Rally Privacy Policy

1. Who we are

Rally is a volunteer management platform operated by Rally VMS Limited, a company incorporated in New Zealand (NZBN 9429052917622) ("Rally", "we", "us", "our").

We take privacy seriously and comply with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). Because we serve customers and individuals in Australia and may handle information about people in the European Economic Area (EEA) and the United Kingdom, this policy also addresses our obligations under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the EU and UK General Data Protection Regulation (together, "GDPR"), where those laws apply.

In this policy "personal information" means information about an identifiable individual, and includes "personal data" as defined under the GDPR.

2. How this policy applies: our two roles

Rally handles personal information in two distinct capacities. Which one applies determines whose privacy policy governs and who is responsible.

2.1 When we act on behalf of an organisation (processor / agent)

Organisations (for example, campaigns, community groups and not-for-profits) use Rally to collect and manage information about their volunteers. When an organisation uses Rally to collect and process volunteer information, that organisation decides what information is collected and why. In that context the organisation is the data controller and agency responsible for the information, and Rally acts as its processor / agent, handling the information on the organisation's behalf and on its instructions.

If you are a volunteer, the organisation you signed up with is primarily responsible for your information, and that organisation's own privacy policy also applies to you. Please read it. Where you have questions about how your information is used, or you wish to exercise your privacy rights, you should contact that organisation in the first instance. We may assist the organisation to respond to your request, but we generally cannot act on volunteer information except on the organisation's instructions.

2.2 When we act for our own purposes (we are a controller / agency)

We are the controller / agency responsible for personal information that we collect and use for our own purposes: for example, information about the people who create and administer organisation accounts, billing information, and information we use to operate, secure, support and improve the Rally platform. This policy governs that information.

The rest of this policy explains our practices in both capacities and, where relevant, notes which role applies.

3. Information we collect

3.1 Information about account holders and administrators

When someone signs up for or administers a Rally account we collect: name, email address, phone number (if collected), the organisation they represent, their role and permissions, and authentication information.

3.2 Volunteer information (collected on behalf of organisations)

Through an organisation's Rally sign-up pages and events, we process information that the organisation collects from its volunteers, which may include: name; email address; phone number; availability and shift preferences; maximum hours a volunteer is willing to contribute; dietary requirements; accessibility requirements; confirmation status; the events, shifts and tasks a volunteer signs up for or is assigned to; sign-up date; and any custom fields, notes or consents the organisation chooses to capture.

We normally collect this information directly from the volunteer when they register. In some cases an organisation's administrators may enter or import volunteer details directly. Where information is collected indirectly in this way, the organisation is responsible for ensuring it was obtained fairly and that the volunteer is made aware of it as required.

3.3 Billing and transaction information

For paid plans we collect billing contact details and payment information. Card payments are processed by our payment provider; we do not store full card numbers ourselves.

3.4 Information we collect automatically

When you use Rally we automatically collect technical and usage information, including IP address, device and browser type, pages and features used, and timestamps, together with cookies and similar technologies (see section 12).

3.5 Sensitive information / special categories of data

Some information may be sensitive and is treated with additional care:

• Dietary requirements may reveal health information or religious beliefs.
• Accessibility requirements may reveal health or disability information.
• The fact that a person volunteers for a political campaign or organisation may itself reveal their political opinions or associations.

Under the GDPR this is "special category" data (Article 9); under the Australian Privacy Act it is "sensitive information" (including health information and information about political opinions, associations or membership). New Zealand's Privacy Act does not have a separate category of "sensitive information". Under NZ law this is all personal information. We nonetheless apply heightened care to it as a matter of good practice and to meet Australian and GDPR requirements: we (and the organisations we act for) rely on the individual's consent, or another applicable condition, to collect and process it, and we do not use it beyond volunteer coordination and the purposes the organisation has notified.

3.6 Collecting only what we need, and what we tell you

We collect only the personal information we reasonably need for the purposes described in this policy. Providing information is generally voluntary, but if you do not provide certain information we (or the organisation) may be unable to do certain things, for example, without contact details we cannot confirm a shift, and without dietary or accessibility information an organisation cannot cater to those needs.

4. How we use information

Acting on behalf of organisations, we process volunteer information to provide the Rally service to that organisation, for example, to register volunteers, record availability and preferences, allocate people to events, shifts and tasks, designate shift captains, produce allocation exports (such as CSV and Excel workbooks), and enable communications the organisation sends to its volunteers.

Acting for our own purposes, we use personal information to:

• create, operate, secure and support Rally accounts;
• authenticate users and prevent fraud, abuse and unauthorised access;
• process payments and administer subscriptions (including "paused"/dormant accounts, where historical data is retained - see section 8);
• provide customer support and respond to enquiries;
• monitor, maintain, troubleshoot and improve the platform, including product analytics and aggregated/anonymised statistics;
• send service and administrative messages; and
• comply with legal obligations and enforce our terms.

We use personal information only for the purpose for which it was collected, or a directly related purpose, unless you consent to another use, or an exception under the Privacy Act (or other applicable law) applies. We may create and use aggregated and anonymised information - insights and statistics that do not identify, and cannot reasonably be used to identify, any individual or organisation - to operate, secure, analyse and improve the Service. Apart from creating such aggregated and anonymised information, we do not use volunteer information that we handle on an organisation's behalf for our own purposes.

5. Our legal bases (where the GDPR applies)

Where we act as controller and the GDPR applies, we rely on the following bases:

• Contract: to provide the platform to account holders and administer their account.
• Legitimate interests: to operate, secure, support and improve Rally, and for limited direct communications, balanced against individuals' rights.
• Legal obligation: to meet record-keeping, tax and other legal requirements.
• Consent: where we rely on consent (for example, certain cookies or marketing); consent can be withdrawn at any time.

Where we act as processor for an organisation, the organisation is responsible for establishing a lawful basis for the volunteer information it collects, including explicit consent for special category data under Article 9.

6. When we share information

We do not sell personal information. We disclose it only as follows:

• To the relevant organisation: volunteer information is accessible to the organisation whose volunteers they are, and to that organisation's authorised administrators and coordinators.
• To service providers (sub-processors): we use trusted third parties to host and run Rally, for example Amazon Web Services, payment providers, email/SMS delivery providers, and analytics/error-monitoring providers. They may process personal information only to provide services to us and under obligations of confidentiality and security. We keep a current list of our sub-processors and update it as they change.
• For legal reasons: where required by law, regulation, legal process or enforceable governmental request, or to protect the rights, safety and property of Rally, our customers or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to appropriate protections.

7. Storage and international transfers

Rally data is stored in Sydney, Australia. Our service providers may process information in other countries, including the United States and the EU.

Because Rally is a New Zealand business, and because we serve Australia and may serve the EEA/UK, information may be transferred across borders. When we transfer personal information overseas we take reasonable steps to ensure it receives a comparable level of protection (as required by the NZ Privacy Act, IPP 12, and APP 8). Where instead we rely on your authorisation to disclose your information to an overseas person that is not required to protect it in a way comparable to the NZ Privacy Act, we will tell you that at the time, and your information may not be protected to New Zealand standards.

For transfers of personal data out of the EEA or UK under the GDPR, we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA where applicable), or an adequacy decision where one applies. New Zealand has been recognised by the European Commission as providing an adequate level of data protection, which supports transfers from the EEA to Rally in New Zealand.

8. How long we keep information

We keep personal information only for as long as necessary for the purposes described in this policy, or as required by law.

Volunteer information is retained for as long as the organisation maintains its Rally account, and is dealt with according to the organisation's instructions and retention settings.

Paused / dormant accounts: where an organisation moves to a paused plan, we retain its historical campaigns, events, volunteer records and related data so the account can be reactivated with its data intact. That data remains subject to this policy and to the organisation's instructions while paused.

Account and billing information is retained for the life of the account and for the necessary period afterwards to meet legal, accounting and audit requirements.

When information is no longer required, we delete it or de-identify it. On termination or closure of an account, we deal with the organisation's data in accordance with our customer terms (including any export or deletion options).

9. Keeping information accurate

We take reasonable steps to ensure that personal information is accurate, up to date, complete, relevant and not misleading before we use or disclose it. Account holders and organisations are responsible for keeping their own and their volunteers' details current, and volunteers can update their details or ask for a correction (see section 11). If we correct information, or refuse a correction request, we will respond as required by the applicable law.

10. How we protect information

We maintain reasonable technical and organisational safeguards designed to protect personal information against loss, misuse and unauthorised access, disclosure, alteration or destruction, including encryption in transit and at rest, access controls, magic-link authentication, logging and monitoring, and regular reviews. Rally is a multi-tenant service, and we take steps to keep each organisation's data logically separated so that one organisation cannot access another's. No system is completely secure, and we cannot guarantee absolute security.

If a privacy breach occurs that is likely to cause serious harm, we will notify affected individuals and the relevant authorities as required by the NZ Privacy Act 2020 (Notifiable Privacy Breach scheme), the Australian Notifiable Data Breaches scheme, and the GDPR, and, where we act as processor, we will notify the affected organisation without undue delay.

11. Your privacy rights

Your rights depend on where you are and on which law applies. In all cases, if you are a volunteer, please contact the organisation you signed up with first; where we hold information as controller, you can contact us directly (section 18).

• New Zealand: You have the right to access the personal information we hold about you and to request correction of it (Information Privacy Principles 6 and 7).
• Australia: You may request access to, and correction of, your personal information (APPs 12 and 13), and you may ask about how your information is handled.
• EEA / UK (GDPR): Where the GDPR applies you may have the right to access, rectify or erase your personal data; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. Where we act as processor, we will pass your request to the relevant organisation (controller) and assist them to respond.

We will respond to verified requests within the timeframes required by the applicable law. We may need to verify your identity, and some information may be withheld where an exception or exemption applies.

12. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences, keep the service secure, and understand how Rally is used. You can control cookies through your browser settings; disabling some cookies may affect how Rally works.

13. Children and young people

Rally is intended to be used by organisations and adults. Volunteers may in some cases be young people. Organisations remain responsible for lawfully collecting information from volunteers who are minors.

14. Direct marketing

Any marketing we send about Rally will comply with the NZ Unsolicited Electronic Messages Act 2007, the Australian Spam Act 2003, and (where applicable) the GDPR and ePrivacy rules. You can opt out of our marketing at any time using the unsubscribe link or by contacting us. Communications an organisation sends to its own volunteers through Rally are the responsibility of that organisation.

15. Unique identifiers

We assign internal identifiers (such as account, event and registration IDs) only as necessary to operate Rally efficiently. We do not adopt as our own a unique identifier that has been assigned to you by another agency (such as a government identifier), and we will not require you to disclose such an identifier except where permitted by law.

16. Third-party links

Rally may contain links to third-party sites and services that we do not control. This policy does not apply to them; please review their privacy policies.

17. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "last updated" date and, where changes are significant, take reasonable steps to notify you.

18. Contact us and how to complain

If you have questions, requests or complaints about how Rally handles personal information, contact our Privacy Officer:

Rally Privacy Officer
Email: [email protected]

We will acknowledge and investigate your complaint. If you are not satisfied with our response, you may complain to the relevant authority:

• New Zealand: Office of the Privacy Commissioner (privacy.org.nz).
• Australia: Office of the Australian Information Commissioner (oaic.gov.au).
• EEA: your local data protection supervisory authority.