Privacy Policy

1. Introduction

Mach-Techs ("we," "us," or "our") is a 501(c)(3) non-profit organization committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at mach-techs.org, use our learning management system (LMS) portal, enroll in courses, book services, make donations, or interact with us in any other way.

By using our website and services, you consent to the data practices described in this policy. If you do not agree, please discontinue use of our services.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and phone number. Your account is authenticated through Amazon Cognito using your email and password.

Payment Information

Payments are processed securely by Stripe. We never see, store, or have access to your full credit card numbers. Stripe is PCI DSS Level 1 compliant. We retain transaction records (amount, date, and description) for accounting and tax purposes.

Student Data

When you enroll in courses or training programs, we collect and store enrollment records, course progress, quiz and assessment results, completion status, and certificates earned.

Booking Data

When you book IT services or consultations, we collect the date and time of the booking, the type of service requested, and any notes or details you provide.

Donation Records

When you make a donation, we record the amount, frequency (one-time or recurring), date, and your contact information for issuing tax-deductible receipts as required under our 501(c)(3) status.

Scholarship Applications

Scholarship applications may include personal information, educational background, financial information, and statements of need or purpose. This information is used solely for evaluating applications.

Contact Form Submissions

When you submit a contact form, we collect your name, email address, and the content of your message.

Newsletter Subscriptions

When you subscribe to our newsletter, we collect your email address and confirmation status. You can unsubscribe at any time via the one-click unsubscribe link in every email.

Usage Data

We may collect information about how you access and use our website, including your IP address, browser type, operating system, pages visited, and the dates and times of your visits.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our IT services and training programs
• Process payments, donations, and issue tax-deductible receipts
• Send transactional emails including enrollment confirmations, payment receipts, booking confirmations, and service updates
• Issue certificates upon course completion
• Evaluate scholarship applications and administer awards
• Respond to your inquiries and contact form submissions
• Send newsletters to subscribers (with consent)
• Improve our website, services, and course offerings
• Comply with legal obligations and protect our rights

We never sell, rent, or trade your personal information to third parties for marketing purposes.

4. Third-Party Services

We use the following third-party services to operate our platform. Each has its own privacy policy governing how they handle your data:

Amazon Web Services (AWS)

We use AWS for hosting our application, database storage, sending transactional emails via Amazon Simple Email Service (SES), and file storage via Amazon S3. Your data is stored in AWS data centers with enterprise-grade security.

Stripe

Stripe processes all payments on our platform. Stripe is PCI DSS Level 1 compliant, the highest level of certification available. Your payment card information is sent directly to Stripe and never touches our servers. See Stripe's Privacy Policy.

Google reCAPTCHA v3

We use Google reCAPTCHA v3 to protect our forms from automated abuse. reCAPTCHA collects hardware and software information (such as device and application data) and sends it to Google for analysis. Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

Amazon Cognito

We use Amazon Cognito for user authentication. Cognito securely manages your login credentials (email and password) and issues authentication tokens. Your password is never stored in plain text.

5. Cookies

We use only essential cookies required for the functionality of our platform:

• Authentication cookies (auth-token, id-token, refresh-token) — These are httpOnly, Secure cookies used to maintain your login session. They are strictly necessary and cannot be disabled.
• Cookie consent preferences — Your consent choice is stored in localStorage.
• reCAPTCHA cookies — Google reCAPTCHA may set cookies as part of its bot detection process.

We do not currently use any tracking, advertising, or analytics cookies.

6. Data Security

We take the security of your data seriously and implement multiple layers of protection:

• Encryption at rest — All stored data is encrypted using AES-256 encryption
• Encryption in transit — All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
• Authentication security — JWT (JSON Web Token) authentication with cryptographic signature verification
• Web Application Firewall (WAF) — Protection against common web exploits and attacks
• Role-based access controls — Only authorized personnel can access sensitive data, with permissions limited to what is necessary for their role

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your information for as long as necessary to fulfill the purposes outlined in this policy:

• Account data — Retained while your account remains active. Upon account deletion, personal data is removed within 30 days.
• Payment and donation records — Retained for 7 years as required for tax, accounting, and legal compliance purposes.
• Student progress and certificates — Retained while you are enrolled and for a reasonable period after to allow certificate verification.
• Newsletter subscription data — Deleted promptly upon unsubscribe in compliance with GDPR requirements.
• Scholarship applications — Retained for 2 years after the application cycle, then securely deleted.
• Contact form submissions — Retained for up to 1 year.

8. Your Rights

You have the following rights regarding your personal information:

• Access your data — View your personal information through your portal account settings at any time.
• Update your information — Edit your profile details directly through your account settings.
• Delete your account — You can delete your account directly from your portal settings page. Alternatively, contact us at info@mach-techs.org. Account deletion is processed within 30 days.
• Unsubscribe from newsletter — Use the one-click unsubscribe link in any newsletter email.

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your CCPA rights, contact us at info@mach-techs.org.

To submit a "Do Not Sell or Share My Personal Information" request, email info@mach-techs.org with the subject line "CCPA Opt-Out Request" and we will process your request within 15 business days.

EU Residents (GDPR)

If you are a resident of the European Union, you have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectification, erasure, restriction of processing, data portability, and the right to object. To exercise these rights, contact us at info@mach-techs.org.

9. Children's Privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a child under 13, please contact us at info@mach-techs.org.

10. Legal Basis for Processing

We process your personal data under the following lawful bases as required by the GDPR and similar data protection regulations:

11. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by the GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay via email and a prominent notice on our website.

Our breach response process includes: containment and assessment of the breach, notification to affected parties and authorities, remediation measures, and a post-incident review to prevent recurrence.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we make material changes, we will notify registered users via email and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: info@mach-techs.org
• Website: mach-techs.org

For data protection inquiries, contact info@mach-techs.org.