GDPR Data Protection Policy
Our commitment to protecting the personal data of individuals in the EU/EEA
Effective Date: February 7, 2026
Lets Farm Financial Cooperative, Inc. (“LFFCI,” “we,” “us,” or “our”), a Georgia-based domestic nonprofit corporation organized under the Georgia Nonprofit Corporation Code and recognized as tax-exempt under Section 501(c)(3) of the Internal Revenue Code, is committed to protecting the personal data of individuals in accordance with applicable data protection laws. This GDPR Data Protection Policy (the “Policy”) addresses our compliance with the European Union’s General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) where it applies to our processing of personal data of individuals located in the European Union or European Economic Area (“EU/EEA”).
1. Scope and Applicability
This Policy applies to the processing of personal data of data subjects located in the EU/EEA when such processing relates to:
- Offering our Website (lffci.org), programs, or donation opportunities to individuals in the EU/EEA
- Monitoring the behavior of individuals in the EU/EEA (e.g., through Website analytics)
- Any other activities that fall within the territorial scope of the GDPR
If you are located outside the EU/EEA, this Policy does not apply to your personal data unless otherwise specified. We process personal data primarily under U.S. laws, including state privacy regulations where applicable.
2. Data Controller
LFFCI acts as the data controller for personal data processed under this Policy. Our contact details are:
| Organization | Lets Farm Financial Cooperative, Inc. |
| Address | 773 Derrydown Way, Decatur, Georgia 30030, United States |
| [email protected] | |
| Phone | +1 (678) 949-0859 |
3. Personal Data We Process
We may process the following categories of personal data from EU/EEA individuals:
- Contact information (name, email address, postal address, phone number)
- Donation-related data (amount, payment details processed via third parties, preferences)
- Program participation data (e.g., registration details for educational modules or apprenticeships)
- Technical data (IP address, browser type, device information, usage data via cookies or analytics)
- Any other data voluntarily provided through forms, emails, or interactions
4. Purposes and Legal Bases for Processing
We process personal data for the following purposes, relying on the specified GDPR legal bases (Article 6):
| Performance of a contract | Processing registration or donation data to provide services or fulfill commitments |
| Legitimate interests | Improving our Website, analyzing usage (with safeguards), communicating about our mission, and preventing fraud |
| Consent | For non-essential cookies, marketing communications, or specific processing where consent is obtained (withdrawable at any time) |
| Legal obligation | Complying with U.S. charitable solicitation laws, tax reporting, or other applicable requirements |
| Public interest | Advancing our charitable and educational purposes under Section 501(c)(3) |
5. Data Sharing and Transfers
We share personal data only as necessary with service providers (e.g., payment processors like PayPal Giving Fund, analytics providers) bound by data protection obligations, and relevant authorities for legal compliance.
Personal data may be transferred to the United States or other non-adequate countries. We implement appropriate safeguards, such as standard contractual clauses or other mechanisms permitted under GDPR Chapter V, to ensure an adequate level of protection.
6. Data Subject Rights
Under the GDPR (Articles 15–22), EU/EEA data subjects have the right to:
- Access their personal data
- Rectify inaccurate data
- Erase data (right to be forgotten)
- Restrict processing
- Data portability
- Object to processing (including for legitimate interests or direct marketing)
- Withdraw consent where processing is based on consent
- Lodge a complaint with a supervisory authority (e.g., in their EU/EEA member state)
To exercise these rights, contact us at [email protected]. We will respond within one month (extendable under GDPR Article 12(3)).
7. Data Security and Retention
We implement technical and organizational measures to protect personal data against unauthorized access, loss, or misuse. Personal data is retained only as long as necessary for the purposes outlined, or as required by law (e.g., donation records for tax purposes), after which it is securely deleted or anonymized.
8. International Data Transfers
Transfers outside the EU/EEA use appropriate safeguards compliant with GDPR requirements.
9. Changes to This Policy
We may update this Policy to reflect changes in our practices or legal obligations. The revised Policy will be posted on our Website with the updated effective date. Continued interaction with our services constitutes acceptance of changes.
10. Contact and Complaints
For questions, rights requests, or concerns regarding this Policy or our GDPR compliance, please contact us at [email protected]. If unsatisfied with our response, you may contact your local EU/EEA supervisory authority.