SMS Policy: Our Commitment to Transparent Messaging

Purpose Forward may use SMS (Short Message Service) to communicate with you regarding our services, consultations, updates, or other relevant information. This SMS Policy outlines our practices and your rights concerning these text messages.

By opting into SMS communications from Purpose Forward, you agree to the terms outlined below. Your privacy and communication preferences are important to us.

Legal Compliance Framework

Purpose Forward is committed to full compliance with all applicable privacy and telecommunications laws and regulations. Our SMS messaging practices adhere to the following legal frameworks:

• Canadian Legal Requirements: As a Canadian not-for-profit corporation, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable provincial privacy legislation. We also adhere to the Canadian Radio-television and Telecommunications Commission (CRTC) regulations regarding commercial electronic messages.
• United States Compliance: When providing services to organizations in the United States or sending messages to US phone numbers, we comply with the Telephone Consumer Protection Act (TCPA), Cellular Telecommunications Industry Association (CTIA) guidelines, and Application-to-Person (A2P) 10-Digit Long Code (10DLC) requirements established by The Campaign Registry.
• International Standards: Where applicable, we also consider the General Data Protection Regulation (GDPR) for European contacts and the California Consumer Privacy Act (CCPA) for California residents, ensuring our practices meet the highest international standards for data protection and privacy.

Information We Collect

For the purposes of this SMS Policy, "personal information" refers to any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual.

Types of Personal Information Collected

When you opt into our SMS messaging service, we collect and process the following categories of personal information:

• Contact Information: This includes your mobile phone number, which serves as the primary identifier for our SMS service. We may also collect your name, email address, and organizational affiliation to properly identify you and provide context for our communications.
• Interaction Data: We automatically collect information about your interactions with our SMS messages, including delivery confirmations, read receipts (where available), response messages, and timestamps of all communications. This data helps us ensure message delivery and maintain communication records.
• Device and Technical Information: We may collect technical information about your mobile device, including carrier information, device type, and operating system, to optimize message delivery and troubleshoot any technical issues.
• Authentication Data: For security purposes, particularly when managing One-Time Passwords (OTPs) and secure access links, we may temporarily store authentication tokens and access credentials necessary to provide you with secure access to restricted services.

Sources and Methods of Personal Information Collection

We collect personal information through several methods, all of which require your explicit consent as detailed in our "Consent and Opt-In Procedures" section:

• Direct Opt-In: You may provide your phone number directly through our website forms, during consultation bookings, or when requesting access to our services. All opt-ins require explicit consent through checkboxes or similar confirmation mechanisms at the point of collection.
• Service Integration: When you utilize our services that integrate with specific third-party platforms (such as Microsoft, HappyFox, Wix), we may collect your phone number as part of the service setup process to enable necessary SMS notifications and secure access related to those integrated services.
• Support Requests: When you contact our support team and specifically request SMS notifications for ticket updates or status changes, we collect your phone number as part of the support ticket creation and management process.

How We Use Your Information

Primary Use Cases

Purpose Forward uses your SMS information exclusively for legitimate operational purposes that directly support our mission of helping social purpose organizations. Our specific use cases include:

• Restricted Service Access: We send SMS messages containing secure hyperlinks that provide you with access to restricted services and platforms. These messages are sent when you request access to specific tools, resources, or administrative functions that require authentication. The hyperlinks are time-sensitive and designed to provide secure, one-time access to prevent unauthorized use.
• Support Request Management: We use SMS to send you hyperlinks and updates related to your support requests submitted through our HappyFox ticketing system. These messages keep you informed about the status of your requests, notify you when responses are available, and provide direct links to view ticket updates or provide additional information.
• One-Time Password (OTP) Management: We send OTPs via SMS to provide secure authentication for accessing various services and platforms. These temporary codes are essential for maintaining the security of your accounts and ensuring that only authorized individuals can access sensitive information or perform critical actions.
• Service Notifications: We may send SMS notifications about important service updates, scheduled maintenance, or critical information that requires immediate attention. These messages are strictly operational and are not used for marketing or promotional purposes.

Data Processing and Third-Party Engagement

Operational Data Processing for Service Delivery – No Commercial Sharing

Purpose Forward engages trusted third-party service providers solely for the purpose of processing your SMS-related information on our behalf to facilitate the delivery of our SMS services. We process your SMS-related information only as necessary to fulfill the specific operational purposes for which you have opted in. Crucially, this engagement is strictly limited to necessary operational processing and does not constitute "sharing" or "selling" of your mobile opt-in data with third parties for their independent marketing, advertising, promotional, or any other commercial use.

• Service Providers: We utilize third-party service providers who are essential for sending and delivering our SMS messages (e.g., Microsoft as our SMS gateway provider), providing secure cloud hosting for our systems, and offering technical support related to SMS functions. These providers act as data processors working strictly under our instructions. They are contractually bound to protect your information and use it solely for the specific services they provide to us, on our behalf, and in strict adherence to our privacy standards and this policy. Your mobile opt-in data is not shared with these providers for their own independent purposes.
• Platform Integration Partners: For providing essential services such as secure access links and support notifications, we engage with integration partners like HappyFox (for support ticket management) and Wix (for website backend services) where SMS notifications are relevant. Information is transmitted to these partners only to the minimum extent necessary to enable the requested functionality and service delivery that you have specifically initiated, and they are restricted from using this data for any purpose other than facilitating our service to you.
• Legal and Regulatory Compliance: We may disclose your information if legally required by law, court order, or other governmental requests. We may also disclose information to protect our rights, property, or safety, or the rights, property, or safety of others, including in emergency situations, strictly in accordance with applicable laws.

Our Unwavering Commitment: Mobile Opt-In Data Will NOT Be Shared or Sold for Marketing or Independent Commercial Purposes

Purpose Forward is steadfast in its commitment to protecting your mobile opt-in data. We unequivocally state that we do not sell, rent, lease, or otherwise share your personal information or mobile opt-in data, including your mobile phone number, with any third parties for their independent marketing, advertising, promotional, or any other commercial purposes. Your SMS data will never be used to generate revenue through data sales or marketing partnerships, nor will it be shared with affiliates or other organizations for their independent marketing or promotional activities.

We implement stringent access controls to ensure that only authorized personnel who require access to perform their job functions can view or process your SMS data. We regularly audit access logs and maintain detailed records of all data access activities. Any processing of your data by third parties, as described above, is solely for the direct operational purposes of delivering the SMS services you have consented to, under our control and direction, and absolutely does not constitute "sharing" in the context of commercial transactions or marketing to third parties.

Consent and Opt-In Procedures

Before sending any SMS messages, Purpose Forward obtains your express written consent through clear and unambiguous opt-in procedures. Our consent process includes clear disclosure about the types of messages you will receive, the frequency of messages, and the purposes for which we will use your information. You must actively agree to receive SMS messages by checking a consent box, clicking an agreement button, or responding to a confirmation message. After your initial opt-in, we send a confirmation message to verify your phone number and confirm your consent through a double opt-in process.

Opt-Out Procedures and Your Privacy Rights for SMS Data

Purpose Forward provides multiple convenient methods for opting out of SMS communications and respects your broader privacy rights concerning your SMS data:

SMS Opt-Out Methods:

• Text Message Opt-Out: You can opt out at any time by replying "STOP," "UNSUBSCRIBE," "CANCEL," or "QUIT" to any SMS message you receive from us. Our system will immediately process your opt-out request and send you a confirmation message acknowledging your opt-out.
• Online Opt-Out: You can manage your SMS preferences through our website by logging into your account or using our contact form to request removal from our SMS service.
• Direct Contact: You can contact us directly via email or phone to request removal from our SMS service using the contact information provided at the end of this Policy.

When you opt out, we process requests immediately and automatically, send a confirmation message, and retain a record of your opt-out request to ensure we don't inadvertently re-add you to our SMS list.

Your Privacy Rights Related to SMS Data:

In addition to the right to opt-out of SMS messages, depending on your jurisdiction (e.g., Canada, California, other US states), you may have specific rights regarding the personal information we collect and process through our SMS services. These may include:

• Right to Access: You have the right to request access to the specific pieces and categories of personal information we have collected about you through our SMS services.
• Right to Correction: You have the right to request that we correct inaccurate personal information about you.
• Right to Deletion: You have the right to request the deletion of your personal information collected via SMS, subject to certain exceptions (e.g., to complete a transaction, detect security incidents, or comply with legal obligations).
• Right to Know: For residents of certain US states (e.g., California), you may have the right to know the categories of personal information collected, the categories of sources from which it is collected, the business or commercial purpose for collecting or selling/sharing it, and the categories of third parties to whom the personal information is disclosed.
• Right to Limit Use and Disclosure of Sensitive Personal Information: For residents of certain US states, you may have the right to limit the use and disclosure of your sensitive personal information, if applicable.

To exercise these rights, please follow the instructions in our general Privacy Policy or contact our Privacy Officer using the contact details provided in the "Contact Information and Complaints" section. We will respond to your request within the timeframes and according to the requirements set forth by applicable laws.

Data Security and Protection Measures

Purpose Forward implements comprehensive technical and operational security measures to protect your SMS data:

• Technical Safeguards: All SMS data is encrypted both in transit and at rest using industry-standard encryption protocols. Our SMS systems are hosted on secure, SOC 2 Type II compliant cloud infrastructure with multiple layers of security controls, including firewalls, intrusion detection systems, and regular security monitoring. We implement strict role-based access controls and require multi-factor authentication for all administrative access.
• Operational Safeguards: All employees who handle SMS data receive regular training on privacy and security best practices. We carefully vet all third-party service providers and conduct regular internal and external security audits. We maintain a comprehensive incident response plan for detecting, responding to, and reporting security breaches.

In the unlikely event of a data breach, we will take immediate steps to contain the breach, conduct a thorough investigation, notify affected individuals and regulatory authorities as required by law, and provide appropriate remediation measures.

Data Retention and Deletion

Purpose Forward retains SMS-related personal information only for as long as necessary to fulfill the purposes for which it was collected:

• Retention Periods: During active service use, we retain your information to provide ongoing service and support. After you opt out or discontinue services, we retain information for 12 months to handle follow-up questions and maintain compliance records. We maintain opt-out records indefinitely to honor your preferences.
• Data Deletion: When retention periods expire, we use secure deletion methods that make it technically infeasible to recover deleted information. We require service providers to delete information from their systems when retention periods expire.
• Right to Deletion: You may request deletion of your SMS data by contacting us. We will respond to deletion requests within 30 days, subject to legal retention requirements.

Message Frequency and Content Guidelines

Message frequency varies based on operational needs rather than a predetermined schedule. Most users receive between 1-10 messages per month, depending on service usage and support needs. All messages are professional, relevant, and directly related to our services. We do not send promotional, marketing, or advertising content via SMS.

Standard message and data rates may apply as determined by your mobile carrier. Purpose Forward does not charge additional fees for SMS messages beyond standard service fees.

Contact Information and Complaints

If you have questions, concerns, or requests related to this SMS Privacy Policy, you can contact us:

If you believe Purpose Forward has not complied with this Policy or applicable privacy laws, you may file a complaint with our Privacy Officer or with relevant privacy regulatory authorities, including the Office of the Privacy Commissioner of Canada.