This notice, effective March 28, 2024, covers user privacy, system security, and information collection practices for Enveritas, Inc.’s websites.

Enveritas believes that privacy is an important human right. We exist to improve the lives of coffee farmers, to protect the environment, and to end global poverty in the coffee sector. In doing so, we are committed to handling data, especially data about people, ethically, fairly, and transparently. We hold ourselves to a high standard of ethical data practices, consistent with our overall mission to improve the lives of the people we serve.

In this Privacy and Data Ethics Notice (“Notice”), we explain what data we collect and share. If you have any questions or concerns after you read this Notice, please feel free to reach out to us at privacy@enveritas.org and we will do our best to answer any questions you have.

Personal Data

Personal Data means information that either identifies you directly (like your name, email address, and address) or can be reasonably linked or combined with other information to identify you (like an account number or IP address). Some countries use terms like “Personal Information” or “Personally Identifiable Information” to address the same types of data. We use the term “Personal Data” to include terms like Personal Information and Personally Identifiable Information. Other information is non-personal information.

Our Data Privacy & Ethics Principles

The following principles inform how Enveritas uses Personal Data to achieve our mission. These include:

1. Transparency and fairness: We tell people what we do with Personal Data in easy-to-understand terms, and we don’t hide the ball.
2. Purpose limitation: We only use Personal Data in ways that are consistent with the reasons we collected it in the first place.
3. Data minimization: We collect only Personal Data that we need for our work, and we limit who has access to Personal Data to only those who have a need to access it for important and legitimate purposes.
4. Accuracy: We keep Personal Data accurate and current.
5. Storage limitation: We do not store Personal Data after we no longer need it. We de-identify and use aggregated Personal Data wherever possible.
6. Security and confidentiality: We use technical, policy, and physical controls to protect the confidentiality, integrity, and availability of Personal Data.
7. Honor individual rights: As discussed below, individuals have rights with respect to their Personal Data. Enveritas honors those rights, regardless of where individual data subjects reside.
8. Accountability by design: We build data privacy and ethics into our business processes, train our workforce, and strive for a culture of ethical data protection.

What We Won’t Do

Unless you give us explicit permission, we will not sell, publish, or share identified, or identifiable Personal Data entrusted to us by an individual.

Website Users

We collect some Personal Data about you by default when you visit our website. We decide what information to collect to maintain the security of our site, to provide site functionality, relevant content, and to improve your experience on our site. The Personal Data we collect by default includes your web browser and operating system, referring URL, country, language settings, and the date and time of your visit. We collect this information to further our legitimate interests in maintaining a safe, working, and relevant website.

No Kids, Please

We hope children are excited by our mission and grow up to be agents for good in the world. However, this website is not intended to collect information from kids under 16. We kindly ask kids who are curious about Enveritas to ask their parents, teachers, or guardians to communicate with us on their behalf.

Customer Representatives

If you engage with us on the nonpublic portions of our website as one of our customers (or vendors who work with our customers), we will collect the information we need to conduct business with you, such as a representative’s name and business contact details.

Contact Us Submissions

If you submit an inquiry in the “contact us” form, we will collect your name and email address so that we may respond to your inquiry.

Consent & Withdrawal

If you consent to us processing your Personal Data and you change your mind, you can withdraw your consent by sending us an email at privacy@enveritas.org.

Links to External Websites

The website and Enveritas platforms may contain links to external websites. A link to such sites does not imply endorsement by Enveritas of such sites. This Privacy Notice does not apply to those external websites, and you should review the privacy policies of these external sites.

Payments

If you are making a payment for services through an Enveritas platform, portal, or service, we will not collect, retain, or handle any payment information. Our payments are processed through Stripe and your personal data will be processed in accordance with Stripe’s privacy notice, found here: https://stripe.com/privacy.

Job Applicants

If you apply for a job with Enveritas, we will use the Personal Data that you provide in your application, including any attachments sent, for the purpose of considering your candidacy for employment. This data includes your name and contact information, the information in your CV or resume, your job preferences, and your profile. If you have a social media profile, including a LinkedIn profile, Enveritas may process the personal data you choose to share on social media as well.

If you use our online job board hosted by Lever, your Personal Data will also be processed according to Lever’s privacy notice, found here: https://www.lever.co/privacy. If you use our online job board hosted by Greenhouse, your Personal Data will also be processed according to Greenhouse’s privacy notice, found here: https://www.greenhouse.com/privacy-policy.

Data Transfers

Sometimes Enveritas needs to transfer your Personal Data to Enveritas affiliates, service providers, or systems in countries that may not offer a level of data protection equivalent to that in your country, including the United States. Where such transfers occur, Enveritas complies with the cross-border data transfer and export control laws of the countries in which it operates.

Your Rights

We honor individual rights with respect to your Personal Data. These include the right to:

• Request to access or obtain a copy of your Personal Data collected by Enveritas;
• Request that we correct inaccurate Personal Data about you;
• Object to Enveritas’ processing of your Personal Data for direct marketing;
• Object to processing based on our legitimate interest for reasons relating to your situation. Please note that we may continue to process your Personal Data, even if you have opposed the processing, if we have compelling legitimate grounds for the processing which override your privacy interests. We will communicate any such decision to you promptly and explain our reasons;
• Request, under certain circumstances, the restriction of the processing of your Personal Data, including sensitive personal data; and
• Lodge a complaint with your local Data Protection Authority or regulator if you have concerns about our data practices.

Only you or someone legally authorized to act on your behalf may make requests regarding your data protection rights.

To exercise these rights, please send an email to privacy@enveritas.org with the details of your request.

Contact Information and DPO

All questions, complaints, or comments about this Privacy Notice or Enveritas’ data protection practices can be emailed to Enveritas at privacy@enveritas.org. Enveritas has appointed Berkeley Research Group, LLC (BRG) as its Data Protection Officer (DPO). You may reach our DPO at privacy@enveritas.org , or by calling the number for your country below and following the prompts.