Effective Date: January 1, 2025

 Table of Contents

• New Policy Changes
• Overview
• Policy Scope
• Our Data Processing Activities
• Your Privacy Rights
• How to Submit a Privacy Request
• Data Retention
• Data Security
• Changes To Our Policy
• Cookie Addendum

 

New Policy Changes

No changes made since the Policy Effective Date listed above.

Overview

Delaware Valley Municipal Management Association (collectively, “Delaware Valley Trusts,” “DVT” or “us” or “we” or “our”) owns and manages the website https://dvtrusts.com  (“Site”) for purposes of providing risk sharing pools for Pennsylvania and Delaware public entities and related services (collectively, the “Services”). To perform the Services, we may need to collect “personal information” of individuals through our Site. “Personal information” generally refers to information that can directly or indirectly be used to identify an individual or, in some cases, an individual’s household. Personal information does not generally include data that is anonymized / de-identified or publicly available. This Privacy Policy (“Policy”) describes how we collect, use, share, retain, and otherwise process your personal information.

If you have any questions about this Policy or wish to submit a privacy request or complaint, please contact us at:

Email: privacy@dvtrusts.com
Phone: (267) 803-5725
Mail: 719 Dresher Road, Horsham, PA 19044
Attention: General Counsel

This Policy is incorporated into and governed by our Terms of Use.

IF YOU DO NOT AGREE WITH ANY ASPECT OF THIS POLICY, PLEASE DO NOT ACCESS OR USE THE SERVICES OR OTHERWISE PROVIDE US WITH YOUR PERSONAL INFORMATION. YOUR CONTINUED USE OF OUR SERVICES SIGNIFIES YOUR ACCEPTANCE OF THIS POLICY. IF YOU LEARN OF A POTENTIAL VIOLATION OF THIS POLICY BY US OR AN OUTSIDE PARTY, PLEASE CONTACT US.

Policy Scope

The Services and this Policy applies to individuals residing in the United States who are 18 years of age or older and/or, to the extent applicable, minor dependents of DVT “online account members” (as defined below). If you are not 18 years of age or older or if you are a minor dependent and have not obtained the consent of your parental guardian, you are NOT permitted to access or use the Services. If you learn that anyone younger than 18 has unlawfully provided us with personal information, please contact us, and we will take steps to delete such information. Additionally, this Policy only applies to personal information that we, or our service providers or partners, collect from you through the Services.

Please note that this policy does not cover any separate disclosures required under federal sectorial privacy laws, such as HIPAA. To the extent that such privacy disclosures are required, they will be provided separately to individuals in accordance with applicable laws and regulations.

We may link to third-party services (including social media services) and/or external websites (“Third Parties”) on our Site. However, we do not own nor control these Third Parties, and we are not responsible for the content or privacy practices of such Third Parties on their sites or applications, including their level of data sharing with other third parties. Additionally, we are not responsible for the data processing practices of the internet browser servicer you choose to use when accessing our Site. Such Third Parties and internet browser servicers may have their own privacy policies, and you should consult those policies accordingly before using or going to their websites or apps.

Our Data Processing Activities

To provide the Services, we collect personal information from individuals who visit our Site (“web-users”). We may also collect personal information from individuals acting on behalf of our DVT member organizations and, if applicable, their underlying insured, if they registered for an online account on our Site (collectively, “online account members”). For information on the personal information we collect, use, and share from our web-users and online account members, please see the below tables. For information on our online tracking activities on our Site, please see our Cookie Addendum.

Personal Information We Collect About You

 Table 1: Personal information collected and purposes of collection for web-users

Information Type	Source	Purpose
Name and contact information (e.g., phone number, email, & name of employing organization)	Directly from the individual	·    To respond to inquiries ·    To provide insurance services to member organizations ·    To provide information on our services ·    To provide our newsletter (only if you sign up) ·    To facilitate our events or trainings (only if you sign up)
Communications made between DVT and the individual		·    To respond to individual inquiries
Business information of public organization representatives who apply for DVT membership including name, business phone and email, title, and signature.	Directly from the individual	To process your employing organization’s DVT member application
Device and Site activity information	Indirectly from the individuals’ interactions with our Site	Please see our Cookie Addendum

 Table 2: Personal information collected and purposes of collection for DVT online account members

Information Type	Source	Purpose
Any personal information collected from our web-users. See Table 1 above for further information.	See Table 1 above	·  See Table 1 above
Information on employees acting on behalf of DVT member organizations collected through the respective DVT online account member portal including name, business contact information, and log-in details.	Directly from the individual	·    To provide insurance services to participating member organizations and, if applicable, underlying insured individuals
If applicable, information on underlying insured individuals connected to DVT member organizations that are collected through the respective DVT online account member portal.	Directly from the individual or from the DVT member organization	·    To provide insurance services to participating member organizations and, if applicable, underlying insured individuals

General Purposes

Any personal information described in Tables 1 and 2 above may also be processed for the following “General Purposes”:

• To provide member / IT support;
• To maintain our Site;
• To comply with legal, law enforcement, and/or government requirements or requests;
• To ensure the safety of our employees;
• To monitor for fraud or illegal activity;
• To exercise our legal rights;
• To run our day-to-day business and facilitate corporate or other business transactions; and
• For our document retention / data storage purposes.

Sensitive Personal Information We Collect About You

We do not knowingly collect sensitive personal information from our web-users. To the extent that you choose to provide us with your sensitive personal information, you expressly consent to our processing of this information in accordance with this Policy.

We may collect the following sensitive personal information from our account members through our online trust portals: health information of underlying insured and/or staff members of DVT member organizations, which is used and/or shared for purposes of providing insurance services. We will obtain your consent directly, or require your member organization to obtain your consent, prior to collecting your sensitive personal information.

Personal Information Recipients

In order to provide the Services, we may need to share your personal information with the categories of third parties described in the table below.

Table 3: Categories of third parties who may receive your personal information

Recipient Type	Personal Information Type	Purpose
Web developers	·     Your activity on our Site ·     Information that you provide to us through the Site	·     To maintain, support, and protect our Site
Direct marketing mailing providers	·     Your name and contact information (e.g., phone number, email, & name of employing organization)	·    To provide our newsletter and/or other direct marketing materials to you
Online claims management platform / electronic records management providers	·     Your activity on the online account member portal that is accessible on our Site ·     Information that you provide through the online account member portal	·    To assist DVT in providing claims management services to participating member organizations and their underlying staff members ·    To provide value add services to online account members
DVT member organizations	·     Personal information, including health information, of underlying insured may be shared with DVT Member Organization, but only to the extent permitted under applicable laws	·    To provide insurance services to participating member organizations and, if applicable, underlying insured individuals
Healthcare Providers (for DVT Health Trust services only)	·     Health plan information of underlying insured	·    To provide insurance services to participating member organizations and underlying insured individuals

General Recipients

The following third parties may receive any and/or all personal information listed in Tables 1 and 2 in certain instances:

• Data storage providers – to provide document retention / data storage services;
• IT software, platform, and/or support service providers – to provide IT software, maintenance, and/or support services;
• Law enforcement, government authorities, and/or judicial bodies – in the event of a legal requirement, inquiry, or investigation; and
• Potential purchasers of DVT – in the event there could be a change in our ownership status.

Other Processing Activities- Email Newsletters and DVT Events

Individuals can consent to receiving the DVT newsletter to stay up to date with DVT news and services by directly signing up to receive the newsletter on our Site. Individuals can later “opt out” or “unsubscribe” to our newsletter at any time by clicking on the unsubscribe link located at the bottom of any of our emails or by otherwise contacting us. If individuals sign up to attend DVT events and trainings, DVT will process such personal information for purposes of facilitating the event and/or training. By signing up for DVT newsletters, events, and/or trainings, you expressly consent to DVT processing your personal information in accordance with this Policy.

Your Privacy Rights

Depending on where you reside, you may have certain rights or choices that allow you to make requests with respect to your personal information (subject to applicable legal exceptions) including rights and/or choices to:

• Obtain confirmation that we accessed and processed your personal information;
• Obtain details about how we collect, use, and share your personal information;
• Access a copy of your personal information in a portable format;
• Obtain a list of the categories of third parties to which we have disclosed your personal information;
• Delete your personal information, (unless an exception under law applies);
• Correct your personal information;
• Opt out of the sale of your personal information or targeted advertising based on your browsing behavior before and after you visit our Site (DVT does not sell or share personal information for targeted advertising purposes);
• Opt-out of any processing of your personal information for the purposes of creating a profile based on your interests or behavior which is used in such a way that would produce legal ramifications or similarly significant real-world effects on you (DVT does not engage in any profiling activities);
• Submit an appeal to us if we initially reject your privacy request;
• Submit a complaint to your applicable State Attorney General or regulatory authority; and/or
• Not have discriminatory action taken against you for exercising your rights.

Sale of Personal Information / Sharing of Personal Information for Targeted Advertising

We do not sell and/or share your personal information or share your personal information for targeted advertising purposes.

Profiling / Automated Decision-making

We do not process your personal information for purposes of creating a profile about you based on your interests or behavior and you will not be subject to decisions that will have a significant impact on you based solely on automated decision-making unless we have a lawful basis for doing so and we have notified you.

How to Submit a Privacy Request

If you would like to exercise any of the above rights (“Privacy Request”), please contact us. We will not discriminate against you for exercising your rights under privacy laws. Further information on the steps needed to complete your Privacy Request are detailed below.

Step 1: Verifying your Request.

Before we can fulfill your Privacy Request, we need to (i) verify your identity or your authority to make the request (if you are submitting a Privacy Request as an agent) and (ii) confirm that the personal information you are requesting belongs to you.

For most requests, we will ask you to provide information that matches at least two pieces of personal information we store about you before responding to your Privacy Request. If you would like to request specific pieces of personal information that we have collected, or if you would like us to delete highly sensitive personal information, you will need to match at least three pieces of information we store about you, and you must provide a signed declaration under penalty of perjury that you are the consumer whose personal information you are requesting. If you have a password-protected account with us, we may use our existing authentication procedures to verify your identity, however, you are not required to have an account with us to make a Privacy Request.

We may refuse any request if we are unable to verify the identity of the person making the request or if we cannot authenticate the legitimacy of the request using commercially reasonable efforts. Under such circumstances, we may follow up with you for additional information as reasonably necessary to authenticate your request. We will only use personal information provided in a verifiable Privacy Request to verify the requestor’s identity or authority to make the Privacy Request.

Authorized Agents

You may grant an authorized agent written permission to submit Privacy Requests, but we may deny requests from authorized agent if we are unable to verify your identity directly as the subject of the personal information at issue. To verify a Privacy Request from an authorized agent, we may require proof that you gave the authorized agent signed permission to submit the Privacy Request, such as by requiring you to directly confirm with us that you provided permission for the authorized agent to submit your Privacy Request, and/or we may ask you to verify your identity directly with us.

Step 2: Responding to your Privacy Request.

After verifying your identity, we will respond to your request by either fulfilling your Privacy Request or explaining why we are denying your Privacy Request. The timeframe in which we respond will vary based on the applicable law where you reside. If we deny your Privacy Request, you may have the option under applicable law to appeal this decision by contacting us. If you are concerned with the result of your appeal, you may have the right to contact your State Attorney General or applicable data protection authority.

Deletion Requests

Please note that for deletion requests, any removal of content by us does not ensure or guarantee complete or comprehensive removal in all places. The content may have been shared or reposted by other parties who act outside of any business relationship with us or may not cooperate with our request for them to delete your personal information, or federal or state law may require maintenance of the content or information. We will do its best to accommodate your Privacy Request, but we cannot guarantee we can remove all personal information from the specified uses. Therefore, please be as specific as possible in your Privacy Request. If the Privacy Request relates to information that we need to provide Services to you, you may not be able to use the Services properly moving forward. We reserve the right to maintain proper business records as required by law, or for otherwise legitimate business purposes to the extent permitted by law, even if such records contain your personal information.

Data Retention

We retain personal information as needed to complete the Services or for other legitimate purposes such as ensuring security of our data and systems, complying with our legal obligations, complying with tax, audit, or other books and record policies, resolving disputes, and conducting internal investigations, and enforcing our agreements or other legal rights. Due to the different purposes for retaining your personal information, the actual retention timeframes may vary depending on the type of personal information we collect from you and the purposes for which we use your personal information. If we determine that your personal information is no longer needed for the purposes described above, it will be deleted or anonymized so that it can no longer be attributed to you. Our collection times will be consistent with applicable law. Please note that residual copies of your personal information may be removed from backup systems subject to our backup data retention schedule.

Data Security

We have implemented technical and organizational measures to address the risk of loss, misuse, alteration, or unauthorized disclosure of personal information under our control. We limit access to your personal information to those employees, agents, contractors, and other third parties who have a need to know such information to provide the Services or in instances where disclosure is necessary in special cases, such as a physical threat to you or others, as permitted by applicable law. We require that such third parties only process your personal information to provide services to us or to implement security measures keep your information confidential and secure.

While we have employed security technologies and procedures to assist in safeguarding your personal information, no system or network can be guaranteed to be 100% secure, and we cannot guarantee that the information you send over the internet is fully secure. You should exercise discretion in what information you disclose and/or transmit through our Site. The transmitted information may be intercepted by others before it reaches us. Please note that e-mail communications sent through the non-account areas of our Site are not encrypted. If you are concerned about sending information to us over the Internet, please send the information by mail or call us to make other arrangements. We are not responsible for the security of information transmitted online. Likewise, when you click on Third Party links from our Site, we cannot control the security measures used on such Third-Party sites or applications. If you have an account with us, you are responsible for maintaining the secrecy of your log in credentials and account information, and for controlling access to your email account and any electronic communications from us.

Changes To Our Policy

We reserve the right to change this Policy at any time. Since this Policy may change as we modify or expand our Services or to comply with changes in applicable laws, we suggest you check back from time to stay informed of such changes. Any substantive changes to this Policy will be described in the New Policy Changes section of this Policy for a period of thirty (30) days. Our Policy’s effective date will always be set forth at the beginning of the Policy. Any changes will be immediately incorporated into this Policy and will be prospective only. We will not make any changes that have retroactive effect unless legally required to do so. Your continued use of the Services after any changes are made to this Policy constitutes your acceptance of the changes. If any changes are unacceptable to you, you should cease all use of the Services. We will not collect new types of personal information beyond what is disclosed in this Policy without providing you notice prior to the collection of that personal information. We will not use your personal information for an unexpected purpose beyond what is disclosed in this Policy without first providing you notice of such change by sending a notice to the email address you provided us and/or by posting a new a revised Policy with a new “Last Updated” date and, to the extent required under law, obtaining your consent.

 

COOKIE ADDENDUM

This Cookie Addendum describes what kinds of cookies and other online tracking technology Delaware Valley Trusts (collectively, “DVT” or “us” or “we” or “our”) uses on its website https://dvtrusts.com (“Site”). For general information on the types of personal information we collect, and our processing activities more generally, please see our main Policy.

Site Tracking Technologies

Cookies

Cookies are small text files containing data that can be used to identity your device. When you visit a particular website, the cookie is filed to a folder within your browser so that when you visit the website in the future, the website will recognize your device and, depending on the type of cookie being used, will perform different activities when you interact with the website. Cookies can be developed by the website owner themselves (“first party cookies”) or another external party (“third party cookies”). Cookies can be used for different purposes including: (i) maintaining the general functioning of a website (“Essential Cookies”), (ii) personalizing a web-user’s experience on a website by remembering their website preferences (“Personalization Cookies”), (iii) analyzing a web-users’ interactions with a website to provide information on the website’s performance (“Analytical Cookies”), and (iv) using information about a web-user’s website interactions for marketing purposes (“Marketing Cookies”).

We use the following cookies on our Site: Essential Cookies and Personalization Cookies. We do not employ first party or third party Analytical or Marketing Cookies on our Site.

You can opt out of Personalization Cookies on our Site through your browser by changing your browser cookie settings to block/delete the cookies by going to the browser settings page (see Chrome, Safari, Firefox, & Internet Explorer). If you are using any other web browser, please visit your browser’s official support documents.

Tracking Pixels

A tracking pixel is a tiny invisible image embedded within a website that can be used gather information about your device and browser. We do not use tracking pixels on our Site.