Privacy Policy

Who we are

The Telluride Science & Innovation Center (“Telluride Science,” “we,” “our”) is a nonprofit organization based in Telluride, Colorado. This policy describes how we collect, use, store, and share information through our facility rental system at rentals.telluridescience.org.

What we collect

When you submit a rental inquiry or sign a rental agreement, we collect:

• Contact and identity: name, email address, phone number, mailing address, and the organization you represent (if any).
• Event details: the type of event, expected attendance, requested dates and times, and any notes you provide.
• Signing information: when you sign a rental agreement electronically, we capture your drawn signature image, the IP address you signed from, and your browser’s user-agent string. We are required to keep these to comply with the federal E-SIGN Act, which makes your electronic signature legally binding.
• Insurance certificates: if your contract requires it, the Certificate of Insurance document you upload.
• Payment information: we do not see or store your credit card number. Card payments are processed by our payment provider, Stripe, which has its own privacy practices.
• Walkthrough records: photos or notes from the post-event walkthrough used to decide damage-deposit returns.

We do not use analytics or tracking cookies on the public pages. The only cookies we set are session cookies for Telluride Science staff to sign into the staff dashboard.

Why we collect it

• To review your rental request and contact you about it.
• To create a legally binding rental agreement.
• To schedule your event on our facility calendar and arrange post-event cleaning.
• To invoice you and process payment.
• To verify insurance coverage where required by the rental agreement.
• To return your damage deposit fairly after the event.
• To resolve any disputes that may arise about the rental.

We do not sell your information, share it for marketing, or use it to build advertising profiles.

Who else sees it

A small number of third-party service providers process information on our behalf so the rental system can work:

• Google — we send emails through Gmail and create rental and cleaning events on Google Calendar. We also use Google Maps and Places to help you autocomplete addresses on the inquiry form.
• Stripe — our payment processor; handles credit-card transactions securely. We never see or store your card number.
• Aplos — our accounting platform; receives payment records (your name, email, and amount) for bookkeeping. It does not process card payments.
• Fly.io — hosts the rental application and stores our data on encrypted disks in the United States.
• Backblaze — receives encrypted backups of our database so we can recover from a disaster.

We share information with these providers only as needed to deliver the service. We do not give them permission to use your information for their own purposes.

We may also disclose information when required by law (for example, in response to a valid subpoena).

How long we keep it

We keep records of completed rentals — including the signed agreement, invoice, and supporting documents — for seven (7) years after the event date. This matches U.S. Internal Revenue Service guidance for business records and gives us time to resolve any tax, insurance, or legal questions that come up later.

Inquiries that are denied or never become signed agreements are kept for a shorter period (typically one to two years) and then deleted.

Encrypted backups follow the same retention schedule and are pruned automatically.

How we protect your information

• All connections to this site use HTTPS encryption.
• Our database and uploaded files are stored on encrypted disks.
• Backups are encrypted at rest and in transit.
• Access to the staff dashboard is restricted to verified Telluride Science employees signed in with their @telluridescience.org Google accounts.
• We log staff actions for accountability (an internal audit log).

No system is perfectly secure. We take reasonable measures appropriate for the kind of data we handle.

Your rights

You can ask us to:

• Show you what information we have about you.
• Correct anything that is wrong.
• Delete your information, except records we must keep by law (e.g., a signed agreement and its invoice, which we keep for the 7-year period above).

To make a request, email cindy@telluridescience.org. We will respond within 30 days.

For California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you specific rights about your personal information. In addition to the rights described above, you have the right to:

• Know what categories of personal information we collect, the sources we collect it from, the purposes we use it for, and the third parties we share it with. Those details are listed in the “What we collect,” “Why we collect it,” and “Who else sees it” sections above.
• Request a copy of the specific pieces of personal information we have collected about you.
• Delete personal information we have collected, subject to legal exceptions (e.g., a signed rental agreement and its invoice, which we are required to keep).
• Correct inaccurate information.
• Opt out of the sale or sharing of personal information. We do not sell your personal information and we do not share it for cross-context behavioral advertising. There is nothing to opt out of.
• Limit the use of sensitive personal information.We do not use the sensitive personal information we collect (such as your signature) for any purpose beyond what is described in this policy.
• Non-discrimination. We will not deny you services, charge you a different price, or provide a different level of service because you exercised your CCPA rights.

To exercise any of these rights, email cindy@telluridescience.org. We may need to verify your identity before we respond. You may also authorize an agent to make a request on your behalf.

For residents of the European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

If you are in the EEA, the UK, or Switzerland, the General Data Protection Regulation (and its UK equivalent) gives you specific rights about your personal data. For the purposes of these laws, Telluride Science is the data controller.

Legal basis for processing. We rely on:

• Contract — to handle your inquiry, create and fulfill a rental agreement, invoice you, and return your damage deposit.
• Legal obligation — to keep records (signed agreements, invoices) for tax and accounting purposes, and to capture the IP and browser at signing to comply with the U.S. E-SIGN Act.
• Legitimate interests — to operate the rental system, prevent fraud and abuse (e.g., the rate limiter on the inquiry form), and keep an internal audit log.

Your rights. You may:

• Request access to your personal data.
• Request that we correct inaccurate data.
• Request that we erase your data (the “right to be forgotten”), subject to records we are required to keep.
• Request that we restrict or object to certain processing.
• Request that we provide your data in a portable format.
• Withdraw consent at any time where we relied on consent.
• Lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner’s Office (ICO). In the EEA, it is the supervisory authority in your country of residence.

To exercise any of these rights, email cindy@telluridescience.org.

International transfers. Telluride Science and our service providers (Google, Stripe, Aplos, Fly.io, Backblaze) are located in the United States. If you submit information to us from outside the United States, your information will be transferred to and processed in the United States, which may have different data-protection laws from your country. Where required, we rely on the European Commission’s Standard Contractual Clauses (or the equivalent UK mechanism) for these transfers.

Children

Our rental system is for adults arranging facility rentals on behalf of themselves or an organization. We do not knowingly collect information from anyone under 18. If you believe a minor has submitted information through this site, please email us and we will remove it.

Changes to this policy

If we make material changes to this policy, we will update the “Last updated” date at the top and, where appropriate, notify renters with active agreements by email.

Contact

Questions about this policy or a privacy request: cindy@telluridescience.org.

Telluride Science, 501(c)3 Tax ID#: 74-2369040

Telluride Science & Innovation Center, PO Box 2429, 300 S. Townsend, Telluride, CO 81435