Effective Date: 2026-10-01
Company Name: Value Network
Value Network (“VALUE NETWORK,” “we,” “our,” “us”) is committed to safeguarding the privacy of visitors to our websites. This Privacy Policy applies to www.valuenetworkwny.org and all affiliated websites operated by VALUE NETWORK and its subsidiaries (collectively, the “Websites”). It explains how we collect, use, disclose, and protect your personal information, and how you may exercise your rights under applicable privacy and data protection laws, including the California Consumer Privacy Act (CCPA), the New York SHIELD Act, and the European Union General Data Protection Regulation (GDPR).
Global Application with Local Variations
This Privacy Policy applies to all VALUE NETWORK websites worldwide. However, certain countries and regions where VALUE NETWORK operates have additional privacy rights and obligations that apply to their residents. The Appendix summarizes those additional rights and requirements. If you reside in one of the jurisdictions listed, please review the Appendix carefully as it supplements your rights under local law.
For technical details about how this website handles data, including the third-party services it uses, see our Website Data & Privacy page.
By accessing or using our Websites, you consent to this Privacy Policy. If you do not agree, you should discontinue use of our Websites.
1. Information We Collect
- Identity Data: name, organization.
- Contact Data: email address, phone number.
- Technical Data: IP address, browser type, operating system, time zone, and device information.
- Marketing & Communications Data: preferences for receiving marketing messages.
We do not intentionally collect sensitive categories of data (e.g., race, health, union membership, political views) unless required by law.
2. How We Use Your Information
- Fulfilling product and service requests.
- Providing customer support.
- Sending marketing communications (with consent).
- Protecting the security and integrity of our website.
- Complying with legal obligations.
3. Lawful Bases for Processing (GDPR)
Where the GDPR applies, we process your information under one or more of the following lawful bases:
- Contractual necessity (to provide services/products you request).
- Consent (e.g., email subscriptions).
- Legitimate interests (e.g., business administration, fraud prevention).
- Legal obligation (to comply with applicable law or regulatory requests).
Learn more about your rights under GDPR here: Know Your Privacy Rights (Know your privacy rights) and the European Commission GDPR site (Data protection European Commission).
4. Your Privacy Rights
Under GDPR (EU/EEA/UK)
Under the GDPR, your rights are as follows. You can read more about your rights in detail here;
- Right to be informed
- Right of access
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right to data portability
- Right to object
- Right not to be subject to automated decision-making
You also have the right to complain to the ICO [Make a complaint | ICO] if you feel we are handling your data improperly.
You may submit GDPR-related requests to: compliance@valuenetworkwny.org.
Under CCPA (California Residents)
California residents have the right to:
- Know what personal information we collect, use, and disclose.
- Request deletion of your personal information.
- Opt-out of the sale or sharing of your information.
- Non-discrimination for exercising your privacy rights.
You may exercise your CCPA rights by contacting: compliance@valuenetworkwny.org (DSR stands for Data Subject Request, the formal term used for privacy rights requests under laws like CCPA and GDPR).
Learn more: California Consumer Privacy Act (California Consumer Privacy Act (CCPA) | State of California Department of Justice Office of the Attorney General).
Under NYS SHIELD Act (New York Residents)
New York residents are entitled to data security protections under the SHIELD Act, which requires reasonable safeguards to protect personal data from unauthorized access, use, or disclosure.
You can submit requests to: compliance@valuenetworkwny.org.
Reference: NYS SHIELD Act Overview (NYS Open Legislation | NYSenate.gov).
5. Cookies and Tracking
We use cookies and similar technologies to improve your website experience, including:
- Performing analytics and website performance monitoring.
- Delivering relevant advertising.
You can manage or disable cookies through your browser settings. For more details, visit: All About Cookies | Online Privacy and Digital Security
6. Data Security and Retention
We implement reasonable administrative, technical, and physical safeguards to protect personal data against unauthorized access, disclosure, alteration, or destruction, in accordance with the NYS SHIELD Act.
We retain personal information only as long as necessary to:
- Provide requested services.
- Comply with legal obligations (e.g., tax reporting).
- Resolve disputes or enforce agreements.
7. Data Transfers
Where personal information is transferred outside the European Union, we use appropriate safeguards, including:
- Standard Contractual Clauses (SCCs).
- Binding Corporate Rules.
- Agreements with data processors subject to equivalent protections.
8. Third-Party Links
Our websites may include links to third-party websites. We are not responsible for the content, policies, or practices of those sites.
9. Changes to This Policy
We may update this Privacy Policy periodically. Updates will be posted with a revised “Effective Date.”
10. Contact Us
For questions, concerns, or to exercise your rights:
Email: compliance@valuenetworkwny.org
California/NYS Requests: compliance@valuenetworkwny.org
Appendix: Country and Region-Specific Privacy Rights & Requirements
This appendix supplements the global Privacy Policy and describes local privacy rights and requirements that apply in jurisdictions where VALUE NETWORK operates. If this Appendix conflicts with the global Privacy Policy, local law prevails.
United States
New York
- SHIELD Act: Requires businesses to implement “reasonable safeguards” (administrative, technical, physical) to protect private information.
- Mandatory breach notification to affected residents and the Attorney General if personal data is compromised.
Ohio
- No comprehensive consumer privacy law.
- Ohio Data Protection Act (2018) provides a safe harbor: companies with a written cybersecurity program aligned to recognized standards (e.g., NIST, ISO, HIPAA, GLBA) may gain protection from tort liability after a breach.
Mississippi
- No comprehensive privacy law.
- State breach notification law requires prompt notice to residents after unauthorized acquisition of personal information.
Texas
- Texas Data Privacy and Security Act (TDPSA, effective July 2024): Provides consumer rights (access, correction, deletion, portability) and requires businesses to limit collection/use of personal data.
- Breach notification law requires disclosure to affected residents and the Attorney General if 250+ residents are impacted.
North Carolina
- No comprehensive privacy law.
- Identity Theft Protection Act requires breach notification to residents and the Attorney General.
Canada
- PIPEDA (Federal): Consent-based, rights of access/correction, breach notification.
- Quebec – Law 25: GDPR-like rules, DPO required, privacy impact assessments.
Mexico
- LFPDPPP: Requires ARCO rights, privacy notices, consent, and restrictions on transfers.
Brazil
- LGPD: GDPR-style law, requiring DPO, lawful bases, rights of access/deletion, cross-border safeguards.
European Union (France, Germany, Italy, Spain, Czechia, Poland, Ireland, Romania)
- GDPR: Full rights (access, rectification, erasure, portability, objection), breach notification, cross-border rules.
- Local DPAs enforce compliance (CNIL – France, BfDI – Germany, Garante – Italy, AEPD – Spain, UODO – Poland, DPC – Ireland, ANSPDCP – Romania, UOOU – Czechia).
United Kingdom
- UK GDPR & Data Protection Act 2018: Mirrors EU GDPR, requires UK rep for non-UK entities.
Morocco
- Law No. 09-08: Requires prior authorization for some processing, DPA notifications, and restrictions on transfers.
Tunisia
- Law No. 2004-63: Registration with INPDP, rights of access/correction, restrictions on transfers.
Australia
- Privacy Act 1988 & APPs: Rights of access/correction, consent for sensitive data, cross-border transfer restrictions, mandatory breach notification.
New Zealand
- Privacy Act 2020: GDPR-like protections, mandatory breach notification, restrictions on cross-border transfers.
China
- PIPL: Strict consent requirements, data localization or cross-border transfer assessments, strong protections for sensitive data.
Hong Kong
- PDPO: Consent-based framework, use limitation principle, data security obligations, and guidance on breach notifications.
Singapore
- PDPA: Consent-based, requires a DPO, breach notification duties, cross-border transfer rules.
Thailand
- PDPA (2019, effective 2022): GDPR-like rights and obligations, including breach notifications and cross-border rules.