Privacy notice
EFFECTIVE DATE: AUGUST 2025
Previous version of Privacy Notice
Bonterra LLC (“Bonterra,” “we,” “us,” or “our”) is an online, cloud-based service platform that provides individuals and organizations the ability to contribute to, organize, and manage their causes (collectively, the “Services”). Bonterra Services which make up the Bonterra family of brands include EveryAction, Mobilize, NGP VAN, CyberGrants, Network for Good, DonorDrive , Apricot, GiveGab and the respective individualized service offerings thereunder.
Our role
With exception to data collected from Bonterra Users (defined in the chart below), we are a business-to-business (B2B) company, meaning our customers are businesses and not consumers.
We act primarily as a service provider to our customers. As such, we do not control the personal information we receive from our customers about their (known as “Customer End Users”) which we process solely on our customers’ behalf. We are not responsible for the privacy practices of our customers. If you are a Customer End User and are seeking information about an organization’s privacy practices, we recommend that you check with them directly.
By engaging with our Services, you (our direct customers and Bonterra Users as defined below) agree and acknowledge our collection, use, and disclosure practices, and other activities, as described in this Privacy Notice. If you do not agree with the practices disclosed in this Privacy Notice, discontinue use of the Services.
Scope
This Privacy Notice details how we collect, use and share personal information in providing our Services to our Customers, Bonterra Users (all as defined below) and website visitors (each, referred to as “you”), as well as our data practices with respect to the personal information we receive from our Customers End Users (as defined below) and process on our Customer’s behalf.
This Privacy Notice is intended to comply with all applicable United States federal and individual state data protection laws as well as the national laws of Canada, Australia, United Kingdom, and the European Union (except, please note that the services offered through Mobilize and NGP VAN are offered only in the United States, and as such, are not subject to foreign data protection laws). Please see the Privacy Rights and Choices section of this Privacy Notice for information about rights you may have pursuant to applicable privacy laws.
If you are located in the United Kingdom or the European Union, please see the Notice to EU, UK and Swiss Residents section of this Privacy Notice for more information.
For purposes of this Privacy Notice, we break down our users into three categories that align with how we handle their personal information:
How we refer to these individuals in the Privacy Notice | How these individuals interact with Bonterra | Examples | Our relationship with these individuals |
---|---|---|---|
Bonterra Users | Individuals who interact directly with our Services |
|
We have our own direct relationship with Bonterra Users |
Customers | Representatives of our prospective and existing Customers |
|
We have our own direct relationship with Customers |
Customer End Users | Individuals who are our Customers’ users |
|
Bonterra processes the personal information of Customer End Users pursuant to agreements with our Customers – as a “services provider” or “processor.”
Our Customers’ use and sharing of this information is governed by their own privacy policies. |
1. Personal information we collect
Information you provide to us. We collect the following categories of Personal information that you may provide to us through the Services or otherwise includes:
- Identifiers and contact information, such as your first and last name, email address, and account password, which are required to access Bonterra’s Services. We also collect other identifiers and contact information, including professional title, business affiliation and address, and phone number in order to better provide Bonterra’s Services, although this information is not required to access Bonterra’s Services.
- Biographical information, such as your age and gender, interests in charitable causes, and occupation. This information is not required to access Bonterra’s Services.
- Event information, including the location, date, and time of an event you sign up for through our Services, when you signed up for that event, the organizations affiliated with the event, the organization promoting the event, and any feedback you provide about the event.
- Payment and transaction datathat our payment service providers collect to process your payments, such as your donations or contributions to the political candidate or nonprofit cause of your choice. Payment processing of donations you make is handled by our third-party payment processors, such as Stripe or Paragon, in accordance with their terms of service and privacy policies.
- Transaction history, including information regarding your donations or other engagement history.
- Communicationsthat we retain from any support requests you submit, and questions you may send us about marketing, job opportunities, etc.
- Marketing data, such as your preferences for receiving our marketing communications, and details about your engagement with those communications.
- Information from cookies and other automated technologies, such as information about the devices you use to engage with our Services (e.g., your device and browser type, your device’s operating system, your IP address, and your geographic location based on IP address), and online activity data including information regarding your interaction with our Services. For more details about the technologies we use, the categories of information we collect and how we use this information, please review our Cookie Policy.
- Other information about Customer End Users that we may collect, which is not specifically listed here, but which we contractually agreed to collect with each Customer. If applicable, Customer End Users should contact the organization that contracts with Bonterra to request a full list of personal information that we process on their behalf, in addition to the information described above.
Third party sources. In certain cases, we combine personal information we receive from you with personal information we obtain from other sources, including:
- Third parties. As is typical for businesses that market their products to other organizations, sometimes we obtain your contact information from third-party data suppliers or joint marketing partners to contact you with communications containing promotions, customer stories, Bonterra news and updates or thought leadership. We may also obtain information from public records in order to conduct due diligence or fraud prevention checks, or to supplement your profile (i.e., to complete your zip code).
- Distribution lists. To engage in an email, SMS, or calling campaign, our Customers may upload a distribution list that provides us information about their donors or constituents (such as their names, email addresses, and mobile phone numbers). We use and process this information to provide the requested services in accordance with our Customer agreement and this Privacy Notice.
- Social media platforms. We may receive information about your activity when you follow us on social media and networking platforms such as Facebook, Instagram, LinkedIn, or X (formerly known as Twitter). Additionally, if you access our Services through a social networking site or a third-party login service (such as Single Sign-On (SSO) or Google), we may collect information about you from that third-party that you have made available via the privacy settings within that third-party service provider.
- Third-party integrations. Should you choose to integrate a third-party product within our Services, such as Google Sheets or Google Drive, we will ask you to grant us permission to view and/or download, as applicable, your Google Sheets or Google Drive. This allows us to configure your integration(s) in accordance with your preferences. We do not use this information for any other purpose.
Bonterra does not collect sensitive personal data in its role as a data controller. If Customers choose to collect Customer End User’s sensitive personal data through Bonterra’s services, Bonterra processes that data only on Customer’s behalf and protects it with appropriate safeguards.
2. How we use personal information
Below is a description of how Bonterra Services may use personal information.
A. Bonterra Users
To fulfill our contractual obligations to you, we use personal information to:
- Facilitate your engagement with us and our affiliate organizations;
- Process payments, enable Bonterra payment products, and complete your other transactions; and
- Provide you with our Services and customer support.
We may also use personal information for the following legitimate business interests:
- Recommend opportunities to engage with organizations and campaigns that use our Services;
- Communicate with you about our Services, including by sending announcements, updates, security alerts, and support and administrative messages; and
- Provide support, and respond to requests, questions, and feedback.
B. Customers
To fulfill our contractual obligations to you, we use personal information to:
- Provide you with our Services and customer support;
- Informe you of changes to our terms, Services, or policies;
- Enable Bonterra payment services and complete your transactions.
We also use personal information for the following legitimate business interests:
- Communicate with you about our Services, including by sending announcements, updates, security alerts, and support and administrative messages; and
- Provide support, and respond to requests, questions, and feedback.
C. Customer End Users
On behalf of our Customers, we use personal information to:
- Enable our Customers to recruit and engage with Customer End Users;
- Enable Customer End Users to complete transactions and make donations through our Services;
- Communicate with Customers and Customer End Users about our Services and your account, including by sending announcements, updates, security alerts, customer support, and administrative messages;
- Provide support, and respond to requests, questions, and feedback; and
- Provide marketing and advertising on behalf of our Customers, including interest-based online advertising.
D. Marketing and advertising, including for:
- Direct marketing (Bonterra Customers and Bonterra Users only). We may contact you about promotions, customer stories, Bonterra news and updates, or thought leadership content. We may send these communications via email or serve you advertisements on our website and others. If you would no longer like to receive such emails, please follow the “Unsubscribe” instructions that are provided at the end of each email. Your e-mail address will be removed from our marketing list. Please allow us a reasonable period of time in order to satisfy your request, as some promotions may already be in process.
- Interest-based advertising. We use cookies and similar technologies to engage in interest-based advertising. Please review section 3 “Personal Information Shared or Sold to Third Parties” and our Cookie Policy to learn how to opt-out and obtain more information. Where required by applicable law, we will engage in interest-based advertising only with your consent.
E. Research and development.
It is in our legitimate business interests to engage in research and development, including to:
- Develop new features, products, and services;
- Analyze, research, and conduct product development, including training machine learning models and leveraging artificial intelligence (AI) tools to optimize internal processes and improve operational efficiency. These tools support, and do not replace, human decision-making; and
- Create aggregated, de-identified, or other anonymous data or analytics. When we create de-identified data, we do not attempt to re-identify that data.
F. Compliance with law, including to:
- Investigate or address claims or disputes relating to use of our Services;
- To satisfy requirements under applicable laws, regulations, operating licenses or agreements;
- Comply with applicable laws, lawful requests and legal process, such as to respond to subpoenas or requests from government authorities;
- Protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);
- Enforce the terms and conditions that govern our Services; and
- Prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks and identity theft.
3. Personal information sold or shared to third parties
We do not sell personal information in exchange for money in any jurisdiction.
However, the California Consumer Privacy Act (“CCPA”) defines the term “sale” very broadly, including in such a way that transfers of information relating to advertising cookies could be considered a sale. As described in our Cookie Policy, we work with certain third-party services to assist us in delivering interest-based advertisements to you.
If you are a California resident, and to the extent that any of these services are considered a “sale” of personal information under the CCPA, then you have the right to opt-out of the sale. Below please find a description of the ways in which you may do so.
- By Selecting the “Cookie Preferences” Link Within Our Website Footer. This empowers you to choose whether you would like to allow certain categories of cookies and similar technologies to collect information about your usage of our website. Please note that your selections are specific to the particular web browser and device that you use to make them, and so would need to be separately submitted on different browsers or devices. You may also need to repeat this step if you clear your browser cookies at any point.
- By Using Industry-Developed Opt-Out Tools. The Digital Advertising Alliance’s CCPA tool allows California consumers to opt out of the sale of personal information by some or all of that framework’s participating companies by accessing the DAA’s tool here: https://www.privacyrights.info/. Please note that your selections are specific to the particular web browser and device that you used to make them.
- By Blocking Web Browser Cookies. Many browser manufacturers provide helpful information about cookie management, including, but not limited to:
- By Blocking Mobile Advertising Identifiers. Your mobile device settings may provide you the ability to limit use of the advertising identities associated with your device for interest-based advertising purposes. Additional information can be found here: https://www.networkadvertising.org/mobile-choice.
- Platform Opt-Outs. The following advertising partners offer opt-out features that let you opt-out of use of your information for interest-based advertising:
- Google: https://adssettings.google.com
- Facebook: https://www.facebook.com/about/ads
- Instagram (European Residents only): https://help.instagram.com/426488546963771/
- X (formerly known as Twitter): https://help.x.com/en/safety-and-security/privacy-controls-for-tailored-ads
4. Retention
For Bonterra Customers and Bonterra Users, only: we retain personal information for as long as appropriate to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information, the purposes for which we process personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
For Customer End Users, only: We will retain personal information as agreed upon in the Customer’s signed agreement.
5. Disclosure of personal information
How we disclose personal information. Below is a description of how and to whom we may disclose personal information, which may be limited under the applicable agreements signed directly by Bonterra with its Customers. Where a third-party is identified, please go to their linked privacy notices for information regarding their collection and use of personal data.
- Affiliates. We may disclose personal information within Bonterra’s corporate affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control) for purposes consistent with this policy.
- Organizations and campaigns. We may disclose personal information to charities, nonprofits, and other organizations, including when you seek to engage with opportunities on our platform or when you engage with a specific organization that uses our platform for its causes.
- Advertising vendors. We disclose personal information to third-party advertising companies, to reach or better understand current and potential users of Bonterra’s services, that can collect information on our website through cookies and other automated technologies. Please review our Cookie Policy for more information and how to control your cookie settings.
- Service providers. We disclose personal information to companies and individuals that provide services on our behalf or help us operate our Services (such as hosting, information technology, customer support, email delivery, and website analytics services).
- Payment processors. We disclose personal information to payment processors such as PayPal and Stripe, to process donations and enable Bonterra payment services.
- Professional advisors. We disclose personal information to professional advisors, such as lawyers, auditors, bankers, and insurers, in the course of the professional services that they render to us.
- Authorities and others.We may disclose personal information if we believe it’s required by applicable law, regulation, operating license or agreement, legal process or governmental request, insurance policy, or where the disclosure is otherwise appropriate due to safety or similar concerns.
- Business transferees. We disclose personal information to others in connection with, or during negotiations of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or into another company.
6. Privacy rights and choices
For Customer End Users only: When a customer uses our Services, we may process Customer End User personal information as a service provider on that Customer’s behalf. We are not responsible for and have no control over the privacy and data security practices of such Customer, which may differ from those explained in this Privacy Notice. The data protection rights listed above do not apply to Bonterra where we process Customer End User personal information as a service provider on behalf of a Customer. If your data has been submitted to us by or on behalf of a Bonterra Customer and you wish to exercise your privacy rights, please contact them directly. Bonterra will, upon request from the controller, assist in responding to data subject rights requests.
Please note that Bonterra is not responsible for our Customers’ communications sent to Customer End Users; to opt out of communications you receive from our Customers, please follow the opt-out or unsubscribe options contained in our Customers’ communications to opt-out of communications sent by our Customers.
For Customers and Bonterra Users only:
You have the right to submit requests for your personal information, including:
(a) right to know what information we collect, disclose, and sell;
(b) right to access a copy of your data;
(c) right to request deletion or correction of your data; and
(d) right to opt out of the sale of your data or the sharing of your data for purposes of targeted behavioral advertising.
In the sections above titled “Personal information we collect”, “How we use personal information”, “Personal information shared or sold to third parties” and “Disclosure of personal information” we have included descriptions of: the data we collect; the categories of sources of such information; the purposes for which we use, sell, share, and disclose the data; the types of data impacted and the categories of third-parties to whom the data is sold; and the disclosure of data to third parties for business purposes.
We do not sell your name and contact information (i.e. email, address, phone). However, as described in the How We Use Personal Information section above, we may share cookies and automated technology information to show you advertising of your interest. To opt-out of such data sharing, please follow the link “Cookie Settings” located at the bottom of each page of Bonterra websites or the process described in section 3.
We also honor the Global Privacy Control, a browser-based opt-out signal. We do not respond to other browser based-signals that do not meet applicable State law requirements, which may include Do Not Track Signals.
To exercise your data deletion, access or update your personal information, please e-mail us at [email protected], and expressly mention the Bonterra product you are a user of. If we decline a request, we will explain why we took that action, subject to applicable legal restrictions.
Authorized agents may be used to submit rights requests, in which cases we will take steps to verify the consumer’s identity and that the agent has authority to act on the consumer’s behalf.
7. Information Security
We employ current industry-standard and legally required technical, organizational, and physical safeguards designed to protect the personal information we collect.
8. Children’s Privacy
Our Services are not intended for use by children under 18 years of age in the U.S. If we learn that we or a Customer has collected personal information through our Services from an individual under 18 without the consent of their parent or guardian as required by law, we will delete it.
9. Legal Framework for Data Transfers
If you provide us with your personal information when using the Services, then please note that we are headquartered in the United States. To provide and operate our Services, it is necessary for us to process personal information in the United States.
If we transfer personal information across borders such that we are required to apply appropriate safeguards to personal information under applicable data protection laws, we will do so. Please contact us for further information about any such transfers or the specific safeguards applied.
Bonterra is committed to protecting your personal data regardless of where you are located. This includes implementing global measures to protect users’ data, including:
- Securing user data when in transit, including through encryption, and at rest.
- Mandating company-wide training regarding privacy and data security.
- Implementing internal policies and procedures to limit access to, and use of, users’ data.
- Limiting government and law enforcement access to Customer, Customer End User and Bonterra User personal data, except where required by law; there are imminent threats to safety; or users have consented to the access.
10. Data Privacy Framework
When we transfer user data from the EEA, UK and Switzerland, we do so on the basis of the necessity to fulfill our agreements with Customers, consent, adequacy decisions regarding the country of transfer (available here or here and transfer mechanisms such as the EU-US Data Privacy Framework (“EU-US DPF”), the UK Extension to the EU-US DPF, and the Swiss-US Data Privacy Framework (“Swiss-US DPF”), as set forth by the US Department of Commerce. Such data remains subject to the GDPR or equivalents after such transfer.
Bonterra has certified to the United States Department of Commerce that it adheres to (1) the EU-US Data Privacy Framework (“EU-US DPF”) Principles regarding the processing of personal data received from EEA member countries in reliance on the EU-US DPF, and from the UK (and Gibraltar) in reliance on the UK Extension to the EU-US DPF; and (2) the Swiss-US Data Privacy Framework Principles (“Swiss-US DPF”) regarding the processing of personal data received from Switzerland in reliance on the Swiss-US DPF. In the event of a conflict between this notice and the Principles mentioned above, the Principles shall govern. In the event that the EU-US DPF or the Swiss-US DPF are invalidated, Bonterra will transfer data that is subject to these certifications in reliance on the other data transfer mechanisms described above.
11. Notice to EU, UK and Swiss residents
- Bonterra’s DPF certification applies to personal data originating from the EEA, UK or Switzerland.
- Our purposes and legal basis for collecting and using personal information are described in the How We Use Personal Information section of this Privacy Policy.
- You have the right to access your personal data that is subject to Bonterra’s DPF certification.
- In addition to applicable rights described in the Privacy Rights and Choices section of this privacy policy, you have the following rights: The right to object to or restrict our processing of your personal information; The right to withdraw your consent to processing your personal information. Please note that withdrawing your consent does not affect the lawfulness of processing based on consent before its withdrawal. To exercise any of these rights, please complete and submit our Data Request Form.
- Request from law enforcement. Bonterra is required under applicable law to share user data, including that which may be subject to Bonterra’s certification, pursuant to legal process or governmental request, including from law enforcement.
- Investigation and enforcement. Bonterra is subject to the investigatory and enforcement powers of the US Federal Trade Commission.
- We have appointed a representative in the EU and the UK. For the EU, please contact our representative by email at [email protected]. In the UK, please contact our representative by email at [email protected]. Visit VeraSafe.com for more information.
- We have further committed to refer unresolved privacy complaints under the Principles to an independent dispute resolution mechanism, BBB NATIONAL PROGRAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.
- Please note that if your complaint is not resolved through these channels, under limited circumstances, a binding arbitration option may be available before a Data Privacy Framework Panel. Additional information on the arbitration process is available on the Data Privacy Framework website at https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2
- If you would like to submit a complaint about our use of your personal information or our response to your requests regarding your personal information, you can contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here.
You can learn more about the EU-US DPF and Swiss-US DPF here, and view Bonterra’s certification, including the scope of data subject to our certification here.
12. Changes to this Privacy Notice
We reserve the right to modify this Privacy Notice at any time. If we make material changes to this Privacy Notice, we will notify you (for example, by posting the Privacy Notice on our Services).
13. How to contact us
You can reach us by email at [email protected] or at the following mailing address:
Bonterra, LLC.
10801 North MoPac Expressway, Suite 400
Austin, TX 78759 USA
Cookie Policy
This Cookie Policy explains how Bonterra uses cookies and similar technologies in connection with our Services.
What are cookies and similar technologies?
- Cookies are text files that websites store on a visitor’s device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, helping us understand activity and patterns, and facilitating online advertising.
- Local storage technologies, like HTML5, provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.
- Web beacons, also known as pixel tags or clear GIFs, are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.
How do we use cookies and other similar technologies?
We, our service providers, and our advertising partners automatically log information about individuals’ interactions with our Services and communications, such as:
- Device information, such as computer or mobile device operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 3G), and general location information such as city, state, or geographic area.
- Online activity information, such as pages or screens viewed, how long individuals spend on a page or screen, the website they visited before browsing to our website, navigation paths between pages or screens, information about activity on a page or screen, access times and duration of access, and whether individuals open our marketing emails or click links within them.
We may also allow our advertising partners to collect this information through our website.
This Cookie Policy refers to all these technologies collectively as “cookies.”
What types of cookies and similar technologies does Bonterra use?
We use the following categories of cookies:
- Essential. These cookies are necessary to allow the technical operation of our Services (e.g., they enable you to move around on a website and to use its features).
- Functionality / performance. We use these cookies to enhance the functionality and performance of the Services.
- Analytics. We use these cookies to help us understand how our Services are performing and being used. For example, we use Google Analytics to collect information about how users use our Services, which we then use to compile reports that disclose trends without identifying individual visitors, and help us improve our Services. For more information on Google Analytics, click here. For more information about Google’s privacy practices, click here. You can opt out of by downloading and installing the browser plug-in available at: https://tools.google.com/dlpage/gaoptout.
- Advertising. We and our third-party advertising partners use these cookies to collect information about how you use our website and use that information to serve online ads that may be relevant to your interests. Please find examples of the third-party advertising cookies we use and links to their platform opt-out pages in the following section.
How can you control the use of cookies?
Other than “essential cookies,” which are required to allow our Services to operate, you can control our use of cookies through our Cookie Settings.
You can also limit online tracking by:
- Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit allaboutcookies.org. Use the following links to learn more about how to control cookies and online tracking through your browser:
- Blocking advertising ID use in your mobile settings. Your mobile device settings can provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
- Using privacy plug-ins or browsers. You can block our websites from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers.
- Advertising industry opt-out tools. You can also use these opt-out options to limit use of your information for interest-based advertising by participating companies:
- Digital Advertising Alliance for Websites: https://youradchoices.com/control
- Network Advertising Initiative: networkadvertising.org
- Platform opt-outs. Some third-party ad networks, including third-party ad servers, ad agencies, ad technology vendors and research firms, allow you to opt-out directly by using their opt-out tools. Some of these providers, and links to their opt-out tools, are:
Note that because these opt out mechanisms are specific to the device or browser on which they are exercised, you will need to opt-out on every browser and device that you use.
Do Not Track. Some Internet browsers can be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit https://allaboutdnt.com/.
For visitors in the EU, UK, and other jurisdictions that require consent for non-essential cookies, we will not set analytics, advertising, or personalization cookies unless you have provided explicit consent through our cookie banner or settings tool.