# Privacy Policy
Elisabeth Kübler-Ross Foundation
Last updated:August 27, 2026
Effective: August 27, 2026
---
Who we are
The Elisabeth Kübler-Ross Foundation ("EKR Foundation," "we," "us," or "our") operates the website at EKRFoundation.org (the "Website") and the programs, resources, and services offered through it.
We are a [501(c)(3) nonprofit] organization based in Scottsdale, Arizona. We are the data controller for the personal information described in this policy.
> **[CONFIRM BEFORE PUBLISHING]** Your current site footer credits the "Elisabeth Kübler Ross Family Limited Partnership," which is a different legal entity from the Foundation. Whichever entity actually controls this website and its data should be named here and in the footer, and they should match. If both entities are involved, say so plainly and explain which one does what.
We take privacy seriously for a specific reason. People come to this Website during some of the hardest passages of their lives — facing a diagnosis, sitting with someone who is dying, or grieving. What you tell us in that context deserves care. We collect as little as we can, we do not sell it, and we say here exactly what we do with it.
---
## What this policy covers
This policy applies to information we collect:
- On this Website
- In email, text, and other electronic messages between you and us
- Through forms, registrations, purchases, and downloads on the Website
It does not apply to information collected offline, or by any third party — including any site or service you reach by clicking a link from ours. Those have their own policies, and we encourage you to read them.
By using the Website, you agree to this policy. If you do not agree, please do not use the Website.
---
## Children under 13
The Website is not directed to children under 13, and we do not knowingly collect personal information from them. If you are under 13, please do not use the Website or send us any information about yourself.
If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete it. If you believe a child under 13 has given us information, contact us at Education@ekrfoundation.org and we will remove it.
Some of our resources address grief in children and teenagers. Those materials are written for the adults who care for them — parents, teachers, counselors, clinicians — not for the children themselves.
---
## Information we collect
### Information you give us
We collect what you choose to provide, which may include:
| What | When you typically give it |
|---|---|
| Name and email address | Newsletter signup, resource download, event registration |
| Mailing address | Purchases requiring shipment, donations requiring acknowledgment |
| Payment information | Purchases and donations — see below |
| Professional details (role, organization) | Training program and certification registration |
| Message content | Contact forms, email correspondence, survey responses |
**We do not ask you to tell us about your own health, your diagnosis, your loss, or your bereavement.** If you choose to share something like that in a message to us, we treat it as confidential and use it only to respond to you. Please do not include information you would not want stored in an email inbox.
**Payment information.** We do not collect or store your full payment card number. Payments are processed by [Stripe / PayPal / your processor], which handles card data directly under its own privacy policy and PCI-DSS obligations. We receive only confirmation of the transaction and limited details such as the last four digits, billing name, and amount.
### Information collected automatically
As you use the Website, we and our providers may collect:
- IP address and approximate location derived from it (typically city-level)
- Device type, operating system, and browser
- Pages viewed, time on site, and the pages you arrived from and left to
- Referring URLs and, where applicable, campaign parameters
This is collected through cookies and similar technologies (see below) and is used in aggregate to understand what people find useful and to keep the site working and secure. Where we can link this to information you have given us, we treat the combination as personal information under this policy.
### Information we do not collect
We do not knowingly collect biometric identifiers, precise geolocation, government ID numbers, or information about your religion, politics, sexual orientation, or union membership. We do not buy personal information from data brokers.
---
## Cookies and similar technologies
A cookie is a small text file placed on your device. We use them in these categories:
**Strictly necessary.** Required for the site to function — session management, security, load balancing, remembering items in a cart, and recording your cookie preferences. These cannot be switched off.
**Analytics.** We use Google Analytics 4 to understand how the Website is used in aggregate. This tells us which resources people actually read and where the site is confusing.
**Marketing and advertising.** [We use / We do not use] advertising and social media pixels, such as the Meta pixel and Google Ads tags, which allow those platforms to recognize visitors to our site.
> **[CONFIRM BEFORE PUBLISHING]** Open your Kajabi settings and your site's page source and list what is actually installed. Do not claim pixels you do not run, and do not omit ones you do. A mismatch between this list and reality is the single most common enforcement trigger.
### Your choices about cookies
Where required by law — including for visitors in the EU, UK, and certain US states — we ask for your consent before setting analytics or marketing cookies, through a banner when you first visit. You can change your choices at any time via [the "Cookie Settings" link in the footer].
You can also block or delete cookies through your browser settings. If you block strictly necessary cookies, parts of the Website may stop working.
**Global Privacy Control.** We honor the Global Privacy Control (GPC) signal. If your browser or extension sends GPC, we treat it as a valid opt-out of the sale or sharing of personal information and of targeted advertising, as required in California, Colorado, Connecticut, Texas, and other states that recognize universal opt-out mechanisms.
We do not respond to browser "Do Not Track" signals, which have no agreed standard. GPC is the mechanism we support.
> **[CONFIRM BEFORE PUBLISHING]** Kajabi does not include a consent banner by default. If you have not installed one, either install one (there are several that drop into Settings → Site Details → custom code) or delete the consent language above and remove non-essential tracking. Saying you ask for consent when you do not is a misrepresentation, and it is the kind a regulator can verify in thirty seconds.
---
## How we use your information
We use personal information to:
- Deliver the resources, programs, events, and products you request
- Process donations and purchases, and send receipts and acknowledgments
- Send our newsletter and program updates, where you have signed up or consented
- Respond to your questions and support requests
- Operate, secure, maintain, and improve the Website
- Understand which of our resources are useful, in aggregate
- Comply with legal, tax, and charitable-registration obligations
We do not use your information to make automated decisions that produce legal or similarly significant effects about you.
### Email and how you can stop it
If you sign up for a resource, register for a program or event, or make a purchase, we may add you to our email list. Every email we send includes an unsubscribe link, identifies us as the sender, and gives you a way to contact us — as the CAN-SPAM Act requires. You can unsubscribe at any time, from any email, or by writing to Education@ekrfoundation.org.
**If you are in the EU or UK,** we will only add you to a marketing list if you affirmatively opt in. Consent for marketing is never bundled into a purchase or download.
We do not sell, rent, or lease our email list.
---
## Legal bases for processing (EU and UK visitors)
If you are in the European Economic Area or the United Kingdom, we process your personal data on these bases:
| Purpose | Legal basis |
|---|---|
| Delivering a resource, program, or product you requested | Performance of a contract |
| Processing donations and purchases | Performance of a contract; legal obligation |
| Marketing emails | Your consent |
| Analytics and non-essential cookies | Your consent |
| Site security, fraud prevention, and service improvement | Legitimate interests |
| Tax, accounting, and regulatory records | Legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you may object at any time (see below).
---
## Who we share information with
**We do not sell your personal information, and we do not share it for cross-context behavioral advertising in exchange for money.** We have not done so in the preceding twelve months.
We do share information in these limited circumstances:
**Service providers.** Companies that operate parts of our service under contract and may use your information only to provide it to us. These currently include:
- **Kajabi** — website hosting, course delivery, email, and customer records
- **[Stripe / PayPal]** — payment processing
- **Google** — analytics
- **[Any email, CRM, event, or shipping providers]**
> **[CONFIRM BEFORE PUBLISHING]** Complete this list. Naming your processors is required under GDPR-adjacent transparency expectations and several state laws, and it is simply the honest thing to do.
**Legal and safety.** We may disclose information when we believe in good faith that the law requires it, in response to a court order or lawful request from a government authority, or where necessary to establish or defend legal claims, enforce our terms, or protect the rights and safety of any person.
**Organizational change.** If the Foundation merges, is acquired, restructures, or transfers substantially all of its assets, your information may transfer as part of that. We will require the recipient to honor this policy or notify you of any material change.
**With your direction.** If you ask us to share something — for example, to connect you with a trainer or partner organization — we will.
### Advertising and affiliate arrangements
[We do not receive commissions for promoting third-party products, and we do not pass your information to third parties for that purpose.]
---
## How long we keep information
We keep personal information only as long as we need it:
| Newsletter subscribers | Until you unsubscribe, then removed within 30 days except for a suppression record so we do not email you again |
| Customer and donor records | 7 years, for tax and charitable-reporting purposes |
| Course and certification records | [Duration — often kept longer for credential verification] |
| Contact form and email correspondence | 2 years after the matter is resolved |
| Analytics data | 14 months (Google Analytics 4 default) |
After these periods we delete the information or irreversibly anonymize it.
---
## How we protect information
We use commercially reasonable safeguards, including TLS encryption for data in transit, access controls limiting staff access to what their role requires, and reputable vendors who maintain their own security programs.
No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. **Email in particular is not a secure channel.** Please do not send us payment card details, health information, or other sensitive material by email. If you do, you do so at your own risk.
If a breach occurs that affects your personal information, we will notify you and the relevant authorities as required by applicable law.
---
## International transfers
We are based in the United States, and information you give us is processed here. If you are in the EEA or UK, this means your data is transferred outside your home jurisdiction.
Where we transfer personal data from the EEA or UK to the US, we rely on [Standard Contractual Clauses / the EU-US Data Privacy Framework where our provider is certified] together with supplementary measures as appropriate. You can request a copy of the relevant safeguards by contacting us.
---
## Your rights
### If you are in the EEA or UK
Under the GDPR and UK GDPR you have the right to:
- **Access** the personal data we hold about you
- **Correct** data that is inaccurate or incomplete
- **Delete** your data ("right to erasure")
- **Restrict** how we process your data
- **Object** to processing based on legitimate interests, and to direct marketing at any time
- **Portability** — receive your data in a structured, machine-readable format
- **Withdraw consent** at any time, without affecting the lawfulness of processing before you withdrew it
- **Complain** to your local supervisory authority
We will respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension.
> **[CONFIRM BEFORE PUBLISHING]** If you actively market to or monitor people in the EU, Article 27 of the GDPR generally requires you to appoint an EU representative and name them here. There is a narrow exemption for occasional, low-risk processing. Worth asking counsel which side you fall on, since your policy currently invites EU signups explicitly.
### If you are in California
Under the CCPA/CPRA you have the right to know what personal information we collect and how we use and disclose it; to delete it; to correct it; to opt out of sale or sharing; to limit use of sensitive personal information; and not to be discriminated against for exercising these rights.
We do not sell or share personal information as those terms are defined by the CCPA. We do not use or disclose sensitive personal information for purposes requiring a right to limit.
You may designate an authorized agent to make a request on your behalf; we will ask for proof of authorization.
### If you are in another US state with a privacy law
As of 2026, comprehensive consumer privacy laws are in effect in twenty states, including Colorado, Connecticut, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. These generally give residents rights to access, correct, delete, and port their personal data, and to opt out of targeted advertising, sale, and certain profiling.
**We extend these rights to every visitor, regardless of where you live.** It is simpler, and it is fairer than making your rights depend on your zip code.
> **[NOTE FOR YOUR RECORDS — not for publication]** Most state privacy laws exempt 501(c)(3) nonprofits, but Colorado, New Jersey, Oregon, Delaware, Maryland, and Minnesota either provide no nonprofit exemption or one so narrow it will not cover you. Those states also have data-volume thresholds you may well fall under. Extending rights to everyone, as the policy above does, means you do not have to relitigate this question every time a state amends its law.
### How to exercise your rights
Email **info@ekrfoundation.org** with the subject line "Privacy Request," or write to the mailing address below. Tell us what you want and give us enough information to find your records. We will verify your identity — usually by confirming you control the email address on file — before acting.
We will not charge you, discriminate against you, or reduce the quality of any service because you made a request.
If we decline a request, we will tell you why and how to appeal. **Appeals:** reply to our decision with "Privacy Appeal" in the subject line. We will respond within 45 days. If we deny your appeal, we will provide a link or contact for your state attorney general.
---
## Links to other sites
The Website links to other organizations, resources, and articles. We do not control those sites and are not responsible for their privacy practices. This policy ends where our site does.
---
## Changes to this policy
We will post any changes on this page and update the "Last updated" date at the top. If we make material changes to how we handle personal information, we will notify you by email — to the address we have on file — and by a notice on the Website home page before the changes take effect.
We keep the previous version available on request, so you can see what changed.
---
## Contact us
Questions, requests, or concerns about this policy or your information:
**Elisabeth Kübler-Ross Foundation**
P.O. Box 4517
Scottsdale, AZ 85261
United States
**Email:** info@ekrfoundation.org
If you are in the EEA or UK and are not satisfied with our response, you may lodge a complaint with your national data protection authority.
