Introduction and Scope of This Policy

Effective Date: November 7, 2025 Welcome to the Grainger County Arts and Heritage Society (GCAHS or “the Society”). We are deeply committed to the preservation of local arts and heritage, and this commitment extends to protecting the privacy and security of the personal information entrusted to us by our members, donors, volunteers, workshop participants, researchers, and website visitors. This comprehensive Privacy Policy outlines the types of information we collect, the methods by which we collect it, how we use that information, the circumstances under which we may disclose it to third parties, and the detailed rights you have regarding your data. This Policy applies to data collected across all platforms and activities related to the GCAHS, including but not limited to our official website (info@gcahs.lat), social media engagement, in-person interactions (such as event ticket purchases, workshop registrations, or museum/archive visits), postal correspondence, and telephonic communications. As a non-profit organization dedicated to cultural stewardship in the Appalachian region, we handle unique types of data, including genealogical records and oral histories, and this policy is specifically designed to address the ethical and legal responsibilities associated with safeguarding this sensitive material. We urge you to read this Policy in its entirety to ensure you fully understand our practices concerning your personal data and how we operate within our mission framework. By interacting with the GCAHS, you acknowledge and consent to the practices described in this Privacy Policy. This policy is subject to review and update, and any material changes will be communicated clearly through this platform.

1. Information We Collect: Categories and Definitions

The information collected by the GCAHS falls into several distinct categories, each defined by its purpose and level of sensitivity. We limit our data collection to what is necessary and relevant for fulfilling our mission, providing services, and maintaining regulatory compliance.

1.1 Personal Identifiable Information (PII)

PII is data that can be used to identify, contact, or locate a single person, or can be used with other sources to uniquely identify an individual. Contact Data: Full legal name, mailing address (for physical correspondence, tax receipts, and membership packets), primary and secondary phone numbers, and email addresses. This is primarily collected through membership forms, event registration, and newsletter sign-ups. Financial/Transaction Data: Credit card details or bank information (only the last four digits, expiry, and transaction ID for record-keeping; full payment details are processed securely via third-party vendors and are not stored by GCAHS). This includes donation amounts, payment methods, and purchase history (e.g., workshop fees, gift shop purchases). Demographic Data: Age or age range (primarily for children’s programs to ensure appropriate curriculum alignment and safety), and sometimes professional background or specific skills (especially for volunteer applications).

1.2 User-Generated and Engagement Data

This data is created through your active interaction with our services and programs. Program and Event Data: Records of workshops attended, tickets purchased, specific exhibit feedback provided, and participation in educational modules. This helps us track program utilization and improve offerings. Volunteer and Membership Data: Records of volunteer hours logged, specific roles performed, training completed, and membership status and tenure. Communication Records: Copies of emails sent to GCAHS staff, notes from telephone conversations, and records of communication preferences (e.g., opt-in/opt-out status for newsletters).

1.3 Archival and Research Data (Unique to GCAHS)

This is data unique to an Arts and Heritage Society, often provided for the benefit of the public archive, but still containing personal information. Donor/Accessioning Data: Detailed records related to individuals who donate artifacts, documents, or photographs to the archive. This includes the donor’s name, contact information, the item’s provenance (chain of ownership), and the legal deed of gift. Oral History Records: Audio, video, and transcribed interviews with community members. While intended for historical research, these records contain sensitive PII such as names, birth dates, detailed life stories, and family member details. The use of this data is strictly governed by the signed legal release form provided by the interviewee. Genealogical Data: Information submitted by researchers or community members, which may include family trees, birth/death dates, marriage records, and residential history. This information is typically shared with explicit consent for inclusion in our research library.

1.4 Technical and Usage Data

This is data collected automatically when you access our website or digital platforms. Device Information: Internet Protocol (IP) address, browser type and version, time zone setting, operating system, and platform. Usage Data: Details about how you use our website, including the pages viewed, the time spent on those pages, link clicks, navigation paths, and referring website addresses. This data is collected through standard tools like Google Analytics (anonymized where possible).

2. Methods of Information Collection

The GCAHS collects information through three primary mechanisms, ensuring transparency at the point of collection.

2.1 Direct Collection from You

This is the most common method, occurring when you voluntarily provide information in response to a specific prompt. This includes, but is not limited to: Completing an online membership enrollment form. Registering for a workshop or ticketed event in person or online. Submitting a volunteer application or background check information. Contacting us directly via email or phone with a specific question. Signing a deed of gift or legal release for artifact donations or oral histories. Making a financial contribution or purchasing an item from our shop.

2.2 Automated Collection Through Technology

When you visit our website, certain data is collected automatically to enhance your experience and help us analyze site performance. Cookies: We use session cookies (temporary, deleted upon closing the browser) and persistent cookies (remain on your device for a set period) to remember your preferences and analyze traffic patterns. Details on managing cookies are provided in Section 9. Log Files: Our web servers automatically create log files that record non-personal usage data, such as IP addresses, referring links, and time stamps, which are standard for maintaining server security and performance. Third-Party Analytics: We utilize services like Google Analytics to track and aggregate website usage data, which helps us understand visitor flow and improve the website layout and content.

2.3 Collection from Third Parties

In limited circumstances consistent with our mission, we may receive information about you from third parties. Grant Providers and Partners: If GCAHS is involved in a collaborative project with an academic partner or receives a grant that requires us to process participant data, we may receive your information from that partner (e.g., participant lists for a joint history project). Payment Processors: When you make a donation, our third-party payment vendor (e.g., Stripe, PayPal) provides us with confirmation of the transaction, your name, and limited contact details to issue tax receipts and update your donor record, but never your full financial account details. Public Records: For genealogical or historical research purposes, our researchers may access publicly available records, such as property deeds, census records, or digitized historical newspapers, which may contain PII. This data is handled according to archival standards.

3. How We Use Your Information: Purposes and Legal Basis

We use the information collected about you for various operational, mission-focused, and legal purposes, all of which are directly tied to the success of the GCAHS and its service to the community.

3.1 Mission Fulfillment and Archival Use

Preservation and Access: Your donated materials, including oral history interviews and associated PII (such as name and birth year), are used to fulfill our core mission of preserving Grainger County history. This information is processed and cataloged to make it available for ethical, scholarly, and public research, as permitted by the legal release agreements you signed. Educational Programming: We use participation data (e.g., age group, workshop history) to design and tailor our educational curriculum, ensuring our programs are age-appropriate, culturally relevant, and meeting community demand. Artifact Provenance: Donor information is crucial for establishing the legal and historical chain of ownership (provenance) for artifacts, which maintains the integrity and value of the entire collection.

3.2 Operational and Administrative Use

Service Delivery: Using contact and transaction data to process your membership, confirm your event registrations, and deliver the specific services you requested (e.g., mailing a membership card, sending pre-workshop instructions). Internal Accounting: Utilizing financial and transaction data to process donations, issue mandated tax receipts, and maintain accurate financial records necessary for auditing and non-profit compliance. Volunteer Management: Processing PII and background information from volunteers to assign appropriate roles, log service hours, provide necessary training, and ensure a safe environment for all GCAHS activities, particularly those involving youth or artifact handling.

3.3 Communication and Outreach

Updates and Newsletters: Using your email address to send you our periodic newsletters, event calendars, and news about new exhibits, provided you have explicitly opted in to receive these communications. Fundraising and Development: Using contact and donor history to communicate with you about fundraising campaigns, capital projects, and opportunities to support the Society, which is essential for sustaining our non-profit operations and securing the future of the archive. Direct Follow-Up: Responding directly to your emails, phone calls, or general inquiries to provide personalized support or resolution to any administrative issues you might encounter.

3.4 Security, Legal, and Compliance Use

Security: Using technical data (like IP addresses and usage logs) to monitor our website for potential security threats, prevent fraudulent activities, and troubleshoot technical issues, ensuring the integrity and stability of our online presence. Regulatory Reporting: Utilizing aggregated program and financial data for mandatory reporting to state and federal non-profit oversight bodies, as well as to grant-making foundations to demonstrate mission impact and responsible resource management. Legal Obligation: Disclosing information when legally required, such as in response to a valid court order, subpoena, or to protect the rights, property, or safety of the GCAHS, our employees, members, or the public.

4. Disclosure and Sharing of Your Information

The GCAHS does not sell, trade, or rent your PII to commercial third parties for marketing purposes. We only share or disclose information under the following limited and controlled circumstances, typically involving service providers or mission partners who assist us in fulfilling our core functions.

4.1 Service Providers and Vendors

We engage trusted third-party service providers who perform specific functions essential to our operation. These parties are contractually obligated to protect your information and are only authorized to use the data for the specific purpose for which we hired them. Payment Processors (e.g., credit card vendors): Handle the secure processing of financial transactions. Email Marketing Platforms (e.g., Constant Contact): Manage the distribution of our electronic newsletters and event announcements. Website Hosting and IT Support: Maintain the security and stability of our website and digital infrastructure. Event Ticketing Systems: Process ticket sales and registrations for workshops and events.

4.2 Research and Mission Partners

Consistent with our mission, some data may be shared with partners under strict agreements. Genealogical Researchers: Limited, approved research data (excluding sensitive PII unless explicitly permitted by the data subject) may be shared with accredited genealogical or academic researchers for scholarly purposes, adhering strictly to the terms of use and research protocols established by GCAHS. Grant Reporting: De-identified, aggregated demographic and participation data (e.g., “75 individuals between the ages of 8-12 attended the youth history camp”) may be shared with foundations or governmental agencies to demonstrate our program reach and fulfill reporting requirements for grant funding.

4.3 Archival and Public Release of Historical Content

Oral Histories and Artifact Documentation: Information provided in oral history interviews and artifact deeds of gift (e.g., the donor’s name, the context of the story, etc.) is intended for public access via our archive or museum exhibitions. This public release is only performed after securing an explicit, written legal release from the donor or interviewee that specifies the scope of publication and use. If a release is not provided, the information remains strictly confidential and non-public.

4.4 Legal and Governmental Requirements

We may disclose your information if we believe in good faith that such action is necessary to: Comply with a legal obligation, such as a court order, subpoena, or search warrant. Protect and defend the rights or property of the GCAHS. Act in urgent circumstances to protect the personal safety of users, the public, or GCAHS staff. Protect against legal liability or potential fraud related to donations or payments.

5. Data Security and Retention

The security and preservation of your personal information, especially sensitive archival and donor data, is paramount to our organization.

5.1 Data Security Measures

We implement a combination of physical, administrative, and technical safeguards designed to protect your PII and archival data from unauthorized access, misuse, loss, or disclosure. Technical Safeguards: Our website uses Secure Socket Layer (SSL) encryption for all data transmission, particularly for payment and registration forms. Our internal networks are protected by firewalls, and access to all digital records is controlled by unique user credentials and multi-factor authentication where applicable. Physical Safeguards: Access to the physical archive and administrative offices where hard copy records are stored is restricted, utilizing locked doors, alarm systems, and controlled entry logs to protect valuable historical and personal documents. Administrative Safeguards: All GCAHS employees and core volunteers receive mandatory training on data privacy protocols, the proper handling of PII, and the legal and ethical requirements for archival research. We operate under a “need-to-know” principle, limiting data access only to personnel who require it to perform their official duties.

5.2 Data Retention Policy

The period for which we retain your personal data depends heavily on the nature of the information and the purpose for which it was collected. Transactional and Membership Data: We retain financial transaction records (necessary for tax and audit purposes) and membership history for a minimum of seven (7) years as required by financial non-profit best practices, or as long as you remain an active member and for a reasonable period thereafter to facilitate renewal. Communication Data: Emails, chat records, and follow-up notes are generally retained for up to three (3) years to ensure continuity of service and provide historical context for recurring inquiries. Archival and Donor Records (Permanent Retention): Data related to artifact provenance, deeds of gift, and historical records (like oral history transcripts) are considered permanent archival material essential to the Society’s mission. This unique class of data is retained indefinitely to ensure the historical integrity of the collection and to meet the terms of the signed donation agreements, which stipulate permanent preservation for the public good.

6. Your Data Rights and Choices

We respect your control over your personal data. You have several rights regarding the personal information GCAHS holds about you, which you can exercise by contacting us using the details provided below.

6.1 Right to Access and Correction (Review)

You have the right to request access to the PII we hold about you (excluding permanent archival data, where the terms of the deed of gift apply) and to request corrections if you believe the data is inaccurate or incomplete (e.g., updating your address or phone number). We will promptly fulfill such requests after verifying your identity.

6.2 Right to Deletion (Erasure)

You have the right to request the deletion of your PII from our non-archival operational databases (e.g., deleting your marketing subscriber profile or your volunteer record after a period of inactivity). However, this right is significantly limited by our archival mission: Exemption for Archival Data: We cannot delete information that has been permanently accessioned into the GCAHS archive under a signed deed of gift or release form (e.g., your name attached to an artifact donation or an oral history interview). This retention is mandatory to preserve historical accuracy and legal integrity, as per the explicit terms of your original contract with the Society. Exemption for Legal Compliance: We cannot delete data necessary for financial, legal, or regulatory compliance (e.g., tax receipts, audit records, or security logs retained for the mandatory seven-year period).

6.3 Right to Restrict Processing

You have the right to request that we restrict the processing of your PII in certain circumstances, such as if you contest the accuracy of the data. For example, you may ask us to pause sending you fundraising solicitations while maintaining your active membership status.

6.4 Opt-Out of Marketing Communications

You may opt out of receiving marketing and fundraising communications from us at any time by: Clicking the “unsubscribe” link provided at the bottom of every electronic newsletter or solicitation email. Contacting us directly at info@gcahs.lat with the subject line “Opt-Out Request.” Please note that even if you opt out of marketing communications, we will still send you essential administrative communications related to your membership status, event registrations, or changes to this Privacy Policy.

7. Cookies and Tracking Technologies

7.1 What are Cookies?

A cookie is a small text file placed on your computer or mobile device when you visit a website. It helps the website recognize your device and remember information about your visit, such as your preferences. Cookies are crucial for modern website functionality.

7.2 How GCAHS Uses Cookies

We use cookies and similar technologies for the following primary purposes: Strictly Necessary Cookies: Essential for enabling you to navigate our website and use features like event registration or shopping cart functionality. These cookies cannot be disabled. Performance/Analytics Cookies: Used to collect aggregated, anonymous information about how visitors use our site (e.g., which pages are most popular, time spent on site). This data helps us monitor and improve site performance and relevance. We use services like Google Analytics for this purpose. Functionality Cookies: Used to remember choices you make (such as language preference or region) and provide enhanced, more personal features.

7.3 Managing Your Cookie Preferences

You have the right to decide whether to accept or reject cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. However, restricting cookies may prevent you from taking full advantage of the interactive features of our website and may impair site functionality. Instructions for managing cookies are typically found within your browser’s “Settings” or “Preferences” menu.

8. Children’s Privacy (COPPA Compliance)

The Grainger County Arts and Heritage Society is committed to protecting the privacy of children, particularly those participating in our youth education and craft programs. We comply with the Children’s Online Privacy Protection Act (COPPA). Our website is not specifically directed at children under the age of thirteen (13), and we do not knowingly solicit or collect PII online from children under 13 without verifiable parental consent. If a parent or guardian enrolls a child under 13 in a workshop, we collect only the necessary PII (name and age) for safety, registration, and curriculum purposes, and we require verifiable parental consent before retaining any photography or video footage of the child for marketing or archival purposes. If we learn that PII from a child under 13 has been collected online without verifiable parental consent, we will promptly take steps to delete that information from our servers and records, unless that information is subject to a legal exemption (such as an artifact donation made by a parent on behalf of the child, which would fall under our archival retention policy).

9. Third-Party Links and External Services

Our website and communications may contain links to external sites that are not operated by the GCAHS, such as links to partnering organizations, academic journals, or local business sponsors. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services. We strongly advise you to review the Privacy Policy of every site you visit when navigating away from our digital properties. The inclusion of any third-party link does not imply endorsement by the GCAHS.

10. Policy Changes and Contact Information

10.1 Changes to This Privacy Policy

The Grainger County Arts and Heritage Society reserves the right to modify this Privacy Policy at any time to reflect changes in our operational practices, mission expansion, or legal and regulatory requirements. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Effective Date” at the top of the document. We encourage all users to periodically review this Policy to stay informed about how we are protecting the information we collect. Your continued use of the GCAHS website or services after any modifications constitutes your acknowledgment and acceptance of the revised Policy.

10.2 Contacting the GCAHS

If you have any questions about this Privacy Policy, our data collection practices, or wish to exercise any of your rights regarding your personal information, please contact us using the details below. For the quickest and most efficient response, please use the email address designated for policy inquiries.

Privacy and Compliance Contact:

Attention: Executive Director and Compliance Officer Email: info@gcahs.lat Mailing Address: Grainger County Arts and Heritage Society PO BOX 101 RUTLEDGE, TN 37861