ETHIOPIAN COMMUNITY CENTER IN MARYLAND

PRIVACY POLICY

Effective Date: March 7, 2026

Last Updated: March 7, 2026

www.ethiopianccmd.org

TABLE OF CONTENTS

Introduction & Overview
Who We Are — Data Controller
Information We Collect
How We Use Your Information
Legal Basis for Processing (GDPR / Maryland Law)
Cookies and Tracking Technologies
Sharing and Disclosure of Information
Third-Party Services and Links
Data Retention
Data Security
Your Privacy Rights
Children’s Privacy
Sensitive Personal Information
International Users
Changes to This Privacy Policy
Contact Us — Privacy Inquiries

1. Introduction & Overview

The Ethiopian Community Center in Maryland (“ECCM,” “we,” “us,” or “our”) is committed to protecting the privacy and personal information of every individual who visits our website, accesses our programs, contacts our office, or interacts with us in any way.

This Privacy Policy explains what personal information we collect, how we use and protect that information, under what circumstances we may share it, and what rights you have with respect to your personal information. It applies to all services offered by ECCM, including our website (www.ethiopianccmd.org), our programs, our community events, our donation portal, and any other online or offline interactions with our organization.

By using our website or engaging with our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms described in this policy, please discontinue use of our website and services.

This Privacy Policy is written to comply with applicable U.S. federal privacy laws, Maryland state privacy laws, the Children’s Online Privacy Protection Act (COPPA), and best practices consistent with the General Data Protection Regulation (GDPR) for individuals who may access our website from the European Economic Area.

2. Who We Are — Data Controller

Ethiopian Community Center in Maryland is a 501(c)(3) nonprofit community-based organization incorporated in the State of Maryland. We operate as the data controller for all personal information collected through our website and services.

Organization Name: Ethiopian Community Center in Maryland

Address: 8701 Georgia Ave, Suite 601, Silver Spring, Maryland 20910

Phone: (240) 285-2798

Email: info@ethiopianccmd.org

Website: www.ethiopianccmd.org

For all privacy-related inquiries, including requests to access, correct, or delete your personal information, please contact us using the information above or refer to Section 16 of this policy.

3. Information We Collect

We collect personal information in several ways depending on how you interact with ECCM. The categories of information we may collect include:

3.1 Information You Provide Directly

When you voluntarily interact with our website or services, you may provide us with:

Contact Information: Full name, email address, mailing address, phone number.
Demographic Information: Age range, preferred language (e.g., English, Amharic, Tigrinya), country of origin, and immigration status — provided voluntarily when applying for services.
Program Application Information: Information submitted when applying for or enrolling in ECCM programs, including household composition, employment status, income range, and educational background.
Donation Information: Billing name, billing address, payment method details (processed securely through third-party payment processors — see Section 8), and donation amount.
Volunteer & Partnership Information: Name, contact details, skills, availability, organization affiliation, and background check consent (where applicable).
Event Registration Information: Name, contact details, and dietary or accessibility preferences when registering for ECCM events.
Contact Form Submissions: Messages, questions, or feedback submitted through our website contact form.
Newsletter Subscriptions: Email address and preferred language when signing up for our newsletter or email updates.

3.2 Information Collected Automatically

When you visit our website, we and our third-party service providers may automatically collect certain technical information, including:

Log Data: IP address, browser type and version, operating system, referring URL, pages visited, time and date of visit, and time spent on each page.
Device Information: Device type, screen resolution, and unique device identifiers.
Location Data: General geographic location derived from your IP address (city/region level only — we do not collect precise GPS location).
Cookie and Tracking Data: Information collected through cookies, web beacons, and similar technologies (see Section 6 for full details).

3.3 Information from Third Parties

We may receive limited information about you from third parties in the following circumstances:

Referral Partners: Social service agencies, healthcare providers, schools, or other nonprofits may refer individuals to ECCM programs and share relevant contact or intake information with your consent.
Donation Platforms: If you donate through a third-party platform (e.g., Donorbox, PayPal, Network for Good), that platform may share your name, email, and donation amount with us.
Social Media: If you interact with our social media pages (Facebook, Instagram, YouTube, LinkedIn), those platforms may share engagement data with us according to their own privacy policies.

3.4 Information We Do Not Collect

ECCM does not collect the following unless explicitly required for a specific lawful purpose and with your clear consent:

Full Social Security Numbers or government identification numbers
Full payment card numbers (these are handled exclusively by our payment processors)
Biometric data
Precise real-time GPS location

4. How We Use Your Information

ECCM uses the personal information we collect for the following purposes:

4.1 Delivering Services & Programs

To process applications and enroll individuals in ECCM programs
To connect community members with social services, employment resources, healthcare referrals, and educational opportunities
To provide case management and follow-up support
To communicate program updates, scheduling changes, and service-related information

4.2 Processing Donations & Transactions

To process charitable donations and issue donation receipts
To manage recurring giving programs
To fulfill in-kind donation requests and acknowledgments
To send tax acknowledgment letters for charitable contributions

4.3 Communications & Community Engagement

To respond to inquiries submitted through our contact form or by phone/email
To send newsletters, event invitations, and community updates (with your consent)
To notify you of upcoming events, new programs, or volunteer opportunities
To conduct community surveys and program evaluations

4.4 Website Operations & Improvement

To operate, maintain, and improve our website
To analyze website traffic and user behavior to improve content and navigation
To detect and prevent fraud, spam, and security threats
To troubleshoot technical issues

4.5 Legal & Compliance

To comply with applicable federal, state, and local laws and regulations
To fulfill reporting obligations to government funders and grant agencies
To enforce our Terms of Use and other organizational policies
To respond to lawful requests from law enforcement or government authorities

4.6 Research & Program Improvement

To evaluate the effectiveness of our programs and services using aggregated, de-identified data
To prepare annual reports and grant applications using anonymized impact statistics
To improve services based on community feedback and program outcomes

ECCM does not sell, rent, or trade your personal information to third parties for commercial or marketing purposes. We are a nonprofit organization — your data is used solely to serve you and our community mission.

5. Legal Basis for Processing

Where applicable under the GDPR (for users in the European Economic Area) or similar frameworks, our legal basis for processing personal information is as follows:

Consent: When you voluntarily provide personal information, sign up for our newsletter, or submit a contact form, you consent to our use of that information for the stated purposes. You may withdraw consent at any time.
Contractual Necessity: When processing is necessary to fulfill a service request, process a donation, or fulfill a program enrollment.
Legitimate Interests: For website analytics, improving our services, and sending relevant community updates to existing contacts — where these interests are not overridden by your privacy rights.
Legal Obligation: Where processing is required to comply with a legal obligation, such as reporting to government funders or responding to a lawful court order.
Vital Interests: In rare emergency situations where processing may be necessary to protect the life or safety of an individual.

6. Cookies and Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files stored on your device by your web browser when you visit a website. They help websites remember your preferences, analyze usage patterns, and deliver a better user experience.

6.2 Types of Cookies We Use

Strictly Necessary Cookies: Essential for the website to function. These enable basic features such as page navigation, secure form submissions, and access to protected areas. These cannot be disabled.
Analytics Cookies: Used to understand how visitors interact with our website. We use Google Analytics to collect anonymized data on page views, session duration, and user behavior. No personally identifiable information is stored through analytics cookies.
Functional Cookies: Remember your preferences such as language selection or font size to enhance your experience.
Marketing / Third-Party Cookies: If we embed content from third-party platforms (e.g., YouTube videos, Facebook plugins), those platforms may set their own cookies. We do not control these and recommend reviewing their privacy policies.

6.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse, delete, or receive alerts before cookies are stored. Please note that disabling certain cookies may affect the functionality of our website.

To learn more about managing cookies, visit: www.allaboutcookies.org

6.4 Google Analytics

We use Google Analytics to analyze website traffic. Google Analytics collects data such as pages visited, time on site, and general location (at the country/region level). This data is aggregated and anonymized. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-Out Browser Add-on at: tools.google.com/dlpage/gaoptout

7. Sharing and Disclosure of Information

ECCM respects your privacy and does not sell, rent, or disclose your personal information to third parties except in the following circumstances:

7.1 Service Providers

We share personal information with trusted third-party vendors and service providers who assist us in operating our website and delivering our programs. These include:

Website hosting providers
Email marketing platforms (e.g., Mailchimp, Constant Contact)
Online payment processors (e.g., Stripe, PayPal, Donorbox)
Event registration platforms
Cloud storage and document management services

All service providers are contractually required to maintain the confidentiality of your personal information and may only use it to perform services on our behalf.

7.2 Government Funders & Grant Agencies

As a nonprofit organization that receives government grants and public funding, ECCM may be required to report program outcomes and participant data to grant agencies and government bodies. In such cases, we report only aggregated, de-identified data unless otherwise required by law or grant agreement, and only with appropriate consents in place.

7.3 Partner Organizations

With your explicit consent, we may share relevant information with partner organizations — such as healthcare providers, workforce agencies, or other nonprofits — to connect you with additional services or resources you have requested.

7.4 Legal Requirements

We may disclose your personal information if required to do so by law or in response to:

A valid court order, subpoena, or legal process
A request from law enforcement agencies
To protect the rights, property, or safety of ECCM, our staff, community members, or the public
To investigate potential violations of our Terms of Use

7.5 Organizational Transfers

In the unlikely event that ECCM merges with, is acquired by, or transfers its assets to another nonprofit organization, your personal information may be transferred as part of that transition. We will notify you of any such change and ensure that your information continues to be protected under a comparable privacy policy.

7.6 Aggregated & De-Identified Data

ECCM may share aggregated, anonymized, or de-identified data (from which all identifying information has been removed) with funders, researchers, the media, or the public for reporting, evaluation, or advocacy purposes. This data cannot be used to identify any individual.

8. Third-Party Services and Links

Our website may contain links to external websites, embedded content (such as YouTube videos or Google Maps), and integrations with third-party platforms. ECCM does not control these third-party services and is not responsible for their privacy practices.

Third-party services we may use or link to include:

Google Maps: Embedded on our Contact page. Subject to Google’s Privacy Policy (policies.google.com/privacy).
YouTube: Embedded videos. Subject to Google’s Privacy Policy.
Facebook / Meta: Social media links and plugins. Subject to Meta’s Data Policy (facebook.com/policy.php).
PayPal / Stripe / Donorbox: Online payment processing for donations. Subject to their respective privacy policies. ECCM does not store full payment card information.
Mailchimp / Constant Contact: Email newsletter delivery. Subject to their privacy policies.
Google Analytics: Website analytics. Subject to Google’s Privacy Policy.

We strongly encourage you to review the privacy policies of any third-party services you access through our website.

9. Data Retention

ECCM retains personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, or as required by law, whichever is longer.

Retention Guidelines:

Program Participant Records: Retained for a minimum of 7 years following the last date of service, in compliance with applicable nonprofit and government grant requirements.
Donation Records: Retained for a minimum of 7 years for tax and audit purposes in accordance with IRS guidelines for 501(c)(3) organizations.
Volunteer Records: Retained for 3 years following the conclusion of the volunteer relationship.
Website Contact Form Submissions: Retained for 2 years unless a longer retention period is needed to resolve a matter.
Email Newsletter Subscriptions: Retained until you unsubscribe or request deletion.
Website Analytics Data: Anonymized and aggregated; retained for up to 26 months per Google Analytics default settings.

When personal information is no longer needed, ECCM will securely delete or anonymize it in accordance with our data destruction procedures.

10. Data Security

ECCM takes the security of your personal information seriously and has implemented reasonable administrative, technical, and physical safeguards to protect your data from unauthorized access, use, alteration, or disclosure.

Our security measures include:

SSL/TLS encryption on all web pages and forms (HTTPS)
Secure, access-controlled cloud storage systems
Password protection and multi-factor authentication for staff accessing organizational systems
Limited access to personal information — only staff with a legitimate need may access participant data
Regular security reviews and software updates
Staff training on data privacy and security practices
Secure payment processing through PCI-DSS compliant third-party processors

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

Data Breach Response

In the event of a data breach that poses a risk to your rights and freedoms, ECCM will notify affected individuals and, where required by law, applicable regulatory authorities, within the timeframes required by applicable law (including within 72 hours under GDPR requirements, where applicable).

11. Your Privacy Rights

Depending on your location and applicable law, you may have the following rights with respect to your personal information:

11.1 Rights Available to All Users

Right to Know: You have the right to request information about the personal data we hold about you, including what categories of information we collect and how we use it.
Right to Access: You may request a copy of the personal information we hold about you in a portable, readable format.
Right to Correct: You may request that we correct inaccurate or incomplete personal information we hold about you.
Right to Delete: You may request that we delete your personal information, subject to any legal obligations that require us to retain it (e.g., financial records).
Right to Opt Out of Communications: You may opt out of receiving marketing and newsletter emails at any time by clicking the unsubscribe link in any email or contacting us directly.
Right to Withdraw Consent: Where you have provided consent for specific data processing activities, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

11.2 Additional Rights for EEA/UK Residents (GDPR)

Right to Restriction of Processing: You may request that we restrict how we process your data in certain circumstances.
Right to Data Portability: You may request that we provide your data in a machine-readable format for transfer to another service.
Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.
Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority if you believe we have processed your data unlawfully.

11.3 Additional Rights for California Residents (CCPA)

California residents have specific rights under the California Consumer Privacy Act (CCPA), including the right to know, access, delete, and opt out of the sale of personal information. ECCM does not sell personal information. To exercise your California privacy rights, please contact us at the information provided in Section 16.

11.4 How to Exercise Your Rights

To exercise any of the rights listed above, please contact ECCM’s Privacy Officer at: info@ethiopianccmd.org or by phone at (240) 285-2798. We will respond to verified requests within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request.

12. Children’s Privacy

The protection of children’s privacy is extremely important to ECCM, particularly given our work with Ethiopian youth and families.

Our website is not directed to children under the age of 13, and we do not knowingly collect personal information directly from children under 13 without verifiable parental consent, in compliance with the Children’s Online Privacy Protection Act (COPPA).

For youth program registration and participation (for children under 18), we collect only the information necessary to deliver program services, and we require a parent or legal guardian to complete enrollment forms and provide consent on behalf of the child.

If you believe that ECCM has inadvertently collected personal information from a child under 13 without appropriate parental consent, please contact us immediately at the information provided in Section 16 and we will take prompt steps to delete that information.

13. Sensitive Personal Information

In the course of providing social services and case management to Ethiopian immigrants and families, ECCM may collect certain categories of sensitive personal information, including:

Immigration status and documentation information
Health and medical information (for health program referrals)
Mental health information (for wellness program referrals)
Income and financial information (for service eligibility determinations)
Religious affiliation (when voluntarily disclosed for program matching)
National origin and ethnicity (for program eligibility and reporting)

ECCM treats all sensitive personal information with the highest level of care, confidentiality, and respect. We collect sensitive information only when strictly necessary for program delivery, with explicit consent from the individual, and in compliance with applicable laws.

Sensitive personal information collected for program purposes is never used for marketing, shared with commercial third parties, or disclosed without your explicit written consent except where required by law.

Staff who handle sensitive personal information are trained in confidentiality practices and are bound by organizational data protection policies.

14. International Users

ECCM is based in Silver Spring, Maryland, United States. If you are accessing our website or services from outside the United States — including from Ethiopia, Eritrea, Europe, or other regions — please be aware that your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

By using our website and services from outside the United States, you acknowledge this transfer. We take appropriate safeguards to ensure that your personal information receives an adequate level of protection wherever it is processed, consistent with the requirements of applicable data protection laws.

For residents of the European Economic Area (EEA) or United Kingdom, we rely on appropriate legal transfer mechanisms — including Standard Contractual Clauses where required — to ensure lawful transfer of personal data to the United States.

15. Changes to This Privacy Policy

ECCM may update this Privacy Policy from time to time to reflect changes in our practices, applicable laws, or organizational operations. When we make changes, we will:

Update the “Last Updated” date at the top of this policy
Post the revised policy on our website with a clear notice
For material changes, notify subscribers by email with reasonable advance notice

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information. Your continued use of our website and services after any changes become effective constitutes your acceptance of the revised policy.

Previous versions of this Privacy Policy are available upon request.

16. Contact Us — Privacy Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Ethiopian Community Center in Maryland

Attn: Privacy Officer

8701 Georgia Ave, Suite 601, Silver Spring, Maryland 20910

Phone: (240) 285-2798

Email: info@ethiopianccmd.org

We aim to respond to all privacy inquiries within 10 business days. For requests to access, correct, or delete your personal information, we will respond within 30 days or within the timeframe required by applicable law.

Our office staff is available in both English and Amharic to assist you with your privacy inquiry.

Your privacy matters to us. Thank you for trusting the Ethiopian Community Center in Maryland.