BeneVets, Inc. - Donor Privacy Policy

Effective date: July 4, 2026 Last updated: July 4, 2026 Board ratification reference: Adopted by the Board of Directors as part of the governance package ratified on May 23, 2026. Document number: 09 of the BeneVets legal document set. Cross-references: Donor Bill of Rights (Doc 10), State Charitable Solicitation Disclosures (Doc 11), Privacy Policy (Doc 02), Data Retention Schedule (Doc 14).

§ 1. Plain-English Summary

In plain English: BeneVets is a 501(c)(3) nonprofit. If you give us a donation, or if you sign up to receive donor emails from us, this policy tells you what we collect, why we collect it, and how we protect it. We do not sell, rent, swap, or trade your information. You can opt out of donor emails at any time without losing anything. You can ask to see, correct, or delete your donor record. We keep donor records for seven years because IRS rules require it. Today, we do not process donations on our website, so we do not collect payment-card information. When we add donation processing, we will update this policy and tell you in advance.

§ 2. Scope of This Policy

In plain English: This donor policy is separate from our regular Privacy Policy. The regular Privacy Policy covers people who use the BeneVets website to look up veterans benefits. This policy covers people who donate to BeneVets or who sign up to hear from us as donors.

This Donor Privacy Policy applies to Personal Information that BeneVets, Inc. ("BeneVets," "we," "us," or "our") collects, uses, retains, discloses, or otherwise processes about donors, prospective donors, and persons who subscribe to the BeneVets donor email program. This policy is separate from, and operates in addition to, the BeneVets Privacy Policy (Doc 02), which governs Personal Information collected from users of the Service. Where a single natural person interacts with BeneVets in both capacities (donor and user), both policies apply concurrently to the respective data flows.

Nothing in this policy expands or limits any right a donor or user has under applicable law, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq. ("CCPA/CPRA"), the California Government Code provisions governing charitable trusts and registry reporting at Cal. Gov't Code § 12580 et seq., or the federal Internal Revenue Code, Title 26 of the United States Code ("IRC").

§ 3. Categories of Donor Personal Information Collected, and Source

In plain English: Below is the list of information we may collect about you as a donor, and where it comes from. Most of the time it comes directly from you.

BeneVets does not collect Sensitive Personal Information as defined at Cal. Civ. Code § 1798.140(ae) in the donor context unless a donor voluntarily supplies it (for example, by writing a tribute description that names a deceased loved one). BeneVets does not request government identification numbers, financial-account numbers (other than as transmitted through a payment processor when activated), or health information from donors.

§ 4. Purposes for Which We Process Donor Personal Information

In plain English: We use your donor information to thank you, to comply with IRS rules, to send you the donor communications you signed up for, and to keep our books in order for audits and the 990 tax return. We do not use your information to target you with online advertising, and we do not let our service providers use it for their own purposes.

BeneVets processes donor Personal Information for the following purposes, each of which corresponds to a documented lawful basis or compliance obligation:

1. Gift acknowledgment and substantiation under IRC § 170(f)(8). For any single contribution of $250 or more, BeneVets must provide the donor with a contemporaneous written acknowledgment that meets the requirements of IRC § 170(f)(8) and the implementing regulations at Treas. Reg. § 1.170A-13(f), including (a) the amount of cash and a description (but not value) of any non-cash property contributed and (b) a statement of whether BeneVets provided any goods or services in consideration, in whole or in part, for the contribution. BeneVets provides the same acknowledgment in writing for all gifts as a matter of policy, not only those over $250.

2. Recordkeeping for IRS Form 990 reporting under IRC § 6033. BeneVets must file IRS Form 990 (or Form 990-EZ or Form 990-N as the gross-receipts threshold dictates) annually under IRC § 6033. Donor records support Schedule A (public-support test under IRC § 509(a)(1) and § 170(b)(1)(A)(vi) or § 509(a)(2) as applicable), Schedule B (Schedule of Contributors, IRS-confidential under IRC § 6104(d)(3)(A)), Schedule M (non-cash contributions), and the Form 990 core form Part VIII (Statement of Revenue).

3. California state-attorney-general reporting. BeneVets is registered with, or will register with, the California Attorney General's Registry of Charitable Trusts under Cal. Gov't Code § 12585 and files Form RRF-1 annually under Cal. Code Regs. tit. 11, § 301. Donor records support that reporting.

4. Donor communications and stewardship. Acknowledgment letters, impact reports, year-end summaries, gift-anniversary outreach.

5. Fundraising appeals - only to donors and subscribers who have affirmatively opted in to the donor email program. BeneVets operates the donor email program as a separate stream from the user newsletter program described in the BeneVets Privacy Policy, with separate consent capture, a separate unsubscribe surface, and (operationally) a separate sender domain where feasible.

6. Combined Federal Campaign ("CFC") reporting. If and when BeneVets is approved as a CFC-eligible charity under 5 C.F.R. § 950.202, BeneVets will report and acknowledge CFC pledges as required by the Office of Personnel Management. This use is reserved and is not active at v1.

7. Audit, tax, and litigation preparedness. Donor records are made available to BeneVets's independent accountants and auditors and, when required, to retained legal counsel, in each case under written confidentiality obligations.

8. Internal analytics on aggregate giving trends - using deidentified or aggregated data only.

BeneVets does not use donor Personal Information for cross-context behavioral advertising as defined at Cal. Civ. Code § 1798.140(k). BeneVets does not "sell" or "share" donor Personal Information within the meaning of Cal. Civ. Code § 1798.140(ad) and (ah).

§ 5. No Sale, Rental, Swap, or Trade of Donor Information

In plain English: We do not sell, rent, swap, or trade our donor list. Not to other nonprofits. Not to companies. Not to political organizations. Period. This is a firm pledge.

BeneVets affirms the following pledge, consistent with the Donor Bill of Rights jointly adopted by the Association of Fundraising Professionals ("AFP"), the Association for Healthcare Philanthropy ("AHP"), the Council for Advancement and Support of Education ("CASE"), and the Giving Institute (1993), and consistent with the donor-privacy expectations articulated by the California Attorney General and the New York Attorney General Charities Bureau:

BeneVets, Inc. does not sell, rent, lease, trade, swap, exchange, or otherwise transfer its donor list, donor identifying information, or donor giving history to any third party, including but not limited to other nonprofit organizations, commercial entities, data brokers, political parties, political action committees, candidate committees, or any other third party for the third party's own use, except as expressly permitted in § 9 (service providers under contractual restriction) or as required by law.

This pledge applies regardless of whether consideration would be received in exchange.

§ 6. Donor List Sharing Posture

In plain English: The same answer as above, in a slightly different way: we never share our donor list. Other nonprofits sometimes "exchange" donor lists with each other so each can solicit the other's donors. We do not do that.

For avoidance of doubt: BeneVets does not participate in donor-list exchanges, cooperative mailings under a common-key arrangement, or any practice in which a third party gains access to BeneVets's donor identities. The only third parties that receive donor Personal Information are the service providers listed in § 9, each under a written contract restricting use to BeneVets's processing instructions.

§ 7. Donor Communications Opt-Out and Granular Controls

In plain English: You decide what we send you. You can turn off any category at any time. The options are: newsletters, year-end appeals, impact reports, and special campaigns. You can also choose "transactional only," which means we only send you tax receipts and confirmations.

A donor or donor-email subscriber may opt out of, or specify granular preferences for, the following donor-communication categories independently:

1. Donor newsletter. General mission updates and program highlights.
2. Year-end appeals. Solicitations issued in the fourth calendar quarter.
3. Impact reports. Annual report and program-impact summaries.
4. Special campaigns. Time-limited appeals tied to a specific program need or matching opportunity.
5. All donor communications ("transactional only"). Suppresses categories 1 through 4. Acknowledgment letters required by IRC § 170(f)(8), tax receipts, and CCPA/CPRA-mandated disclosures continue to be sent, since these are not commercial messages within the meaning of 15 U.S.C. § 7702(2).

Each commercial donor email includes a one-click unsubscribe link, a List-Unsubscribe and List-Unsubscribe-Post: One-Click header pair compliant with RFC 8058, and BeneVets's valid postal address as required by 15 U.S.C. § 7704(a)(5)(A)(iii). A donor may also opt out by writing to the donor-privacy address in § 17.

Opt-outs are honored within ten (10) business days of receipt and in any event within the thirty-five (35) day reasonable-time window contemplated by Cal. Code Regs. tit. 11, § 7026(f) for analogous CCPA requests. BeneVets does not condition any benefit on a donor's communications preferences and does not penalize a donor for opting out.

§ 8. Anonymous Giving and Recognition Opt-Out

In plain English: You can give anonymously. You can also tell us not to list your name on any donor wall, annual report donor list, or recognition tier, even if you give a large gift.

A donor may elect at the time of the gift, or at any later time, to:

1. Give anonymously - BeneVets will not list the donor's name in any public donor recognition surface.
2. Decline recognition at any donor tier - even if the gift would otherwise qualify for a named recognition level.
3. Use a designated alias for recognition (for example, "In honor of Sergeant J.D.") if BeneVets adopts a recognition program permitting alias listing.

Anonymity elections are recorded in the donor record and are honored across all BeneVets publications, including the Form 990 Schedule B disclosures permitted under IRC § 6104(d)(3)(A) (Schedule B contributor identities are not subject to public-inspection disclosure as to most 501(c)(3) charities under current IRS practice; see Rev. Proc. 2018-38, vacated by Bullock v. IRS, 380 F. Supp. 3d 1042 (D. Mont. 2019), and Treasury's 2020 final regulations at 26 C.F.R. § 1.6033-2(a)(2)(ii)(F), under which 501(c)(3) public charities continue to report Schedule B identifying information to the IRS).

§ 9. Disclosure to Third-Party Service Providers

In plain English: A few outside companies help us operate. Each of them is contractually bound to use your information only for the job we hire them to do, not for their own purposes.

BeneVets discloses donor Personal Information to the following categories of service providers, each of which is a "Service Provider" within the meaning of Cal. Civ. Code § 1798.140(ag), under a written contract that (a) limits processing to BeneVets's documented instructions, (b) prohibits the service provider from selling or sharing the information, (c) prohibits use for cross-context behavioral advertising, and (d) prohibits combining the donor data with data from other sources except as permitted by Cal. Code Regs. tit. 11, § 7050.

BeneVets does not disclose donor Personal Information to advertising networks, data brokers, list-rental companies, political committees, or any party for the recipient's own purposes.

§ 10. Required Tax-Status and Substantiation Disclosures

In plain English: BeneVets is a 501(c)(3). Donations to BeneVets are tax-deductible as far as the law allows. Below is the language the IRS requires on tax receipts.

BeneVets, Inc. is a California nonprofit public benefit corporation organized and operated for charitable and educational purposes within the meaning of IRC § 501(c)(3) and recognized by the Internal Revenue Service as a public charity exempt from federal income tax under IRC § 501(a). BeneVets's EIN is 99-3359742. Contributions to BeneVets are deductible by donors as charitable contributions under IRC § 170 to the extent permitted by law. Donors are advised to consult their own tax advisors regarding the deductibility of any particular contribution.

For any contribution of $250 or more, BeneVets provides a contemporaneous written acknowledgment under IRC § 170(f)(8) that includes (a) the amount of cash and a description (but not value) of any non-cash property contributed, (b) a statement of whether BeneVets provided any goods or services in consideration, and (c) a description and good-faith estimate of the value of any goods or services so provided, or, if such goods or services consist solely of intangible religious benefits, a statement to that effect.

For non-cash contributions over $500, donors must file IRS Form 8283 with their federal income-tax return. For non-cash contributions over $5,000 (other than publicly traded securities), the donor must obtain a qualified appraisal under Treas. Reg. § 1.170A-17. BeneVets may sign Form 8283 Section B Part IV in its capacity as donee but does not opine on the donor's appraised value.

IRC § 6113 disclosure (reserved). BeneVets is a 501(c)(3) public charity, contributions to which are deductible as charitable contributions under IRC § 170. The IRC § 6113 fundraising-solicitation disclosure obligation, which applies to certain non-deductible-contribution organizations, does not apply to BeneVets. If BeneVets ever becomes subject to § 6113, the required statutory language will appear on each solicitation.

§ 11. State Charitable-Solicitation Registration Disclosures

In plain English: Several states require nonprofits to register before asking for donations from people who live there. The full list of those state-required disclosures is in Document 11.

BeneVets is or will be registered with the California Attorney General's Registry of Charitable Trusts and with the charitable-solicitation regulators of other U.S. states as required by the laws of those states. The full set of state-by-state disclosures, including the verbatim language each state requires, is incorporated by reference from the State Charitable Solicitation Disclosures document (Doc 11). The state disclosures govern in case of any conflict with this policy as to a specific state's required language.

§ 12. Records Retention for Donor Data

In plain English: We keep donor records for seven years so we can prove our 990 filings and respond to audits. After seven years, we securely destroy or deidentify the records, except for permanent records like total annual giving by year, which we keep indefinitely for historical reporting.

BeneVets retains donor Personal Information for a period of seven (7) years following the later of (a) the date of the donor's most recent gift, (b) the date of the donor's most recent affirmative communication preference, or (c) the date of the donor's most recent communication with BeneVets, after which BeneVets securely destroys or irreversibly deidentifies the donor's record. The seven-year period reflects the audit-preparedness window for IRS Form 990 filings (the three-year statute of limitations under IRC § 6501(a) plus a six-year reach-back under IRC § 6501(e) for substantial-omission cases, plus a margin) and the California requirements for nonprofit recordkeeping at Cal. Gov't Code § 12586.

The following categories of donor-related records are retained on a different schedule, as set forth in the Document Retention and Destruction Policy (Doc 18, Part B):

• Aggregate annual giving totals, donor count totals, and other roll-up metrics: permanent.
• Endowment-gift instruments and any other gift instrument creating a permanent or term endowment: permanent.
• Pledge agreements: term of pledge plus seven years.
• Records of the Form 990 itself, including Schedule B: seven years (the Form 990 itself is permanent per Doc 18, but Schedule B is held for the audit-preparedness window).

A donor may request earlier deletion under § 13 below, subject to the legal-hold exceptions described in Doc 18, Part B.

§ 13. Right to Access, Correct, or Delete Donor Personal Information

In plain English: You can ask us to show you the donor record we have on you, to fix something that's wrong, or to delete the record. We will answer within 45 days. We may need to keep some records longer if the IRS or California requires it.

A donor or donor-email subscriber may request that BeneVets:

1. Provide a copy of the Personal Information BeneVets has collected about the donor in the preceding 12 months (or, on request, for the preceding seven years to the extent records exist), in a portable, machine-readable format where technically feasible.
2. Correct inaccurate Personal Information.
3. Delete Personal Information.

To exercise these rights, contact BeneVets at the address in § 17. BeneVets will verify the requester's identity using authentication procedures consistent with Cal. Code Regs. tit. 11, § 7060 et seq. BeneVets will respond within forty-five (45) days of receipt of a verifiable request, with one optional forty-five-day extension as permitted at Cal. Civ. Code § 1798.130(a)(2), and will provide a written explanation if any portion of a request cannot be honored.

Statutory and audit-preparedness exceptions. BeneVets may retain a donor record notwithstanding a deletion request to the extent required by:

• IRC § 6033 and the IRS Form 990 audit-preparedness window (seven years);
• IRC § 170(f)(8) acknowledgment-substantiation recordkeeping;
• California Attorney General Registry of Charitable Trusts recordkeeping at Cal. Gov't Code § 12586;
• A pending or anticipated legal proceeding (litigation hold) under Doc 18, Part B;
• A pending audit by independent auditors or by a tax authority.

Where BeneVets retains a record under one of these exceptions, BeneVets will (a) flag the record "deletion requested - legal retention basis" in the donor management system, (b) suppress further solicitation use, (c) limit access to the record to personnel with a specific legal-or-audit reason to access it, and (d) complete deletion at the earliest date on which the retention basis lapses.

§ 14. Donor Data Security

In plain English: We protect donor information the same way we protect user information: strong encryption, limited staff access, regular security review.

BeneVets implements administrative, physical, and technical safeguards designed to protect donor Personal Information against unauthorized access, disclosure, alteration, and destruction. These safeguards include:

• Encryption in transit. All donor data in motion is transmitted over Transport Layer Security ("TLS") 1.2 or higher with current-generation cipher suites.
• Encryption at rest. Donor records are stored in datastores using AES-256-GCM encryption at rest. Donor records containing payment data (reserved for activation) will be tokenized via the payment processor's vault and not stored on BeneVets-managed infrastructure.
• Access controls. Role-based access, principle of least privilege, mandatory multi-factor authentication for all personnel with donor-record access.
• Logging and audit. Access to donor records is logged.
• Vendor diligence. Service providers handling donor data are vetted for SOC 2 Type II or equivalent attestations where commercially available.
• Incident response. BeneVets maintains an incident response plan that includes donor-data scenarios and includes notification under the California breach-notification statute, Cal. Civ. Code § 1798.82, where applicable.

No system is perfectly secure. In the event of a security incident affecting donor Personal Information, BeneVets will notify affected donors in accordance with applicable law and will cooperate with the California Attorney General as required.

§ 15. Children

In plain English: We do not knowingly accept donations from anyone under 18.

BeneVets does not knowingly accept donations from minors. The BeneVets donation experience (when activated) will require the donor to attest to being eighteen (18) years of age or older. The donor email program is not directed to minors. If BeneVets becomes aware that it has received a donation from a minor, BeneVets will, on request from the parent or legal guardian, refund the donation and delete the related donor record subject to the legal-retention exceptions in § 13.

§ 16. International Donors

In plain English: We accept donations only from people in the United States and U.S. territories. We do not accept donations from outside the U.S.

BeneVets accepts donations only from donors located in the United States, the District of Columbia, and the U.S. territories of Puerto Rico, the U.S. Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands, and from holders of Army Post Office ("APO"), Fleet Post Office ("FPO"), and Diplomatic Post Office ("DPO") mailing addresses. BeneVets does not accept donations from the European Economic Area, the United Kingdom, Canada, Mexico, or any other foreign jurisdiction. When on-site donation processing activates, the donation form will use mailing-address validation to enforce this scope. BeneVets disclaims any intent to solicit donations outside the United States.

§ 16A. No On-Site Payment Data Collection at v1 (Future-State Disclosure)

In plain English: Right now, our website does not process donations. We have not turned on a donation page yet. That means we do not collect credit-card numbers, bank-account numbers, or payment information at all. When we turn on the donation page, we will update this policy first, and we will tell donors what payment processor we are using.

As of the effective date of this policy, BeneVets does not operate an on-site donation surface and does not collect payment-instrument Personal Information (including credit card primary account numbers, debit card numbers, ACH account or routing numbers, or comparable financial-account credentials). Donor records collected as of the effective date are limited to the categories listed in § 3 and arise from the donor email program and from gifts received via external channels (such as donor-advised fund grant letters, employer-matching gift programs, mailed checks, or direct bank-issued charitable giving).

When on-site donation processing activates, BeneVets will:

1. Update this Donor Privacy Policy to identify the payment processor and describe payment-data handling;
2. Update the Sub-processor List (Doc 04) to add the payment processor;
3. Comply with Payment Card Industry Data Security Standard ("PCI DSS") obligations applicable to BeneVets's processing scope, which is anticipated to be SAQ A (the lowest-burden self-assessment level, for merchants that fully outsource cardholder-data handling to a validated processor);
4. Notify donor-email subscribers of the policy update before activation.

§ 17. Contact for Donor-Privacy Questions

In plain English: Write to us if you have a donor-privacy question.

Donors may direct questions or requests under this policy to:

BeneVets, Inc. Attn: Donor Privacy 1441 Pomona Road, Suite 20 Riverside County, California [ZIP] Email: donor-privacy@benevets.org

The Treasurer (currently Callie) and the Executive Director (currently Walter) are jointly responsible for compliance with this policy. The Secretary (currently Harish) maintains the donor-privacy correspondence log under the document-retention policy (Doc 18).

§ 18. Cross-References

In plain English: Three other documents you may want to read.

• Donor Bill of Rights (Doc 10) - sets out the rights every BeneVets donor has, in plain language.
• State Charitable Solicitation Disclosures (Doc 11) - the state-by-state language some states require BeneVets to put in front of donors who live there.
• Privacy Policy (Doc 02) - for the separate program of user data collected from people who use the BeneVets website for veterans-benefits research.

§ 19. Changes to This Policy

In plain English: If we change this policy, we will update the "Last updated" date and email donor-program subscribers about material changes.

BeneVets may update this policy from time to time. Material changes will be communicated to donor-email subscribers at least thirty (30) days in advance of the effective date of the change, except where the change is required by law or to fix an error. Historical versions are retained under Doc 18.

End of Document 09.