Privacy Policy

1. Who we are This Privacy Policy explains how Benedict Society, operating as the "Benedict XVI Society" (the "Society", "we", "us"), processes personal data when you use benedictxvisociety.org, its subdomains, including research.benedictxvisociety.org ("Benedict AI"), our newsletters, events, and donation channels (together, the "Services"). The Society is a nonprofit corporation organized under the laws of Michigan, USA, with its principal office at 1717 Pennsylvania Avenue NW, Suite 1025, Washington, DC 20006, United States. The Society is the controller of your personal data within the meaning of Regulation (EU) 2016/679 (the "GDPR"). Privacy contact: info@benedictxvisociety.org We have not appointed a Data Protection Officer; privacy inquiries are handled by the contact above. 2. Scope This Policy applies to the Services. It does not apply to third-party websites and services we link to or use for specific functions, in particular the donation platform Givebutter (givebutter.com) and social media platforms, which process your data under their own privacy policies (see Sections 5 and 8). 3. Personal data we collect Data you provide to us: 1. contact data: name, email address, postal address, telephone number, institutional affiliation and title (for example clergy, academic); 2. communications: inquiries, correspondence, feedback, applications for programs, formation, or retreats; 3. event data: registrations, dietary or accessibility requirements you choose to share, attendance records, and, where notified at the event, photographs and recordings; 4. newsletter data: email address and subscription preferences, including confirmation and interaction records (double opt-in); 5. donation data: donor name, contact details, donation amount, date, designation, and acknowledgment history, which we receive from the donation platform; we do not receive or store full payment card numbers; 6. Benedict AI data: the questions and prompts you submit, the generated responses, and related usage data (see Section 6); 7. other submissions, for example testimonials or prayer intentions. Data collected automatically: IP address, date and time of access, device, browser and operating system information, referring URL, pages viewed, approximate location derived from IP address, and data collected through cookies and similar technologies (see Section 7). Data from third parties: confirmation and donor data from the donation platform, registration data from event co-organizers or partner institutions, and publicly available information relevant to our mission and partnerships. You are not legally required to provide personal data, but without certain data we cannot provide the relevant Service (for example, we cannot register you for an event without your name and contact details). 4. Religious data and other special categories Because of our religious mission, some data you provide may reveal your religious beliefs, for example a prayer intention, a retreat application, or your participation in formation programs. Such data is a special category of personal data under Article 9(1) GDPR. We process it only on one of the following bases: 1. your explicit consent (Article 9(2)(a) GDPR), which you may withdraw at any time; 2. Article 9(2)(d) GDPR: processing carried out in the course of our legitimate activities as a not-for-profit body with a religious aim, relating to members, former members, or persons who have regular contact with us in connection with our purposes; on this basis we do not disclose such data outside the Society without your consent; or 3. data you have manifestly made public (Article 9(2)(e) GDPR). We do not infer religious beliefs from mere visits to the Site, and we do not use special category data for advertising or profiling. 5. Purposes and legal bases Purpose Data Legal basis (GDPR) Providing and securing the Site, logging, abuse and fraud prevention Automatically collected data Legitimate interests, Art. 6(1)(f): secure and functional operation of the Services Responding to inquiries and correspondence Contact data, communications Legitimate interests, Art. 6(1)(f); Art. 6(1)(b) where the inquiry concerns steps prior to an agreement Event and program administration (registration, admission, communication, safety) Contact and event data Art. 6(1)(b) (performance of the registration agreement); Art. 9(2)(a) or 9(2)(d) for data revealing religious beliefs Newsletter and updates Newsletter data Consent, Art. 6(1)(a), withdrawable at any time via the unsubscribe link or by contacting us Fundraising communications Contact and donation data Consent, Art. 6(1)(a), for email in the EU/EEA; legitimate interests, Art. 6(1)(f), with an easy opt-out, for postal mail and for communications outside the EU/EEA Donation administration, acknowledgments, donor records Donation data Art. 6(1)(b); legal obligation, Art. 6(1)(c) (tax, accounting, charity regulation); legitimate interests, Art. 6(1)(f) (donor relations) Operating Benedict AI Benedict AI data Legitimate interests, Art. 6(1)(f): providing the research tool; consent, Art. 6(1)(a), where required; see Section 6 Compliance with legal obligations (tax, accounting, sanctions and AML screening of donations, responses to authorities) Relevant records Legal obligation, Art. 6(1)(c) Establishing, exercising, or defending legal claims Relevant records Legitimate interests, Art. 6(1)(f); Art. 9(2)(f) where special categories are concerned Where we rely on legitimate interests, you may object at any time (see Section 11); we have balanced our interests against your rights and will provide further information on the balancing on request. 6. Benedict AI Benedict AI is an artificial intelligence research tool. When you use it, we process the prompts you enter, the generated output, and technical usage data (timestamps, session identifiers, IP address, error logs). 1. Purposes: generating responses to your queries; maintaining, securing, and debugging the tool; preventing abuse; and evaluating and improving retrieval quality and answer accuracy. 2. Provider: Benedict AI is provided on our behalf by Perpetuals.com Ltd. (NASDAQ: PDC), 255 California Street, 6th Floor, San Francisco, CA 94111, United States, which provides the AI, hosting, and database infrastructure used for the service. Prompts are not used to train general-purpose AI models. 3. Please do not enter sensitive data. The tool does not need personal data to answer theological questions. Do not include special category data about yourself or others, third parties' personal data, or confidential matter in prompts. If prompts nevertheless contain data revealing religious beliefs, Section 4 applies. 4. Retention: prompts and outputs that a user chooses to save are retained for up to 12 months for the purposes above and then deleted or anonymized. Inputs that a user does not save, or that the user deletes, are not retained as saved content. Technical and security logs are retained for up to 90 days. 5. No automated decisions: Benedict AI does not make decisions producing legal or similarly significant effects concerning you (Article 22 GDPR). 6. Transparency: responses are AI-generated and may be inaccurate; you are interacting with an AI system, not a human (see also our Terms of Service, Section 8, including the notice under Regulation (EU) 2024/1689). 7. Cookies and similar technologies We use limited browser storage, necessary security services, and optional third-party services on the Site. 1. Necessary services: we store your privacy preference in your browser's local storage under the key "benedict-cookie-consent-v1". This is required to remember whether you accepted or rejected optional services. It remains until you change your settings or clear your browser storage. We also load Google reCAPTCHA on the contact page to protect the form from automated abuse. reCAPTCHA is required to submit the contact form and may process technical data or use similar technologies under Google's privacy terms. 2. Functional services: with your prior consent, we load optional Brevo components on the newsletter page to operate the subscription form. Brevo may use cookies or similar technologies under its own privacy notice. 3. We do not currently use analytics or advertising cookies on the Site. You can accept, reject, or configure optional services through the cookie banner and withdraw or change your choice at any time through the "Cookie Settings" link in the Site footer. 8. Recipients of your data We share personal data with: 1. service providers (processors) acting on our instructions under Article 28 GDPR data processing agreements: website hosting, IT support, email delivery and newsletter tools, event management tools, CRM and donor management, and the Benedict AI infrastructure providers listed in Section 6; 2. the donation platform Givebutter and its payment processors, which act as independent controllers or processors for payment handling under their own terms and privacy policies; 3. event co-organizers and partner institutions, where you register for a jointly organized event; the relevant partners will be named in the event materials; 4. professional advisers (lawyers, auditors, accountants) bound by confidentiality; 5. authorities and courts, where required by law or to establish, exercise, or defend legal claims; and 6. a successor organization, in the event of a reorganization of our charitable activities, subject to this Policy. We do not sell personal data, and we do not share personal data with third parties for their own marketing. Data revealing religious beliefs is not disclosed outside the Society without your consent (Section 4). 9. International data transfers We operate from the United States, so personal data collected in the EU/EEA is transferred to the United States, and data may also be shared with the providers listed above in other third countries. For transfers from the EU/EEA (and the UK and Switzerland) to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), supplemented where necessary by additional technical and organizational measures, and on the UK Addendum or IDTA and the Swiss equivalents where applicable. As a nonprofit organization, the Society is generally not eligible to self-certify under the EU-U.S. Data Privacy Framework and does not rely on it. You can request a copy of the relevant safeguards through our privacy contact. 10. Retention We keep personal data only as long as necessary for the purposes described above, in particular: 1. donation, tax, and accounting records: 7 years under U.S. requirements; 2. newsletter data: until you unsubscribe, plus a minimal suppression record to honor your opt-out; 3. inquiries and correspondence: up to 2 years after the matter is closed, unless a longer period is needed for legal claims; 4. event records: up to 2 years after the event, and longer for tax-relevant records; 5. Benedict AI prompts and outputs: 12 months (Section 6); 6. server logs: 90 days. Afterwards, data is deleted or irreversibly anonymized, subject to legal hold obligations and applicable statutes of limitation. 11. Your rights (EU/EEA, UK, Switzerland) Under the GDPR and equivalent laws you have the right to: 1. access your personal data (Art. 15); 2. rectification of inaccurate data (Art. 16); 3. erasure (Art. 17); 4. restriction of processing (Art. 18); 5. data portability (Art. 20); 6. object to processing based on legitimate interests, for reasons arising from your particular situation (Art. 21(1)), and to object at any time, without giving reasons, to processing for direct marketing, including fundraising (Art. 21(2)); 7. withdraw consent at any time, with effect for the future, without affecting the lawfulness of prior processing (Art. 7(3)); and 8. not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Art. 22); we do not carry out such processing. To exercise your rights, contact info@benedictxvisociety.org or write to the office listed in Section 14. We may need to verify your identity and will respond within one month, extendable by two further months for complex requests, in which case we will inform you. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or of the alleged infringement. We would appreciate the chance to address your concern first, but you are not required to contact us before complaining. 12. Users in the United States The Society is a nonprofit organization. Most comprehensive U.S. state privacy laws either do not apply to nonprofit organizations or apply only above processing thresholds that we do not meet. Where a state law grants you rights (for example rights of access, correction, deletion, or to opt out of targeted advertising), we will honor valid requests submitted through the contact in Section 14. We do not sell personal data or process it for targeted advertising. 13. Children The Services are not directed to children under 16. We do not knowingly collect personal data from children under 13 (in accordance with the U.S. COPPA) or below the applicable age of digital consent in the EU/EEA (for example 14 in Italy, 16 in Germany) without verifiable parental consent. If you believe a child has provided us personal data, contact us and we will delete it. 14. Contact Benedict Society (operating as the "Benedict XVI Society") Principal office: 1717 Pennsylvania Avenue NW, Suite 1025, Washington, DC 20006, United States Phone: +1 202 559 9200 Email: info@benedictxvisociety.org 15. Security We apply technical and organizational measures appropriate to the risk (Article 32 GDPR), including encryption in transit (TLS), access controls and least-privilege administration, logging, vendor due diligence, and contractual safeguards with processors. No system is completely secure; we will notify you and the competent authorities of personal data breaches where required by law. 16. Changes to this Policy We may update this Policy from time to time. The current version with its effective date is published on this page; for material changes we will provide notice on the Site or by email. Earlier versions are available on request.