Privacy Policy

Effective Date: June 1, 2024

Pennsylvania Association for Sustainable Agriculture d/b/a Pasa Sustainable Agriculture (Pasa) is committed to providing clear and concise information regarding our collection and processing of personal information, as well as that by our subawarded partner organizations (collectively, “Pasa”). By accessing our websites, submitting for information through our websites, registering for events, membership, or making a donation, or applying to, and participating, in programs and services (collectively, “Pasa Services”), you consent to the information collection and handling practices outlined in this policy. Additionally, by using Pasa Services, Farmers, Members, and Associates are agreeing to Pasa’s Terms of Use.

I. Personal Information Use & Processing
In providing the suite of Pasa Services, Pasa primarily acts as a service provider under contract to farm owners, farm business representatives, and farm workers (collectively, “Farmers”) as well as associated members and/or supporters of Pasa’s work (collectively, “Members and Associates”). Pasa is a data controller of the personal information we collect and hold information on behalf of our Farmers, Members, and Associates through our own systems and our data processors. Our Farmers, Members, and Associates are data providers, and in some cases, data processors.

Accordingly, we may use or disclose the personal information we collect for one or more of the following purposes:

1. 1. To fulfill the purpose for which the personal information was collected and provide the requested Pasa Services, this may include participation in grant programs, research studies, technical assistance, resources, or other programming or services.
   2. To distribute communications and legally required notices regarding the status of Pasa Services via phone, email, and SMS text.
   3. To provide Pasa Services maintenance, enhancement, research, development, security, support, and website optimization.
   4. To maintain compliance with federal and state laws related to software-as-a-service, background screening, financial institutions, and money services businesses.
   5. To create, maintain, customize, and secure Pasa Services Farmers, Members, and Associates’ profiles.
   6. To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
   7. To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Pasa’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Pasa is among the assets transferred. Any information under this subsection 7 will only be discussed in the aggregate and in compliance with all applicable laws.

Pasa will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. Additionally, Pasa’s processing of sensitive personal information is limited to activities necessary for the delivery and performance of Pasa Services on behalf of our Farmers, Members and Associates, and end users. Under applicable programs, Pasa shall abide by the rules and requirements of Section 1619 of the Food, Energy, and Conservation Act of 2008 (“Section 1619 Requirements”).

II. Personal Information Collection
Pasa collects and processes personal information through our websites and as a service provider to our Farmers, Members, and Associates. This personal information includes a broad range of data elements and may pertain to Farmers, Members, and Associates’ business information and activities that support the Farmers, Members, and Associates’ application for programming including but not limited to events, research, and funding for agricultural practices (“Personal Information”). Personal Information you submit to us varies based on how you are engaging with the Pasa Services (for example by using our websites vs participating in a Pasa grant program).

By way of example, Pasa has collected the following categories of personal information from our Farmers, Members, and Associates regarding their business and/or activities through Pasa Services within the last twelve (12) months:

III. Personal Information Exceptions
Personal information does not include:

Publicly available information from government records.
De-identified or aggregated consumer information.
Information excluded from state privacy law scope, like:

health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); and
personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

IV. Personal Information Sources
Pasa collects the categories of personal information listed above from the following sources:

Farmer, business, owner, representative, member, and associate personal information is collected (i) from Farmers, Members, and Associates’ during enrollment in or utilization of Pasa Services offered on behalf of Farmers, Members, and Associates, (ii) from Farmers, Members, and Associates via direct input into Pasa Services or integration with Farmers, Members, and Associates’ software systems and third party service providers, and (iii) indirectly from federal geological farm information obtained with permission from the Farmers, Members, and Associates and integrated with Pasa Services.

V. Personal Information Disclosure
Pasa does not sell or otherwise distribute outside of the uses detailed above personal information collected through Pasa Services, and no such disclosure has occurred in the prior 12 months.

Pasa may provide personal information to third parties for business purposes under limited circumstances, including service providers and vendors that support or integrate with the Pasa Services described in this statement (see chart below). Pasa only discloses personal information to the extent reasonably necessary to support Pasa Services requirements, or for the third-party vendors or service providers to perform the services on our or our Clients’ behalf. We do not permit third party vendors or service providers to use or disclose your personal information except for the purpose of providing the services we request of them. Where applicable, Pasa communicates where Section 1619 Requirements apply to any third parties and requires their compliance with such. However, please note that Pasa does not maintain direct control over the privacy policies and practices of Farmers, Members and Associates, or any other subprocessors, third-party companies, agents, or contractors.

VI. Personal Information Rights and Choices – State Privacy Rights

Certain state jurisdictions (California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, New Jersey, New Hampshire, Oregon, Tennessee, Texas, Utah, and Virginia) provide their legal residents with specific rights regarding their personal information. For an up to date listing and more information on the rights each state legislation provides, please visit the website of the International Association of Privacy Professionals. Each right includes the ability to make a specific consumer request and corresponding obligation of the receiving party to (i) verify the identity of the requestor and (ii) respond in accordance with statutory guidelines. This section describes your rights and explains how to exercise those rights. These requirements are in addition to any rights under the Section 1619 Requirements, where applicable. The most restrictive rights to the user shall apply.

VII. Accessing and Updating Personal Information

In the event your personal information is determined to be outdated, incomplete, or inaccurate, you may access and update your information by contacting your Pasa Services Technical Assistance Provider, or if you do not have one, a request at the email address listed below (See “Contact Us”). If you require verification that your requested changes have been completed, you may request confirmation at the email address listed below (See “Contact Us”).

VIII. Access to Specific Information Regarding Personal Information Use/Disclosure and Portability

You have the right to request a summary of the collection, use, and disclosure of your personal information over the past 12 months or if applicable, for the term of a specific grant period. Under most circumstances, this request for disclosure should be submitted to the email address listed below (See “Contact Us”).

In response to a verifiable consumer request for these services, we will disclose the following information for the applicable Pasa Services:

1. 1. The categories, specific types, and sources of personal information we collected about you.
   2. Our business purpose for collecting the personal information.
   3. The categories of third parties with whom we share that personal information and the purpose for the disclosure.

You also have the right to request a copy of this personal information in a readily usable format that is transferable to other entities (frequently referred to as “data portability”). If you make a data portability request, Pasa may be (i) restricted from providing certain sensitive personal information in response to the request or (ii) prohibited from granting the request entirely if it presents an unreasonable security risk.

IX. Retention and Deletion of Personal Information

Pasa keeps data for as long as necessary to deliver the Pasa Services and to maintain adequate records. Any deletion of information is subject to Pasa’s internal destruction policies and the rights of deletion detailed below.

You have the right to request that Pasa delete any of your personal information that we collected and retained, subject to certain exceptions. Under most circumstances, this request for deletion should be submitted to the email address listed below (See “Contact Us”).

Once we receive and confirm your verifiable consumer request, we will delete or de-identify your personal information from our records, unless one of the following exceptions applies:

We may deny your deletion request if retaining the information is necessary for Pasa or our service providers to:

1. 1. Complete the transaction for which we collected the personal information, provide the Pasa Services that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with the farmer, member, or associate, or otherwise perform our contract with the farmer, member, or associate or the funders related thereto.
   2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
   3. Debug Pasa Services to identify and repair errors that impair existing intended functionality.
   4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
   5. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
   6. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us or our Clients.
   7. Comply with laws, regulations, statutes, codes, ordinances, or other legal obligations.
   8. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

X. Submitting Consumer Requests – Exercising Access, Data Portability, and Deletion Rights
Under most circumstances, consumer requests to exercise the access, data portability, and deletion rights described above should be submitted to the email address listed below (See “Contact Us”).

Only you (or someone legally authorized to act on your behalf) may make a verifiable consumer request related to your personal information.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period, unless otherwise permitted under an applicable grant or Pasa program. The verifiable consumer request must:

1. 1. Provide sufficient information that allows us to confirm your identity as the person about whom we collected personal information (and, if applicable, the authority and identity of an authorized representative).
   2. Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Please note, we cannot respond to your request or provide you with personal information if we cannot (i) verify your identity or authority to make the request and (ii) confirm the personal information relates to you.

We will only use additional personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

XI. Consumer Request Responses and Timelines
We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please email privacy@pasafarming.org. We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require additional time beyond the 45 days, we are entitled to an extension up to an additional 45 days (for a total response timeline capped at 90 days). In the event that an extension is necessary, we will inform you of the reason and extension period in writing.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt, unless otherwise required under an applicable program/grant. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

XII. Personal Information Sales and Sharing – Opt Out Rights
Pasa does not sell personal information collected through Pasa Services, and no such activity has occurred in the prior 12 months. In the event that Pasa changes its practices and engages in the sale of personal information as regulated or permitted by law, we will provide advance notification to impacted individuals and offer the ability to opt in/opt out in accordance with regulatory requirements.

XIII. Non-Discrimination
We will not discriminate against you for exercising any of your privacy rights. Unless permitted by law, we will not engage in any of the following practices in response to your exercise of privacy rights:

1. 1. Deny you goods or services.
   2. Provide you a different level or quality of goods or services.
   3. Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

XIV. Data Security
Pasa implements and maintains appropriate physical, administrative, technical and organizational measures to protect the information we process against unauthorized or unlawful access, use or disclosure, and against accidental loss, damage, alteration or destruction. Under our security policies and practices, access to personal information is restricted and authorized only for those who have a business need for such access in relation to the Pasa Services. Pasa strives to protect the personal information that we process; however, no security program is 100% secure and we cannot guarantee that our safeguards will prevent every unauthorized attempt to access, use, or disclose personal information. We maintain security incident response policies and procedures to handle incidents involving unauthorized access to personal data we process.

XV. Children’s Online Privacy
Pasa Services do not target or attract the attention of children under the age of 13 for the online collection of personal information.  If you are the parent or guardian of a child whom you believe has disclosed personal information to us, please contact us at the information below so that you may review the information submitted and have such child’s information deleted and removed from our systems.

XVI. Third Party Service Providers and Links
In addition to information we may share directly to third party service providers and vendors, we may also utilize third parties and third party integrations to carry out the data collection or other services and tools on our websites or in the Pasa Services. This may include payment processors, CRMs, third party integrations, e-sign services, google integrations, etc. There may also be links to third party sites or external resources. While we control what we do with the information we collect through these third parties, we do not control how these third parties collect and use your Personal Information and you are subject to their individual privacy policies. Furthermore, your use of any linked website is solely at your own risk. The inclusion of a link to a third party website does not indicate that we endorse, represent, warrant, or accept any responsibility for the content or conduct on the third party website. The third party service providers we work with may also use Cookies to collect information about your online activities over time and on other websites, and may use such information to target advertising to you on our websites and on other websites and mobile applications.

XVII. Changes to Our Privacy Policy
Pasa reserves the right to amend this privacy statement at our sole discretion at any time. When we make changes to this privacy statement, we will post the updated content to our applicable websites and services along with the effective date of the change. Your continued use of Pasa Services following the posting of changes constitutes your acceptance of such changes.

XVIII. Contact Us
If you have any questions or concerns about this Privacy Statement or its implementation, you may contact us via the following methods:

Via US Postal Service at:

Pasa Sustainable Agriculture
Attn: Privacy (Legal)
1631 N Front St
Harrisburg, PA 17102

OR Via email at: privacy@pasafarming.org