Introduction
The Rainforest Alliance (“Rainforest Alliance”, “we”, “us” and “our”) places a high priority on protecting your privacy.
This Privacy Policy (the “Privacy Policy”) describes how we handle the personal information we collect and process. The Privacy Policy applies to the programs and services that we provide, as well as your use of our websites, mobile and web apps or platforms, and any other services that link to or refer to the Privacy Policy (such programs and services, collectively, our “Services”).
Personal information is processed by or on behalf of the controller:
Rainforest Alliance
27 East 28th St, 8th floor
New York, NY 10016
USA
Information We Collect and Receive
Depending on your interactions with our Services, we may collect and/or receive personal information about you in a few different ways.
Information you (and others) give us
We will collect the personal information that you provide directly to us. We may also collect personal information provided to us by your organization, our business partners, or our suppliers.
Website visitors and other online users
- When you contact us, for instance, by email or filling out a form on our website such as our newsletter subscription, you may give us your personal information such as your name, telephone number, email address, physical address, and other demographic information;
- When you donate funds online, you give us your billing information such as credit card data;
- When you otherwise contact us online, for instance, through social media pages; or
- When you register to create an account in our mobile or web apps or platforms, you may give us personal information such as your name, title, telephone number, email address, physical address and organizational affiliation.
Donors
- When you send us a check or make a donation by phone, we keep a record of the donation; or
- When you meet with us in person at events or meetings, we may collect and process personal information about you for fundraising purposes.
Certification program participants and auditors
- Participants in the Rainforest Alliance Sustainable Agriculture Standard certification and traceability scheme, the UTZ certification program, other certification programs, or assurance programs (collectively, “Certification Program”), provide data to us through the certification auditing or review process (directly and/or through a certification body), through use of our certification and traceability apps (such as RACP/MultiTrace), and through the trademark or label approval process, as required by our Certification Program standards, policies and rules (our “Standards”).
- Certification bodies (“CBs”) provide data to us through the CB authorization and audit processes and through use of our certification and traceability and CB management apps.
- Personal information provided to us includes name and contact details such as title, telephone number, email address, physical address and organizational affiliation as well as demographic and location data (in the case of farmers or farm groups) as required by our Standards.
Other program participants
- If you are a program participant (other than our Certification Program), we may collect personal information about you, such as your name, contact details and organizational affiliation, for program delivery and impact tracking purposes.
Candidates for positions
- When you submit personal information as part of an inquiry for or submission of an application for a position at Rainforest Alliance.
Others who contract or partner with us
- When you contract with us, receive a grant from us, make a grant to us, participate in trainings, workshops or meetings with us, supply us with goods or services, or otherwise partner with us.
Information we process about you may include the following list of data elements:
- Contact details including: your name; home and business addresses; email addresses; phone numbers; facsimile number; instant messaging contact; or any other details contained in an email signature.
- Education and professional qualifications and professional and employment information including: degrees and schooling information; licenses and professional memberships; occupation or title; and service fees or other compensation.
- Payment processing related information including: bank account number; taxpayer identification number or social security number; digitized or electronic signature; and credit card information.
- Personal characteristics including: age; date of birth; gender; marital status; nationality; leisure and interests; language preferences; and photographs, videos and audio recordings.
- Other information: In addition to the above, we may collect other information for specific purposes. For example, we may collect geolocation data for farmers or farm group members participating in our certification schemes or sustainability programs to check for deforestation risks. If we apply for a visa on your behalf, we may collect passport information. If you make a large donation to us, we may conduct a criminal or background check for due diligence purposes. We may collect information about consumer products purchased in relation to our special events. We may collect income or salary information for special events, fundraising purposes or for purposes related to research and evaluation of our programs. When we publish editorial content about or conduct research and evaluation on our programs, we may collect information about an individual’s economic, familial, cultural or social identity.
Information We Collect Automatically
We also collect or receive certain information automatically, such as online usage and log data, when you visit or use our websites, mobile or web apps or platforms, or other online Services (collectively, our “Online Services”).
We may collect some of this information using cookies, web beacons, and other technologies. When you visit our website, you will receive a one-time cookie pop up consent wherein you are given the opportunity to consent to the use of cookies. Should you decide not to consent to the use of cookies, some functionality of our Online Services may not work properly. Should you consent to the use of cookies, depending on how you access and use our Online Services, we may receive:
- Log information. This is information that is automatically collected and stored when you use our Online Services or the websites and apps of our business partners and affiliates, for example:
- Information about your interactions with the websites, apps, platforms and other services you use, the content you view, the search queries you submit, and information in cookies and similar technologies; and
- Information about how you access those websites, apps, platforms and other services, your browser or operating system, your Internet Protocol (IP) address, and the sites you visited before using our Online Services.
- Device information. This is information we automatically collect and store about the device used by you use when accessing our Online Services — for example, the type of device used by you and certain device identifiers which may be unique to your device.
- Location information. This information may include information about your location derived from your IP address if you are on a computer, or your mobile device’s more precise geolocation information.
Most web browsers accept cookies automatically but can be configured not to do so or to notify the user when a cookie is sent. If you wish to disable cookies, please refer to your browser’s help section. Please note that you may need to take additional steps beyond changing your browser settings to refuse or disable cookies and similar technologies.
Read our comprehensive Cookie Policy.
Google Analytics
We also collect information via Google Analytics to understand how visitors use our website and create reports of website visitation trends. The analytics features we have implemented are Google Analytics Demographics and Interest Reporting, AdWords Remarketing, and Google Display Network Impression Reporting. Visitors can learn about Google’s practices here and may opt-out of Google Analytics by downloading the Google Analytics Opt-out Browser Add-on.
Other information
We may receive other information about you that is publicly or commercially available and combine that with the information we have collected or received about you in other ways. We may receive information about you when you choose to connect with social networking websites while using our Online Services.
How We Use the Information We Collect and Receive
We use the information we collect and receive for the following purposes:
- Processing the information is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, or
- The processing is necessary for the purposes of a legitimate interest, or
- Processing is necessary for compliance with a legal obligation, or
- You have given consent to the processing of your personal information for one or more specific purposes.
More specifically, we collect and receive personal information for the following purposes:
To provide our Services and to enforce any applicable terms and conditions. We use the personal information we collect and receive to provide our Services, as needed in order to enter into or enforce applicable terms, and to enter into and manage contractual relationships and obligations when you do business with us.
To communicate with you. We use the personal information we collect and receive to communicate with you about Rainforest Alliance’s work, including updates on our programs, projects and services, new features of our Online Services, invitations to special events, and opportunities to contribute financially. You may choose to opt out any time you receive this type of information from us. We also use the information we collect and receive to communicate with you about your accounts, changes to our policies and terms, or to respond when you contact us.
To improve our Services. We use the personal information we collect and receive to provide information or content you or other users of our Services are likely to find relevant and engaging. We may also use this information to conduct surveys to measure your satisfaction with our Services, which we use to improve our Services. Information collected will allow us to adjust and improve our Services to your wishes and needs and to prepare anonymized statistics about the use of our Services. Using this information to improve our Services is in our legitimate interest.
To provide effective advertising. You may receive advertising on third-party websites and apps such as Google AdWords, Facebook, and Instagram. We use the personal information we collect and receive to advertise and to make the advertising we provide more effective, which is in our legitimate interest. Some of the ways we do this are:
- Showing you ads based on your online activities, such as website content you view and other interactions you have with our websites (including subscribing to our newsletters), your geographic location, the languages you speak, the keywords that you use in search engines, the types of social media content that you “like” and/or follow;
- Limiting the number of times you see the same ad; and
- Measuring the effectiveness of the ads you see.
For administrative purposes. We use the personal information you provide for administrative purposes, such as assessment and acceptance of suppliers, contractors or business partners. We also use your personal information to confirm and verify your identity and for due diligence and screening purposes, for example, checking against government sanctions lists.
To fulfill our legal or regulatory obligations. We use the personal information we collect and receive to comply with applicable law, respond to valid legal process, or for other legal reasons, including to protect our organization or our Services.
How We Share the Information We Collect and Receive
We may share the personal information we collect or receive from you or about you with third parties to provide products and services you have requested, when we have your consent, or as described in this Privacy Policy.
We may share information with:
- Affiliates. The personal information received by one Rainforest Alliance affiliate can be shared among other Rainforest Alliance affiliates.
- Your organization. When you create an account or do business with us as an employee, affiliate or member of an organization, we may share your information with your organization. For example, if you are a company employee registered in our certification and traceability apps, your username and transaction details may be shown to others within your company.
- Business partners and other stakeholders. We may share information with select business partners with whom we have business relationships, such as organizations who collaborate with us in projects and partnerships, as well as funders, grantees and subgrantees for projects and programmatic activities.
- Certification program. In addition to certification-related information made available to the general public as part of public summaries, we share information received through our Certification Program (including contact information) with select third parties such as auditors and CBs in order to support the Certification Program, in accordance with our Certification Program standards, policies and rules. For example, we may share information with auditors to confirm certification audit data. We may also share anonymized and aggregated certification-related information with third party researchers.
- Online training platform. All information collected or received by us in the Rainforest Alliance Learning Network is used to measure the impact of this platform and the training content offered on it. To that end, we will provide learning-related information, such as the level of completion of courses and grades earned, to trainers, impact evaluators, the participants themselves and, in some cases, their employers. In addition, the Rainforest Alliance may share de-identified, aggregate information on participants’ performance data with select business partners for impact demonstration purposes.
- Service providers. Companies or individuals that provide services to the Rainforest Alliance or act on our behalf may have access to personal information about you. For example, we may disclose or provide access to information to consultants, IT vendors, vendors who collect or make payments for services, donations or royalties, and professional advisors such as auditors and attorneys. These service providers are limited in their ability to use information they receive in the course of providing their services to us and may not use information for any purposes other than the services for which we have engaged them.
- Third Parties that provide content, advertising services, or functionality within our Online Services. Some of the content, advertising, and functionality within our Online Services may be provided by third parties that are not affiliated with us. Such third parties include:
- Advertising providers, which help us provide ads that are tailored to users’ interests and understand how users respond to those ads; and
- Audience-measurement companies, which help us measure the overall usage of our Online Services and compare that usage to other online services.
- Some of these companies may participate in industry-developed programs designed to provide consumers with choices about whether to receive targeted ads. To learn more, please visit the websites of the Network Advertising Initiative and the Digital Advertising Alliance.
- Other parties in response to valid legal process or when necessary to protect our organization or our Services. We may disclose your personal information to other parties, such as judicial, governmental or regulatory bodies, if:
- It is necessary to respond to lawful governmental requests or legal processes (for example, a court order, search warrant, or subpoena);
- The personal information is relevant to a crime that has been or is being committed;
- An emergency exists that poses a threat to your safety or the safety of another person; or
- It is necessary to protect the rights or property of the Rainforest Alliance.
- Change of control. In the event that the ownership of the Rainforest Alliance or an affiliate or their assets changes as a result of a merger, acquisition, reorganization, sale, transfer or other disposition of assets, or in the unlikely event of a bankruptcy, your personal information may be transferred to another company.
- Aggregate information. We may aggregate and/or de-identify personal information such that it is no longer linked to an individual. This Privacy Policy does not limit our ability to disclose aggregated or de-identified information that is not linked to you. We may use and disclose such non-personally identifiable information to donors, partners, stakeholders and any other third parties in our discretion for marketing, advertising, research, impact reporting, or other legitimate business purposes.
Cross-Border Data Transfers
The Rainforest Alliance is a global organization, with affiliates, suppliers and business partners located throughout the world, which means that your personal information may be transferred, stored, and processed outside of the country or region where it was initially collected. Please be advised that your personal information may be transferred outside the country of your residence to a country that may not have laws with the same levels of protections as those of your home country. For data subjects whose data was collected in the European Economic Area (EEA) or the United Kingdom (UK), please note that we may transfer your personal information to third countries outside of the EEA and the UK, which the European Commission (EC) or the UK data protection authorities may not have deemed “adequate” for information security purposes, including the United States (“Third Countries”). We have in place appropriate and reasonable measures for the transfer of such personal information, including contractual measures requiring the protection of personal information. For personal information transfers out of the EEA or the UK to Third Countries, we rely on the EC’s Standard Contractual Clauses. If you require more information about our data transfer mechanisms, please contact LegalTeam@ra.org.
Our Commitment to Security
We employ appropriate and reasonable administrative, technical and organizational measures to protect your personal information against loss or against any form of unlawful processing and shall impose such security obligations on any data processor we enlist. For example, we, or our data processor(s), shall use servers that have been placed in a controlled, secure environment, protected against unauthorized access.
Children’s Privacy
Our Online Services are intended for a general audience. We do not knowingly collect, use, or disclose personal information from children under the age of 16 without prior parental consent, except as permitted by the Children’s Online Privacy Protection Act (COPPA). If you are a parent who consents to the collection of personal information from your child, you agree that your child may use all of our Online Services and that we may collect, use, and disclose your child’s personal information consistent with this Privacy Policy.
Records Retention
Rainforest Alliance keeps records only for as long as they are needed for us to conduct our business and to comply with our legal obligations. We adhere to our Records Retention and Management Policy to determine which records shall be retained and for how long. A copy of our Records Retention and Management Policy can be obtained by contacting LegalTeam@ra.org.
Data Subject Rights
Subject to applicable law, you may have the following rights:
- The right to withdraw consent to our processing of your personal data at any time
- Receive a copy of or access to your personal data
- Request a copy of your personal data to be sent to a third party
- Restrict processing of your personal data
- Rectify or correct your personal data
- Ask us to erase your personal data or delete it
To exercise the rights outlined above, you can contact us at the physical address and/or email provided below:
Rainforest Alliance 27 East 28th St, 8th floor New York, NY 10016 USA LegalTeam@ra.org
We will respond within one month (or any earlier period required by law) by: 1) complying with your request as soon as practicable; or 2) providing to you an explanation regarding our inability to comply with your request based on our legal obligations. If your request is complex, we may extend this period by an additional two months (or any shorter period if required by law), and you will be informed about any such extension within the initial period.
If you withdraw your consent, we will discontinue the processing of your personal information upon receipt of your withdrawal. However, any processing performed prior to your withdrawal remains a legitimate processing based on a valid consent at the time. We will not be under the obligation to reverse the processing. Please also note that withdrawing consent or choosing to delete some types of personal information may prevent us from providing services or programs to you or responding to your queries. In order to better protect you and safeguard your personal information, we may take steps to verify your identity before granting access or making changes to your information.
If you are in the EEA, you have the right to lodge a complaint with an EU supervisory authority should you feel that we have violated any of your rights as provided under the GDPR.
If you are outside the EEA, you may have the right to lodge a complaint with your local authority responsible for personal data protection.
How to Contact Us
If you have questions or concerns about this Privacy Policy or about Rainforest Alliance’s privacy practices in general, please contact us at:
Rainforest Alliance 27 East 28th St, 8th floor New York, NY 10016 USA LegalTeam@ra.org
Changes to This Privacy Policy
We may update this Privacy Policy from time to time, and so you should review it periodically. If there are significant changes to Rainforest Alliance’s information practices, you will be provided with appropriate online notice.
Translation disclaimer
Rainforest Alliance’s website is originally published in English and contains information translated into other languages by third party translators. Translations are provided as a service to our website visitors and are provided “as is”. Rainforest Alliance makes no warranty of any kind, either expressed or implied, as to the accuracy, reliability, or correctness of any translations from English into any other language. Any discrepancies or differences arising from translations are not binding and have no legal effect. If any questions arise regarding the accuracy of any translated materials, please refer to the original English version.