Privacy Policy

Data Privacy and Personal Information Protection Policy

Effective Date

2/20/2025

Approved By

Board of Directors, KMT2C Foundation

Next Review Date

2/20/2027

1. Purpose

The purpose of this Data Privacy and Personal Information Protection Policy (“Policy”) is to establish principles and requirements governing the collection, use, retention, protection, and deletion of personal information by KMT2C Foundation (“the Foundation”). This Policy reflects the Foundation’s commitment to ethical data practices and compliance with applicable privacy laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA).

2. Scope

This Policy applies to:

• The Foundation’s Board of Directors
• Officers, employees, contractors, and volunteers
• All personal information collected or processed by or on behalf of the Foundation

This Policy covers personal information collected through websites, forms, email communications, and other engagement channels operated by the Foundation.

3. Definitions

• Personal Information / Personal Data: Information that identifies or relates to an identifiable individual, as defined under applicable privacy laws.
• Processing: Any operation performed on personal information, including collection, storage, use, disclosure, or deletion.
• Data Subject: An individual whose personal information is processed by the Foundation.

4. Data Minimization and Categories of Information Collected

The Foundation adheres to principles of data minimization and purpose limitation.

4.1 Categories of Personal Information Collected

The Foundation collects only the following categories of personal information:

• Name (required)
• Optional location information, limited to:
  • City
  • State or province
  • Country

The Foundation does not collect genetic data, health data, biometric data, financial information, precise geolocation data, or government-issued identifiers through general communications or public-facing forms.

5. Purpose of Processing

Personal information is processed solely for purposes aligned with the Foundation’s non-profit mission, including:

• Communicating regarding research initiatives, programs, events, or organizational updates
• Understanding general geographic interest in the Foundation’s activities
• Maintaining internal administrative and engagement records

The Foundation does not sell or share personal information for commercial purposes or targeted advertising.

6. Legal Basis for Processing

6.1 GDPR Lawful Bases

Where GDPR applies, the Foundation processes personal data based on one or more of the following lawful bases:

• Consent, where voluntarily provided
• Legitimate interests, specifically the operation and promotion of a non-profit genetic research accelerator, provided such interests are not overridden by individual rights and freedoms

7. Data Sharing and Disclosure

The Foundation does not sell or share personal information within the meaning of the CCPA/CPRA.

Personal information may be disclosed only:

• To service providers performing services on behalf of the Foundation under written agreements requiring confidentiality and data protection
• To comply with applicable laws, regulations, subpoenas, or lawful      governmental requests

8. Data Retention and Deletion

Personal information shall be retained only for as long as reasonably necessary to fulfill the purposes outlined in this Policy or as required by law.

• Optional location information may be removed upon request at any time.
• Upon receipt of a verified written deletion request, the Foundation will delete the individual’s personal information unless retention is legally      required.

Deletion Requests

Requests for deletion must be submitted in writing to:

info@kmt2c.org

9. Individual Privacy Rights

9.1 GDPR Rights

Where applicable, individuals have the right to:

• Access their personal data
• Request correction of inaccurate data
• Request erasure
• Restrict or object to processing
• Data portability, where applicable
• Lodge a complaint with a supervisory authority

9.2 CCPA/CPRA Rights (California Residents)

California residents have the right to:

• Know what personal information is collected, used, or disclosed
• Request deletion of personal information
• Request correction of inaccurate personal information
• Not be discriminated against for exercising privacy rights

The Foundation does not collect sensitive personal information as defined by the CPRA.

10. Information Security

The Foundation shall implement reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction.

11. Children’s Privacy

The Foundation does not knowingly collect personal information from children under the age of 13, or under 16 where required by applicable law. Any such information identified will be promptly deleted.

12. International Data Transfers

Where personal information is transferred across national borders, the Foundation will take reasonable steps to ensure appropriate safeguards are in place in accordance with applicable data protection laws.

13. Governance and Oversight

The Board of Directors has oversight responsibility for this Policy. Management is responsible for implementation, training, and compliance.

This Policy shall be reviewed periodically and updated as necessary to reflect legal, regulatory, or operational changes.