WA-SAST Privacy Policy

Effective Date: March 2026

1. Who We Are

This Privacy Policy applies to the WA-SAST ecosystem, including wa-sast.org (our learning management system) and gethelp.wa-sast.org (our resource directory). These sites are operated by Social Strategies, a consulting firm based in Seattle, Washington.

Data Controller: Social Strategies determines how user data is collected and processed to provide training and resource services to Washington State service providers.

Role of Partners: Partner organizations act as contributors of content (events, resources). They do not control the platform and do not have access to user account-level information.

Hosting: Our services are hosted by PeoplesHost, a US-based web hosting provider.

2. Information We Collect

We collect minimal personal information necessary to provide our services:

Category	What We Collect	Purpose
Profile Data	Name, email address, organization/agency name	Account creation, certificates, localized resources
Learning Data	Course enrollments, completion status, certificates earned	Track progress, issue certificates
Technical Data	IP address, browser type, server logs	Security monitoring, site stability

What We Do NOT Collect

We intentionally minimize data collection. We do NOT collect:

• Date of birth or age
• Gender or demographic information
• Social Security numbers or government IDs
• Financial information or payment data
• Health records or Protected Health Information (PHI)
• Location tracking or GPS data

3. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Contractual Necessity: To provide the training services you registered for and issue certificates
• Legitimate Interest: To maintain site security, prevent fraud, and improve our services
• Consent: For optional communications such as newsletters (you may opt out at any time)

4. Single Sign-On (SSO) Between Sites

We use JSON Web Tokens (JWT) to allow you to move between our learning platform (wa-sast.org) and our resource directory (gethelp.wa-sast.org) without logging in twice.

When you log in to wa-sast.org, a secure token containing your email and user ID is passed to gethelp.wa-sast.org, which creates a mirrored subscriber account.

The JWT token is transmitted securely over HTTPS and expires after a single use to prevent replay attacks.

5. Cookies

We use cookies for essential site functionality:

• Session cookies: Keep you logged in while browsing
• Security cookies: Prevent cross-site request forgery

We do NOT use cookies for advertising, tracking, or behavioral targeting.

Third-party content embedded on our site (such as YouTube videos, Vimeo, or Google Maps) may set their own cookies when you interact with their content. These are governed by those services' respective privacy policies.

6. How We Share Information

We do not sell, rent, or trade your personal information.

We may share information only in these limited circumstances:

• Hosting Provider: PeoplesHost hosts our servers and has access to data as necessary to provide hosting services
• Legal Requirements: If required by law, court order, or to protect the safety of our users
• Aggregate Statistics: We may share anonymized, aggregate data (e.g., "X users completed training in 2026") that cannot identify individuals

7. Data Security

We implement reasonable security measures to protect your information:

• All data is transmitted via HTTPS encryption
• Access to user data is restricted to authorized personnel only
• Our hosting provider performs regular security scans and malware monitoring
• Passwords are stored using secure hashing algorithms

No system is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Data Retention

We retain your account information for as long as your account remains active.

Account Deletion: You may request deletion of your account at any time by contacting us (see Section 11). Upon deletion, we will remove your personal information, though we may retain anonymized aggregate data and certificate records as required for compliance.

9. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users via the email address associated with their account
• Provide information about what data was affected and steps you can take
• Report to relevant authorities as required by applicable law

Given that we collect minimal personal data (name, email, and organization only), the risk and impact of any potential breach is significantly limited compared to platforms that collect sensitive financial or health information.

10. Age Restriction

WA-SAST is intended for use by professionals aged 18 and older. We do not knowingly collect personal information from anyone under the age of 18.

If we become aware that we have collected information from a minor, we will take steps to delete that information promptly. If you believe a minor has provided us with personal information, please contact us immediately.

11. Your Rights

You have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your account and personal data
• Opt-Out: Unsubscribe from marketing emails at any time

To exercise these rights, contact us at: Mail@WA-SAST.org

We will respond to requests within 30 days.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted to this page with an updated effective date. We encourage you to review this policy periodically.

For significant changes that materially affect how we use your data, we will provide notice through the site or via email.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: