1. Introduction and Scope

1.1 Effective Date and Commitment to Privacy

The HIVE CENTER FOR THE BOOK ARTS (“HIVE Center,” “we,” “us,” or “our”) is deeply committed to protecting the privacy and confidentiality of the personal information entrusted to us by our students, clients, donors, members, website visitors, and community partners. This Comprehensive Privacy Policy outlines our procedures and protocols regarding the collection, use, processing, storage, and disclosure of personal data gathered through our physical operations at 1408 SEWARD ST, EVANSTON, IL 60202-2131, our primary website (hctba.site), related digital services, and all educational, professional, and fundraising activities. This Policy is effective as of [Insert Date, e.g., November 1, 2024] and supersedes any previously published privacy statement. We recognize that the trust of our community is paramount, and just as we uphold the highest standards of craftsmanship in our book arts, we uphold the highest standards of privacy and data security in our digital and administrative practices. This document is intended to be transparent, detailed, and comprehensive, reflecting our dedication to ethical data stewardship in compliance with applicable local, state, and national regulations governing data privacy and protection, establishing clear expectations for all users interacting with the HIVE Center’s services.

1.2 Defining the HIVE Center and Data Context

The HIVE Center operates as a non-profit educational and cultural organization. Our core activities that involve the collection and processing of personal data fall into three distinct categories: (a) Educational Services, which includes the registration, scheduling, payment, and delivery of our workshops and classes in bookbinding, letterpress, and paper arts; (b) Professional Bindery Services, which involves managing client relationships for custom commissions, archival restoration projects, and fine art editions, necessitating data related to project specifications, delivery, and invoicing; and (c) Community Engagement and Fundraising, which covers membership drives, donations, email newsletters, and event participation. Each of these functions requires a different type and volume of personal data, and this Policy addresses the specific measures and assurances applied to each context. Our data processing is always aligned with our organizational mission: to preserve and promote the art of the book through education, practice, and community engagement, ensuring that data processing remains proportionate, necessary, and relevant to achieving these core institutional objectives while respecting individual privacy rights at every stage of the data lifecycle.

2. Information We Collect and the Rationale for Collection

2.1 Categories of Personal Data Collected

We collect various types of information necessary to fulfill our service commitments, administer our educational programs, and communicate effectively with our stakeholders. This data can be broadly categorized as follows:

2.1.1. Registration and Enrollment Data: This information is mandatory for participating in any HIVE Center educational program. It includes the student’s full legal name, physical home address (necessary for mailing materials or certificates), primary email address (for communication regarding class changes, materials lists, and digital resources), and telephone number (for urgent class cancellation notifications). For youth programs, we collect the parent or guardian’s name and contact details, along with the child’s age for appropriate placement and safety protocols. Payment details, such as credit card information, are collected but are not stored directly on our servers; they are processed securely through accredited third-party payment processors who maintain PCI DSS compliance. We also collect emergency contact information, which is solely used in the event of an incident during an in-person workshop.

2.1.2. Transactional and Commission Data: For clients engaging our professional Custom Bindery Services, we collect specific information required to execute the contract and manage the specialized project. This includes the client’s billing name and address, project delivery address, detailed project specifications (which may include descriptions or photographs of the commissioned item or the antique book needing restoration), and detailed payment history. Because custom book arts often involve high-value transactions, we retain this data for historical record-keeping, warranty claims, and future reference regarding the materials and techniques used in the specific commission, which is crucial for subsequent repairs or appraisals.

2.1.3. Donor and Membership Data: For individuals who support the HIVE Center through donations or paid memberships, we collect the name, donation amount, and preferred method of contact (email/postal mail) to fulfill our legal obligation to issue tax receipts and to acknowledge contributions appropriately. Donor records are strictly managed and are not shared outside of authorized fundraising and accounting personnel. We also collect information on preferred membership levels and benefits utilized to ensure accurate service delivery commensurate with the membership tier selected.

2.1.4. Technical and Behavioral Data: When you visit our website (hctba.site), we automatically collect certain technical data using cookies, web beacons, and similar tracking technologies. This includes your IP address, browser type and version, time zone setting, operating system, and platform. Behavioral data is collected to understand how you navigate and interact with our website, such as pages viewed, time spent on pages, click paths, and referring links. This technical data is primarily aggregated and anonymized to help us monitor website performance, identify popular programs, troubleshoot technical issues, and improve the user experience, ensuring our digital services are accessible and efficient.

2.2 Voluntary Information and Consent

In certain circumstances, you may voluntarily provide us with additional information beyond what is strictly necessary. This may include survey responses about your satisfaction with a recent workshop, unsolicited testimonials about our services, or demographic information (e.g., artistic background, prior experience level) provided during optional course registration fields. By submitting this voluntary information, you provide us with explicit consent for its use in accordance with the specific context in which it was provided, such as for internal market research or for publication (with your explicit written permission) on our website for promotional purposes. We ensure that any such voluntary data is handled with the same stringent security and confidentiality protocols applied to mandatory personal information.

3. How and Why We Use Your Information

3.1 Fulfillment of Core Services and Contractual Obligations

The primary purpose for processing your data is to fulfill the specific services you have contracted us to provide.

3.1.1. For Educational Services: We use your Registration Data to enroll you in the specified workshop or class, manage the class roster, communicate required materials and prerequisites, process tuition payments, and issue completion certificates. We also use contact information to communicate any critical changes, such as a last-minute instructor change or severe weather closure, ensuring the seamless and safe delivery of the educational program you purchased.

3.1.2. For Professional Bindery Services: We use your Transactional Data to prepare detailed estimates and invoices, manage the production schedule for your custom commission, track the precise materials used (e.g., specific leather dyes or archival paper stock), manage delivery logistics, and communicate status updates regarding the restoration or binding process. This use is strictly governed by the contractual agreement established upon acceptance of our project proposal.

3.2 Internal Operations and Continuous Improvement

We use collected data for critical internal purposes essential for the effective operation of a non-profit arts organization and educational center. We analyze aggregated, non-identifiable data concerning class attendance rates, geographic distribution of our student body, and trends in workshop popularity to inform our curriculum planning and resource allocation. For example, if we see a significant increase in demand for advanced marbling techniques, we use that data to schedule more frequent workshops and ensure our studio is adequately stocked with necessary pigments and tools. Transactional data helps our finance team with budgeting, financial reporting, and compliance with non-profit accounting standards. This internal use is entirely focused on operational efficiency and improving the overall quality and relevance of the HIVE Center’s offerings to the community.

3.3 Communication and Marketing (Legitimate Interest and Consent)

We use your contact information to maintain ongoing communication about the HIVE Center’s mission and activities.

3.3.1. For Newsletters and Updates: With your explicit consent (opt-in), we use your email address to send our regular electronic newsletters, which include information about new workshop schedules, exhibition openings, special events, and announcements regarding our efforts in cultural preservation. You maintain the right to withdraw this consent at any time through the ‘unsubscribe’ link provided in every electronic communication.

3.3.2. For Fundraising and Mission Support: As a non-profit organization, we have a legitimate interest in soliciting financial support to sustain our operations and fund scholarship programs. We use Donor Data to communicate our mission’s impact, send fundraising appeals, and provide tax documentation. We carefully balance this legitimate interest against your fundamental rights, always providing clear opt-out mechanisms for any postal or electronic appeals.

4. Legal Basis for Processing Personal Data

Our legal justifications for processing your personal data adhere to the principles required by major data protection frameworks, including the European Union’s General Data Protection Regulation (GDPR), which often serves as the global benchmark for privacy compliance. We rely on the following distinct legal bases:

4.1. Contractual Necessity: This is the legal basis for processing data required to enter into, or perform, a contract with you. This applies directly to all data processed for class enrollment (e.g., managing registration, receiving payment, providing class access) and for custom binding or restoration contracts (e.g., invoicing, project management, delivery logistics). Without processing this essential data, we would be unable to provide the service or product you have purchased.

4.2. Legitimate Interests: We process certain data when it is necessary for the legitimate interests pursued by the HIVE Center or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. Examples include: (a) Using technical data for fraud prevention and ensuring the security of our website and systems; (b) Conducting internal analysis and aggregated reporting to improve our educational curriculum and service quality; and (c) Sending mission-based fundraising appeals to past donors or members, provided we offer a simple mechanism to opt out of such communications.

4.3. Consent: We rely on your explicit, affirmative consent for specific, non-essential processing activities, primarily for: (a) Sending you our marketing newsletters and promotional emails about new workshops; (b) Publishing your testimonial or photographs of your work on our website or in promotional materials; and (c) Collecting and processing any sensitive personal data (e.g., health information related to a specific accessibility request for a physical workshop). Where consent is the legal basis, you have the absolute right to withdraw it at any time, and we will cease the relevant processing promptly.

4.4. Legal Obligation: In rare cases, we process personal data where it is necessary to comply with a legal obligation to which the HIVE Center is subject. This includes retaining financial records for tax and accounting purposes as mandated by U.S. federal and state law, or responding to a valid legal process, such as a court order or subpoena.

5. Data Sharing and Disclosure to Third Parties

The HIVE Center does not sell, rent, or trade any personal data to third parties for commercial gain. We only share or disclose information in the limited circumstances described below, and we impose strict contractual obligations on all third parties to protect your data and only process it for the specified, limited purpose.

5.1. Service Providers: We engage trusted third-party companies and individuals to perform functions and provide services necessary for our operations. These Service Providers act as data processors on our behalf. Examples include: (a) Payment Processors (e.g., Stripe, PayPal) for tuition and commission payments; (b) Email Service Providers (e.g., Mailchimp, Constant Contact) for sending our newsletters and transactional emails; (c) Web Hosting Providers for maintaining our website infrastructure; and (d) Accounting Software providers for financial record-keeping. These providers are only given access to the information necessary to perform their specific tasks and are contractually prohibited from using the data for any other purpose, maintaining the confidentiality and security of your personal information in alignment with this Policy.

5.2. Legal Compliance and Protection: We may disclose your personal data if we are required to do so by law or in the good faith belief that such action is necessary to: (a) Comply with a legal obligation or a governmental request; (b) Protect and defend the rights or property of the HIVE Center; (c) Act in urgent circumstances to protect the personal safety of users of the Service or the public; or (d) Protect against legal liability or fraud. This disclosure is always executed with due consideration for legal proportionality and the preservation of privacy rights.

5.3. Business Transfers: In the event the HIVE Center undergoes a merger, acquisition, or sale of assets, personal data may be transferred as part of the transaction. We will ensure that the receiving entity agrees to adhere to the standards set forth in this Privacy Policy, and we will notify you via email or a prominent notice on our website of any change in ownership or uses of your personal data, as well as any choices you may have regarding your personal data.

6. Cookies and Tracking Technologies

6.1. Definition and Use of Cookies

Our website, hctba.site, uses “cookies” and similar tracking technologies (like web beacons and pixels) to enhance your experience, analyze site usage, and support our internal operations. A cookie is a small text file placed on your device by a web server when you access our site. These files are essential for optimizing our service delivery, remembering your preferences, and providing the necessary technical functionality.

We utilize several types of cookies: (a) Necessary Cookies, which are essential for you to navigate the website and use its features, such as accessing secure areas or managing your enrollment cart; (b) Performance Cookies, which collect anonymous data on how visitors use our website (e.g., which pages are most popular, if they encounter error messages) to help us improve its structure and performance; and (c) Functionality Cookies, which remember choices you make (such as language preference or region) to provide enhanced, personalized features. We do not use intrusive third-party advertising cookies, reflecting our focus on mission-driven educational and cultural services rather than consumer advertising.

6.2. Managing and Refusing Cookies

You have the right to decide whether to accept or reject cookies. You can exercise your preferences by modifying the settings in your web browser. Most browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. However, if you choose to reject cookies, please be aware that this may affect the availability and functionality of some features on our website, particularly those related to secure enrollment and transactional processes. To learn how to manage your cookie preferences, consult your browser’s help documentation. We are committed to honoring Do Not Track (DNT) signals where technically feasible and will provide clear information regarding the impact of refusing our functional cookies on your ability to utilize all HIVE Center online services.

7. Data Security and Retention

7.1. Data Security Measures

The HIVE Center takes the security of your personal data extremely seriously. We implement robust and commercially reasonable physical, electronic, and administrative security measures designed to protect your information from unauthorized access, loss, misuse, alteration, or destruction. Our security controls include: (a) Encrypting data transmission using Secure Socket Layer (SSL/TLS) technology for all payment and registration forms; (b) Implementing access controls and strong password policies, limiting access to personal data to only those employees and contractors who require it to perform their job duties (e.g., the Programs Manager needs enrollment data, but the Lead Instructor only needs class rosters); (c) Utilizing firewalls, intrusion detection systems, and regular security audits of our data processing environment; and (d) Ensuring that all physical records containing personal information (such as paper enrollment forms or bindery contracts) are stored in locked, access-controlled facilities within our Evanston premises. While we strive to use acceptable means to protect your personal data, we acknowledge that no method of transmission over the Internet or method of electronic storage is 100% secure, and therefore, we cannot guarantee its absolute security.

7.2. Data Retention Policy

We will retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. The duration of retention is determined by several factors:

7.2.1. Contractual Obligation: Data related to class enrollment and custom commissions is retained for a period of up to seven (7) years after the completion of the service, to comply with tax and audit requirements and to handle any potential contractual disputes or warranty claims related to the bespoke binding work.

7.2.2. User Relationship: If you are an active member or subscriber to our newsletter, we retain your contact data until you explicitly request deletion or unsubscribe from our services.

7.2.3. Legitimate Interest (Historical/Archival): Donor and sponsorship records are retained indefinitely, as this information is essential for the HIVE Center’s historical institutional memory and is crucial for public and internal archival purposes related to the history and funding of our non-profit mission. This data is often anonymized or aggregated where possible to minimize privacy impact.

Once the retention period expires, we securely destroy or permanently anonymize the data to ensure that it cannot be reconstructed or traced back to you.

8. Your Data Protection Rights

Depending on your jurisdiction and the nature of our interaction, you may possess specific rights regarding the personal data we hold about you. The HIVE Center is committed to facilitating the exercise of these rights, which may include:

8.1. The Right of Access (or Right to Know): You have the right to request confirmation as to whether we are processing personal data concerning you, and if so, access to the personal data and specific information regarding the purposes of processing, the categories of personal data concerned, the recipients to whom the personal data has been or will be disclosed, and the planned retention period.

8.2. The Right to Rectification (Correction): You have the right to obtain the correction of inaccurate personal data we hold about you and to have incomplete personal data completed, including by providing a supplementary statement. We ask that you notify our Programs Manager promptly via email should your contact information change (e.g., change of address or primary email).

8.3. The Right to Erasure (Right to Be Forgotten): In certain circumstances (e.g., the data is no longer necessary for the purpose for which it was collected, or you withdraw consent), you have the right to request the deletion of your personal data. We will honor this request unless we have a compelling legitimate interest (e.g., legal or tax compliance) to retain the data, in which case we will inform you of the grounds for refusal.

8.4. The Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data under certain conditions, such as if you contest the accuracy of the data or the lawfulness of the processing, allowing the data to be stored but not processed further until the dispute is resolved.

8.5. The Right to Object: You have the right to object to the processing of your personal data when processing is based on our legitimate interests (e.g., fundraising appeals or marketing). If you object, we will cease processing the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

8.6. The Right to Data Portability: You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and have the right to transmit that data to another controller without hindrance from us, where technically feasible and where processing is based on consent or contract.

To exercise any of these rights, please submit a written request via email to info@hctba.site, clearly indicating the right you wish to exercise and providing sufficient information for us to verify your identity and locate your records. We commit to responding to all verifiable requests within thirty (30) days of receipt, ensuring the process is handled with professionalism and transparency, reflecting our institutional respect for individual privacy autonomy.

9. Children’s Privacy (Adherence to COPPA)

The HIVE CENTER FOR THE BOOK ARTS is proud to offer educational programming specifically designed for youth, including those under the age of 13. However, we strictly adhere to the requirements of the U.S. Children’s Online Privacy Protection Act (“COPPA”) regarding the collection of personal information from children under 13 years of age.

9.1. Parental Consent: We do not knowingly collect personal information online from children under 13 without verifiable parental consent. For any youth enrollment, the online registration form specifically requires the parent or legal guardian to provide their own contact information and to affirmatively consent to the collection of the child’s name, age, and any emergency contact details necessary for the physical safety and administration of the in-person class.

9.2. Limited Data Collection: For children under 13, the only information collected is strictly limited to that necessary for the administration and safety of the educational service (e.g., the child’s first name for a class roster and the parent’s contact/emergency information). We do not market to children under 13, nor do we collect persistent identifiers (like cookies) for behavioral tracking or targeted advertising purposes related to this demographic. If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will promptly take steps to delete that information from our servers. Parents who believe we may have collected information from their child under 13 without consent may contact us immediately at info@hctba.site.

10. International Data Transfers

The HIVE CENTER FOR THE BOOK ARTS is based in Evanston, Illinois, United States. While our primary services are delivered locally, our website and data infrastructure may utilize servers and service providers located globally. If you are accessing our services or submitting personal data from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your home jurisdiction.

By using our services, enrolling in our programs, or providing us with any personal data, you acknowledge and consent to this transfer, processing, and storage of your information in the United States. Where we transfer personal data to recipients outside of the United States, we take appropriate measures to protect your information, typically by entering into standard contractual clauses (SCCs) or other legally recognized safeguards to ensure that the data recipient provides an adequate level of protection consistent with this Privacy Policy and applicable data protection laws.

11. Changes to This Privacy Policy

The landscape of data privacy is constantly evolving, and the HIVE Center for the Book Arts reserves the right to update or change this Comprehensive Privacy Policy at any time to reflect changes in our practices, services, or legal requirements. We will notify you of any material changes by revising the “Effective Date” at the top of this Policy and, where appropriate and feasible, by sending a notification email to our registered users or by placing a prominent notice on our website homepage. We encourage you to periodically review this Policy to stay informed about how we are protecting the personal information we collect. Your continued use of the HIVE Center’s services and website after any changes to this Privacy Policy constitutes your acceptance of those changes.

12. Contact Information and Dispute Resolution

12.1. Exercising Your Rights and General Inquiries

If you have any questions, concerns, complaints, or comments regarding this Comprehensive Privacy Policy, our data processing practices, or wish to exercise any of your data protection rights detailed in Section 8, please do not hesitate to contact our administrative team. All official communications regarding data privacy should be submitted in writing.

Primary Privacy Contact (Administrative Office): HIVE CENTER FOR THE BOOK ARTS Attention: Programs Manager / Privacy Inquiry 1408 SEWARD ST EVANSTON, IL 60202-2131 Email: info@hctba.site

12.2. Dispute Resolution and Supervisory Authority

We are committed to resolving any privacy-related disputes or concerns efficiently and professionally. If you feel that the HIVE Center has not handled your data or your privacy request appropriately, we encourage you to contact us directly using the details provided above to allow us the opportunity to resolve the issue internally. Should you remain dissatisfied with our response, you retain the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. For residents within the European Economic Area (EEA), you can find the contact information for your local Data Protection Authority (DPA) online. We commit to cooperating fully with any regulatory bodies as required by law to ensure the fair and transparent resolution of all data privacy complaints, upholding the ethical standards expected of a trusted cultural and educational institution.