1. WHO WE ARE

ACT-2 is a nonprofit organization based in the United States that provides information, community connections, referrals, educational opportunities, programs, events, resource navigation, and other support in furtherance of its charitable mission, including support for veterans, service members, military families, caregivers, and related communities.

Unless expressly stated otherwise, ACT-2 is an independent nonprofit organization and is not the United States Department of Veterans Affairs (“VA”), United States Department of Defense (“DoD”), a branch of the United States Armed Forces, or another governmental agency.

For purposes of applicable privacy and data-protection laws, ACT-2 may act as the organization responsible for determining why and how personal information collected through the Services is processed.

2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal information collected through ACT-2 Services that link to or reference this Policy. It may apply to information collected through:

• ACT-2's website;
• Contact and inquiry forms;
• Program or service-request forms;
• Event registrations;
• Community-partner applications;
• Surveys and feedback forms;
• Volunteer or participation forms;
• Email and other electronic communications;
• Resource-navigation requests;
• ACT-2's artificial intelligence assistant or chatbot;
• Online databases, constituent-management systems, and similar systems used to administer ACT-2 programs; and
• Other online services operated on behalf of ACT-2.

Certain programs or activities may have additional privacy notices or consent requirements. Where a program-specific notice conflicts directly with this Privacy Policy regarding information collected specifically for that program, the more specific notice will govern that information.

3. PERSONAL INFORMATION WE MAY COLLECT

The personal information ACT-2 collects depends upon how you interact with us.

4. HIGHLY SENSITIVE INFORMATION

General website forms, ordinary email, and the AI chatbot are not intended as repositories for highly sensitive credentials or documents. Unless ACT-2 specifically requests information through an appropriate secure process, please do not submit:

• Social Security numbers;
• Passwords;
• Banking information;
• Credit or debit card numbers;
• Financial-account credentials;
• VA claim or file numbers;
• Copies of government identification documents;
• Authentication credentials;
• Complete medical or mental health records;
• Detailed medical histories unnecessary to a referral;
• Security codes;
• Private keys; or
• Other information that could create a significant risk of identity theft, financial harm, or unauthorized access if disclosed.

If ACT-2 requires sensitive information for a particular service or program, we may provide separate instructions concerning how that information should be submitted.

5. INFORMATION ABOUT HEALTH, DISABILITY, AND OTHER SENSITIVE NEEDS

ACT-2 may learn information concerning health, mental health, disability, housing instability, financial hardship, legal needs, benefits needs, or other sensitive circumstances when an individual voluntarily requests assistance.

ACT-2 generally collects this information for resource-navigation, referral, program-administration, or related charitable purposes.

ACT-2 is not representing through this Privacy Policy that it is a healthcare provider, health plan, healthcare clearinghouse, or otherwise subject to any particular healthcare privacy law solely because a person voluntarily provides health-related information.

Users should avoid providing detailed medical records or information that is unnecessary for ACT-2 to facilitate the requested assistance.

6. HOW WE COLLECT INFORMATION

7. HOW WE USE PERSONAL INFORMATION

ACT-2 may use personal information for purposes including:

8. LEGAL BASES FOR PROCESSING WHERE REQUIRED

Certain privacy laws require an organization to identify a lawful basis for processing personal information. Where such laws apply, ACT-2 may rely upon one or more lawful bases depending upon the circumstances, including:

9. COMMUNITY PARTNERS AND REFERRAL DATA SHARING

A central part of ACT-2's work is connecting individuals with organizations that may be able to provide relevant services. When reasonably necessary to facilitate an assistance request, service, resource connection, referral, program, or other requested support, ACT-2 may disclose relevant personal information to independent third parties, including:

• Nonprofit organizations;
• Government agencies;
• Veterans-service organizations;
• Educational institutions;
• Employers;
• Employment-service providers;
• Housing organizations;
• Legal-service organizations;
• Healthcare or mental health resource organizations;
• Benefits organizations;
• Financial-resource organizations;
• Community organizations; and
• Other providers reasonably related to the requested assistance.

ACT-2 seeks to limit referrals to information reasonably relevant to the applicable request.

For example, if a user asks ACT-2 for assistance locating an employment resource, ACT-2 may provide the relevant partner with contact information and information necessary to explain the user's employment-related request.

By requesting ACT-2's assistance with a resource connection, you understand that fulfillment of that request may require ACT-2 to communicate relevant information to an organization capable of providing the requested resource.

Where applicable law requires separate consent or authorization before certain information can be shared, ACT-2 will seek such permission as required.

Community Partners are generally independent organizations and may have their own privacy practices. Once information is received independently by another organization, that organization's processing may be governed by its own privacy notice, legal obligations, and relationship with you.

10. SERVICE PROVIDERS AND TECHNOLOGY VENDORS

ACT-2 uses third-party service providers to support its operations. Depending upon ACT-2's current technology configuration, these providers may perform services involving:

• Website hosting;
• Cloud infrastructure;
• Form processing;
• Database management;
• Constituent or customer relationship management;
• Email delivery;
• Communications;
• Event registration;
• Analytics;
• File storage;
• Cybersecurity;
• Artificial intelligence;
• Automation; and
• Other technology or operational functions.

These providers may receive or process personal information when reasonably necessary to provide their services to ACT-2. ACT-2 seeks to use service providers appropriate for the information and functions involved, but third-party providers maintain their own systems, safeguards, terms, and practices.

Current material providers may include: Netlify, Supabase, OpenAI, and other technology providers used to operate ACT-2's Services.

ACT-2 may update its service providers from time to time without materially changing the purposes for which personal information is processed.

11. ARTIFICIAL INTELLIGENCE AND OPENAI

ACT-2 may provide an AI-powered assistant intended to help users navigate general information, ACT-2 resources, programs, and potentially relevant external resources.

12. COOKIES, ANALYTICS, AND SIMILAR TECHNOLOGIES

ACT-2's website may use cookies, analytics technologies, pixels, local storage, server logs, and similar technologies. These technologies may be used to:

• Operate the website;
• Maintain security;
• Remember preferences;
• Understand website traffic;
• Analyze how users interact with the website;
• Diagnose technical problems; and
• Improve ACT-2's Services.

Some cookies may be essential to operation of the website, while others may support analytics or other non-essential functions. Where applicable law requires consent before non-essential cookies or similar technologies are used, ACT-2 will seek appropriate consent. Users may also be able to control cookies through browser settings or any cookie-management mechanism made available on the website.

13. MARKETING, NEWSLETTERS, AND EVENT COMMUNICATIONS

ACT-2 may provide individuals with opportunities to receive:

• Newsletters;
• Event announcements;
• Community-resource information;
• Program updates;
• Fundraising communications; and
• Other organizational communications.

Where required, ACT-2 will obtain appropriate permission for marketing or promotional communications. An individual's request for services should not be conditioned upon agreement to receive optional marketing communications unless the communication is reasonably necessary to provide the requested service.

Users may unsubscribe from promotional email communications using the unsubscribe mechanism included in applicable emails or by contacting ACT-2. ACT-2 may continue to send non-promotional communications reasonably necessary to administer a registration, respond to a request, provide a requested service, or maintain an existing organizational relationship.

14. NO SALE OF PERSONAL INFORMATION

ACT-2 does not sell personal information for monetary consideration.

ACT-2 does not intend to use personal information collected through assistance requests as a commodity for sale to commercial data brokers.

ACT-2's disclosure of information to service providers, Community Partners, or other organizations for the purposes described in this Privacy Policy is not intended as a sale of information.

If ACT-2's practices materially change, ACT-2 will update this Privacy Policy and provide additional notices or choices where required by applicable law.

15. AGGREGATED AND DE-IDENTIFIED INFORMATION

ACT-2 may create aggregated, statistical, or de-identified information from information collected through its programs and Services. For example, ACT-2 may report:

• Number of individuals served;
• General categories of needs reported;
• Event attendance;
• Referral counts;
• Program outcomes;
• Geographic service patterns;
• Satisfaction results; or
• Other program-impact information.

ACT-2 may use such information for program evaluation, impact reporting, grant reporting, fundraising, research, planning, public education, communications, and organizational improvement. ACT-2 seeks not to publicly identify an individual through aggregated or de-identified reporting unless the individual has separately authorized identification or disclosure.

16. TESTIMONIALS, STORIES, PHOTOGRAPHS, AND PUBLICITY

ACT-2 will not treat an individual's private assistance request as permission to publicly disclose that person's identity or story.

When ACT-2 seeks to use identifiable testimonials, personal stories, photographs, videos, quotations, or similar materials for public communications, ACT-2 may obtain separate authorization or consent where appropriate.

Participation in a resource request or receipt of ACT-2 assistance does not, by itself, constitute consent to public use of a person's identity, image, or personal circumstances.

Event photography and media may be subject to separate notices, releases, signage, or consent procedures.

17. WHEN WE MAY DISCLOSE INFORMATION

18. DATA MINIMIZATION

ACT-2 seeks to collect personal information reasonably relevant to the purposes for which it is collected. Users are encouraged not to submit unnecessary sensitive information. ACT-2 may periodically review forms, systems, and processes to reduce unnecessary collection where reasonably practicable.

19. DATA RETENTION

ACT-2 does not intend to retain all personal information indefinitely. Retention periods may vary depending upon:

• The type of information;
• Why the information was collected;
• The nature and duration of an individual's relationship with ACT-2;
• Program-administration needs;
• Referral follow-up needs;
• Grant or funder requirements;
• Financial, accounting, audit, or tax requirements;
• Contractual obligations;
• Legal obligations;
• Applicable limitation periods;
• Security requirements; and
• The need to establish, exercise, or defend legal claims.

ACT-2 seeks to retain personal information only for as long as reasonably necessary for legitimate organizational purposes or as required by applicable law. When personal information is no longer reasonably needed, ACT-2 may delete, destroy, anonymize, or otherwise appropriately dispose of it, subject to technical limitations and legitimate backup, archival, legal, or compliance requirements. Information maintained by third-party service providers may also be subject to provider-specific retention schedules and technical limitations.

20. DATA SECURITY

ACT-2 seeks to use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the personal information it maintains. Safeguards may include measures relating to:

• Access control;
• Account security;
• Authentication;
• Vendor management;
• Encryption where appropriate and available;
• System configuration;
• Data minimization;
• Staff or volunteer access;
• Secure disposal;
• Incident response; and
• Other measures appropriate to ACT-2's operations.

However, no website, database, cloud platform, electronic transmission, AI system, email service, or storage system can be guaranteed to be completely secure. Accordingly, ACT-2 cannot guarantee absolute security or that unauthorized third parties will never defeat security measures. Users should use reasonable care when transmitting personal information electronically.

21. SECURITY INCIDENTS AND DATA BREACHES

ACT-2 may maintain procedures for identifying, evaluating, responding to, and documenting suspected security incidents involving personal information.

If ACT-2 determines that a security incident requires notice to affected individuals, regulators, law enforcement, service providers, or other parties under applicable law, ACT-2 will provide such notice in accordance with applicable legal requirements.

Nothing in this Privacy Policy should be interpreted as promising notification for an event that does not legally or reasonably require notification.

22. INTERNATIONAL USERS AND DATA TRANSFERS

ACT-2 is based in the United States, and its Services may be accessed from other countries. If you access the Services from outside the United States, personal information may be transferred to, processed in, or stored in the United States and potentially other countries where ACT-2's service providers operate.

Those countries may have privacy and data-protection laws that differ from the laws of your jurisdiction. Where applicable law imposes requirements concerning international transfers of personal information, ACT-2 will seek to use an appropriate lawful transfer mechanism or other legally recognized safeguard where required.

Because ACT-2 uses third-party technology providers, information may also be transferred internationally through those providers according to their infrastructure and applicable contractual arrangements.

23. PRIVACY RIGHTS

Depending upon your location, the type of information involved, ACT-2's relationship with you, and applicable law, you may have certain rights concerning personal information. These rights may include the right to:

• Request confirmation whether ACT-2 processes personal information about you;
• Request access to certain personal information;
• Request correction of inaccurate or incomplete information;
• Request deletion of certain information;
• Request restriction of certain processing;
• Object to certain processing;
• Withdraw consent where processing is based upon consent;
• Request portability of certain information;
• Opt out of certain communications;
• Receive information about categories of recipients;
• Submit a complaint to an applicable privacy or data-protection authority; and
• Exercise other rights provided by applicable law.

These rights are not absolute. ACT-2 may deny or limit a request where an exception applies, where ACT-2 is legally required or permitted to retain the information, or where the requested right does not apply to ACT-2 or the processing involved.

24. HOW TO SUBMIT A PRIVACY REQUEST

Privacy-related requests may be submitted to:

Please include sufficient information for ACT-2 to understand your request. ACT-2 may need to take reasonable steps to verify your identity before providing access to, correcting, or deleting personal information. ACT-2 may also request information necessary to locate the applicable records.

ACT-2 will respond within the period required by applicable law where a legally mandated response period applies. If ACT-2 cannot fulfill all or part of a request, ACT-2 may explain the reason where required by law.

25. EUROPEAN ECONOMIC AREA, UNITED KINGDOM, AND OTHER INTERNATIONAL PRIVACY RIGHTS

If applicable data-protection law in your jurisdiction applies to ACT-2's processing, you may have additional rights or protections. Individuals in the European Economic Area or United Kingdom may, where applicable, have rights concerning:

• Access;
• Rectification;
• Erasure;
• Restriction;
• Objection;
• Data portability;
• Withdrawal of consent; and
• Complaints to an appropriate supervisory authority.

The availability of a particular right depends upon the circumstances and lawful basis for processing. Nothing in this Privacy Policy is intended to waive a privacy right that cannot lawfully be waived.

26. AUTOMATED DECISION-MAKING

ACT-2's AI assistant is intended primarily for informational and resource-navigation purposes. Unless ACT-2 provides a separate notice stating otherwise, ACT-2 does not intend to rely solely upon its website AI assistant to make decisions producing legal or similarly significant effects concerning an individual's:

• Government benefits;
• Employment;
• Housing;
• Healthcare;
• Legal rights;
• Financial services; or
• Eligibility for significant services.

If ACT-2 later implements automated processing for a materially different purpose, ACT-2 will evaluate whether additional notice, human review, consent, or other safeguards are required by applicable law.

27. CHILDREN'S PRIVACY

ACT-2's general website and AI assistant are not directed to children under 13 and are not intended to knowingly collect personal information directly from children under 13 without appropriate parental or legal-guardian involvement.

ACT-2 may operate events, programs, or community activities in which minors participate. Those activities may use separate registration forms, parental or guardian consent, media releases, waivers, emergency-contact forms, privacy notices, or other program-specific procedures.

If ACT-2 learns that personal information was collected online directly from a child under 13 in circumstances requiring parental consent and appropriate consent was not obtained, ACT-2 will take reasonable steps to address the information in accordance with applicable law.

If you believe a child has submitted personal information to ACT-2 improperly, contact us at info@militaryvetexpo.org.

28. PARENTS AND GUARDIANS

Parents and legal guardians should supervise minors' use of online ACT-2 Services where appropriate. A parent or guardian should not submit a minor's highly sensitive medical, financial, identification, or benefits information through a general website form or AI chatbot unless ACT-2 specifically requests that information through an appropriate process.

Program-specific forms involving minors may include separate requirements that supersede general website procedures for the applicable activity.

29. THIRD-PARTY WEBSITES AND SERVICES

The Services may link to websites, programs, organizations, resources, or services operated by third parties. ACT-2 does not control the privacy, data-security, tracking, retention, or information-handling practices of independent third parties.

This Privacy Policy does not govern information you provide directly to an independent third-party website or provider. Users should review the privacy policies and terms of third-party services before providing personal information.

30. SOCIAL MEDIA

ACT-2 may maintain accounts on social-media platforms. Information you post publicly or submit directly through a social-media platform may be processed by both ACT-2 and the applicable platform according to the circumstances. Public comments, posts, tags, or other interactions may be visible to others. This Privacy Policy does not control the independent privacy practices of social-media platforms.

31. EMAIL AND ELECTRONIC COMMUNICATIONS

Email and ordinary electronic communications may not provide the same security protections as a purpose-built secure data-transfer system. Users should not send highly sensitive credentials, complete medical records, government identification documents, or other unnecessary sensitive information through ordinary email unless specifically instructed to do so through an appropriate process.

ACT-2 may retain electronic communications as reasonably necessary to respond to requests, document services, maintain records, comply with legal obligations, or otherwise fulfill legitimate organizational purposes.

32. DO NOT TRACK AND SIMILAR SIGNALS

Browser and device technologies may permit users to send privacy-related preference signals. ACT-2's response to such signals may depend upon the technologies deployed on the website and applicable legal requirements. Where ACT-2 is legally required to recognize a particular opt-out or privacy-preference signal, ACT-2 will seek to implement the required response.

33. CHANGES TO THIS PRIVACY POLICY

ACT-2 may update this Privacy Policy periodically to reflect changes in:

• Programs;
• Services;
• Technology;
• Vendors;
• Data practices;
• Legal requirements; or
• Organizational operations.

When the Policy changes, ACT-2 will post the revised version and update the “Last Updated” date. Where applicable law requires additional notice or consent concerning a material change in processing, ACT-2 will take appropriate additional steps. Users are encouraged to review this Privacy Policy periodically.

34. RELATIONSHIP TO TERMS OF USE

Your use of the Services is also subject to ACT-2's Terms of Use. The Terms of Use contain important provisions concerning:

• Artificial intelligence;
• Community Partners;
• Third-party services;
• Disclaimers;
• Limitations of liability;
• User responsibilities;
• Indemnification; and
• Other terms governing use of ACT-2's Services.

This Privacy Policy addresses information-handling practices and should not be interpreted as modifying limitations, disclaimers, or other contractual provisions contained in the Terms of Use, except where applicable privacy law requires otherwise.

35. CONTACT US

Questions, concerns, complaints, or requests concerning this Privacy Policy or ACT-2's handling of personal information may be directed to: