Website Privacy Policy

Website Privacy Policy

Operation Outbreak, Inc. (“Operation Outbreak,” “we,” “our,” or “us”) respects your privacy and is committed to protecting it. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (the “Site”). By using the Site, you agree to the practices described here.

For purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR, the data controller responsible for your personal data described in this Privacy Policy is Operation Outbreak Inc., 361 Newbury St, 5th Floor, Boston, MA 02115, contactable at welcome@operationoutbreak.org.  Our Data Protection Officer is Kian Sani; privacy@operationoutbreak.org. Our EU representative is VeraSafe Czech Republic s.r.o., Rohanské nábřeží 678/23, Prague 8, 18600, Czech Republic; privacy_notice@verasafe.com

Information We Collect

We may collect the following types of information:

Personal Information (you provide): such as your name, email address, phone number, or other details when you fill out forms, make a donation, subscribe to newsletters, or contact us.

Non-Personal Information (automatically collected): such as browser type, device information, operating system, referring website, and browsing behavior on our Site.

Cookies and Tracking Technologies: We use strictly necessary cookies as well as non-essential cookies (such as analytics, functional, and marketing/advertising cookies), pixels, and similar technologies to operate, improve, and analyze use of the Site and to personalize experiences. Where required by law, we obtain your prior opt-in consent before placing non-essential cookies on your device. You can manage your cookie preferences, adjust your browser settings, or opt out, as described in the “Cookies and Tracking” section below. 

We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, health, or religious beliefs) through the Site. Please do not submit such information to us unless we specifically request it.

How We Use Your Information

We may use your information to:

Provide, maintain, and improve the Site and our services.

Communicate with you, including sending newsletters or updates (if you opt in).

Monitor Site usage, performance, and security.

Comply with legal obligations and enforce our Terms of Use.

Tailor content or features to your interests (if cookies are enabled). 

Legal Basis for Processing (EEA/UK/Switzerland): Where the GDPR applies to our processing of your personal data, we rely on one or more of the following legal bases for the purposes above: your consent (for example, for non-essential cookies and marketing communications), which you may withdraw at any time; the necessity of processing to perform a contract with you or to take steps at your request before entering into one; compliance with a legal obligation; or our legitimate interests in operating, securing, and improving the Site, provided those interests are not overridden by your rights and interests.

How We Share Information

We do not sell your personal information. We may share information in limited circumstances:

Service Providers: With trusted vendors who provide hosting, analytics, email, donation processing or security services.

Legal Compliance: If required by law, subpoena, or court order.

Safety and Rights: To protect the rights, property, or safety of Operation Outbreak, our users, or others.

With Consent: If you explicitly authorize us to share your information. 

Where service providers process personal data on our behalf, we enter into data processing agreements consistent with Article 28 of the GDPR, imposing confidentiality, security, and sub-processing obligations, and we take reasonable steps to ensure they provide an adequate level of protection for your personal data. 

Third-Party Services

The Site may link to third-party websites or services. We are not responsible for their content or privacy practices. Please review their policies before providing personal information.

We use a third party service provider, Rebel Idealist Inc. (d/b/a Donorbox), to process donations. We do not store credit card numbers or other financial information about you. 

Data Security

We take reasonable technical and organizational measures to protect your information. However, no system is fully secure, and we cannot guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required by law, affected individuals without undue delay, in accordance with Articles 33 and 34 of the GDPR.

Data Retention

We keep personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, taking into account the nature of the data, the purposes of processing, and any applicable legal, accounting, or reporting requirements. Where a longer retention period is required or permitted by law (for example, to establish, exercise, or defend legal claims, or to meet regulatory obligations), we will retain personal data for that longer period.  

Children’s Privacy

The Site is not directed to children under 13, and we do not knowingly collect personal data from them. If we learn a child under 13 has provided us with personal data, we will delete it promptly.

Your Rights

 Under U.S. Law (CCPA for California Residents)

If you live in California, you have the right to:

Know what personal information we collect, use, and share.

Request deletion of your personal information.

Opt out of the sale of personal information (we do not sell data).

Not face discrimination for exercising your rights. 

You may make a request by contacting us (see Section 11). We may need to verify your identity before fulfilling your request.

Under EU/UK/Swiss Law (GDPR)

If you are located in the European Union, Switzerland, United Kingdom, or another jurisdiction with similar laws, you have rights including:

Access: Request a copy of the personal data we hold about you.

Correction: Request corrections to inaccurate data.

Erasure: Ask us to delete your data (“right to be forgotten”).

Restriction: Limit how we process your data.

Portability: Receive your data in a portable format.

Objection: Object to certain uses, including direct marketing. 

Withdraw Consent: Where our processing is based on your consent, withdraw that consent at any time, without affecting the lawfulness of processing carried out before your withdrawal.

Automated Decision-Making: We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, without human involvement.  

You may also lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or the place of the alleged infringement, including, where applicable, the UK Information Commissioner’s Office (ICO) or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Cookies and Tracking

We use the following categories of cookies and similar tracking technologies on the Site:

Strictly Necessary Cookies: Required for the Site to function (for example, security and load balancing) and cannot be switched off.

Analytics Cookies: Help us understand how visitors use the Site.

Functional Cookies: Remember your preferences and choices.

Marketing/Advertising Cookies: Used to deliver relevant advertising and measure its effectiveness.

Where required by law, including under the GDPR and applicable EU/UK ePrivacy rules, we will not activate non-essential cookies (analytics, functional, and marketing/advertising cookies) unless and until you provide your affirmative opt-in consent through our cookie consent banner or preference center. You may accept or decline non-essential cookies, change your preferences, and withdraw your consent at any time through the cookie preference settings available on the Site or by contacting us using the details in the “Contact Us” section. You may also manage or block cookies through your browser settings, though doing so may affect Site functionality.  

International Data Transfers

If you are located in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction with data transfer restrictions, please note that your personal data may be transferred to, stored, and processed in the United States and other countries that may not have data protection laws equivalent to those in your jurisdiction. When we transfer personal data outside of the EEA, UK, or Switzerland, we do so on the basis of one or more of the following safeguards, as applicable: (a) an adequacy decision by the European Commission, UK government, or Swiss authorities recognizing that the destination country provides an adequate level of protection; (b) the European Commission’s Standard Contractual Clauses (and, for transfers from the UK, the UK International Data Transfer Addendum), together with any supplementary measures needed to ensure an essentially equivalent level of protection; or (c) another valid transfer mechanism recognized under applicable data protection law. You may request more information about, or a copy of, the safeguards we use for a specific transfer by contacting us using the details in the “Contact Us” section.

Changes to This Privacy Policy

We may update this Policy occasionally. Any changes will be posted here with a new Effective Date. Your continued use of the Site after changes are posted means you accept the updates.

Contact Us

If you have questions or wish to exercise your privacy rights, please contact us: welcome@operationoutbreak.org.  361 Newbury St, 5th Floor, Boston, MA 02115

Last Updated: August 17, 2026

OPE0055745