Effective Date: October 1, 2023
Orr Group (“we”, “us”, or “our”), is a consulting firm, specializing in serving nonprofits and is located in Washington, DC, and New York City, NY.
This statement applies regardless of how our website is accessed and will cover any device by which we make our website available, or you choose to access our website.
Personal Data is data or information that is identified or identifiable with a natural person (“Personal Data”). It may include your name, your email address, your physical address, your telephone number, usernames, and other information that may be used to identify you. A list of the types of Personal Data we collect can be found in Section D.1.
Though Orr Group is not subject to the same legal requirements with regard to this data, we strive to maintain the same level of care for all of the data we handle.
We do not collect the following information:
If we ever do collect any of the above-listed information, we will seek your consent where we are legally required to do so.
B. Data Controllers & Data Processors
A Data Controller determines why and how the data is processed (“Data Controller”). Processing is described in further detail below.
A Data Processor performs the processing actions on the data that it is given (“Data Processor”). Where we serve as a Data Processor for our [clients], we are responsible for the operations, which may include the collection, use, storage, disclosure, analysis, deletion or modification of data, performed on the Personal Data that our [clients] provide to us, at the direction of our [clients].
Where we serve as a Data Processor, it is our [clients], not Orr Group, who determine how and why Personal Data submitted to us is used. When we serve as a Data Processor, our processing activities are governed by a contract signed by us and our [client], and our [clients] may be responsible for disclosing to you what information is collected, the legal basis for collection, and your rights, when required by law.
Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act, Orr Group, where Orr Group processes Personal Data for a [client], we are referred to as a Service Provider.
C. Your Data Rights
Orr Group is committed to the data protection principals of lawfulness, fairness, and transparency. If you, your data, and Orr Group are covered by a specific data protection law or regulation, you may have certain rights with regard to your Personal Data. We have provided a summary of these rights (“Data Rights”) for your reference:
Please note that these rights are not absolute and certain exemptions may apply to the requests you submit to us. The rights do not apply to all of the data we collect, store, and use, nor may every individual exercise these rights with regard to their Personal Data.
D. How Orr Group Collects Your Data
Where we serve as the Data Controller, the categories of Personal Data that we collect include:
When we serve as a Data Processor, our [clients] may also provide us with the Personal Data they control.
We use your Personal Data for the following general purposes:
When we serve as a Data Controller, our collection and use of your Personal Data is based on one or more of the following legal bases:
Where Orr Group serves as the Data Processor for one of our [clients], our [client] is responsible for determining the legal basis for processing your Personal Data.
We send cookies to your web browser when you visit our website. Cookies are small pieces of data that websites store on a device, that are used to collect information about you and your visit to our website (“Cookies”). Cookies can improve your browsing experience because they help our website remember your preferences to offer you a more personalized experience. They also help us understand how visitors are using our website. Cookies may be set by us or by our third-party partners. For more information about Cookies, please visit https://allaboutcookies.org/.
Our website may collect the following types of cookies:
You can disable cookies in your browser settings; however, some of our website features may not function properly as a result.
E. Data Storage & Retention
Your data is stored and processed on servers in the United States, and Orr Group accesses the data from the United States.
Cookies may be kept for varying lengths of time, depending on the type of Cookie. Generally, Cookies fall into one of two categories:
F. Disclosure of Personal Data
Orr Group may disclose your Personal Data to our contracted service providers so that they can provide us with services, which may include IT and system administration and hosting.
We may provide your Personal Data to our third-party partners in a way that constitutes “selling” or “sharing” under a relevant data privacy law as necessary for our business purposes, including providing targeted advertising. This disclosure does not mean that we have actually sold or shared your specific Personal Data, or that we intend to sell or share your specific Personal Data in the future for any reason, including targeted advertising.
If you, your data, and Orr Group are covered by a specific data protection law or regulation, you may be entitled to opt-out of the sale or sharing of your Personal Data and/or sharing of your data for Targeted Advertising. To do so, please follow the procedure described in Section H.
G. Data Transfers
Our webservers and hosting services are located in the United States. Personal Data you provide while located in the European Union (“EU”), the European Economic Area (“EEA”), the United Kingdom (“UK”), or in another international jurisdiction, may be transferred to the United States. If we transfer information from the EU, EEA, UK, or another country with cross-border transfer obligations, our service providers use Binding Corporate Rules, Standard Contractual Clauses, or other approved transfer mechanisms.
H. Exercising Your Data Rights
This section explains how you may exercise your Data Rights (described in Section C, above), when you are entitled to do so. The Data Rights and processes described in this section do not apply generally, and nothing in this section is intended to extend the Data Rights to you, or an admission that Orr Group is required to comply with any specific data protection law or regulation. Additionally, Orr Group is only required to respond to any requests you make when it is serving as the Data Controller—in cases where Orr Group is the Data Processor, you must reach out to the Data Controller to exercise your rights.
If you are unsure if you and/or our Personal Data fall under a specific data protection law, please review the scope of the data privacy laws or consult with an attorney.
If you, your data, and Orr Group are covered by a specific data protection law or regulation, and wish to make a request or objection based on a Data Right, please contact us at the contact information listed in Section I. We may ask for additional information to verify your identity before we act on a request or objection.
We have at least 30 days to respond to your request or objection from the date we receive it and will alert you if we exercise our right to take additional time to process your request. Please note that we may retain a copy of your communications, including your name and contact information, to help us resolve any issues you raise.
Where Orr Group serves as the Data Processor, please reach out to the Data Controller to exercise any rights to which you may be entitled.
If you, your data, and Orr Group are covered by a specific data protection law or regulation, and we refuse to take action on your request to exercise your Data Rights, we will provide you with a notification and the reason for our refusal. You may also be entitled to appeal our decision. If you choose to appeal our decision, please email us at the email address in Section I with “APPEAL” and your first and last name written in the subject line.
If you have any complaints about the way we handle your personal data, please contact us so we may resolve the issue.
If you, your data, and Orr Group are covered by a specific data protection law or regulation, and you are unsatisfied with our response, or you do not believe that we can assist you with your complaint or concern, you may also have the right to lodge a complaint a government authority:
I. How to Contact Us
Orr Group, Inc
3000 K Street NW, Suite e280
Washington, DC 20007