GDPR Policy
Last Updated: September 18, 2026
FOR Local Communities (“we,” “us,” or “our”) respects your privacy and is committed to protecting personal information. This GDPR Policy explains how we collect, use, store, disclose, and protect personal data when the European Union (“EU”) or United Kingdom (“UK”) data protection laws, including the General Data Protection Regulation (“GDPR”), apply.
FOR Local Communities is a California-based community organization providing services and resources that may include Enhanced Care Management (ECM), Community Supports, housing-related assistance, and connections to food, transportation, healthcare, and other community resources.
1. Scope of This Policy
This policy applies to personal data collected through our website, online forms, communications, and other interactions where GDPR or similar applicable data protection requirements apply.
Because FOR Local Communities primarily operates in California, GDPR may not apply to every visitor or service interaction. Where GDPR does apply, we process personal data in accordance with applicable data protection requirements.
2. Personal Data We May Collect
Depending on how you interact with us, we may collect information such as:
Name and contact information
Email address and telephone number
Information submitted through website forms
Service inquiries and referral information
Communication preferences
Technical information such as browser type, device information, and IP address
Website usage and analytics information
Information necessary to respond to requests for community services
Other information you voluntarily provide to us
Where appropriate and legally permitted, information related to health, care needs, disability, housing circumstances, or other sensitive matters may constitute special category data and receive additional protections.
3. How We Use Personal Data
We may process personal data to:
Respond to questions and requests
Provide or coordinate community-based services
Process service inquiries and referrals
Communicate with individuals and families
Determine or assist with potential service eligibility
Connect individuals with appropriate community resources
Operate and improve our website and services
Maintain appropriate records
Protect the security and integrity of our systems
Comply with applicable legal and regulatory requirements
We will not use personal data for purposes that are materially incompatible with the purposes for which it was collected unless permitted by applicable law.
4. Legal Bases for Processing
Where GDPR applies, our legal basis for processing personal data may include:
Consent: You have given us permission to process information for a particular purpose.
Contractual necessity: Processing is necessary to provide a service you requested or to take steps at your request.
Legal obligation: Processing is necessary for us to comply with applicable laws or regulatory requirements.
Legitimate interests: Processing is necessary for legitimate organizational purposes, provided those interests do not override your applicable privacy rights.
Vital interests: Processing may be necessary to protect someone's vital interests in limited circumstances.
Where special category personal data is processed, we rely on an additional lawful condition permitted under applicable data protection law.
5. Cookies and Website Technologies
Our website may use cookies and similar technologies for essential website functionality, security, analytics, performance, and other permitted purposes.
Where required by applicable law, non-essential cookies will be used only after obtaining appropriate consent.
You may also be able to manage certain cookies through your browser settings.
6. Sharing Personal Data
We may share personal information when reasonably necessary with authorized service providers, healthcare or community partners, technology providers, professional advisers, government or regulatory authorities, or other parties where permitted or required by law.
Depending on the services involved, this may include Medi-Cal managed care plans and organizations involved in coordinating Enhanced Care Management or Community Supports.
We do not sell personal information simply because you interact with our website.
7. International Data Transfers
FOR Local Communities operates primarily in the United States.
If you access our website from the European Economic Area (“EEA”), UK, or another jurisdiction, your personal information may be processed or stored in the United States.
Where GDPR requires safeguards for an international transfer of personal data, we will use an appropriate lawful transfer mechanism where applicable.
8. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining appropriate records, resolving disputes, and satisfying legal, regulatory, contractual, or reporting obligations.
Retention periods may differ depending on the type of information and the services involved.
9. Your GDPR Rights
Where GDPR applies to you, you may have the right to:
Request access to your personal data
Request correction of inaccurate or incomplete information
Request deletion of personal data in certain circumstances
Request restriction of processing
Object to certain processing
Request data portability where applicable
Withdraw consent where processing is based on consent
Object to certain direct marketing
Lodge a complaint with an appropriate data protection supervisory authority
These rights are subject to exceptions and limitations under applicable law.
10. Exercising Your Rights
To exercise an applicable privacy right, please contact FOR Local Communities using the information below.
We may need to verify your identity before processing certain requests to protect personal information from unauthorized access or disclosure.
We will respond within the timeframe required by applicable law.
11. Children's Privacy
Our services may support children and families in certain circumstances. When personal information concerning children is collected or processed, we take appropriate measures consistent with the nature of the service and applicable privacy requirements.
Where consent from a parent or legal guardian is legally required, we will seek appropriate authorization.
12. Data Security
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, or destruction.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
13. Health Information and HIPAA
Some information handled in connection with our services may also be subject to U.S. healthcare privacy requirements, including the Health Insurance Portability and Accountability Act (“HIPAA”), where applicable.
Where another privacy law provides specific protections or requirements for health information, we will handle such information in accordance with applicable legal obligations.
14. Third-Party Websites
Our website may contain links to health plans, government agencies, community organizations, healthcare providers, or other third-party websites.
Those organizations operate under their own privacy practices. We encourage you to review their privacy policies before providing personal information through their websites.
15. Data Breaches
Where a personal data breach occurs and GDPR applies, we will assess the incident and provide notifications to applicable supervisory authorities and affected individuals when required by law.
16. Complaints
If you have concerns about how we handle your personal information, please contact us so we can review your concern.
Where GDPR applies, you may also have the right to submit a complaint to the data protection authority responsible for your jurisdiction.
17. Changes to This GDPR Policy
We may update this GDPR Policy periodically to reflect changes in our practices, services, technologies, or applicable legal requirements.
Updates will be published on our website with a revised “Last Updated” date.
18. Contact Us
For GDPR, privacy, or personal data requests, please contact:
FOR Local Communities
Email: info@forlocalcommunities.org
Phone: 209-209-3955
Website: forlocalcommunities.org
When contacting us about a privacy request, please provide enough information for us to understand and appropriately respond to your request.