Rally Privacy Policy

1. Who we are

Rally is a volunteer management and donation/disclosure platform operated by Rally VMS Limited, a company incorporated in New Zealand (NZBN 9429052917622) ("Rally", "we", "us", "our").

We take privacy seriously and comply with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). Because we serve customers and individuals in Australia and may handle information about people in the European Economic Area (EEA) and the United Kingdom, this policy also addresses our obligations under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the EU and UK General Data Protection Regulation (together, "GDPR"), where those laws apply.

In this policy "personal information" means information about an identifiable individual, and includes "personal data" as defined under the GDPR.

2. How this policy applies: our two roles

Rally handles personal information in two distinct capacities. Which one applies determines whose privacy policy governs and who is responsible.

2.1 When we act on behalf of an organisation (processor / agent)

Organisations (for example, campaigns, community groups and not-for-profits) use Rally to collect and manage information about their volunteers and donors. When an organisation uses Rally to collect and process volunteer or donor information, that organisation decides what information is collected and why. In that context the organisation is the data controller and agency responsible for the information, and Rally acts as its processor / agent, handling the information on the organisation's behalf and on its instructions.

If you are a volunteer or donor, the organisation you signed up with, or donated to, is primarily responsible for your information, and that organisation's own privacy policy also applies to you. Please read it. Where you have questions about how your information is used, or you wish to exercise your privacy rights, you should contact that organisation in the first instance. We may assist the organisation to respond to your request, but we generally cannot act on volunteer or donor information except on the organisation's instructions.

2.2 When we act for our own purposes (we are a controller / agency)

We are the controller / agency responsible for personal information that we collect and use for our own purposes: for example, information about the people who create and administer organisation accounts, billing information, and information we use to operate, secure, support and improve the Rally platform. This policy governs that information.

The rest of this policy explains our practices in both capacities and, where relevant, notes which role applies.

3. Information we collect

3.1 Information about account holders and administrators

When someone signs up for or administers a Rally account we collect: name, email address, phone number (if collected), the organisation they represent, their role and permissions, and authentication information.

3.2 Volunteer information (collected on behalf of organisations)

Through an organisation's Rally sign-up pages and events, we process information that the organisation collects from its volunteers, which may include: name; email address; phone number; availability and shift preferences; maximum hours a volunteer is willing to contribute; dietary requirements; accessibility requirements; confirmation status; the events, shifts and tasks a volunteer signs up for or is assigned to; sign-up date; and any custom fields, notes or consents the organisation chooses to capture.

We normally collect this information directly from the volunteer when they register. In some cases an organisation's administrators may enter or import volunteer details directly. Where information is collected indirectly in this way, the organisation is responsible for ensuring it was obtained fairly and that the volunteer is made aware of it as required.

3.3 Donor and fundraiser information (collected on behalf of organisations)

Organisations record information about their donors and supporters in Rally, which may include: name; residential address or locality; occupation and employer; email address; phone number; donation or ticket purchase amount and date; the fundraiser event a donation or ticket is linked to; and any gift-in-kind description, declaration or consent the organisation chooses to capture.

This information may be collected indirectly - entered or imported by an organisation's administrators, for example from donations or ticket sales the organisation has already collected by other means (such as bank transfer, cheque or in person) - or, where an organisation makes a donation or ticket-purchase page available, directly from the donor or supporter who submits it themselves. Where information is collected indirectly, the organisation is responsible for ensuring it was obtained fairly and that the donor is made aware of it as required. Where we collect information directly from a donor or supporter, we will provide the relevant privacy information to them at the point of collection.

Some of this information (in particular a donor's address, occupation and employer) is collected because the organisation is legally required to obtain and retain it in order to meet donation disclosure obligations under applicable electoral law, such as the NSW Electoral Funding Act 2018 - not because Rally otherwise needs it to operate the platform.

3.4 Billing and transaction information

For paid plans we collect billing contact details and payment information. Card payments for organisation subscriptions are processed by our payment provider; we do not store full card numbers ourselves. Rally does not currently process donation or ticket payments itself - these are collected by the organisation outside Rally and simply recorded in the platform - but if we introduce online donation or ticket payment functionality in the future, those payments will also be processed by our payment provider on the same basis.

3.5 Information we collect automatically

When you use Rally we automatically collect technical and usage information, including IP address, device and browser type, pages and features used, and timestamps, together with cookies and similar technologies (see section 12).

3.6 Sensitive information / special categories of data

Some information may be sensitive and is treated with additional care:

• Dietary requirements may reveal health information or religious beliefs.
• Accessibility requirements may reveal health or disability information.
• The fact that a person volunteers for, or makes a donation to, a political campaign or organisation may itself reveal their political opinions or associations.

Under the GDPR this is "special category" data (Article 9); under the Australian Privacy Act it is "sensitive information" (including health information and information about political opinions, associations or membership). New Zealand's Privacy Act does not have a separate category of "sensitive information". Under NZ law this is all personal information. We nonetheless apply heightened care to it as a matter of good practice and to meet Australian and GDPR requirements: we (and the organisations we act for) rely on the individual's consent, or another applicable condition, to collect and process it, and we do not use it beyond volunteer/donor coordination and the purposes the organisation has notified.

3.7 Collecting only what we need, and what we tell you

We collect only the personal information we reasonably need for the purposes described in this policy. Providing information is generally voluntary, but if you do not provide certain information we (or the organisation) may be unable to do certain things - for example, without contact details we cannot confirm a shift; without dietary or accessibility information an organisation cannot cater to those needs; and without the donor details required by electoral law, an organisation may be unable to lawfully accept a donation.

4. How we use information

Acting on behalf of organisations, we process volunteer and donor information to provide the Rally service to that organisation, for example, to register volunteers, record availability and preferences, allocate people to events, shifts and tasks, designate shift captains, produce allocation exports (such as CSV and Excel workbooks), record and classify donations entered by the organisation, manage fundraiser events, prepare the disclosure returns required by applicable electoral law (such as the NSW Electoral Funding Act 2018), and enable communications the organisation sends to its volunteers and donors. If we introduce public-facing donation or ticketing pages in the future, we will also use this information to operate those pages directly.

Acting for our own purposes, we use personal information to:

• create, operate, secure and support Rally accounts;
• authenticate users and prevent fraud, abuse and unauthorised access;
• process payments and administer subscriptions (including "paused"/dormant accounts, where historical data is retained - see section 8);
• provide customer support and respond to enquiries;
• monitor, maintain, troubleshoot and improve the platform, including product analytics and aggregated/anonymised statistics;
• send service and administrative messages; and
• comply with legal obligations and enforce our terms.

We use personal information only for the purpose for which it was collected, or a directly related purpose, unless you consent to another use, or an exception under the Privacy Act (or other applicable law) applies. We may create and use aggregated and anonymised information - insights and statistics that do not identify, and cannot reasonably be used to identify, any individual or organisation - to operate, secure, analyse and improve the Service. Apart from creating such aggregated and anonymised information, we do not use volunteer or donor information that we handle on an organisation's behalf for our own purposes.

5. Our legal bases (where the GDPR applies)

Where we act as controller and the GDPR applies, we rely on the following bases:

• Contract: to provide the platform to account holders and administer their account.
• Legitimate interests: to operate, secure, support and improve Rally, and for limited direct communications, balanced against individuals' rights.
• Legal obligation: to meet record-keeping, tax and other legal requirements.
• Consent: where we rely on consent (for example, certain cookies or marketing); consent can be withdrawn at any time.

Where we act as processor for an organisation, the organisation is responsible for establishing a lawful basis for the volunteer information it collects, including explicit consent for special category data under Article 9.

6. When we share information

We do not sell personal information. We disclose it only as follows:

• To the relevant organisation: volunteer and donor information is accessible to the organisation the volunteer signed up with, or the donor gave to, and to that organisation's authorised administrators and coordinators.
• To electoral commissions, and the public: where an organisation uses Rally to prepare and lodge donation disclosure returns required by electoral law (such as the NSW Electoral Funding Act 2018), those returns - which may include a donor's name, address or locality, occupation and donation amount, where the applicable disclosure threshold is met - are provided by the organisation to the relevant electoral commission (for example, the NSW Electoral Commission), and that commission may publish the return as a public record. This disclosure is a legal obligation of the organisation as a political donee, not a discretionary choice by Rally, and applies regardless of this policy.
• To service providers (sub-processors): we use trusted third parties to host and run Rally, for example Amazon Web Services, payment providers, email/SMS delivery providers, and analytics/error-monitoring providers. They may process personal information only to provide services to us and under obligations of confidentiality and security. We keep a current list of our sub-processors and update it as they change.
• For legal reasons: where required by law, regulation, legal process or enforceable governmental request, or to protect the rights, safety and property of Rally, our customers or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to appropriate protections.

7. Storage and international transfers

Rally data is stored in Sydney, Australia. Our service providers may process information in other countries, including the United States and the EU.

Because Rally is a New Zealand business, and because we serve Australia and may serve the EEA/UK, information may be transferred across borders. When we transfer personal information overseas we take reasonable steps to ensure it receives a comparable level of protection (as required by the NZ Privacy Act, IPP 12, and APP 8). Where instead we rely on your authorisation to disclose your information to an overseas person that is not required to protect it in a way comparable to the NZ Privacy Act, we will tell you that at the time, and your information may not be protected to New Zealand standards.

For transfers of personal data out of the EEA or UK under the GDPR, we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA where applicable), or an adequacy decision where one applies. New Zealand has been recognised by the European Commission as providing an adequate level of data protection, which supports transfers from the EEA to Rally in New Zealand.

8. How long we keep information

We keep personal information only for as long as necessary for the purposes described in this policy, or as required by law.

Volunteer and donor information is retained for as long as the organisation maintains its Rally account, and is dealt with according to the organisation's instructions and retention settings - except that donation and disclosure records may need to be retained for longer where the organisation is required to keep them for a minimum period under applicable electoral law (such as the record-keeping requirements of the NSW Electoral Funding Act 2018).

Paused / dormant accounts: where an organisation moves to a paused plan, we retain its historical campaigns, events, volunteer and donor records and related data so the account can be reactivated with its data intact. That data remains subject to this policy and to the organisation's instructions while paused.

Account and billing information is retained for the life of the account and for the necessary period afterwards to meet legal, accounting and audit requirements.

When information is no longer required, we delete it or de-identify it. On termination or closure of an account, we deal with the organisation's data in accordance with our customer terms (including any export or deletion options), subject to any minimum retention period the organisation is required to observe under electoral or other law.

9. Keeping information accurate

We take reasonable steps to ensure that personal information is accurate, up to date, complete, relevant and not misleading before we use or disclose it. Account holders and organisations are responsible for keeping their own, their volunteers' and their donors' details current, and volunteers and donors can update their details or ask for a correction (see section 11). If we correct information, or refuse a correction request, we will respond as required by the applicable law.

10. How we protect information

We maintain reasonable technical and organisational safeguards designed to protect personal information against loss, misuse and unauthorised access, disclosure, alteration or destruction, including encryption in transit and at rest, access controls, magic-link authentication, logging and monitoring, and regular reviews. Rally is a multi-tenant service, and we take steps to keep each organisation's data logically separated so that one organisation cannot access another's. No system is completely secure, and we cannot guarantee absolute security.

If a privacy breach occurs that is likely to cause serious harm, we will notify affected individuals and the relevant authorities as required by the NZ Privacy Act 2020 (Notifiable Privacy Breach scheme), the Australian Notifiable Data Breaches scheme, and the GDPR, and, where we act as processor, we will notify the affected organisation without undue delay.

11. Your privacy rights

Your rights depend on where you are and on which law applies. In all cases, if you are a volunteer or donor, please contact the organisation you signed up with, or donated to, first; where we hold information as controller, you can contact us directly (section 18).

• New Zealand: You have the right to access the personal information we hold about you and to request correction of it (Information Privacy Principles 6 and 7).
• Australia: You may request access to, and correction of, your personal information (APPs 12 and 13), and you may ask about how your information is handled.
• EEA / UK (GDPR): Where the GDPR applies you may have the right to access, rectify or erase your personal data; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. Where we act as processor, we will pass your request to the relevant organisation (controller) and assist them to respond.

We will respond to verified requests within the timeframes required by the applicable law. We may need to verify your identity, and some information may be withheld where an exception or exemption applies, including where information forms part of a public disclosure return already lodged with an electoral commission.

12. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences, keep the service secure, and understand how Rally is used. You can control cookies through your browser settings; disabling some cookies may affect how Rally works.

13. Children and young people

Rally is intended to be used by organisations and adults. Volunteers may in some cases be young people. Organisations remain responsible for lawfully collecting information from volunteers, or accepting donations from donors, who are minors.

14. Direct marketing

Any marketing we send about Rally will comply with the NZ Unsolicited Electronic Messages Act 2007, the Australian Spam Act 2003, and (where applicable) the GDPR and ePrivacy rules. You can opt out of our marketing at any time using the unsubscribe link or by contacting us. Communications an organisation sends to its own volunteers or donors through Rally are the responsibility of that organisation.

15. Unique identifiers

We assign internal identifiers (such as account, event and registration IDs) only as necessary to operate Rally efficiently. We do not adopt as our own a unique identifier that has been assigned to you by another agency (such as a government identifier), and we will not require you to disclose such an identifier except where permitted by law.

16. Third-party links

Rally may contain links to third-party sites and services that we do not control. This policy does not apply to them; please review their privacy policies.

17. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "last updated" date and, where changes are significant, take reasonable steps to notify you.

18. Contact us and how to complain

If you have questions, requests or complaints about how Rally handles personal information, contact our Privacy Officer:

Rally Privacy Officer
Email: [email protected]

We will acknowledge and investigate your complaint. If you are not satisfied with our response, you may complain to the relevant authority:

• New Zealand: Office of the Privacy Commissioner (privacy.org.nz).
• Australia: Office of the Australian Information Commissioner (oaic.gov.au).
• EEA: your local data protection supervisory authority.