Privacy and Cookie Policy 

The Autism Community in Action (TACA) 
Effective Date: September 24, 2026 
Last Updated: September 24, 2026 

A Short Summary 
We wrote this summary so you don’t have to read the whole policy to understand the basics. The full policy below controls. 

Who we are. TACA is a 501(c)(3) nonprofit. We provide education, support, resources, programs, events, and community connection for individuals and families impacted by autism. 

What we collect. Contact details, account and registration information, donation and transaction records, the content of messages you send us, volunteer information, survey responses, and technical information about your visits to our website. 

Sensitive information. Because of our mission, people sometimes tell us about a diagnosis, disability, therapies, medications, education needs, or family circumstances. We treat that information as sensitive. We do not sell it, and we do not use it for advertising. 

We do not sell your personal information, and we do not rent, trade, or exchange donor or member lists. 

Advertising and analytics. We use analytics and advertising technologies to understand website usage, measure the effectiveness of our communications and campaigns, and improve our services. Where required by applicable law, these technologies do not operateuntil you provide the appropriate consent. We do not use advertising technologies on portions of our website where individuals submit requests for help or provide sensitive information. 

Your choices. You can change your cookie preferences at any time, unsubscribe from our emails, opt out of targeted advertising, and ask us to access, correct, or delete information about you. 

How to reach us. privacy@tacanow.org, or the address and phone number in Section 32. 

The Autism Community in Action (“TACA,” “we,” “us,” or “our”) respects your privacy and is committed to being transparent about how we collect, use, share, and protect personal information. 

TACA is a nonprofit organization that provides education, support, resources, programs, events, and community connections for individuals and families impacted by autism. 

This Privacy and Cookie Policy explains our practices when you interact with TACA, including through our website at tacanow.org, our programs and services, events, communications, fundraising activities, online tools, and other interactions with us. 

1. Scope of This Policy 
This Policy applies to personal information TACA collects through or in connection with:

 
– Our websites and online services 
– TACA programs and educational resources 
– Conferences, workshops, community gatherings, and other events 
– Program and event registrations 
– Donations and fundraising activities 
– Email, telephone, text, and other communications 
– Contact forms and requests for information or support 
– Surveys, evaluations, listening sessions, and feedback 
– Volunteer activities 
– Online accounts and member services 
– Social media and digital advertising interactions 
– Other interactions with TACA where this Policy is provided or referenced 

This Policy does not govern the independent privacy practices of third-party websites, applications, or services. When TACA links to or integrates with third-party services, TACA remains responsible for its own collection, use, and disclosure of information through those integrations as described in this Policy. The third party’s independent processing of information is governed by its own privacy policy and terms. 

This Policy does not apply to information TACA collects about its employees and job applicants in that capacity, which is addressed separately. 

2. A Note About Which Privacy Laws Apply to TACA 
Privacy laws in the United States apply differently to nonprofit organizations than to businesses. Some laws exempt nonprofits entirely; others apply to nonprofits in full; and some apply only above certain size thresholds. 

Rather than ask you to work out which rules apply to us, TACA has chosen to extend the core privacy rights and choices described in this Policy to everyone who interacts with us, regardless of where you live, except where doing so would conflict with law or with our legal recordkeeping obligations. 

Where a specific law gives you a right that goes beyond what we offer voluntarily, and that law applies to TACA, we will honor it. Section 21 describes state-specific rights in more detail. 

3. Information We Collect 
The personal information we collect depends on how you interact with TACA. 

Contact Information 
– Name 
– Email address 
– Mailing address 
– ZIP or postal code, including where a form asks for a ZIP code without a full address 
– Telephone number 
– Communication preferences 

Location Information 
Most TACA forms ask for a ZIP or postal code, and that information is stored in our constituent records. We use it to: 

– Point you toward resources, providers, chapters, programs, and events near you 
– Plan where to hold events and where to direct outreach 
– Understand which communities we are reaching and where we are not 
– Report on the geographic reach of our programs to funders and in our public reporting, in aggregate 
– Group communications by region so that what we send you is relevant 

What we do not do with it: 

– We do not treat a ZIP code as precise geolocation, and we do not convert it into one 
– We do not use it to infer or track whether you are seeking healthcare, therapy, or evaluation 
– We do not use it for geofencing of any kind 
– We do not combine it with health, diagnosis, disability, or support-request information for advertising or audience-building 

Account and Profile Information 
If you create an account or participate in certain TACA services, we may collect: 

– Username or account identifiers 
– Password or authentication information 
– Profile information 
– Preferences 
– Information you choose to provide about yourself or your family 

Program and Event Information 
When you register for or participate in a TACA program, conference, workshop, support activity, community event, or other service, we may collect: 

– Registration information 
– Program participation 
– Event attendance 
– Interests and preferences 
– Accessibility or accommodation requests 
– Dietary or medical needs you provide for an event 
– Information provided in surveys or evaluations 
– Information you voluntarily provide to help us identify relevant resources or services 

Donations and Transactions 
When you make a donation, purchase an item, register for a paid event, or otherwise complete a transaction with TACA, we may collect: 

– Name and contact information 
– Donation or transaction amount 
– Billing information 
– Transaction history 
– Donor preferences 
– Tribute or memorial information 
– Employer or matching-gift information 
– Information related to fundraising and donor stewardship 

Payment card information is collected and processed by our third-party payment processors. TACA does not receive or store complete payment card numbers. We receive confirmation of the transaction and limited details such as the last four digits of the card, the card type, and the billing name and address. 

Communications and Requests for Support 
If you contact TACA, we collect the information contained in your communication, including: 

– Questions and requests 
– Comments and feedback 
– Your correspondence with TACA representatives 
– Information you voluntarily provide about yourself or your family 

Because of TACA’s mission, communications sometimes contain sensitive information concerning autism, disability, healthcare, education, therapies, family circumstances, or other personal matters. Section 16 explains how we handle that information. 

Health, Disability, and Other Sensitive Information 
Individuals may voluntarily provide TACA with information related to: 

– Autism or another diagnosis 
– Disability 
– Physical or mental health 
– Medical care 
– Medications 
– Therapies 
– Treatment 
– Educational or developmental needs 
– Behavioral needs 
– Family circumstances 
– Services or supports being sought 

We collect and use this information only as reasonably necessary to provide the programs, resources, support, or services you request; to operate and evaluate our programs; to respond to your requests; to improve our services; or for other purposes we disclose at the time we collect it. 

We do not sell this information. We do not use it for targeted advertising. 

TACA is not a healthcare provider, health plan, or healthcare clearinghouse. Information you provide to TACA is generally not protected health information under the Health Insurance Portability and Accountability Act (“HIPAA”), and HIPAA generally does not govern our handling of it. It may, however, be protected by state consumer health data laws. See Section 16 and our separate Consumer Health Data Privacy Notice. 

Surveys, Evaluations, and Feedback 
We may collect information when you participate in: 

– Surveys 
– Program evaluations 
– Listening sessions 
– Community feedback activities 
– Testimonials 
– Research or assessment activities 
– Impact measurement initiatives 

We may aggregate or de-identify information for purposes such as program evaluation, research, reporting, fundraising, planning, advocacy, and improving TACA’s programs and services. When we de-identify information, we maintain it in de-identified form and do not attempt to re-identify it, except to test the effectiveness of our de-identification. 

Because a ZIP code combined with other details can sometimes identify a specific person, we report geographic information at a level broad enough that individuals cannot reasonably be identified, and we remove or truncate ZIP codes when we prepare de-identified data sets. 

Volunteer Information 
If you volunteer with TACA, we may collect: 

– Contact information 
– Volunteer interests 
– Skills and experience 
– Availability 
– Training history 
– Volunteer activities 
– Program assignments 
– Background screening information, where applicable and with your authorization 

Form Submissions 
When you submit any form on our website (a contact form, a support request, an event registration, a survey, or a donation form), we collect the information you provide in that form, together with technical information such as an IP address, timestamp, and browser information, which we use to operate the form, prevent spam and fraud, and maintain security. 

What We Do Not Collect 
TACA does not knowingly or intentionally collect: 

– Precise geolocation data. A ZIP or postal code is not precise geolocation, and we do not derive precise location from it 
– Biometric identifiers, such as fingerprints, voiceprints, or facial-recognition templates 
– Genetic information 
– Social Security numbers, driver’s license numbers, passport numbers, or other government identification numbers, except where required for a specific purpose such as employment, background screening, or a legally required disclosure 
– Financial account credentials or full payment card numbers 
– Information about union membership 
– Information from third-party data brokers about your health, diagnosis, or disability 

If a specific TACA program ever requires information of this kind, we will tell you at the point of collection, explain why, and obtain any consent the law requires. 

4. Information Collected Automatically 
When you visit our website or use our online services, TACA and certain service providers may automatically collect information about your device and your interaction with our website, including: 

– Internet Protocol (IP) address 
– Browser type and version 
– Device type 
– Operating system 
– Pages viewed 
– Links clicked 
– Referring website or source 
– Date and time of visits 
– Approximate geographic information derived from IP address (typically city or region, not precise location) 
– Device identifiers 
– Online identifiers 
– Website interactions 
– Information about how you arrived at TACA’s website 
– Interactions with digital advertising or communications 
– Email interactions, such as whether an email was opened or a link was clicked 

We collect this information using cookies, pixels, tags, log files, software development kits, and similar technologies. 

5. Cookies and Similar Technologies 
Cookies are small files or pieces of information stored on or associated with your browser or device when you visit a website. 
TACA and certain third parties use cookies, pixels, tags, and similar technologies to operate our website, remember preferences, understand how people use our website, measure the effectiveness of our communications and campaigns, and support TACA’s outreach and fundraising activities. 

Not all cookies perform the same function. We group the technologies used on our website into the categories below. Where the law requires consent, non-essential cookies do not load until you provide it through our cookie preference tool. 

Strictly Necessary Cookies 
These technologies are necessary for basic website operation and support functions such as: 

– Website security 
– Fraud prevention 
– Session management 
– Account authentication 
– Donation processing 
– Event registration 
– Saving your privacy or cookie preferences 
– Other essential website functions 

Because these technologies are necessary for the website or a requested service to function, they cannot be disabled through our cookie preference tool. You may be able to block them through your browser, but parts of the website may then stop working. 

Functional Cookies 
Functional cookies help provide enhanced features or remember choices you make, such as: 

– Remembering website preferences 
– Remembering login or display settings 
– Supporting certain embedded features 

If these technologies are disabled, some website features may not operate as intended. 

Analytics Cookies 
TACA uses analytics technologies to understand how visitors interact with our website and how our website performs. These technologies may collect information such as website usage, device and browser information, referral information, and approximate geographic information. 

Analytics information helps us understand: 
– The number of visitors to our website 
– Which pages visitors use 
– How visitors navigate through the website 
– How visitors arrive at TACA’s website 
– Which TACA resources receive the most engagement 
– How long visitors spend on portions of the website 
– General device, browser, and approximate geographic information 
– The effectiveness of website improvements 

We use this information to improve our website, content, programs, and communications. We configure our analytics technologies to limit the collection of identifying information where appropriate and where those controls are available to us.  

Tag Management 
TACA uses tag-management technologies to configure and manage certain technologies deployed on our website. Analytics, advertising, measurement, and other technologies may be implemented through these systems. The specific data collected depends on the individual technology being managed, and each technology is subject to the consent category applicable to its purpose and use.  

Advertising and Marketing Cookies 
TACA uses or may use advertising and marketing technologies provided by third-party platforms to help us measure and improve digital outreach, fundraising campaigns, and other communications. These technologies help us: 

– Measure whether a campaign resulted in a website visit, registration, donation, or other action 
– Understand the effectiveness of TACA advertising and outreach 
– Avoid repeatedly showing the same advertisements 
– Build or reach audiences that may be interested in TACA’s mission 
– Measure interactions with TACA advertisements 
– Improve future campaigns 
– Depending on the technology involved, these providers may receive: 
– Device or browser information 
– IP address 
– Online identifiers 
– Pages visited 
– Referral information 
– Advertising interactions 
– Information about actions taken on our website 

Limits we place on advertising technologies. Because of the nature of TACA’s mission, we apply the following limits: 

– We do not use information an individual provides to TACA about a diagnosis, health condition, disability, treatment, or request for support for targeted advertising. 
– We do not knowingly use personal information for targeted advertising where we know or should reasonably know the individual is under 18 years of age. 
– Where the law requires consent before we may collect or share this information, advertising technologies remain off until consent is given. 
– Where available, we enable privacy-restricting settings offered by advertising platforms, such as Meta’s limited data use and Google’s restricted data processing options. 

6. Your Cookie Choices 
Where required by applicable law, TACA provides visitors with choices regarding non-essential cookies and similar technologies. 
Our cookie consent tool allows you to: 

– Accept all cookies 
– Reject non-essential cookies 
– Manage preferences by category 

Strictly necessary technologies remain active because they are required for the website or requested services to function. 

You can change your cookie preferences at any time by selecting the “Cookie Preferences” link in the footer of every page of our website. 

Rejecting analytics or advertising cookies will not prevent you from accessing TACA’s core website content or services. 
Cookie-based preferences are stored in your browser or on your device. If you use a different browser or device, or clear your cookies, you may need to set your preferences again. Your applicable privacy experience may also be determined based on your location or other circumstances, as described in this Policy. 

7. Browser Privacy Controls, Global Privacy Control, and Do Not Track 

Browser settings 
Most web browsers allow you to manage cookies through browser settings. Depending on your browser, you may be able to: 

– View stored cookies 
– Delete cookies 
– Block cookies from particular websites 
– Block third-party cookies 
– Block all cookies 
– Blocking all cookies may affect the functionality of TACA’s website and other websites you use. 

Global Privacy Control and other opt-out preference signals 
Some browsers and browser extensions support Global Privacy Control (GPC), a signal that communicates a user’s privacy preference regarding the sale or sharing of personal information. Where required by applicable law, TACA will recognize and process applicable privacy preference signals in accordance with those requirements.

 
Do Not Track 
Web browsers may offer a “Do Not Track” setting. There is still no common industry or legal standard for how websites should respond to it. TACA does not currently respond to Do Not Track signals. 

8. Third-Party Cookies and Technologies 
Some features and technologies on TACA’s website are provided by third-party service providers. These providers may process information on TACA’s behalf or may collect information independently in connection with their services. The types of third-party services we use may include analytics, advertising and marketing, video and media, payment and donation processing, event registration, communications, security, and other technology services. 

The information that third parties may collect or receive depends on the service, how it is configured, and your interactions with it. Where required by applicable law, we obtain consent before applicable technologies collect or share information. Third parties may also process information in accordance with their own privacy policies and terms. 

TACA does not control the privacy practices of third-party services that operate independently from TACA. We encourage you to review the privacy policies of third-party services with which you interact. 

9. Information We Receive From Other Sources 
TACA may receive information about individuals from third parties in addition to information provided directly to us. These sources may include: 

– Service providers 
– Fundraising platforms 
– Event platforms 
– Social media services 
– Digital advertising platforms 
– Publicly available sources 
– Donor research providers 
– Data and information providers 
– Matching-gift providers 
– Other organizations or individuals where permitted by law 

We may combine information obtained from these sources with information already maintained by TACA. 

We do not obtain information about your health, diagnosis, disability, or treatment from data brokers or other third-party data sources. Information of that kind comes to us only from you or, in the case of a child or dependent adult, from a parent, caregiver, or legal representative. 

10. Constituent Relationship Management 
TACA uses EveryAction as its constituent relationship management platform and may use other service providers to manage relationships with members of our community. 

Depending on an individual’s relationship with TACA, our CRM may contain: 

– Name 
– Contact information 
– Communication history 
– Communication preferences 
– Donation history 
– Event participation 
– Volunteer activity 
– Program engagement 
– Interests 
– Fundraising information 
– Other information provided to TACA or obtained from permitted sources 

We use this information to provide services, communicate with our community, conduct fundraising and donor stewardship, understand engagement, evaluate our activities, and support TACA’s charitable mission. 

11. Donor Research and Wealth Screening 
TACA may use third-party services, including WealthEngine, to assist with donor research, fundraising, stewardship, and relationship management. These services provide information derived from publicly available information, third-party databases, or other permitted sources, which may include estimates or indicators related to: 

– Charitable giving 
– Philanthropic interests 
– Professional affiliations 
– Business affiliations 
– Property ownership 
– Public records 
– Estimated financial capacity 
– Potential affinity for TACA’s mission 

TACA uses this information to better understand potential and existing supporters, appropriately manage donor relationships, prioritize fundraising activities, and advance our charitable mission. 

Wealth-screening information is never used to determine whether an individual or family is eligible to receive TACA programs, resources, or support. It is not combined with health, diagnosis, disability, or support-request information. It is not used to set the price of any service. 

If you would prefer that we not include you in donor research or wealth screening, contact us at privacy@tacanow.org and we will note that preference in our records. 

12. How We Use Personal Information 
TACA uses personal information to: 

– Provide TACA programs, resources, education, and services 
– Respond to questions and requests 
– Connect individuals with appropriate TACA resources 
– Register individuals for programs and events 
– Provide requested accommodations 
– Administer online accounts 
– Process donations and transactions 
– Issue donation acknowledgments and tax receipts 
– Communicate about programs, resources, events, and opportunities 
– Send fundraising communications 
– Manage donor relationships and stewardship 
– Conduct donor research 
– Manage volunteers 
– Conduct surveys and program evaluations 
– Understand the needs of the TACA community 
– Measure program reach and impact 
– Improve our programs, services, and website 
– Analyze website usage 
– Measure outreach and advertising campaigns 
– Personalize communications where appropriate 
– Maintain organizational records 
– Detect and prevent fraud, misuse, or security incidents 
– Comply with legal obligations 
– Protect TACA, members of our community, and others 
– Carry out other purposes disclosed at the time information is collected 

We limit our collection and use of personal information to what is reasonably necessary and proportionate for these purposes. For sensitive information, we limit collection and use to what is strictly necessary for the specific service you have requested or for a purpose you have consented to. 

We may also use aggregated or de-identified information that does not reasonably identify an individual for program evaluation, research, reporting, organizational planning, advocacy, fundraising, measuring impact, and improving TACA’s mission-related activities. 

Artificial intelligence and large language models 
TACA does not intentionally provide personal information to third parties for the purpose of training their artificial intelligence models or large language models. Where TACA uses AI-assisted tools in its own operations, we do so subject to Section 31 and applicable contractual, privacy, and security requirements. 

13. Legal Bases for Processing (Individuals in the EEA, UK, and Switzerland) 
The lawful basis we rely on depends on the specific processing activity and the circumstances in which we collect and use the information. If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal information on the following legal bases: 

Performance of a contract or a service you requested. For example, registering you for an event, administering your account, or processing a donation. 

Legitimate interests. For example, operating and improving our website, maintaining organizational records, fundraising, security, and fraud prevention, where those interests are not overridden by your rights. 

Consent. For example, non-essential cookies, certain marketing communications, and the collection of health or other special category information. You may withdraw consent at any time. 

Compliance with a legal obligation. For example, tax, accounting, and charity reporting requirements. 

Substantial public interest or your explicit consent. This covers special category data, including health and disability information, which we process only with your explicit consent or where another lawful condition applies. 

You may also have the right to lodge a complaint with your local data protection authority. 

14. How We Share Personal Information 
TACA may disclose personal information in the following circumstances. 

Service Providers 
We provide information to companies and organizations that perform services on our behalf, including: 

– Website hosting providers 
– Information technology providers 
– Constituent relationship management systems 
– Email and communications platforms 
– Payment processors 
– Donation platforms 
– Event registration systems 
– Analytics providers 
– Digital advertising platforms 
– Data security providers 
– Donor research and wealth-screening providers 
– Mailing and fulfillment services 
– Survey and evaluation platforms 
– Professional advisers, including auditors and legal counsel 

These providers may access information only as necessary to perform services for TACA. Where a provider processes information on TACA’s behalf, we use contractual and other appropriate safeguards designed to require the provider to protect the information and process it only for authorized purposes. Where a third party processes information independently, its processing may be governed by its own privacy policy and legal obligations. 

Programs, Events, and Community Partners 
Where appropriate, we may provide limited information to organizations assisting TACA in operating a program, service, event, or community activity. Examples include a venue that requires an attendee list, or a co-hosting organization. 

We will seek your consent where required by applicable law or where appropriate based on the nature of the information or the proposed use. We do not provide health, diagnosis, disability, or support-request information to community partners without your consent. 

Analytics and Advertising Providers 
TACA may make limited information available to third-party analytics and digital advertising providers in connection with website analytics, advertising measurement, campaign attribution, audience development, outreach, and fundraising campaigns.

 
Depending on the technology and how it is configured, this information may include online identifiers, device and browser information, IP address, referral information, and website activity. TACA configures these technologies to limit the collection and sharing of sensitive or health-related information where appropriate and applies applicable consent requirements. 

See Sections 5 and 15 for additional information about analytics, advertising, and related technologies. 

Legal and Safety Purposes 
We may disclose information if reasonably necessary to: 

– Comply with applicable law or regulation 
– Respond to a subpoena, court order, or legal process 
– Respond to lawful requests from government authorities 
– Investigate potential fraud 
– Investigate or respond to security incidents 
– Enforce TACA’s agreements or policies 
– Protect the rights, safety, or property of TACA, members of our community, or others 

Where we are permitted to do so, we will attempt to notify you before disclosing your information in response to legal process. 

Organizational Transactions 
If TACA is involved in a merger, affiliation, restructuring, transfer of assets, or similar organizational transaction, information may be transferred as part of that transaction, subject to applicable law and to the commitments in this Policy. 

At Your Direction or With Your Consent 
We may share information when you ask us to do so or when you provide appropriate consent. 

15. Sale, Sharing, and Targeted Advertising 

TACA does not sell personal information for money.

 
TACA does not rent, trade, exchange, or otherwise make donor, member, or mailing lists available to other organizations for their own marketing or fundraising. 

TACA does not sell sensitive information, including health, diagnosis, or disability information, under any circumstances.

 
Some privacy laws define “sale,” “sharing,” and “targeted advertising” more broadly than an exchange of information for money. Under those broader definitions, TACA’s use of advertising and measurement technologies described in Section 5 may be treated as “sharing” personal information or as “targeted advertising.” 

You can opt out of that activity at any time by: 

– Setting your preferences in our Cookie Preferences tool to reject advertising cookies; 
– Enabling Global Privacy Control in your browser or browser extension; or 
– Submitting a request as described in Section 20, which we will apply to our records as well as to your browser. 
– We honor these opt-outs regardless of whether a particular state law requires us to. 

16. Our Approach to Sensitive and Health-Related Information 
Because TACA provides information and support concerning autism, disability, healthcare, therapies, education, and family services, some interactions with TACA involve sensitive or health-related information. 

We take additional care with information that reveals, or could reasonably be associated with: 

– Autism or another diagnosis 
– Disability 
– Health status 
– Treatment 
– Medication 
– Therapy 
– Healthcare needs 
– Educational or developmental needs 
– Requests for support 

Our commitments regarding this information: 

– We collect it only when it is strictly necessary for the program, resource, or support you have requested, or where you have consented. 
– We do not sell it. 
– We do not use it for targeted advertising or profiling. 
– We do not disclose it to third parties other than service providers acting on our behalf under contract, unless you direct or consent to the disclosure or the law requires it. 
– We restrict internal access to staff and volunteers who need it to do their work. 
– We obtain your consent where applicable law requires consent before collecting, using, or sharing consumer health data or other sensitive information. 
– We do not use it to discriminate against individuals or families. 
– We do not require you to provide it in order to receive general information, use our website, or subscribe to our communications. 

Several states, including Washington, Nevada, and Connecticut, have laws specifically governing consumer health data. If you are a resident of one of those states, please also see our separate Consumer Health Data Privacy Notice, available at tacanow.org/consumer-health-data-privacy-notice/, which describes the categories of consumer health data we collect, how we use and share it, and the additional rights you have, including the right to withdraw consent and to have your consumer health data deleted.

 
17. Donor Privacy 

TACA respects the privacy of our donors. We use donor information to: 

– Process and acknowledge donations 
– Provide tax documentation 
– Maintain donation records 
– Communicate about TACA’s mission and impact 
– Conduct donor stewardship 
– Inform donors about opportunities to support TACA 
– Conduct fundraising analysis 
– Conduct appropriate donor research 
– Maintain relationships with supporters 

TACA may use service providers to support fundraising, communications, payment processing, research, analytics, data management, and donor engagement. 

TACA does not sell, rent, trade, or exchange donor lists. 

Donors may at any time ask us to: 

– Change or stop fundraising communications 
– Be excluded from donor research and wealth screening 
– Give anonymously, so that their name is not listed in donor recognition materials 
– Correct or update their donor record 

Contact us at privacy@tacanow.org or by phone to make any of these requests. 

18. Email, Text, and Communication Preferences 
You may receive communications from TACA if you: 

– Subscribe to TACA communications 
– Participate in a TACA program 
– Register for an event 
– Make a donation 
– Request information 
– Volunteer 
– Otherwise establish a relationship with TACA 

Email 
You may unsubscribe from promotional or fundraising emails using the unsubscribe link included in those communications, or by contacting us. We will process your request promptly. 

Unsubscribing from promotional communications will not stop necessary transactional or administrative communications, including: 

– Donation and purchase receipts 
– Registration confirmations 
– Account notifications 
– Security and privacy notices 
– Communications relating to a service you requested 

Text messages 
TACA may offer text-message communications in the future for program updates, service-related notifications, and other communications. If we offer SMS, we will send messages only to individuals who have provided the required consent. 

If you opt in: 

– Message frequency varies. 
– Message and data rates may apply. 

You may opt out at any time by replying STOP to any message, and you may reply HELP for assistance. 

Consent to receive text messages is never a condition of receiving TACA programs, resources, support, or services. 

We do not sell, rent, or share mobile telephone numbers or text-message opt-in information with third parties or affiliates for their marketing purposes. We share them only with the service providers who deliver messages on our behalf. 

Postal mail and telephone 
You may ask us to stop sending postal mail or to stop calling you at any time by contacting us at privacy@tacanow.org or the phone number in Section 32. 

19. Your Privacy Rights 
Depending on where you live and the laws that apply to TACA, you may have certain rights regarding your personal information. As described in Section 2, TACA provides the following privacy choices and rights to individuals, subject to applicable law, legal limitations, and the procedures described below: 

– Know and access. Confirm whether we process personal information about you, and obtain a copy of it, including the categories of information, the sources, the purposes, and the categories of third parties to whom we disclose it 
– Correct. Correct inaccurate personal information 
– Delete. Request deletion of personal information we hold about you 
– Portability. Obtain a copy of certain information in a portable, readily usable format 
– Withdraw consent. Withdraw consent where our processing is based on consent, including consent to process consumer health data 
– Opt out of targeted advertising 
– Opt out of any sale or sharing of personal information 
– Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects 
– Obtain a list of third parties to which we have disclosed personal information, where the law provides this right 
– Appeal a decision we make about a privacy request 
– Non-retaliation. TACA will not discriminate or retaliate against you for exercising a privacy right, and will not deny you programs, resources, or support because you made a request 

Privacy rights are subject to legal limitations and exceptions. For example, we may need to retain certain donation and transaction records for tax, accounting, audit, or legal purposes even after you request deletion, and we may decline a request where honoring it would require us to violate a legal obligation or would compromise the privacy or safety of another person. 

20. How to Submit a Request, Verification, Authorized Agents, and Appeals 

Submitting a request 
To exercise any right described in Section 19, contact us: 

Email: privacy@tacanow.org (please include “Privacy Request” in the subject line) 
Phone: +1(855) 726-7810 
Mail: Privacy Request, The Autism Community in Action, 17752 Sky Park Cir Ste 140, Irvine, CA 92614 

Please tell us what right you wish to exercise and provide enough information for us to locate your records. 

Verification 
To protect your information, we will take reasonable steps to verify your identity before we act on a request to know, correct, delete, or port information. We may ask you to confirm information already in our records. We will not ask for more information than we need to verify your identity, and we will use information you provide for verification only for that purpose. 

We do not require verification to process an opt-out of targeted advertising, sale, or sharing, or to unsubscribe from communications.

 
Requests about a child or dependent adult 
A parent, legal guardian, or authorized legal representative may submit a request on behalf of a minor child or a dependent adult. We may ask for documentation confirming the relationship or authority. 

Authorized agents 
You may use an authorized agent to submit a request on your behalf. We may require written proof of the agent’s authorization, and we may contact you directly to confirm that you authorized the request and to verify your identity. 

Our response times 
We will acknowledge your request promptly and respond within the time required by applicable law. For U.S. privacy requests, this may generally be within 45 days, subject to any applicable extension. For individuals whose requests are subject to UK or EEA data protection law, we will generally respond within one month, subject to applicable extensions for complex requests. We will inform you if an extension is permitted and necessary. There is no charge for a request unless applicable law permits us to charge a reasonable fee for excessive, repetitive, or manifestly unfounded requests, in which case we will tell you before proceeding. 

Appeals 
If we decline your request in whole or in part, we will explain why and tell you how to appeal. To appeal, reply to our decision or write to privacy@tacanow.org with “Privacy Appeal” in the subject line, within 45 days of our decision. 

We will review the appeal and inform you in writing of our decision, and the reasons for it, within 45 days of receiving the appeal. If we deny your appeal, we will provide you with a method to contact your state Attorney General to submit a complaint. 

21. State-Specific Privacy Rights 
Privacy laws differ across the United States, and they treat nonprofit organizations differently from one another. 

Several state comprehensive privacy laws, including those in Colorado, Oregon, Delaware, Minnesota, Maryland, and New Jersey, apply to nonprofit organizations that meet certain thresholds, without a general nonprofit exemption. 

Connecticut’s law, as amended effective July 1, 2026, lowered its applicability thresholds and added triggers tied to the processing of sensitive data. 

Certain state consumer health data laws, including laws in Washington, Nevada, and Connecticut, may impose additional requirements on organizations that collect, use, or share consumer health data. Where such laws apply to TACA, we comply with their applicable consent, disclosure, security, deletion, and consumer-rights requirements. Please see our separate Consumer Health Data Privacy Notice for additional information. 

The California Consumer Privacy Act applies to for-profit businesses and generally does not apply to nonprofit organizations such as TACA. 

Where an applicable state law gives you a right or protection beyond what this Policy provides, we will honor it. Where a state law would not apply to TACA, we still provide the rights described in Sections 19 and 20 as a matter of policy. 

Additional notes for particular states 

Maryland residents. We do not sell sensitive data, and we do not process personal data for targeted advertising or sell personal data where we know or should reasonably know the individual is under 18. 

Colorado, Connecticut, Delaware, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas residents. We honor universal opt-out mechanisms, including Global Privacy Control, as described in Section 7. 

Minnesota and Oregon residents. You may request a list of the specific third parties, or the categories of third parties, to which we have disclosed your personal information. Contact us as described in Section 20. 

Nevada residents. In addition to the rights above, you may direct us not to sell certain covered information. As noted, we do not sell personal information. 

Washington and Nevada residents. Please see our separate Consumer Health Data Privacy Notice. 

California residents. California’s “Shine the Light” law permits residents to request information about the disclosure of personal information to third parties for their direct marketing purposes. TACA does not disclose personal information to third parties for their own direct marketing purposes. 

22. Children’s and Teens’ Privacy 
TACA’s mission involves children and families. Our general website and online services, however, are directed to parents, caregivers, professionals, supporters, and other adults, and are not directed to children under 13, unless a specific program or service states otherwise. 

TACA does not knowingly collect personal information online from children under 13 without first providing notice to a parent or legal guardian and obtaining verifiable parental consent as required by the Children’s Online Privacy Protection Act (“COPPA”). 

Information provided by parents and caregivers. Parents and caregivers frequently provide information about a child when seeking TACA programs, resources, education, or support. Examples include a child’s age, diagnosis, therapies, school situation, or needs. We use that information only for the purposes for which it was provided and as described in this Policy. We do not use it for advertising, we do not sell it, and we do not disclose it to third parties other than service providers acting on our behalf, unless you direct us to or the law requires it. 

If a TACA program collects information directly from a child under 13. Where a program, event, or online service is directed to children under 13 or where we knowingly collect information from a child under 13, we will: 

– Provide a direct notice to the parent or legal guardian describing the specific categories of information we collect, the purpose of each, how long we will keep it, and the third parties (by name or category) to whom we disclose it; 
– Obtain verifiable parental consent before collection, and obtain separate consent before disclosing a child’s information to any third party for that third party’s own purposes; 
– Collect only the information reasonably necessary to participate; 
– Not condition participation on the child providing more information than is reasonably necessary; 
– Retain the information only as long as reasonably necessary to fulfill the purpose for which it was collected, and then delete it securely; 
– Not use the child’s information for targeted advertising or profiling; 
– Provide the parent or guardian the ability to review the information, refuse further collection or use, and request its deletion. 

Teens. We do not process the personal data of individuals we know or should reasonably know to be under 18 for targeted advertising, and we do not sell it. 

If you believe a child has provided personal information to TACA without appropriate parental consent, please contact us at privacy@tacanow.org and we will review the information and, where required by applicable law, delete it. 

23. Third-Party Websites and Embedded Content 
TACA’s websites may contain links to, or embedded content from, third-party websites and services, such as: 

– Videos 
– Images 
– Social media content 
– Event platforms 
– Maps 
– Payment services 
– Other embedded applications or services 

Embedded content behaves as though you had visited the other website. These third parties may collect information about you independently, set their own cookies, embed additional tracking, and monitor your interaction with that content, including if you are logged in to their service. 

TACA does not control the independent privacy practices of third-party websites and services. We encourage you to review the applicable privacy policies before providing personal information to third parties. 

24. Social Media 
TACA maintains accounts and pages on social media platforms. 

When you interact with TACA through a social media platform, both TACA and the platform may receive information about your interaction. The platform’s collection and use of information is governed by its own privacy practices. 

Information you post publicly on social media, including in public or semi-public groups, may be visible to others. Please consider carefully before sharing details about your family’s health, diagnosis, or care in a group setting, even in a group TACA administers.

 
25. Data Retention 
TACA retains personal information for as long as reasonably necessary to fulfill the purposes for which it was collected and to meet legal, administrative, operational, fundraising, and reporting needs. 

Retention periods differ depending on the type of information, the purpose for which it was collected, your relationship with TACA, and applicable legal requirements. Our general practice is: 

– Donation and transaction records: 7 years after the transaction, for tax, accounting, and audit purposes. 
– Donor and constituent records in our CRM: for the duration of the relationship and 7 years after the last interaction. 
– Program and event registration records: 7 years after the program or event. 
– Support requests and related correspondence: 3 years after the matter is closed, unless you ask us to delete it sooner. 
– Health, diagnosis, and disability information you provide: generally only as long as reasonably necessary for the request, program, or other purpose for which it was collected, subject to applicable legal, administrative, operational, security, audit, and recordkeeping requirements. 
– Volunteer records: for the duration of service and 7 years after. 
– Email subscription and communication preference records: until you unsubscribe, plus a suppression record kept indefinitely so that we do not contact you again. 
– Website analytics and log data: retained according to the applicable analytics and log-data retention settings, which TACA configures based on the purposes for which the information is used and applicable law. Where applicable, these settings are generally 14 months or less. 
– Advertising and campaign measurement data: as determined by the platform’s retention settings, which we configure to the shortest practical period. 
– Children’s information collected under COPPA: only as long as reasonably necessary for the purpose collected, then deleted. 

Certain donation and transaction information must be retained for tax, accounting, auditing, or legal purposes even after an individual requests deletion. 

When personal information is no longer reasonably needed, TACA deletes, anonymizes, aggregates, or securely disposes of it in accordance with applicable law and our internal retention schedule. 

26. Data Security 
TACA uses administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, loss, modification, or disclosure. Depending on the circumstances, these safeguards include: 

– Role-based access controls, so staff and volunteers see only what they need 
– Multi-factor authentication for administrative and CRM access 
– Encryption of information in transit and, where appropriate, at rest 
– Security monitoring and patching of our systems 
– Staff and volunteer privacy and security training 
– Vendor due diligence and contractual data protection commitments 
– Written incident response procedures 
– Secure disposal of records 
– Other safeguards appropriate to the sensitivity of the information involved 

No system for transmitting or storing information can be guaranteed to be completely secure, and TACA cannot guarantee absolute security. Please do not send sensitive information to us through unsecured channels if you are uncomfortable doing so; you may always call us instead. 

27. Data Breaches and Security Incidents 
TACA maintains a written incident response plan. If we become aware of a security incident involving personal information, we will promptly investigate, take steps to contain and remediate the incident, and assess what notifications are required. 

Where required by law, and in any event without unreasonable delay, TACA will notify affected individuals, governmental authorities, consumer reporting agencies, and other parties as applicable. Our notice will describe, to the extent known, what happened, what information was involved, what we are doing in response, and what steps you can take. 

28. Automated Decision-Making, Profiling, and Artificial Intelligence 
TACA uses technology, analytics, segmentation, donor research, and similar tools to help organize information, understand engagement, prioritize fundraising activities, personalize communications, and improve organizational operations. Examples include grouping constituents by interest or giving history and estimating which supporters may be interested in a campaign. 

Our commitments: 

We do not use automated decision-making, with or without human review, to determine whether an individual or family is eligible to receive TACA programs, resources, or support. Those decisions are made by people. 

We do not use automated processing to make decisions that produce legal or similarly significant effects concerning you, such as decisions about credit, housing, employment, education, insurance, or healthcare. 

We do not use sensitive information, including health, diagnosis, or disability information, for profiling. 

Where we use AI-assisted tools internally, we do so subject to human review of any consequential output, and we do not input sensitive personal information into tools that would use it to train third-party models. 

We do not make personal information available to third parties for training their artificial intelligence models or large language models. 
Where applicable law gives you rights concerning automated decision-making or profiling, including the right to be informed, to access information about the logic involved, to opt out, or to have a decision reviewed by a person, we will honor those rights. Contact us as described in Section 20. 

29. International Visitors and Cross-Border Transfers 
TACA is based in the United States, and our programs and online services are primarily directed to individuals in the United States. 
If you access our website or provide information from outside the United States, your information will be transferred to, stored in, and processed in the United States and possibly other countries where our service providers operate. Privacy and data-protection laws in the United States may differ from those in your country, and may not provide the same level of protection. 

Where required by applicable data protection law, we use appropriate safeguards for international transfers, which may include an applicable adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. 

30. Accessibility of This Policy 
TACA is committed to making our information accessible to the community we serve. 

If you need this Policy in an alternative format such as large print, plain language, or a screen-reader-friendly document, or if you need help submitting a privacy request, contact us at privacy@tacanow.org or +1(855) 726-7810 and we will assist you. There is no charge for this assistance. 

31. Changes to This Policy 
TACA may update this Privacy and Cookie Policy periodically to reflect changes in our programs and services, our technology, our data practices, applicable laws, or our operations. 

When we update this Policy, we will revise the “Last Updated” date at the top. If we make material changes to how we collect, use, or share personal information, we will provide additional notice before the change takes effect, for example by posting a notice on our website, emailing subscribers, or obtaining consent where the law requires it. 

Prior versions of this Policy are available on request. 

Version history 
Version 2.0, September 24, 2026. Comprehensive rewrite, adding cookie disclosures and consent, sensitive and consumer health data commitments, recognition of opt-out preference signals, request and appeal procedures, state-specific rights, children’s and teens’ privacy, a retention schedule, automated decision-making, and accessibility. 

Version 1.0, May 1, 2026. Prior policy. 

32. Contact Us 
If you have questions about this Privacy and Cookie Policy, TACA’s privacy practices, or would like to exercise a privacy right, please contact: 

The Autism Community in Action (TACA) 

Attn: Privacy 17752 Sky Park Circle, Suite 140 Irvine, CA 92614

Email: privacy@tacanow.org 

Phone: (949) 640-4401 

For privacy-related requests, please include “Privacy Request” in the subject line or description of your request. We will review and respond in accordance with Section 20.