Privacy Policy

Effective Date: May 15, 2026 · Last Reviewed: May 15, 2026 · www.junaidfamilyfoundation.org

Our commitment: The Junaid Family Foundation is dedicated to protecting the privacy and personal information of everyone who visits our website, contacts us, or interacts with us online. We do not sell, rent, trade, or share your personal information with third parties for marketing or advertising purposes. We do not engage in targeted advertising, online behavioral advertising, or retargeting of any kind.

01 — Scope and Introduction

Who we are. The Junaid Family Foundation (“Foundation,” “we,” “us,” or “our”) is an Ohio nonprofit corporation and 501(c)(3) private charitable foundation headquartered at 3900 Park East Drive, Suite 101, Beachwood, Ohio 44122. We operate the website www.junaidfamilyfoundation.org (the “Site”).

What this Policy covers. This Privacy Policy (“Policy”) describes how we collect, use, disclose, retain, and protect personal information in connection with our Site and our online interactions with you. This Policy applies to information we collect: (a) through the Site; (b) in email, electronic messages, or other communications between you and us through the Site; and (c) through any other online means we expressly link to this Policy. This Policy is primarily directed at our online data practices. To the extent we collect personal information from you through offline interactions (such as in-person meetings, telephone calls, or written correspondence unconnected to this Site) we handle such information with the same care and in a manner consistent with this Policy unless a separate privacy notice governs that interaction.

What this Policy does not cover. This Policy does not apply to information collected by us offline or through any other means not expressly linked to this Policy, or to any third-party website, application, or service that may link to or be accessible from the Site. We are not responsible for the privacy practices of third parties and encourage you to review their privacy policies before engaging with them.

02 — Personal Information We Collect

“Personal information” (also referred to as “personal data”) means any information that identifies, relates to, describes, or is reasonably capable of being associated, directly or indirectly, with you as a particular individual. We collect the following categories of personal information and obtain them from the sources identified below.

A. Information you provide directly to us:

Contact and inquiry information. Your name, email address, and the content of any message you submit through our contact or inquiry form.
Records and copies of your correspondence with us if you contact us by email or other electronic means.

B. Information collected automatically as you use the Site:
As you navigate through and interact with our Site, we use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns. We use this automatically collected information to improve our Site and to deliver a better and more personalized experience. These automatic collection technologies help us estimate our audience size and usage patterns, store information about your preferences, and recognize you when you return to our Site. The technologies and the information they collect include the following:

Usage details. Information about how you access and use our Site, including pages viewed, time spent on each page, links clicked, search queries submitted on the Site, clickstream data (the path you follow through the Site), page response times, download errors, and how you arrived at our Site (e.g., from a search engine, a direct URL, or a referring website).
Device and connection information. Your IP address, browser type and version, operating system and version, device type (desktop, mobile, tablet), device language settings, hardware model, and mobile network information.
General location information. General geographic region (country, state, or city level) derived from your IP address. We do not collect precise geolocation data.
Cookies and similar tracking files. Information collected through cookies, web beacons, pixel tags, and similar technologies, as further described in Section 04.

C. Information we may receive from third parties. We may receive personal information about you from other sources and combine that with information we collect directly from you. For example, we may obtain information from service providers that we engage to perform services on our behalf.

D. Information we do not collect. We do not collect or solicit sensitive categories of personal information through our website, including Social Security numbers, financial account or payment card numbers, government-issued identification numbers, health or medical information, biometric data, precise geolocation data, racial or ethnic origin, religious beliefs, or information relating to criminal history. If you inadvertently include such information in a contact form submission, please notify us immediately and we will delete it.

To the extent that any information you voluntarily provide to us, for example, through a contact form message, includes sensitive personal information (such as health or medical information, religious beliefs, or racial or ethnic origin), we will process such information solely to respond to your inquiry and only to the extent necessary to do so. We will not use such information for any secondary purpose without your express consent.

E. Aggregated and de-identified information. We may collect, use, and share information that has been aggregated or de-identified so that it cannot reasonably be used to identify you. Such aggregated or de-identified information is not personal information and is not subject to this Policy.

F. Statistical and technical information. We also collect statistical and aggregated information that does not directly identify any specific individual, such as the percentage of visitors who access particular pages, aggregate usage patterns, and general traffic data. We may also collect technical information about your internet connection, including the resources and features of the Site that you access and use, your download errors, and the length of your visits to certain pages. If we combine or connect any such non-personal statistical or technical data with personal information so that it directly or indirectly identifies an individual, we treat the combined information as personal information subject to this Policy.

03 — How We Use Your Personal Information

We use personal information we collect only for purposes that are reasonably necessary, adequate, and relevant to those purposes, consistent with FTC fair information practice principles and applicable state consumer privacy law data minimization requirements. Specifically, we use your personal information to:

Respond to your inquiries. To read, process, and respond to messages you send through our contact form.
Operate and improve the Site. To understand how visitors use our Site; identify and fix technical problems; analyze usage patterns; improve content, structure, and navigation; estimate our audience size and usage patterns; recognize returning visitors; and deliver a better and more personalized experience to our users.
Ensure security and prevent fraud. To detect, investigate, and prevent potentially fraudulent transactions, security incidents, abuse, and other illegal or harmful activities.
Comply with legal obligations. To comply with applicable federal and state laws, regulations, court orders, and lawful requests from governmental authorities, including our recordkeeping obligations as a registered Ohio 501(c)(3) organization.
Enforce our agreements. To carry out our obligations and enforce rights arising from any agreements between you and us, including our Terms of Use.
Other disclosed purposes. For any other purpose we describe at the time you provide the information, or for any purpose to which you specifically consent.

What we do not do with your information. We do not use your personal information for: targeted advertising or online behavioral advertising; profiling that produces legal or similarly significant effects; selling or renting to third parties; cross-context behavioral advertising; automated decision-making about you without human review; or any purpose incompatible with the purposes described above without first obtaining your consent.

04 — Cookies and Tracking Technologies

This is an informational website, and we do not use a cookie consent banner. When you visit, the following load automatically and may place cookies or similar technologies on your device: Google Analytics (GA4), through the Google Site Kit plugin, which helps us understand how the site is used; embedded YouTube videos, which set cookies when a page loads or a video plays; and our contact form, provided by a third-party service, which sets a cookie to operate the form. We do not use these tools to build advertising profiles or to track you across other sites. Google retains Analytics event data for 2 months and user data for 14 months. If you prefer not to be measured, you can block or delete cookies through your browser settings, install Google’s Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout, and manage Google’s data practices at policies.google.com/technologies/partner-sites.

Web Beacons. Pages of our Site may contain small electronic files known as web beacons (also called clear gifs, pixel tags, or single-pixel gifs) that permit us, for example, to count users who have visited certain pages and to gather related website statistics such as page popularity and system integrity.

Do Not Track (DNT). Some web browsers offer a “Do Not Track” (DNT) feature. Because no industry standard for DNT signals exists, our Site does not currently alter its data collection practices in response to DNT signals. If a recognized DNT standard is established, we will revisit this approach. We honor the Global Privacy Control (GPC) where required by applicable law and technically feasible, as described in Sections 10 and 11.

05 — How We Disclose Your Personal Information

We may disclose aggregated, de-identified, or anonymized information without restriction. We may disclose personal information in the following circumstances:

Subsidiaries and affiliates. To any subsidiaries or affiliates of the Foundation, subject to the same protections described in this Policy. As of the effective date of this Policy, the Foundation has no subsidiaries or affiliates that share or receive personal information collected through this Site.
Service providers.
Legal compliance and governmental requests. To comply with any applicable law, regulation, legal process (such as a subpoena or court order), or enforceable governmental or regulatory request; and to protect the Foundation against legal claims.
Protection of rights and safety. When we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Foundation, our users, or the public, including for purposes of fraud prevention, abuse detection, or cybersecurity.
Business transfers. In connection with, or during negotiations of, any merger, acquisition, asset sale, reorganization, dissolution, or similar transaction, or in the event of insolvency or bankruptcy proceedings, in which personal information held by us is among the assets considered or transferred. We will notify you of any such change and your choices under applicable law.
With your consent. For any other purpose disclosed to you at the time we collect your information, or to which you specifically consent.

Personal information categories we may disclose to service providers: The categories of personal information we disclose, and the categories of recipients to whom we disclose them, are as follows: (a) to service providers (website hosting, analytics, IT support): contact and inquiry information, device and usage information, and analytics/cookies data; (b) in connection with legal compliance or governmental requests: contact and inquiry information and any other information required by the legal process; (c) in connection with a business transfer: all categories of personal information held at the time of the transaction; and (d) with your consent: only the specific information you authorize us to disclose. We do not disclose sensitive personal information to any third party because we do not collect it through our Site.

We do not sell your personal information. We do not sell, rent, trade, license, or otherwise transfer your personal information to any third party for that party’s own marketing, advertising, or commercial benefit. We are not a data broker and do not participate in data broker marketplaces.

06 — How We Protect Your Personal Information

We implement commercially reasonable administrative, physical, and technical security measures designed to protect personal information against accidental loss or destruction and against unauthorized access, use, alteration, or disclosure. Our security measures include: (a) encrypted transmission of data over the internet using HTTPS/TLS; (b) access controls restricting personnel access to personal information on a need-to-know basis; (c) vendor due diligence requirements for our third-party service providers; and (d) periodic review of our security practices.

No method of transmission over the internet or method of electronic storage is completely secure. While we use commercially reasonable efforts to protect your personal information, we cannot guarantee its absolute security. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Site.

Breach notification. In the event of a data breach involving personal information, we will notify affected individuals and any required authorities in accordance with applicable law. This includes, without limitation, compliance with the following: Ohio’s data breach notification statute (Ohio Rev. Code § 1349.19); any applicable state breach notification law based on your state of residence; and, where applicable, GDPR Article 33-34 breach notification requirements for EEA/UK residents.

07 — How Long We Retain Your Personal Information

We retain personal information only for as long as reasonably necessary to fulfill the purpose for which it was collected, including responding to inquiries and maintaining records required by law. When personal information is no longer needed, we securely delete or anonymize it. Unless a longer retention period is required or permitted by applicable law, we apply the following criteria in determining retention periods:

The nature and sensitivity of the personal information and the potential risk of harm from unauthorized use or disclosure;
The purposes for which we process the personal information and whether we can achieve those purposes through other means;
Applicable legal, regulatory, tax, accounting, or other record-retention obligations; and
Whether retention is necessary to resolve disputes, enforce our agreements, or establish, exercise, or defend legal claims.

We keep contact-

08 — Children’s Privacy

COPPA compliance. Our Site is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. The Children’s Online Privacy Protection Act (“COPPA”), 15 U.S.C. §§ 6501 et seq., and the FTC’s COPPA Rule, 16 C.F.R. Part 312, prohibit online collection of personal information from children under 13 without verifiable parental consent. We do not engage in any such collection.

If you are under 13 years of age, you are not permitted to use or provide any information on this Site, submit any contact form inquiry, or provide any information about yourself, including your name, address, telephone number, or email address. If you are under 13, please do not use or access this Site at any time or in any manner.

Broader minor protections. As a best practice consistent with the majority of state consumer privacy laws that classify minors’ personal data as sensitive, we do not knowingly collect personal information from anyone under the age of 18 for use in targeted advertising, profiling, or personal data sales.

If you believe we have inadvertently collected personal information from a child under 13, or from a minor under 18 for any restricted purpose, please contact us immediately at info@junaidfamilyfoundation.org. We will take prompt steps to delete such information from our records.

09 — Third-Party Services, Links, and Embedded Content

Our Site may contain links to third-party websites and may embed third-party content or functionality (such as social media sharing buttons or embedded video). This Policy applies solely to information collected by us through our Site. Clicking on a third-party link will direct you away from our Site. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party website, application, or service.

When third parties (including Google LLC for analytics) use automatic collection technologies on our Site, the information they collect may be associated with your personal information or they may independently collect information, including personal information, about your online activities over time and across different websites and online services. We do not control these third parties’ tracking technologies or how they may be used.

These third parties may use tracking technologies to collect information about you when you use our Site. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites, applications, and other online services. If you have questions about an advertisement or other content provided by a third party on our Site, please contact that third party directly. We are not responsible for any third party’s privacy practices or content.

We strongly encourage you to review the privacy policies of any third-party website or service you visit through links on our Site before providing any personal information. Our providing a link does not imply endorsement of that website or service.

10 — Your Choices and Opt-Out Mechanisms

We provide the following mechanisms through which you can exercise meaningful choices about how we collect and use your personal information:

Cookies and tracking technology. You can set your browser to refuse all or some browser cookies, to delete cookies that have already been placed, or to alert you before cookies are sent. Most browsers include instructions in their Help menu. Please note that disabling cookies will not meaningfully restrict your use of our Site, though some features may not function as expected.
Google Analytics opt-out. You can opt out of Google Analytics data collection by installing the Google Analytics Opt-Out Browser Add-on, available free of charge at tools.google.com/dlpage/gaoptout. This add-on instructs Google Analytics not to transmit information about your visit to Google Analytics servers.
Email communications. If you receive email communications from us and no longer wish to do so, you may opt out by contacting us at info@junaidfamilyfoundation.org or by following any unsubscribe instructions included in the message.
Global Privacy Control (GPC). We recognize GPC signals and honor them where required by applicable law and technically feasible. Because we do not sell or share personal information for targeted advertising purposes, a GPC signal at this time primarily results in adjustment of non-essential analytics cookie practices where legally required.
Withdrawing consent. Where our processing of your personal information is based on your consent, you may withdraw consent at any time by contacting us at info@junaidfamilyfoundation.org. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Location information. Our Site derives your general geographic region from your IP address through Google Analytics. We do not collect precise geolocation data. If you wish to prevent even general geographic inference, you may use a VPN or opt out of Google Analytics as described above. Note that doing so will not affect your ability to use the Site.

11 — Your State Privacy Rights

Certain U.S. state privacy laws provide residents with specific rights regarding their personal information. Depending on your state of residence, these rights may include the right to know what personal information we collect and how we use it, the right to request access to or deletion of personal information, the right to correct inaccurate personal information, and the right to opt out of certain processing where applicable. We do not sell or share personal information, and we do not engage in targeted advertising. We take a harmonized approach and extend the following rights to all users regardless of state of residence, to the extent practicable and legally required:

Right to know and access (confirmed processing and data access). You may request that we confirm whether we process your personal information and, if so, provide you with a copy of the personal information we hold about you, including the categories collected, the purposes for processing, and the categories of third parties to whom we disclose it.
Right to correction. You may request that we correct inaccuracies in your personal information, taking into account the nature of the information and our processing purposes.
Right to deletion. You may request that we delete personal information we hold about you. We will comply unless we are required to retain the information to comply with a legal obligation, to resolve a dispute, to enforce an agreement, to complete a transaction you requested, or as otherwise permitted by applicable law.
Right to data portability. Where technically feasible and required by applicable law, you may request your personal information in a structured, commonly used, and machine-readable format.
Right to opt out of sales, targeted advertising, and profiling. We do not sell personal information, use it for targeted advertising, or engage in profiling that produces legal or similarly significant effects. These opt-out rights therefore do not currently apply to our practices, but we will honor any such requests.
Right to non-discrimination. We will not discriminate against you for exercising any of your privacy rights described in this Policy. We will not deny services, charge different prices, or provide a different level of service based on your exercise of privacy rights.

Important: The exact scope of these rights varies by state, and there are exceptions where we may not have an obligation to fulfill your request. For example, we may decline to delete personal information that we are required to retain by law, that is necessary to complete a transaction, or that is needed to detect security incidents or protect against fraud or illegal activity. We will always explain the basis for any denial.

How to submit a request. To exercise any of the rights above, please submit a verifiable request to us by: (1) emailing info@junaidfamilyfoundation.org; or (2) writing to us at Junaid Family Foundation, Attn: Privacy, 3900 Park East Drive, Suite 101, Beachwood, Ohio 44122. Please include your full name, email address, the right you wish to exercise, and sufficient information for us to verify your identity, which may include asking you to confirm information we already have on file or providing a signed declaration under penalty of perjury. We will only use personal information provided in a request to verify the requestor’s identity or authority to make the request.

To exercise these rights, email info@junaidfamilyfoundation.org. Requests are handled by our Executive Director and website team, and we will respond within 45 days.

Response timing. We will acknowledge receipt

Appeals. If we decline to take action on your request, you may appeal our decision within a reasonable time by contacting us at info@junaidfamilyfoundation.org with the subject line “Privacy Rights Appeal.” We will respond to your appeal within the period required by applicable law and inform you of any action taken or not taken and the reasons for our decision. If your appeal is denied, you may contact your state attorney general’s office to submit a complaint.

Alternative dispute resolution. If you are not satisfied with our response to a privacy inquiry or complaint, you may also submit a complaint to a recognized independent dispute resolution body. As a registered 501(c)(3) organization, the Foundation is committed to transparency and accountability in all privacy matters, and we take all complaints seriously.

GPC signals. We honor GPC browser-based opt-out signals where required by applicable law and technically feasible, including in states such as Colorado and California. Because we do not sell personal information or use it for targeted advertising, honoring a GPC signal means we will adjust non-essential cookie practices where legally required and treat GPC as an opt-out of any covered processing.

12 — Visitors Outside the United States

The Foundation is based in the United States, and any information you provide is processed and stored here. As a US private foundation, we are generally not subject to the California Consumer Privacy Act or comparable state laws, and, based on how this site operates, we do not believe the EU or UK GDPR applies to us. Even so, and wherever you are located, you may ask us to access, correct, or delete the personal information you have given us, and we will respond within one month. Email info@junaidfamilyfoundation.org.

13 — Ohio and State-Specific Considerations

The Foundation is incorporated in Ohio and subject to Ohio law. The following Ohio-specific legal provisions are relevant:

Federal Trade Commission Act (15 U.S.C. § 45). The FTC serves as the primary federal regulator for consumer privacy under its authority to prohibit unfair or deceptive business practices. We design our privacy practices to be consistent with FTC fair information practice principles, which include notice, choice, access, and security. We do not make any material misrepresentations in this Policy and do not engage in practices that are unfair or deceptive within the meaning of FTC Act Section 5.
Ohio Data Protection Act (Ohio Rev. Code §§ 1354.01 et seq.).
Ohio Personal Information Security Breach Notification Act (Ohio Rev. Code § 1349.19). Ohio law requires notification to affected individuals and, in certain circumstances, to the Ohio Attorney General in the event of a breach of the security of personal information. We comply with these notification obligations.
Ohio charitable solicitation registration. As an Ohio-registered charitable organization, we comply with the Ohio Attorney General’s charitable solicitation registration requirements, which include certain disclosure obligations.

Residents of the following states that have enacted comprehensive consumer privacy laws may have additional rights under those laws where they apply, and we voluntarily extend the rights described in Section 11 of this Policy: California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia, among others. Most of these laws do not apply to the Foundation, either because it is a nonprofit organization or because we do not meet the applicable thresholds. Nonetheless, as a matter of good practice, we honor these rights for all users on a harmonized basis, to the extent practicable.

14 — Changes to This Policy

We may update this Policy from time to time to reflect changes in our privacy practices, our Site, applicable law, or other factors. When we make changes, we will: (a) revise the “Effective Date” and “Last Reviewed” dates at the top of this page; (b) post the updated Policy on our Site; and (c) where changes are material, provide additional notice such as a prominent notice on our Site’s homepage or, if we have your email address and the change materially affects your rights, notify you by email before the change takes effect. We encourage you to review this Policy periodically. Your continued use of our Site after we post changes constitutes acceptance of the revised Policy.

Material changes to this Policy will apply prospectively to personal information collected after the effective date of the change. Personal information collected prior to a material change will continue to be governed by the version of this Policy in effect at the time of collection, unless you expressly consent to the new terms.

We will archive prior versions of this Policy and make them available upon written request so that you have a clear record of what practices were in effect when your information was collected.

TCT: The contact form is served by a third-party provider (its cookie was observed on the live Site). Confirm the provider’s identity, that a written data processing or service agreement is in place, and where form submissions are stored and for how long. This bears directly on this disclosure and on the 24-month retention statement above.

TCT: Confirm actual practice matches these periods. (1) Are contact-form messages in fact purged within 24 months? Inbox messages that sit indefinitely would contradict this. (2) Does the Google Analytics property’s configured data-retention setting match the stated figure? GA4 default is 2 or 14 months depending on configuration.

TCT: Confirm the Site does something technically observable in response to a Global Privacy Control signal, or soften to “where required and technically feasible.”

TCT: “Login credentials” implies user accounts, but nothing else in the documents indicates the Site has any. If there are no accounts, delete this reference (and the parallel username/password language in the Terms). If accounts are planned, disregard.

TCT: Threshold note. The Foundation is a 501(c)(3) nonprofit. The CCPA (which reaches only a for-profit “business”) and most state comprehensive privacy laws do not apply to it; the few that can reach nonprofits (e.g., Colorado, Oregon, New Jersey) apply only above processing thresholds this Site is unlikely to meet. We have reframed this as voluntary, good-practice compliance. Confirm that is the intended posture. Note that once published these commitments become enforceable representations under FTC Act Section 5 and Ohio’s Consumer Sales Practices Act.

TCT: Confirm the Foundation has the staffing to meet these commitments (10-business-day acknowledgment, 45-day response, formal appeals). If not, resource the function or relax the language. These timelines are enforceable once published.

TCT: The Ohio Data Protection Act safe harbor is an affirmative defense available only to an organization that maintains a written cybersecurity program conforming to a named framework (e.g., NIST, ISO 27001). We softened the claim. To assert the safe harbor, the Foundation must actually create, maintain, and document such a program; otherwise the statement gives no protection and is itself a representation.

Questions, Requests, or Complaints?

If you have questions, comments, or concerns about this Privacy Policy or our privacy practices, wish to exercise your privacy rights, or wish to submit a complaint, please contact us by any of the following means:

Junaid Family Foundation

Attn: Executive Director – Privacy Inquiries
3900 Park East Drive, Suite 101
Beachwood, Ohio 44122

Email: info@junaidfamilyfoundation.org

Phone: (216) 777-3921

Website: www.junaidfamilyfoundation.org

To register a formal privacy complaint or concern that has not been resolved to your satisfaction through the contact information above, you may contact the Ohio Attorney General’s Consumer Protection Section at 30 E. Broad St., 14th Floor, Columbus, Ohio 43215, or by calling 800-282-0515.