Effective date: May 1, 2026
Organization: Exchange Press (“we,” “us,” or “our”)
Website: exchangepress.com

Exchange Press is a program of Dimensions Educational Research Foundation, a 501(c)(3) nonprofit based in the United States. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website, online store (powered by WordPress and WooCommerce), event registration pages (together, the “Services”). For questions, contact us at info@exchangepress.com, +1 (800) 221-2864, or by mail: 7700 A Street, Lincoln, NE 68510, USA.

Note: We process only occasional, small-scale personal data from individuals in the EU/UK and do not process special-category data or data relating to criminal convictions/offenses.

1) Information We Collect

  1. a) Information you provide
  • Accounts & profiles (e.g., name, email, password, organization/role, contact details).
  • Orders, donations & registrations via WooCommerce (e.g., items selected, billing/shipping details, email/phone). Payment card data is handled by our payment processor(s); we do not store full card numbers on our servers. Our site may include products/donations/registration listings and merchandise.
  • Communications (emails, forms, event applications, surveys, support requests).
  • Newsletter sign-ups (we obtain consent to receive marketing emails at subscription).
  1. b) Automatically collected
  • Usage & device data (IP address, device/browser, pages viewed, timestamps, referrer).
  • Cookies and similar technologies to keep you logged in, remember preferences, enable cart/checkout, measure site performance, deliver and measure advertising, reduce fraud, and improve content (see Cookies, Analytics & Advertising below).  We do not use behavioral advertising, cross-site tracking,  or third-party advertising networks. We do not profile users for targeted advertising purposes. 
  1. c) From third parties
  • Payment processors (transaction status, fraud-prevention signals).
  • Email/communication and analytics providers (aggregate metrics).
  • Shipping and address-verification services (when applicable).
  • Advertising partners (see Cookies, Analytics & Advertising).

2) How We Use Information

We use personal information to:

  • Provide, secure, and improve the Services (including WordPress/WooCommerce functionality).
  • Process memberships, orders, donations, event registrations, refunds, and support.
  • Send transactional messages (receipts, account notices) and—with consent or as permitted—send newsletters and updates.
  • Analyze engagement and improve content and performance.
  • Enforce policies; protect against fraud and security incidents; comply with legal obligations.
  • We use personal information to analyze engagement and improve content and performance. We use email marketing and CRM tools to understand how visitors and subscribers interact with our website and communications. 
  • Deliver, personalize, and measure advertising on our site and across the web, and to understand our audience (see Cookies, Analytics & Advertising). We do not use behavioral advertising, cross-site tracking, or third-party advertising networks. We do not profile users for targeted advertising purposes. 

3) Lawful Bases for Processing (EU/UK Visitors)

Where the EU GDPR or UK GDPR applies, we rely on:

  • Contract (to deliver requested Services, registrations, orders/donations).
  • Consent (certain emails; analytics/non-essential cookies where required; publishing directory entries when consent is the chosen basis; ads personalization and measurement in the EEA/UK/CH where required).
  • Legitimate interests (operate and improve our programs; secure the Services; prevent fraud; limited outreach to existing participants, balanced against your rights).
  • Legal obligation (tax, accounting, compliance).

We conduct only occasional, small-scale processing of EU/UK personal data and do not process special categories or criminal-related data.

4) Sharing of Information

We share information with:

  • Service providers/processors supporting our website, store, event registration, payments, email, analytics, hosting, security, advertising, and IT—under contracts requiring appropriate safeguards and limited use.
  • Event/program partners as needed to fulfill registrations or co-hosted activities (disclosed when applicable).
  • Legal/safety (to comply with law, subpoenas, or protect rights, property, and safety).
  • Organizational changes (e.g., nonprofit reorganization/merger), consistent with this Policy.

We may disclose, share, or sell your mailing address to third-party organizations, including nonprofit and for-profit partners, for fundraising, marketing, and outreach purposes. In some jurisdictions, this may be considered a “sale” or “sharing” of personal information. We do not sell or share email addresses or other personal information. Where required by law, you may opt out of such sale or sharing at any time. 

5) International Transfers

We are located in the United States; your information may be processed in countries with different data-protection laws. For EU/UK data, when required we use Standard Contractual Clauses with processors and adopt appropriate supplementary measures. Given our small-scale, occasional EU/UK processing and absence of special/criminal data, we do not appoint an EU/UK representative at this time.

6) Cookies, Analytics & Advertising

We (and approved providers) use cookies and similar technologies to run essential site features, remember preferences, measure traffic, deliver and measure advertising, and improve our Services. We do not use behavioral advertising, cross-site tracking, or third-party advertising networks. We do not profile users for targeted advertising purposes. 

  1. a) Types of cookies/technologies
  • Strictly necessary (e.g., login/session, cart/checkout, security/fraud prevention).
  • Analytics/performance (e.g., to understand how the site is used and improve it).
  • Advertising (e.g., to limit repeats, measure performance, and understand audiences). 
  1. b) Your choices
  • EEA/UK/CH visitors: Where required, we obtain your consent before using cookies/identifiers for analytics and measurement. If we participate in the IAB Transparency & Consent Framework (TCF v2.2), your choices will be shared with participating vendors to respect your preferences.
  • U.S. residents: Some states provide rights to opt out of “sale” or “sharing” of personal information and/or targeted advertising. If our use of advertising cookies and similar technologies constitutes “sale,” “sharing,” or targeted advertising under applicable law, you may exercise your rights via our “Do Not Sell or Share My Personal Information” process (see Section 10(b)). We also honor Global Privacy Control (GPC) signals where required.
  • Browser controls: You may block or delete cookies via your browser. Essential features may not function without necessary cookies.
  • Industry tools: You may opt out of interest-based advertising with participating companies via industry tools (e.g., the DAA WebChoices page). These opt-outs are browser-specific and may rely on cookies to remember your choice.

7) Data Retention

We retain information only as long as needed for the purposes described or as required by law. Illustrative periods:

  • Orders/donations/registrations: retain financial records for 7 years (or as required by law).
  • Accounts/memberships: retained while active, then deleted or anonymized after a defined period.
  • Directory entries: retained until you update or request removal.
  • Security logs: retained for a limited period for security and troubleshooting.

8) Security

We use administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption in transit (HTTPS), access controls, regular updates to WordPress, WooCommerce, and plugins, and least-privilege practices. No method of transmission or storage is fully secure; we cannot guarantee absolute security.

9) Your Rights

  1. a) EU/UK data subject rights

When GDPR/UK GDPR applies, you may have the right to access, rectify, erase, restrict or object to certain processing (including direct marketing), and data portability. Where processing is based on consent, you may withdraw consent at any time. Contact info@exchangepress.com. 

  1. b) U.S. state privacy rights and opt-outs

Some U.S. state laws provide consumer rights (e.g., access, deletion, correction). Where applicable, we will honor your requests consistent with those laws.

Do Not Sell or Share My Personal Information / Targeted Advertising Opt-Out: If you are a resident of a U.S. state that provides this right (e.g., California), you may opt out of the sale or sharing of personal information and/or targeted advertising by emailing info@exchangepress.com with the subject line “Privacy Request.” We also honor Global Privacy Control (GPC) signals where required by law.

  1. c) Email and marketing choices

You can unsubscribe from non-transactional emails via the link in the email or by contacting us. We will continue to send essential transactional messages (e.g., receipts, order updates, account notices).

10) Children’s Privacy

Our Services are not directed to children under 13 (or under 16 in the EU/UK). We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us to request deletion.

11) Third-Party Services and Plugins

Our Services run on WordPress, WooCommerce, ActiveCampaign, and HubSpot and may also use additional plugins/integrations (e.g., payment processors, form builders, security, analytics, email services, and advertising partners). We use email marketing and customer relationship management (CRM) tools to understand how visitors and subscribers interact with our website, emails, and other communications. These third parties process personal information to provide their features; we recommend reviewing their privacy notices.

12) Payment Processing

Payments/donations/registrations are handled by third-party payment processors that comply with industry standards. We receive only the information necessary to confirm/fulfill transactions (e.g., tokenized payment data, status). For full card details and security practices, see the applicable processor’s privacy notice.

13) Do Not Track

Browsers may offer a “Do Not Track” (DNT) signal. Our Services do not respond to DNT signals. We honor legally required consent/opt-out mechanisms where applicable, including Global Privacy Control (see Section 10(b)).

14) Changes to This Policy

We may update this Privacy Policy from time to time. The “Effective date” above shows when it was last revised. Material changes will be posted on this page and, if appropriate, communicated by email or on-site notice.

15) Contact Us

Exchange Press
7700 A Street, Lincoln, NE 68510 USA
+1 (800) 221-2864 (toll-free in the US) | +1 (425) 883-9394 (main)
info@exchangepress.com