, AZ 85008
By Phone: 480.941.1225
By Email: info@dbg.com
OBLIGATION TO PROVIDE PERSONAL DATA
You may object at any time to the processing of your personal data or, where your consent is required, withdraw such consent by contacting us at info@dbg.com. However, please note that if you withdraw your consent, you may not be able to access or use certain information, features or services of the website.
AUTOMATED DECISION-MAKING
As a matter of principle, we do not use fully automated decision-making processes. In the event that we should use such processes in individual cases, we will, if required by law, specifically inform you of this and of your rights in this respect.
USING DATA FOR PROFILING PURPOSES
As a matter of principle, your personal data will not be processed automatically with the objective of evaluating certain personal aspects (profiling). In the event that we should process your personal data with the objective of conducting profiling, we will, if required by law, specifically inform you of this and of your rights in this respect.
CHANGES TO THIS GDPR NOTICE
DBG will update this privacy notice from time to time in order to reflect the changes in our practices and services and to remain compliant with data protection laws and regulations. IF YOU DO NOT AGREE TO THIS NOTICE, PLEASE DO NOT USE DBG’S WEBSITE OR PROVIDE DBG WITH YOUR PERSONAL DATA. Your use of DBG’s website and/or mobile applications indicates your acceptance of this notice and of the collection and use of your personally identifiable information in accordance with this policy.
Last update: December 2019
