Privacy Policy

This Privacy Policy describes how NCTRCA collects, uses, discloses, retains, and protects personal information in connection with the Site, accounts, online forms, communications, events, programs, and linked transactions. It applies to information about individuals, including owners, officers, employees, agents, and representatives of business entities. It does not apply to information governed solely by a separate written privacy notice or agreement that expressly supersedes this Policy.

1. Governmental and Public-Records Context

NCTRCA is a Texas local governmental and nonprofit entity. Information collected through the Site may become a governmental or local-government record and may be retained or disclosed as required by the Texas Public Information Act, records-retention laws, subpoenas, court orders, audits, or other legal requirements. Some information may be confidential or excepted from disclosure under law, but NCTRCA cannot promise that all information submitted through the Site will remain confidential. Privacy requests do not override mandatory retention, public-disclosure, archival, litigation-hold, or other legal obligations.

2. Personal Information We May Collect

Depending on the feature used, NCTRCA may collect the following categories of information: Account and identity information: name, business address, business email, business telephone number, username, authentication data, job title, organization, business location, business structure, EIN, NAICS Codes, summary of services offered, bonding information, team size, years of experience, and account preferences; Business and program information: business name, address, ownership or organizational information, industry, certifications, capabilities, size, revenue ranges, service areas, qualifications, application responses, supporting documents, and information about representatives; Transaction information: services or events selected, amounts, dates, receipts, transaction identifiers, status, and limited payment-related metadata received from a payment provider; Communications and submissions: messages, support requests, survey responses, event registrations, uploaded files, comments, feedback, and records of communications; Marketing information: subscription choices, interests, campaign interactions, event preferences, and unsubscribe records; Device and usage information: IP address, browser and device type, operating system, referring pages, pages viewed, links clicked, approximate location derived from IP address, session information, timestamps, and diagnostic or security logs; Cookie and analytics information: online identifiers and usage measurements collected through cookies, pixels, tags, local storage, Google Analytics, or similar technologies; and Information from other sources: information from participating governmental entities, service providers, public databases, business directories, event partners, referrals, or the user’s organization, where permitted by law.

3. Information Users Should Not Submit Through General Forms

Unless NCTRCA specifically requests it through a designated secure process, users should not submit Social Security numbers, complete driver’s-license or passport numbers, full payment-card or bank-account data, medical information, biometric identifiers, personal passwords, private encryption keys, protected security details, or another person’s highly sensitive information. Users should minimize personal information and redact unnecessary information from uploaded documents.

4. Sources of Information

NCTRCA may collect information directly from the user; automatically from the user’s browser or device; from the user’s employer, organization, or account administrator; from participating governmental entities and program partners; from payment, hosting, analytics, communications, event, and security service providers; and from public or commercially available sources. NCTRCA will use information from another source only for lawful purposes related to its governmental, nonprofit, administrative, business-development, security, or operational functions.

5. How NCTRCA Uses Information

operate, maintain, secure, troubleshoot, and improve the Site and accounts; create and authenticate accounts and manage organizational administrators; process registrations, applications, program participation, service requests, payments, receipts, and related records; communicate about accounts, transactions, deadlines, programs, events, opportunities, policy changes, security, and support; provide requested resources and personalize content or communications based on stated interests; send marketing communications where permitted and maintain opt-out preferences; measure Site use, understand audiences, evaluate program effectiveness, and improve user experience through analytics; detect, prevent, investigate, and respond to fraud, misuse, security incidents, policy violations, and legal claims; comply with public-records, records-retention, audit, reporting, procurement, subpoena, court-order, grant, and other legal obligations; protect the rights, safety, property, and operations of NCTRCA, participating entities, users, and the public; and carry out another purpose disclosed when information is collected or with the individual’s consent.

6. How NCTRCA May Disclose Information

NCTRCA may disclose personal information in the following circumstances: Service providers: to vendors that host the Site, manage accounts, process payments, provide analytics, send communications, support events, store records, provide cybersecurity, or perform other services for NCTRCA, subject to contractual or legal restrictions where appropriate; Participating entities and program partners: to participating governmental entities, program administrators, event partners, or other organizations when necessary to administer a requested program, service, application, referral, or opportunity and when permitted by law; The user’s organization: to an organization’s authorized account administrators or representatives regarding organization-related accounts, submissions, transactions, or activity; Public records and legal compliance: when disclosure is required or permitted by the Texas Public Information Act, records laws, subpoena, court order, audit, investigation, governmental request, or other law; Security and protection: when reasonably necessary to investigate misuse, enforce terms, prevent fraud, respond to an incident, or protect rights, safety, property, systems, or the public; Reorganization or transfer of functions: to a successor governmental body, participating entity, contractor, or service provider in connection with a lawful reorganization, transfer, consolidation, or outsourcing of a function, subject to applicable law; and Consent or direction: when the individual requests, authorizes, or directs the disclosure.

7. Google Analytics and Similar Technologies

NCTRCA ordinarily does not use Google Analytics. Google Analytics may be used in the future to understand how visitors use the Site. Google Analytics may collect online identifiers, device and browser information, approximate geographic information, referral information, and interactions with the Site through tags or cookies. Google processes this information under its own terms and policies. NCTRCA will configure analytics controls and retention settings based on operational needs and applicable law. Users can learn about Google’s data practices and available controls through Google’s published Analytics privacy resources. Should NCTRCA use Google Analytics in the future, Users will be notified.

8. Payment Processing

Payments may be processed through a third-party portal or processor linked from the Site. The processor may collect payment-card, bank, billing, authentication, and fraud-prevention information directly from the user. NCTRCA may receive transaction status, amount, date, payer name or business, receipt or reference number, and other information needed to reconcile and administer the transaction. The processor’s privacy notice governs its collection and use of information. You may request the processors privacy notice by contacting NCTRCA at INFO@NCTRCA.org or by the link to the payment processor provided on this Site.

9. Marketing Choices

Users may unsubscribe from promotional email by using the unsubscribe link or contacting INFO@NCTRCA.org. NCTRCA may retain the email address and opt-out status to honor the request. An individual who opts out of marketing may continue to receive transactional, security, account, program-administration, public-safety, or legally required communications. Text-message marketing, if later offered, should be governed by a separate consent and disclosure appropriate to the messaging program.

10. Sale, Sharing, and Targeted Advertising

NCTRCA does not sell personal information for monetary consideration. Depending on the technologies actually enabled, a disclosure of online identifiers to analytics or advertising providers could be treated as a “sale,” “sharing,” or processing for targeted advertising under some state laws even when no money changes hands. Where applicable law gives an individual a right to opt out, NCTRCA will provide an applicable choice through a link or the request process below.

11. Retention

NCTRCA retains information for the period reasonably necessary to administer accounts, programs, services, transactions, security, audits, and legal obligations. Retention may be governed by Texas local-government records schedules, NCTRCA’s adopted records-control schedule, contract requirements, litigation holds, grant or audit requirements, and other law. As a result, NCTRCA may be unable to delete information immediately or at all, even after an account closes. When lawful and appropriate, NCTRCA may de-identify information and retain it for analytics, reporting, planning, security, or archival purposes.

12. Security

NCTRCA uses administrative, technical, and physical safeguards designed to protect information in light of its nature, the systems used, and reasonably foreseeable risks. Safeguards may include access controls, authentication, encryption in transit, backups, logging, vendor management, training, incident response, and system monitoring. No security method is perfect, and NCTRCA cannot guarantee that information will never be accessed, used, or disclosed without authorization. Users must protect account credentials and promptly report suspected compromise to INFO@NCTRCA.org.

13. Privacy Rights and Requests

Depending on the individual’s state of residence and whether a particular law applies to NCTRCA or the relevant information, the individual may have rights to request access, confirmation, correction, deletion, portability, a list or description of disclosures, or an opt-out of certain sales, sharing, targeted advertising, or profiling. An individual may submit a request at INFO@NCTRCAorg. The request should identify the individual, the relationship to NCTRCA, the account or business involved, the right requested, and sufficient information for verification. NCTRCA may verify identity and authority, request additional information, deny or limit a request when permitted by law, and retain records of the request. An authorized agent may submit a request where applicable, but NCTRCA may require proof of authorization and may verify the request directly with the individual. NCTRCA will not unlawfully discriminate against an individual for exercising an applicable privacy right. Where applicable law provides an appeal, the individual may appeal by writing “Privacy Appeal” to INFO@NCTRCA.org and explaining the basis for the appeal.

14. Voluntary Access and Correction Requests

Even when a state consumer privacy law does not apply because of NCTRCA’s governmental or nonprofit status, NCTRCA may, as a matter of policy and subject to law, consider reasonable requests to access or correct account information. A request to delete information remains subject to records-retention, public-records, security, audit, contractual, and legal obligations. Account users may be able to update certain information directly through account settings.

15. Public Information Requests Are Separate

A privacy request is not a request under the Texas Public Information Act. Public information requests must be submitted through NCTRCA’s designated methods. Conversely, a public information request does not substitute for an account-security report or privacy-rights request.

16. Children

The Site is intended for business users and is not directed to children under seventeen. NCTRCA does not knowingly seek to collect personal information online from a child under seventeen through the Site. Account users must be at least eighteen years old. If NCTRCA learns that personal information was submitted by a child contrary to these requirements, NCTRCA will address the information consistent with applicable law, records obligations, and available deletion authority. Concerns may be sent to INFO@NCTRCA.org.

17. U.S. Operations and Cross-State Use

The Site is operated in the State of Texas, United States and directed to United States users. Information may be processed or stored in states other than the user’s state, including where NCTRCA’s service providers operate. Users outside the United States should not use the Site unless NCTRCA expressly authorizes that use and provides any additional required notice.

18. Third-Party Sites

This Policy does not govern third-party websites or services linked from the Site. Users should review the third party’s privacy notice. NCTRCA is not responsible for a third party’s privacy, security, accessibility, or data practices.

19. Changes to this Policy

NCTRCA may update this Policy to reflect changes in law, technology, programs, or practices. The effective date will be revised when changes are posted. NCTRCA will provide additional notice of a material change when required by law or reasonably appropriate.

20. Contact Information

Privacy questions or requests: INFO@NCTRCA.org.