Backpack Bed for Homeless Inc. EIN: 46-5748662 A 501(c)(3) Nonprofit Organization — Nashville, Tennessee, USA

1. Introduction

Backpack Bed for Homeless Inc. is a 501(c)(3) nonprofit organization domiciled in Nashville, Tennessee, committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information in accordance with applicable United States federal and state privacy laws, including but not limited to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the CAN-SPAM Act, the Children's Online Privacy Protection Act (COPPA), and applicable Tennessee state laws.

Your generosity helps people sleeping on the street find warmth and dignity. We treat your personal information with the same care and respect you show to those experiencing homelessness.

By interacting with us — whether donating, volunteering, subscribing to communications, or visiting our website — you consent to the practices described in this policy. If you do not agree, please contact us (Section 13) or refrain from providing personal information.

2. Scope

This policy applies to all individuals whose personal information we collect, hold, use, or disclose, including donors, website visitors, volunteers, subscribers, staff, contractors, and suppliers, regardless of where they are located. This policy applies to information collected through our website, email, telephone, mail, in-person interactions, and third-party platforms.

3. Anonymity

You can browse our website without identifying yourself. However, we will need your personal information for certain activities such as processing donations, issuing tax-deductible receipts, or managing volunteer applications. Contact our Privacy Officer (Section 13) to discuss how we can accommodate your preferences.

4. Personal Information We Collect

We only collect personal information reasonably necessary for our nonprofit functions. The categories of personal information we may collect include:

• Identifiers: Name, postal address, email address, phone number, date of birth
• Donation and financial information: Donation amount, donation history, payment details, transaction references. Your payment card details are processed directly by third-party payment gateways — we do not store your full card details on our systems.
• Volunteer information: Application details, emergency contacts, skills, availability, background check information (where applicable)
• Communication preferences: Your opt-in/opt-out choices and preferred contact methods
• Internet and electronic network activity: IP address, browser type, operating system, device type, pages visited, referring URLs, date/time of visit, cookie data, and usage information collected via Google Analytics and similar technologies
• Enquiries and feedback: Details of your questions, comments, or complaints
• Other: Any personal information you voluntarily provide

Sensitive personal information: We do not generally collect sensitive personal information (such as Social Security numbers, financial account login credentials, precise geolocation, racial or ethnic origin, religious beliefs, health information, or sexual orientation). If we need to collect sensitive information — for example, for volunteer background checks — we will only do so with your explicit consent or as required by law.

5. How We Collect Your Personal Information

We collect personal information:

• Directly from you: When you donate, volunteer, subscribe, contact us, or attend events — via our website, email, phone, mail, or in person
• Through our website: Via cookies, Google Analytics, and similar tracking technologies (see Section 9)
• From third parties: Such as fundraising platforms, payment processors, event organizers, or social media platforms — only where you have consented to them sharing your information or where permitted by law
• Publicly available sources: In limited circumstances where lawful and reasonable

6. How We Use and Disclose Your Personal Information

We use and disclose your personal information for the following purposes:

• Processing donations: Securely processing your gifts, issuing tax-deductible receipts (as permitted under Section 170 of the Internal Revenue Code), maintaining donation records
• Communications: Sending thank-you messages, newsletters, impact updates, fundraising appeals, and event invitations in accordance with your preferences (see Section 8)
• Volunteer management: Assessing applications, coordinating activities, conducting background checks where required
• Website improvement: Analyzing website usage through Google Analytics to improve our site and services
• Legal compliance: Meeting obligations to the Internal Revenue Service (IRS), Tennessee Secretary of State (charitable solicitation registration), and other federal, state, and local regulatory bodies
• Internal administration: Management, planning, reporting, auditing, and maintaining records using platforms such as Salesforce and Mailchimp
• Responding to enquiries: Addressing your questions, feedback, and complaints

We only use personal information for the purpose it was collected, or a related purpose you would reasonably expect.

Who We May Disclose To

• Our team: Employees, volunteers, and contractors bound by confidentiality obligations
• Third-party service providers: Payment processors (e.g., Stripe, PayPal), analytics providers (Google Analytics), email platforms (e.g., Mailchimp), CRM systems (e.g., Salesforce), website hosting, IT support, and cloud storage providers
• Professional advisors: Lawyers, accountants, and auditors
• Regulatory bodies: Where required or authorized by law (e.g., IRS, state attorneys general, law enforcement)
• Others: With your express consent or as otherwise permitted by law

We will never sell your personal information. For the purposes of the CCPA/CPRA, we do not "sell" or "share" (as those terms are defined under California law) your personal information.

7. Third-Party Services

Some of our third-party service providers may operate in various jurisdictions within and outside the United States. These may include Google (Analytics), Stripe, PayPal, Mailchimp, Salesforce, and other providers.

Important: When your personal information is shared with or collected by a third-party service provider, that provider's own privacy policy and terms govern their handling of your data. We do not control, and are not responsible for, the privacy practices, data handling, security, or legal compliance of third-party service providers. We encourage you to review the privacy policies of any third-party service you interact with.

We select service providers we believe maintain appropriate security practices, but we make no representations or warranties regarding their compliance with any applicable privacy laws.

8. Direct Marketing and CAN-SPAM Compliance

We may send you marketing communications about our work, fundraising, and events where you have consented or where permitted by applicable law.

All commercial email communications comply with the CAN-SPAM Act of 2003, including:

• Clear identification of us as the sender
• Accurate subject lines and header information
• Inclusion of our physical mailing address
• A clear and conspicuous opt-out mechanism

Opting out is easy. You can unsubscribe at any time by:

• Clicking the unsubscribe link in any email
• Contacting our Privacy Officer (Section 13)

We will process your opt-out request within 10 business days as required by the CAN-SPAM Act. We may still contact you for non-marketing purposes (e.g., donation receipts, responding to enquiries).

9. Website, Cookies, and Google Analytics

Cookies

Our website (https://BackpackBed.org/us) uses cookies — small text files stored on your device — to enable website functionality, remember preferences, and analyze usage.

Google Analytics

We use Google Analytics (operated by Google LLC) to analyze website traffic. Google Analytics collects data including your IP address, pages visited, browser type, and device information. We have enabled IP anonymization where available.

Google's handling of your data is governed by Google's own privacy policy and terms of service. We do not control how Google collects, stores, processes, or uses Analytics data. You can opt out of Google Analytics by installing the tools.google.com.

Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) setting. There is currently no universally accepted standard for how websites should respond to DNT signals. At this time, our website does not respond to DNT signals. However, you can manage tracking through your cookie and browser settings as described below.

Other Tracking

We may use pixel tags or web beacons in emails to measure communication effectiveness.

Managing Cookies

You can control cookies through your browser settings. Disabling cookies may affect website functionality. For guidance, visit allaboutcookies.org.

Third-Party Links

Our website may link to other websites. We are not responsible for the privacy practices or content of third-party websites.

10. Security

We take reasonable steps to protect your personal information from misuse, loss, and unauthorized access, modification, or disclosure, including:

• SSL/TLS encryption for data transmitted through our website
• Firewalls, password protection, and access controls
• PCI DSS-compliant third-party payment processing — we do not store full card details
• Confidentiality obligations and privacy training for team members
• Secure storage of physical records
• Incident response procedures — in the event of a data breach, we will comply with applicable federal and state breach notification laws, including the Tennessee Identity Theft Deterrence Act (Tenn. Code Ann. § 47-18-2107) and any other applicable state notification requirements

No method of internet transmission or electronic storage is completely secure. We cannot guarantee absolute security of your personal information.

Data Retention

We retain personal information only as long as reasonably necessary or as required by law:

• Donation and financial records: Minimum 7 years (IRS record-keeping requirements)
• Volunteer records: Duration of engagement plus a reasonable period (generally 7 years)
• Other records: Retained as needed, then destroyed or de-identified

11. Your Privacy Rights

Depending on your state of residence, you may have specific privacy rights under applicable state law. We are committed to honoring the following rights where applicable:

11.1 All Supporters

All individuals may:

• Request information about the personal information we hold about you
• Request correction of inaccurate or outdated personal information
• Opt out of marketing communications at any time
• Contact us with any privacy questions or concerns

11.2 California Residents — CCPA/CPRA Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share your information.
• Right to Delete: You may request that we delete your personal information, subject to certain legal exceptions (e.g., tax record-keeping requirements).
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share your personal information as defined under the CCPA/CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact our Privacy Officer (Section 13). We will respond within 45 days of receiving a verifiable request (which may be extended by an additional 45 days where reasonably necessary). We may need to verify your identity before processing your request.

You may designate an authorized agent to submit a request on your behalf. We may require proof of authorization and identity verification.

11.3 Residents of Other States

Privacy laws are evolving across the United States. Residents of states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) may have similar rights, including rights to access, correct, delete, and opt out. If you are a resident of a state with applicable privacy legislation, please contact our Privacy Officer (Section 13) to exercise your rights, and we will respond in accordance with the applicable law.

11.4 Nevada Residents

Under Nevada law (NRS 603A), you may submit a request directing us not to sell your personal information. As stated above, we do not sell your personal information.

12. Children's Privacy

We do not knowingly collect personal information from children under the age of 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If we become aware that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will take reasonable steps to delete the information as soon as possible. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact our Privacy Officer (Section 13).

13. Contact Us and Complaints

For any privacy questions, concerns, access/correction requests, or complaints, contact our Privacy Officer:

Privacy Officer Backpack Bed for Homeless Inc. 603 Cobert Ln, Franklin Nashville, TN 37064 United States

Email us via our website https://BackpackBed.org/us)

We will acknowledge your inquiry promptly and aim to respond within 30 days (or within shorter timeframes where required by applicable state law). If you are not satisfied with our response, you may file a complaint with the applicable regulatory authority, including:

• Federal Trade Commission (FTC): ftc.gov
• Tennessee Attorney General — Consumer Protection Division: tn.gov
• California Attorney General (for CCPA/CPRA matters): oag.ca.gov
• Your state attorney general's office, as applicable

14. Changes to This Policy

We may update this policy to reflect changes in our practices, legal requirements, or technology. Updates will be posted on our website with a revised date. Significant changes may be communicated by email or website notice. Your continued interaction with us after changes constitutes acknowledgment of the updated policy. Where required by law (e.g., CCPA/CPRA), we will provide notice of material changes at least as prescribed by applicable statute.

15. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the State of Tennessee and the United States of America. To the extent permitted by law, you agree to submit to the exclusive jurisdiction of the state and federal courts located in Davidson County, Tennessee in relation to any dispute arising out of or in connection with this Privacy Policy or our handling of your personal information.

Nothing in this clause limits your right to file a complaint with the Federal Trade Commission (FTC), your state attorney general, or any other regulatory body with jurisdiction under applicable law. Nothing in this clause is intended to limit any rights you may have under applicable state privacy statutes that cannot be waived by contract.

Thank you for supporting Backpack Bed for Homeless Inc. Your compassion for people sleeping on the street inspires everything we do. We are honoured by your trust — in our mission and in the way we handle your personal information.

Backpack Bed for Homeless Inc. EIN: 46-5748662 updated 21 February 2026.