Privacy Policy

1. Who We Are

Monticello Institute for Advocacy is a limited liability company (LLC) operating as a nonprofit entity and currently pursuing federal tax-exempt status under Section 501(c)(3) of the Internal Revenue Code.

Principal Address:
1235 East Blvd., Ste E, PMB 2272
Charlotte, NC 28203
Contact Information:


2. Information We Collect

We collect the following types of personal information:

A. Information You Provide Voluntarily

  • First and last name
  • Email address
  • Phone number
  • Mailing address (including street, city, state, zip/postal code)

This information is collected when you:

  • Contact us via form, email, mail, or phone
  • Subscribe to our newsletter
  • Make a donation or payment
  • Request information or services

B. Information Collected Automatically

We use standard analytics tools to automatically collect:

  • IP address
  • Browser type
  • Pages visited
  • Referring site
  • Date and time of visit
  • Clickstream behavior

This data is collected using:

  • Google Analytics
  • Google Ads tracking pixels
  • Facebook/Meta remarketing pixels
  • LinkedIn remarketing pixels
  • MailChimp email pixel tracking
  • reCAPTCHA to detect and prevent spam

3. Use of Personal Information

We may use the personal information we collect from you for a variety of business, operational, and compliance purposes. These include, but are not limited to, the following:

A. Respond to Inquiries and Provide Services

We use your information to respond to your messages, requests for information, or service inquiries submitted through our contact forms, email, phone, fax, or postal mail. This includes:

  • Answering general questions about our nonprofit initiatives
  • Providing requested resources, educational materials, or publications
  • Assisting with accessibility, public records navigation, or other forms of administrative advocacy
  • Following up on any direct communication initiated by you

B. Send Newsletters, Alerts, or Educational Updates (If Explicitly Opted-In)

If you have subscribed to our mailing list or opted in to receive communications:

  • We will use your name and email address to send newsletters, policy updates, blog digests, or educational alerts aligned with our mission
  • You may unsubscribe at any time using the “unsubscribe” link in each email or by contacting us directly at [email protected]

We do not send unsolicited marketing emails, and we do not sell, trade, give, or rent your contact information to third parties except where explicitly required by law.

C. Process Donations, Payments, and Financial Transactions via PayPal

If you make a donation or contribute financially to the Monticello Institute for Advocacy:

  • Your name, contact details, and payment data are collected to process the transaction securely via PayPal, our third-party payment processor
  • We use this information to send payment confirmations, donation receipts, and, where appropriate, acknowledgments or tax-related documentation once tax-exempt status is recognized

We do not store your credit card or bank account numbers on our servers.

D. Improve Website Functionality and User Experience

We analyze aggregated data from web traffic tools like Google Analytics to:

  • Monitor site performance, traffic sources, and user behavior
  • Understand what content is most visited or requested
  • Identify usability issues or accessibility barriers
  • Inform future site updates or redesigns

This helps us ensure that our site remains usable, informative, and accessible to all, especially those navigating public systems with disabilities or limited digital access.

E. Conduct Remarketing, Targeted Outreach, and Awareness Campaigns

To further our educational mission and public visibility, we may use:

  • Google Ads and Facebook/Meta pixels to serve targeted ads to visitors who have previously engaged with our site or content
  • Email retargeting via MailChimp to send relevant updates to subscribers based on prior interaction (e.g., clicking on a disability rights post)
  • Demographic or interest-based data (in aggregate only) to refine messaging and reach underserved populations

You can opt out of such targeting via your browser settings or by visiting Network Advertising Initiative opt-out.

F. Maintain Legal, Regulatory, and Ethical Compliance

We may use or disclose your personal information as necessary to:

  • Comply with legal obligations under applicable federal, state, or international law
  • Respond to lawful requests by public authorities, including to meet national security or law enforcement requirements
  • Fulfill nonprofit reporting requirements (e.g., donation tracking, grant audit trails)
  • Enforce our Terms of Use or defend against claims in legal proceedings
  • Maintain accurate records for IRS, state charity regulators, or other governing bodies related to our 501(c)(3) application or nonprofit status

4. Legal Basis for Processing (GDPR)

If you are a resident of the European Union (EU), the European Economic Area (EEA), or the United Kingdom, we process your personal data only where we have a lawful basis to do so under the General Data Protection Regulation (GDPR) or the UK GDPR, as applicable.

The legal bases on which we rely include the following:

A. Consent (Article 6(1)(a) GDPR)

We process certain personal data based on your explicit and freely given consent. This applies, for example, when:

  • You subscribe to our email newsletter or updates via a sign-up form
  • You agree to the use of cookies or tracking pixels via a cookie consent banner
  • You check a box affirming that you wish to be contacted or to receive specific resources
  • You participate in a voluntary survey, feedback form, or advocacy campaign

You have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You may do so by clicking “unsubscribe” in our emails or by contacting us at [email protected].


B. Contractual Necessity (Article 6(1)(b) GDPR)

We may process your personal data where it is necessary to fulfill a contractual obligation or to take steps at your request before entering into a contract. This may include:

  • Providing services you have requested, such as follow-up communications after a contact form submission
  • Processing a donation and delivering a confirmation or acknowledgment
  • Registering you for a webinar, workshop, or advocacy event and sending necessary participation details

This basis ensures we can deliver the services you expect in a reliable and consistent manner.


C. Legal Obligation (Article 6(1)(c) GDPR)

In certain cases, we are legally required to process your personal information to comply with:

  • Tax laws, charity compliance, and financial recordkeeping obligations (e.g., tracking donation receipts)
  • Transparency or accountability reporting to government authorities
  • Requirements imposed by state, federal, or EU regulations (e.g., sanctions compliance, data access logs)

We will retain only the minimum amount of personal data necessary to satisfy these legal obligations and will not use such data for any unrelated purpose.


D. Legitimate Interests (Article 6(1)(f) GDPR)

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms. These interests include:

  • Enhancing the security, performance, and usability of our website
  • Understanding how our site and content are being accessed to improve educational offerings
  • Promoting our nonprofit mission through outreach, remarketing, or analytics
  • Preventing fraud, spam, and malicious activity (e.g., use of Google reCAPTCHA)

When relying on this basis, we conduct a balancing test to ensure that our interests do not unfairly infringe on your privacy rights.


Right to Object

If we process your personal data based on legitimate interest, you have the right to object to such processing under Article 21 of the GDPR. You can do so by contacting us at [email protected]. We will assess your request and cease processing unless we can demonstrate compelling legitimate grounds to continue.


5. Sharing, Disclosure, and Third-Party Access

We respect your privacy and your right to control your personal information. Accordingly:

We do not sell, trade, or give away your personal data

We do not, and will not, sell, rent, trade, license, lease, or otherwise disclose your personal information to third parties for their own commercial gain, advertising purposes, or data monetization activities.

We do not participate in any data brokerage, cooperative databases, or information exchanges. We do not give away data to partners, affiliates, or advertisers.

  • Google Analytics & Google Ads – for tracking website usage metrics, page interactions, and displaying remarketing content to users who have previously visited our site.
  • MailChimp (Intuit) – to manage email campaigns, newsletter subscriptions, and mailing list preferences for users who opt in.
  • PayPal – to securely process donations and payments you initiate through our website.
  • WordPress, hosting, DNS, CDN, and security providers – to operate, secure, and maintain the website’s functionality and infrastructure.

We provide these third parties only with the minimum amount of data necessary for them to perform their designated functions, and no more.

Contractual Safeguards

Each third-party data processor with whom we work is:

  • Bound by a legally enforceable Data Processing Agreement (DPA) or equivalent contract
  • Prohibited from using your data for any secondary purpose
  • Required to implement strong data protection and security measures in accordance with applicable privacy laws

We carefully vet all vendors for data protection standards and ensure compliance with GDPR, CCPA, and CPRA.

Required Disclosures by Law

We reserve the right to disclose personal information if:

  • Required to do so by applicable law, regulation, legal process, subpoena, or valid government request
  • Necessary to establish, exercise, or defend legal claims or to protect the rights, property, or safety of the Monticello Institute for Advocacy, its users, or the public

However, unless prohibited by law, we will make reasonable efforts to notify affected users before disclosing personal data in response to a legal demand.


6. Cookies & Tracking Technologies

We use cookies and similar technologies to enhance your browsing experience, improve the performance of our website, and support the core functionality of our digital services. These technologies include cookies, pixels, tags, beacons, scripts, and device/browser fingerprinting tools.

A. What Are Cookies?

Cookies are small text files placed on your device by a website or third-party service when you visit a page. They store user-specific information such as preferences, login status, or tracking identifiers. Some cookies are temporary (“session cookies”) and expire after you leave the site; others are persistent and remain until manually deleted or expired.


B. How We Use Cookies and Tracking Technologies

We use first-party and third-party cookies, along with related technologies, for the following purposes:

1. Site Analytics and Performance Monitoring

We use cookies set by Google Analytics and similar services to:

  • Measure and analyze traffic sources, page views, bounce rates, and time on page
  • Understand visitor behavior, popular content, and site usability
  • Monitor site stability, speed, and errors

This helps us continually refine our content and accessibility offerings.

2. Remarketing and Behavioral Advertising

We use Google Ads, Meta/Facebook Pixel, and MailChimp email tracking pixels to:

  • Serve targeted ads to users who previously visited our website
  • Deliver relevant educational outreach to segments based on activity
  • Remind users about unfinished signups or engagement opportunities

These tracking tools may use pseudonymous identifiers (e.g., cookie ID, device ID) but do not include directly identifying information unless you have voluntarily provided it (e.g., by subscribing).

3. Authentication and Bot Protection

We employ a reCAPTCHA to detect and prevent malicious form submissions and protect our site from automated abuse. This tool uses:

  • Device behavior analysis (mouse movements, click patterns)
  • IP address and browser fingerprinting
  • Referrer and session timestamps

This protects both us and our users from fraudulent access, spam, and DDoS-style activity.


C. Types of Cookies We Use

TypePurposeDuration
Strictly NecessarySecurity, reCAPTCHA, load balancingSession or short-term
Performance & AnalyticsGoogle Analytics, traffic dataPersistent
FunctionalSave preferences, contact form memorySession or persistent
Marketing & RetargetingGoogle Ads, Meta Pixel, MailChimpPersistent

D. Your Choices and Opt-Out Options

You have the right to control how cookies are used on your device. You can:

  1. Adjust your browser settings to refuse or delete cookies:
    • Most modern browsers allow you to block some or all cookies and set alerts for when cookies are placed.
    • Blocking cookies may affect the functionality of some features.
  2. Use opt-out tools provided by third parties:
  3. Disable or delete cookies manually in your browser or through a browser extension.

E. Consent and Notice (GDPR/CPRA Compliance)

For visitors from the EU/EEA or California, we respect your rights under GDPR, CCPA, and CPRA. You may:

  • Decline non-essential cookies upon visiting the site
  • Review and change your cookie preferences at any time
  • Request to view, correct, or delete any associated data under our Contact form

We do not track users across third-party websites over time for behavioral profiling purposes outside of our educational remarketing efforts, and we honor “Do Not Track” browser signals where technically feasible.


7. Data Retention

We retain personal information only for as long as is reasonably necessary to fulfill the purposes outlined in this Privacy Policy, or as required to meet our legal, regulatory, contractual, and ethical obligations. The duration for which we keep your data depends on several factors, including the nature of the data, the purpose for which it was collected, and any applicable legal or operational requirements.

A. Purpose-Based Retention

We may retain your personal information for the following durations, based on its use case:

  • Communications and Inquiries: We retain contact form submissions, email correspondence, and other inquiries for up to 36 months to ensure appropriate follow-up, resolve disputes, or provide historical context in recurring matters.
  • Email Subscriptions and Newsletters: We retain your email address and subscription preferences until you unsubscribe, request deletion, or the mailing list is purged for inactivity (typically every 2 years).
  • Donor and Payment Records: We retain donation and transaction data for a minimum of 7 years, or longer if required by applicable federal or state nonprofit, tax, or financial reporting regulations. This includes information needed for potential IRS audits or donor acknowledgment correspondence once our 501(c)(3) determination is granted.
  • Website Analytics Data: Aggregated or pseudonymized analytics data from tools like Google Analytics may be retained for up to 26 months to support long-term performance trends, content strategy, and accessibility research.
  • User Preferences and Cookie Settings: Depending on the user’s browser and consent selections, some cookies or preference settings may persist for up to 12–24 months, or until manually deleted.
  • reCAPTCHA and Security Logs: We retain IP addresses, behavioral data, and spam protection logs generated through reCAPTCHA or server logs for up to 12 months to monitor and defend against abuse or intrusion attempts.

B. Legal, Regulatory, and Archival Requirements

In some circumstances, we may retain certain information for extended periods where such retention is:

  • Required by applicable tax, accounting, or legal compliance standards
  • Necessary for the establishment, exercise, or defense of legal claims
  • Required to comply with laws such as Section 501(c)(3) reporting rules, the Internal Revenue Code, or state charity registration statutes
  • Relevant to data preservation requests, subpoenas, court orders, or regulatory audits
  • Justified for archival, research, statistical, or public interest purposes, such as analyzing outreach trends, producing anonymized reports, or evaluating long-term accessibility impact

When retained for these purposes, the data will be minimized and subject to safeguards such as pseudonymization, restricted access, and non-commercial use limitations.


C. Right to Request Deletion

Under applicable privacy laws such as the GDPR, CCPA, and CPRA, you may have the right to request deletion of your personal information at any time, subject to certain exceptions. If we are unable to fulfill a deletion request due to a legal obligation or overriding legitimate interest, we will inform you of the reason and scope of continued retention.

To submit a deletion request, contact:
email: [email protected]
webform: monticelloinstitute.org/contact
physical mail: 1235 East Blvd., Ste E, PMB 2272, Charlotte, NC 28203
fax: (704) 234-7333


8. Your Privacy Rights


A. Rights of Residents in the European Union, EEA, and United Kingdom (GDPR / UK GDPR)

If you are located in the European Union, European Economic Area (EEA), or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR provides you with the following rights:

  • Right of Access: You may request access to the personal data we hold about you.
  • Right to Rectification: You may request correction of inaccurate or incomplete data.
  • Right to Erasure: You may request that we delete your personal data in certain circumstances (“right to be forgotten”).
  • Right to Restrict Processing: You may request that we limit the way we use your data.
  • Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format.
  • Right to Object: You may object to processing based on our legitimate interests, including for direct marketing purposes.
  • Right to Withdraw Consent: If processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
  • Right to Lodge a Complaint: You may submit a complaint to your local data protection authority.

To exercise these rights, please contact us at:
[email protected]


B. Rights of California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with the following rights:

  • Right to Know: You may request information about the categories and specific pieces of personal data we collect, use, disclose, or sell.
  • Right to Access: You may request a copy of your personal information.
  • Right to Deletion: You may request that we delete personal information collected about you, subject to certain exceptions.
  • Right to Correct: You may request correction of inaccurate personal information.
  • Right to Opt Out of Sale/Sharing: You may direct us not to sell or share your personal information for cross-context behavioral advertising.
  • Right to Limit Use of Sensitive Personal Information: If applicable, you may limit the use and disclosure of sensitive data.
  • Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your rights.

To make a request, email: [email protected]
We will take reasonable steps to verify your identity before fulfilling your request.


C. Rights of Residents Under Other U.S. State Privacy Laws

The following states have enacted consumer data privacy statutes that afford similar rights to those provided under the GDPR and CCPA/CPRA. If you are a resident of any of the jurisdictions listed below, you may exercise the rights provided under the applicable law, including but not limited to:

Rights Commonly Available:

  • Right to access personal data
  • Right to delete personal data
  • Right to correct inaccuracies
  • Right to data portability
  • Right to opt out of targeted advertising
  • Right to opt out of the sale of personal data
  • Right to opt out of profiling in furtherance of decisions with legal or significant effects
  • Right to appeal a denial of a privacy request

Covered States as of This Privacy Policy’s Effective Date:

To submit a request under any of these state laws or any other laws that have been enacted post the effective date of this Privacy Policy, email us at: [email protected]

We will verify your identity and respond in accordance with applicable statutory timelines. If we deny your request, you have the right to appeal our decision, and we will inform you of the appeal process.


D. Rights Under the California Online Privacy Protection Act (CalOPPA)

In accordance with CalOPPA:

  • We post this Privacy Policy conspicuously on our homepage.
  • Users may visit our site anonymously.
  • We honor “Do Not Track” browser settings when technically feasible and do not track users across third-party websites for advertising purposes unless you have opted into such tracking via cookies or pixels.

Exercising Your Rights

To exercise any of the rights above, or to make a general privacy inquiry, please contact us:

📧 Email: [email protected]
📨 Web Form: monticelloinstitute.org/contact
📠 Fax: (704) 234-7333
📬 Mail: 1235 East Blvd., Ste E, PMB 2272, Charlotte, NC 28203

We will respond within the timeframe required by the applicable law and will not discriminate against you for exercising your lawful rights.nd provide this policy visibly linked from our homepage as required.


9. Data Security

We are committed to safeguarding the personal information you entrust to us. To that end, we implement and maintain appropriate technical and organizational security measures designed to protect your data against unauthorized access, use, disclosure, alteration, or destruction, consistent with the sensitivity of the information and the risks associated with its processing.

Our security framework is built upon the principles of confidentiality, integrity, and availability, and includes both preventive and responsive controls.


A. Technical Safeguards

We employ the following technical measures to protect personal data:

  • Secure Socket Layer (SSL) encryption: All data transmitted between your browser and our website is encrypted using industry-standard HTTPS protocols.
  • Firewall protection: Our hosting environment is secured by firewalls that block unauthorized network traffic and filter suspicious activity.
  • Intrusion detection and prevention systems (IDPS): We monitor access logs for unusual patterns or brute force attempts.
  • Data minimization and access controls: User data is stored only where necessary and is accessible only to authorized personnel or vendors under strict permissions.
  • Regular software updates: We promptly apply security patches and updates to WordPress core, plugins, and other systems to reduce exposure to known vulnerabilities.
  • reCAPTCHA and anti-spam filtering: We deploy a reCAPTCHA tool and other tools to prevent automated submissions, bots, and spam attacks.

B. Organizational and Administrative Safeguards

In addition to technical controls, we implement the following organizational practices:

  • Role-based access control (RBAC): Only individuals with a “need to know” are granted access to personal data or backend systems.
  • Confidentiality agreements: Employees, contractors, and service providers with data access responsibilities are bound by confidentiality obligations.
  • Vendor vetting and contracts: All third-party service providers with access to personal data are reviewed for security posture and are required to sign Data Processing Agreements (DPAs) or equivalent contractual assurances.
  • Regular data security training: Staff receive periodic training on cybersecurity hygiene, phishing awareness, and safe data handling practices.
  • Retention and disposal protocols: We securely delete or anonymize personal data when it is no longer needed, using methods consistent with industry standards and applicable laws.

C. Data Breach Notification Procedures

Although no method of transmission or storage is 100% secure, we maintain a formal Incident Response Plan and commit to:

  • Notifying affected users promptly if a data breach occurs that is likely to result in a risk to their rights and freedoms (in accordance with Article 33 of the GDPR, CCPA §1798.82, or relevant state laws).
  • Cooperating with regulatory authorities and taking immediate remedial action to contain and mitigate the breach.

D. Your Role in Protecting Your Data

While we take every reasonable step to secure your personal data, you also have a role to play. You should:

  • Use a secure, private internet connection when accessing our site.
  • Refrain from submitting sensitive personal information unless explicitly requested (e.g., Social Security numbers, health data).
  • Be cautious when forwarding our emails or sharing your contact forms with others.

E. Security of Payment Information

We do not collect or store your payment card or bank account information directly. All donation and payment transactions are securely processed via PayPal, which complies with the Payment Card Industry Data Security Standard (PCI DSS). For details about PayPal’s security practices, please visit:
https://www.paypal.com/webapps/mpp/paypal-safety-and-security


10. Children’s Privacy

We take the privacy and safety of minors seriously. In accordance with applicable laws and best practices:

A. Intended Audience

Our website, monticelloinstitute.org, and the services and content provided through it, are intended for use only by individuals who are 18 years of age or older. We do not market to or solicit data from minors, and our website is not designed to attract children.


B. No Knowing Collection of Children’s Data

We do not knowingly collect, solicit, or store personal information from individuals under the age of 18, and we do not knowingly allow such individuals to submit forms, sign up for newsletters, make donations, or otherwise interact with our site in a way that collects personally identifiable information.

If you are under 18, you are not authorized to use this site or provide any personal information through it. We ask that you immediately discontinue use and seek assistance from a parent or legal guardian.


C. Parental Notification and Deletion Procedures

If we become aware that we have inadvertently collected personal data from a child under 18 without verified parental consent, we will:

  • Immediately delete the information from our records
  • Terminate any associated accounts or access
  • Take steps to ensure that similar data is not collected in the future

If you believe that we may have collected personal information from a minor under the age of 18, please contact us immediately at:
📧 [email protected]
📠 (704) 234-7333

We will promptly investigate and delete the data in accordance with applicable laws, including the Children’s Online Privacy Protection Act (COPPA) in the U.S.


D. No Use of Children’s Data for Profiling or Targeted Advertising

Because we do not knowingly collect any information from individuals under the age of 18, we do not use, share, or process such data for:

  • Targeted advertising
  • Behavioral profiling
  • Remarketing or tracking pixels

We further affirm that we do not make any data about known or suspected minors available to third parties or service providers.


11. International Data Transfers

Our organization, the Monticello Institute for Advocacy, is based in the United States, and our website infrastructure, service providers, and data processing operations are primarily located in the U.S. By accessing or using our website or submitting your personal information to us, you acknowledge and agree that your information will be transferred to, stored, and processed in the United States, regardless of your country of origin.


A. Transfer from the European Economic Area (EEA), United Kingdom (UK), or Other Jurisdictions with Data Transfer Restrictions

If you are located in the European Union (EU), the European Economic Area (EEA), the United Kingdom, or any other jurisdiction with data transfer regulations, please be aware:

  • The United States may not provide a level of data protection equivalent to that required by your home jurisdiction.
  • U.S. law may permit government authorities to access your personal data without the level of redress or oversight afforded under EU/UK laws.
  • Nevertheless, we take appropriate safeguards to protect your personal data when it is transferred to the United States, including:
    • Working only with third-party processors who commit to data processing agreements (DPAs) consistent with Standard Contractual Clauses (SCCs) or other recognized legal mechanisms under Article 46 of the GDPR
    • Implementing contractual, technical, and organizational security measures (e.g., encryption, access controls, data minimization)
    • Minimizing international transfers where feasible

If a future adequacy decision or approved framework (such as the EU-U.S. Data Privacy Framework) governs such transfers, we will rely on it where appropriate.


B. Implications of International Transfers

By using our website or submitting personal information from outside the United States, you understand and expressly consent to:

  • The transfer of your data to servers and service providers in the U.S.
  • The processing and storage of that data in accordance with U.S. laws, which may differ from those in your country
  • The potential for government access to your information under U.S. law (e.g., FISA 702 or Executive Order 12333), which may not offer the same rights or remedies available under EU/EEA data protection law

C. Your Rights and Remedies

If you reside in a jurisdiction with enhanced international data protections (such as the EU/EEA, UK, Switzerland, or Canada), and believe that your data has been transferred or processed in violation of your rights under local law, you may:

  • Withdraw consent at any time (if consent was the basis for processing)
  • Request additional information about the safeguards we use for data transfers
  • Lodge a complaint with your local supervisory authority (e.g., your country’s data protection regulator)

To inquire about international transfers or request a copy of applicable transfer safeguards, contact us at:
[email protected]


12. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Updates will be posted on this page with a revised “Effective Date.” Continued use of our site after changes constitutes your acceptance.


13. Contact Us

If you have questions or concerns about this Privacy Policy, you may contact us using any of the methods below:

Monticello Institute for Advocacy
1235 East Blvd., Ste E, PMB 2272
Charlotte, NC 28203
Email: [email protected]
Fax: (704) 234-7333
Web Form: monticelloinstitute.org/contact