Privacy Statement

The protection of TPM members is a primary privacy and security priority of The Prepared Majority.

TPM treats member identity, membership status, contact information, applications, internal records, internal communications, and other personally identifiable member information as non-public information.

TPM applies the following principles to member information:

• Need to know
• Least privilege
• Minimum necessary access
• Minimum necessary disclosure
• Purpose limitation
• Secure handling and storage
• Individual accountability for access

When TPM has discretion regarding access to or disclosure of member information, protecting the privacy, safety, and security of the member shall take priority over administrative convenience, organizational position, publicity, or unnecessary information sharing.

TPM seeks to collect only information reasonably necessary to operate the TPM Network, communicate with individuals, administer membership, provide requested services, protect the Network, and carry out legitimate organizational activities.

TPM uses collected information only for legitimate organizational purposes, including:

• Responding to questions and requests.
• Helping visitors locate the appropriate TPM Area.
• Communicating with prospective members.
• Administering TPM's recruitment and membership processes.
• Routing inquiries to the appropriate TPM organizational level.
• Providing authorized information about TPM activities, programs, resources, training, and events.
• Processing authorized membership-related transactions.
• Maintaining and improving TPM's website and services.
• Protecting TPM members, applicants, systems, information, and infrastructure.
• Detecting or investigating fraud, abuse, misuse, security incidents, or unauthorized activities.
• Maintaining records necessary for legitimate organizational operations.
• Meeting applicable legal obligations.

Information collected for one purpose shall not be used for an unrelated purpose without an appropriate organizational basis, the individual's authorization where appropriate, or a legal requirement. Submitting an inquiry or application does not automatically establish membership in TPM or guarantee acceptance into the organization.

The TPM website may use a ZIP code, city, state, or other limited geographic information to identify the appropriate TPM Area associated with a visitor's location.

Geographic information may be used to:

• Identify the applicable TPM Area.
• Present relevant Area information.
• Route an inquiry to the appropriate TPM contact when requested.
• Support legitimate administration of TPM's geographic organizational structure.

TPM should not require precise GPS location information for a standard ZIP-code-based Area lookup. A ZIP code or location lookup by itself does not establish that an individual is a TPM member.

TPM uses a selective membership and recruitment process administered primarily at the TPM Area level.

Prospective-member and applicant information shall receive privacy protection comparable to member information.

Information collected during recruiting, application, vetting, or membership administration shall not become generally accessible throughout TPM simply because the information exists within a TPM system. Access is limited according to the individual's authorized responsibilities.

TPM shall not publicly identify a person as a member or applicant merely because the individual has contacted, applied to, participated with, or joined TPM.

Member information is restricted, non-public information.

Access is permitted only when an authorized individual has a legitimate organizational need to know the information to perform a specific assigned responsibility.

Access to member information shall be based on: Need to know + least privilege + minimum necessary access.

Holding a leadership, administrative, technical, or other position within TPM does not automatically entitle an individual to unrestricted access to member information.

Access shall be limited to:

• The specific information required.
• The members for whom the authorized individual has responsibility.
• The appropriate organizational level.
• The authorized purpose.
• The period during which access is legitimately required.

The technical ability to access information does not constitute authorization to access or use that information.

Because TPM operates through Areas, States, Regions, and the National Network, personally identifiable member information should normally remain at the lowest organizational level reasonably necessary.

Organizational seniority alone does not create an unrestricted right to personally identifiable member information.

TPM membership rosters are restricted and non-public.

TPM shall not make its membership roster publicly searchable or publicly available.

TPM does not sell, rent, trade, or commercially distribute membership lists.

An individual's membership status shall not be confirmed to an unauthorized person or outside organization solely because that information has been requested.

Internal access to rosters remains subject to TPM's need-to-know and minimum-necessary requirements.

Individuals authorized to access systems containing protected member information shall use their own assigned credentials. Credentials shall not be shared.

Where technically supported and appropriate to the system, TPM should implement security controls including:

• Individual user accounts
• Multifactor authentication
• Role-based access control
• Least-privilege permissions
• Strong authentication
• Secure credential management
• Access logging
• Administrative activity logging
• Periodic access review
• Prompt revocation of unnecessary access

Access to sensitive systems should be removed when an individual's authorized responsibility ends.

TPM systems containing sensitive member information should maintain sufficient records, where technically feasible and appropriate, to determine:

• Who accessed protected member information.
• When access occurred.
• Which systems or records were accessed.
• Significant changes made to protected information.
• Changes to access permissions.
• Significant administrative actions.

Security and access records should themselves be protected against unauthorized access, alteration, or deletion. Individuals authorized to access protected information are accountable for using that access only for legitimate TPM purposes.

Member and applicant information shall not be accessed or used:

• Out of curiosity.
• For personal purposes.
• For unauthorized commercial activity.
• For unauthorized solicitation.
• To create independent contact lists.
• For purposes unrelated to assigned TPM responsibilities.
• To identify members to unauthorized third parties.
• To disclose an individual's membership status without authorization.
• To monitor members without a legitimate organizational, safety, legal, or security purpose.
• To circumvent TPM information-access controls.

Unauthorized access, use, copying, disclosure, or distribution of protected member information may result in immediate restriction or termination of access and other appropriate organizational action.

TPM does not sell personal information.

TPM only discloses personal information when reasonably necessary for a legitimate and authorized organizational purpose or when legally required. When disclosure is necessary, TPM shall seek to disclose only the minimum information necessary for that particular purpose.

Personal information may be disclosed only:

• To authorized TPM personnel with a legitimate need to know.
• Within the appropriate TPM organizational level when necessary to perform an authorized function.
• To technology, hosting, communications, payment, security, or other service providers acting on TPM's behalf and only to the extent necessary to provide the authorized service.
• When reasonably necessary to protect a member or applicant from fraud, abuse, security threats, or unlawful activity.
• When reasonably necessary to protect TPM's Network, systems, information, infrastructure, or members from legitimate threats.
• When required by applicable law or valid legal process.

TPM does not disclose personal information for purposes unrelated to the purpose for which the information was collected unless specifically authorized by the individual or otherwise required by law.

TPM shall not voluntarily disclose a member's identity, contact information, membership status, application information, or other protected personal information to an outside party unless the member has authorized the disclosure or a legitimate, specifically authorized organizational necessity exists.

When disclosure is legally required, TPM shall seek to disclose only the information required by applicable law or valid legal process.

Nothing in this Privacy Statement is intended to circumvent or interfere with a lawful obligation imposed upon TPM.

TPM may rely on outside providers for services such as:

• Website hosting
• Email and communications
• Payment processing
• Data storage
• Cybersecurity
• Website administration
• Other technology or operational services

Where member information must be provided to a service provider, TPM shall seek to provide only the minimum information reasonably necessary for the provider to perform the authorized service. Use of a service provider does not change the restricted status of TPM member information.

If TPM accepts membership dues, donations, event fees, merchandise payments, or other authorized transactions electronically, payment processing may be performed by an independent payment processor.

TPM should avoid storing complete payment-card information within TPM systems when payment information can instead be securely handled by the authorized payment processor.

Information collected specifically for payment processing should not be used for unrelated purposes.

TPM's website may use cookies and similar technologies necessary to:

• Operate website functionality.
• Maintain website security.
• Remember appropriate user preferences.
• Measure website performance.
• Diagnose technical problems.
• Understand general website usage.

If TPM implements non-essential advertising, behavioral tracking, marketing, or advanced third-party analytics technologies, TPM should update this Privacy Statement and provide appropriate controls or notices where required.

TPM uses administrative, technical, organizational, and physical safeguards appropriate to the nature of the information being protected.

TPM's security approach should include, where appropriate:

• Access control
• Least privilege
• Multifactor authentication
• Encryption
• Secure communications
• System monitoring
• Security logging
• Controlled administrative access
• Data backups
• Security updates
• Incident response procedures
• Access revocation
• Periodic security review

No website, network, communications platform, electronic storage system, or security measure can guarantee absolute security. TPM therefore combines technical security with restricted access and information-minimization practices.

TPM shall seek to retain personal information only as long as reasonably necessary for the legitimate purpose for which the information was collected or as required by applicable obligations.

Retention considerations include:

• Membership administration
• Applicant processing
• Organizational operations
• Financial recordkeeping
• Security investigations
• Dispute resolution
• Legal requirements

When information is no longer reasonably necessary, TPM should appropriately delete, anonymize, or securely archive the information according to applicable TPM procedures. Continuing possession of information does not create continuing authorization for unrestricted access to it.

Access to member information shall be promptly reviewed, modified, suspended, or removed when an individual's:

• Membership ends.
• Leadership position changes.
• Organizational assignment changes.
• Administrative responsibility ends.
• Need for the information no longer exists.
• Access authorization is suspended or revoked.

A former position or responsibility within TPM does not provide a continuing right to access, retain, copy, disclose, or use member information obtained through that position.

Suspected unauthorized access, disclosure, loss, alteration, misuse, or compromise of protected member information shall be treated as a privacy and security incident.

TPM should promptly take appropriate steps to:

• Contain the incident.
• Restrict or terminate unauthorized access.
• Protect affected systems and information.
• Preserve appropriate security and access records.
• Determine what information was affected.
• Determine which individuals may have been affected.
• Investigate the circumstances of the incident.
• Implement corrective measures.
• Provide notifications when required by applicable law or TPM policy.
• Review security measures to reduce the likelihood of recurrence.

Protecting affected members shall remain a central consideration in TPM's response to an information-security incident.

Depending upon applicable law, the nature of the record, and TPM's obligations, individuals may contact TPM regarding their personal information.

Individuals may contact TPM regarding:

• Access to certain personal information maintained about them.
• Correction of inaccurate personal information.
• Deletion of information when appropriate.
• Changes to communication preferences.
• Unsubscribing from non-essential communications.
• Privacy concerns.
• Suspected unauthorized disclosure of their information.

TPM may take reasonable steps to verify the identity and authority of a person making a request before releasing, altering, or deleting protected information. The privacy-request process itself shall not be used as a means for an unauthorized person to discover whether another individual is a TPM member.

The TPM public website is not intended to knowingly collect personal information directly from children under 13 without appropriate authorization.

If TPM determines that such information has been improperly collected through the public website, TPM will take reasonable steps to address the information consistent with applicable requirements.

The TPM website may contain links to websites and services operated by third parties.

TPM does not control the privacy, security, content, or information-handling practices of independent third-party websites.

Visitors should review the privacy practices of third-party services before providing personal information to them.

TPM distinguishes between information appropriate for the public website and information maintained for internal organizational purposes.

Certain information concerning the following may be restricted from public disclosure:

• Members and applicants
• Internal communications
• Internal systems
• Organizational security
• Operational procedures
• Facilities and infrastructure
• Capabilities
• Preparedness standards
• Security procedures

Nothing in this Privacy Statement should be interpreted as requiring TPM to publicly disclose confidential organizational, membership, security, preparedness, or operational information except where disclosure is legally required.

TPM may update this Privacy Statement as its organization, technology, website, services, security requirements, or applicable legal obligations change.

When material changes are made, TPM will update the Last Updated date displayed at the beginning of this statement.

TPM should periodically review this Statement to make sure published privacy commitments remain consistent with actual TPM practices.

Questions, concerns, privacy requests, or reports of suspected misuse of personal information may be submitted through TPM's designated privacy contact.

Sensitive information should not be submitted through an ordinary email or public contact form unless specifically requested by TPM through an appropriate secure process.