This Privacy Policy explains how The DeBary Volunteer Firemen’s Association, Inc., doing business as The DeBary Volunteer Fire Support Team (“the Association,” “we,” “us” or “our”), collects, uses, shares and protects personal information when you visit debaryvfa.org (the “Site”), fill out one of our forms, place an order in our online shop, make a donation, or otherwise communicate with us.
Effective date: October 30, 2026
Last updated: October 30, 2026
1. Who we are
The DeBary Volunteer Firemen’s Association, Inc. is a Florida not-for-profit corporation founded in 1953 and recognized by the Internal Revenue Service as a tax-exempt social welfare organization under section 501(c)(4) of the Internal Revenue Code. We are a volunteer group that supports the firefighters who serve DeBary, Florida, for example by providing firefighter rehab (water, sports drinks, snacks, ice, shade and cooling) at emergency scenes through our support unit. You can learn more on our About Us and History pages.
We are not a fire department and we do not provide emergency services. If you have an emergency, call 911. Please do not use our website forms or email to report an emergency.
For the purposes of data protection laws that use the term, the Association is the “controller” (or “business”) responsible for the personal information described in this policy. Our contact details appear at the end of this policy.
2. Scope of this policy
This policy applies to personal information we collect:
- through the Site, including its contact and request forms and its online shop;
- through email, phone calls, postal mail and messages you send to us; and
- in connection with orders, donations, hall-use requests, fire-safety presentation requests and volunteer interest that begin on the Site.
This policy does not cover websites and services run by others, even if we link to them, such as Facebook, PayPal, Venmo, the City of DeBary, the Orange City Fire Department, Volusia County or other government websites. Those organizations have their own privacy policies, which we encourage you to read. It also does not cover information about our members that we keep in our internal membership records, which is handled under our internal practices and applicable law.
3. Information we collect
3.1 Information you give us through our forms
The Site offers four forms: a general contact form, a hall-use request form, a fire-safety presentation request form, and a volunteer interest form. When you submit one of these forms, we collect:
- your name;
- your email address;
- your phone number, if you choose to provide it (this field is optional);
- the message you write, including any details you choose to include (for example, the date and type of event you are planning, the group you would like a presentation for, or your availability to volunteer); and
- which form you used (the “form type”).
Each submission is stored in our website’s database and is also sent by email to the Association so that a volunteer can respond. Please include only the information we need to help you. Do not send us Social Security numbers, financial account numbers, medical information or other sensitive information through our forms.
3.2 Information we collect when you place an order or donate through our shop
Our online shop, powered by the WooCommerce plugin, offers items such as our 70th Anniversary Challenge Coin and donation items such as the Firefighter Rehab Supplies Fund and the Fire Station 39 Equipment Fund. When you check out, we collect:
- billing name and address;
- shipping name and address (if different, and if the order is shipped);
- email address and phone number;
- the items, quantities, amounts and any order notes you provide; and
- the payment method you choose and the status of your payment.
Our checkout currently offers two payment methods: check by mail and pay at local pickup. We do not collect or store credit card or debit card numbers on the Site. If you mail us a check, the check itself will show the information printed on it (such as your name, address and bank account details); we use that information only to deposit and record your payment. Some pages offer links to PayPal or Venmo. Those links take you to those services, which collect and process your payment information under their own terms and privacy policies. When you pay us through PayPal or Venmo, those services share with us the information needed to identify your payment, such as your name, username or email address, the amount, the date and any note you add.
3.3 Communications with us
If you email us, call us, write to us, or message us on Facebook, we receive the information you choose to share, such as your name, contact details and the content of your message. We keep these communications so we can respond and follow up.
3.4 Technical and security information
Like most websites, the Site automatically receives certain technical information when you visit, including:
- your Internet Protocol (IP) address;
- your browser type and version and device information (the “user agent”);
- the date and time of your visit and the pages or files you request; and
- the address of the page that referred you to the Site, if any.
We use the Wordfence security plugin as a website firewall. Wordfence logs the IP addresses of visitors and information about requests made to the Site so that it can detect and block attacks, spam, brute-force login attempts and other malicious traffic. Our web hosting provider may also keep standard server logs for the same security and operational reasons. In addition, when you submit a form, we store your IP address and user agent with your submission to help prevent spam and abuse. Our forms use a hidden “honeypot” field to filter automated spam; we do not use third-party CAPTCHA services that would send your information to another company.
3.5 Cookies
The Site uses a small number of cookies that are needed for the Site, the shop cart and checkout, logged-in accounts, security, and remembering your cookie choices. We do not use advertising cookies, and no analytics tools are installed by default. For details, including a table of each cookie we use, see our Cookie Policy.
The Site’s fonts, scripts and images are hosted on our own server. We do not load Google Fonts or content from third-party content delivery networks, so simply viewing our pages does not send your IP address to those companies.
3.6 Information we do not intentionally collect
We do not knowingly collect sensitive personal information through the Site, such as Social Security numbers, driver’s license numbers, health information, precise geolocation, or information about race, religion or sexual orientation. If you later apply to become a member, any additional information needed for that process (for example, information needed for a background check) will be collected separately, with its own notice and, where required, your consent.
4. How we use information
We use personal information only for purposes connected with our mission and the reason you gave it to us. Specifically, we use it to:
- Respond to you. Answer questions, messages and requests you send through our forms, email, phone or social media.
- Handle requests. Review and schedule hall-use requests at our Association Hall, and arrange fire-safety presentations for community groups.
- Follow up on volunteer interest. Contact you about volunteering, meetings and next steps if you submit the volunteer interest form.
- Fill orders and record donations. Process, ship or arrange pickup of orders, record payments and donations, send order confirmations and receipts, and handle returns and refunds under our Donation, Shipping & Refund Policy.
- Keep the Site secure. Detect, prevent and respond to spam, fraud, abuse, security incidents and technical problems.
- Run the Association. Keep accurate financial and organizational records, meet our tax and reporting obligations, and manage our relationships with insurers, accountants and legal advisors.
- Comply with law. Respond to lawful requests, enforce our Terms and Conditions, and protect the rights, property and safety of the Association, our volunteers, the public and others.
We do not use your information for targeted advertising, we do not build advertising profiles, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
5. Legal bases for processing (visitors from the EEA, UK and Switzerland)
The Association is a local organization in Florida and our Site is directed to people in the United States. If you are located in the European Economic Area, the United Kingdom or Switzerland and the General Data Protection Regulation (GDPR), the UK GDPR or similar laws apply to our processing of your information, we rely on the following legal bases:
- Contract: to process and fulfill an order you place, or to take steps you request before entering into an arrangement (such as a hall-use request).
- Legitimate interests: to respond to messages, follow up on volunteer interest and presentation requests, keep the Site secure, prevent spam and fraud, and run the Association. We balance these interests against your rights and expectations, and we limit what we collect.
- Legal obligation: to keep financial records and comply with tax, accounting and other legal requirements.
- Consent: to set non-essential cookies (if any are used in the future) and, where required, to send you optional communications. You can withdraw consent at any time without affecting processing that took place before you withdrew it.
6. How we share information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as described below and only to the extent needed:
- Volunteers and officers of the Association. Members who need the information to respond to you, fill orders, schedule the hall, arrange presentations or keep financial records. They are expected to use it only for Association purposes.
- Service providers. Companies that provide services to us and process information on our behalf, including our website hosting provider (which stores the Site, its database and server logs), our email service and email delivery providers (which carry and store form notifications and correspondence), and the U.S. Postal Service or another carrier (which receives the name and address needed to deliver a shipped order). Our security plugins run on our own server.
- Payment processors, where applicable. If you choose to pay through PayPal or Venmo, you provide your payment information directly to those services. If you pay by check, your check is processed through our bank.
- Professional advisors and insurers. Accountants, auditors, attorneys and insurers, when reasonably necessary for them to advise us or provide coverage (for example, information about a hall-use event if an insurance question arises).
- Partner agencies, only when you ask or the law requires. We do not routinely share your information with the City of DeBary, the Orange City Fire Department or Volusia County. If your request needs their involvement (for example, a presentation request that should be handled by the fire department), we will tell you or ask you first, unless the law requires otherwise.
- Legal and safety reasons. When we believe in good faith that disclosure is required by law, subpoena, court order or other legal process; to protect the rights, property or safety of the Association, our volunteers, firefighters, the public or others; or to investigate fraud, security incidents or violations of our Terms.
- Organizational changes. If the Association merges with, transfers its assets to, or is succeeded by another organization (for example, on dissolution under Florida law), information may be transferred to that organization, subject to this policy’s protections.
7. How long we keep information
We keep personal information only as long as reasonably needed for the purposes described above, unless a longer period is required or permitted by law, or needed to resolve a dispute, enforce our agreements or respond to a security incident. Our general retention periods are:
| Type of information | Typical retention period |
|---|---|
| Contact form and fire-safety presentation request submissions | Up to 24 months after our last communication with you |
| Hall-use requests and related correspondence | Up to 3 years after the event or decision, for scheduling, insurance and recordkeeping |
| Volunteer interest submissions (if you do not join) | Up to 24 months after our last communication with you |
| Volunteer interest submissions (if you become a member) | Moved to membership records and kept for the duration of membership plus a reasonable period afterward |
| Order, payment and donation records | 7 years after the end of the fiscal year in which the transaction occurred, for tax and accounting purposes |
| General email and other correspondence | Up to 3 years, unless related to an order, donation or request covered above |
| IP address and user agent stored with form submissions | Kept with the submission and deleted when the submission is deleted |
| Security firewall logs (Wordfence) and server logs | Generally no more than 90 days, unless needed to investigate a specific security incident |
| Spam submissions caught by our filters | Deleted periodically, generally within 30 days |
| Cookies | See the durations listed in our Cookie Policy |
When information is no longer needed, we delete it or, where deletion is not practical (for example, in routine backups), we keep it protected until it is overwritten in the normal course.
8. How we protect information
We use reasonable administrative, technical and physical safeguards appropriate to a small volunteer organization, including:
- encrypted connections (HTTPS) for the Site;
- a web application firewall and login protections (Wordfence), along with additional hardening measures such as WP Hide & Security Enhancer and a non-default database table prefix (Brozzme DB Prefix);
- limiting access to submissions and order records to the volunteers who need it;
- keeping our website software and plugins updated; and
- not collecting card numbers on our Site.
No website, email system or storage method is completely secure, and we cannot guarantee absolute security. Please use caution when sending information by email. If we learn of a data breach affecting your personal information, we will notify you and any appropriate authorities as required by applicable law, including the Florida Information Protection Act (section 501.171, Florida Statutes) where it applies.
9. Your choices and rights
9.1 Rights we offer everyone
Regardless of where you live, you may ask us to:
- tell you what personal information we have about you and give you a copy;
- correct information that is inaccurate or incomplete;
- delete your information, subject to records we must keep for legal, tax or security reasons (such as order and donation records); and
- stop contacting you.
We will not treat you differently or deny you service because you make a privacy request.
9.2 California residents (CCPA/CPRA)
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), generally applies to for-profit businesses that meet certain thresholds. As a nonprofit organization, the Association does not believe it is subject to the CCPA. Even so, we voluntarily honor the following requests from California residents, to the extent they apply to us:
- Right to know the categories and specific pieces of personal information we have collected, the sources, our purposes and the categories of recipients.
- Right to delete personal information we have collected from you, subject to legal exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in the CCPA.
- Right to limit the use of sensitive personal information. We do not use sensitive personal information for purposes that would give rise to this right.
- Right to non-discrimination for exercising these rights.
In the past 12 months, the categories of personal information we have collected are: identifiers (such as name, email address, postal address, phone number and IP address); commercial information (such as order and donation records); internet or electronic activity information (such as security logs and browser information); and any other information you choose to include in a message. We collect this information from you directly, from your browser or device, and from payment services you choose to use. We use and disclose it only for the purposes and to the recipients described in Sections 4 and 6. You may use an authorized agent to make a request on your behalf; we may ask the agent for proof of authorization and may ask you to verify your identity directly.
9.3 Florida residents and the Florida Digital Bill of Rights
Florida’s Digital Bill of Rights (part V of chapter 501, Florida Statutes) applies to for-profit businesses that meet specific thresholds, including more than $1 billion in annual global gross revenue. It does not apply to the Association. We nonetheless offer Florida residents the rights described in Section 9.1, and we protect personal information and respond to security breaches as required by Florida law.
9.4 Residents of other U.S. states
A number of states have adopted consumer privacy laws. Most exempt nonprofit organizations or apply only to organizations that process the personal information of very large numbers of residents. Given our size and local focus, we do not expect those laws to apply to us, but we will honor requests made under them as described in Section 9.1 and will comply with any law that does apply.
9.5 Visitors from the EEA, UK and Switzerland
If the GDPR, UK GDPR or similar law applies, you have the right to access, rectify or erase your personal information; to restrict or object to our processing; to data portability; and to withdraw consent at any time where we rely on consent. You also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner’s Office). We would appreciate the chance to address your concern first, so please contact us.
9.6 How to make a request
To make any of these requests, email us at [email protected] with the subject line “Privacy Request,” call us at 386-801-2469, or write to us at the mailing address below. Please tell us what you are asking for and how to reach you. To protect your information, we may need to verify your identity, usually by matching the information you provide with the information we already have (for example, confirming a request from the email address you used on a form or order). We will respond within 45 days, or within one month where the GDPR or UK GDPR applies. If we need more time, we will tell you why. If we decline your request, we will explain our reasons, and you may ask us to reconsider by replying to our decision with the subject line “Privacy Appeal.”
10. Do Not Sell or Share, and Global Privacy Control
We do not sell personal information, we do not share personal information for cross-context behavioral advertising, and we do not use advertising or tracking cookies. Because we do not sell or share personal information, there is nothing you need to opt out of. Nonetheless, if your browser or browser extension sends a Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of the sale or sharing of personal information associated with that browser, and as a choice to reject any non-essential cookies. We will continue to honor GPC if our practices ever change.
Some browsers also offer a “Do Not Track” setting. There is no common industry standard for responding to Do Not Track signals, but because we do not track visitors across websites, our practices are the same whether or not Do Not Track is turned on.
11. Children’s privacy
The Site is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information online from children under 13, consistent with the Children’s Online Privacy Protection Act (COPPA). Children under 13 should not submit forms, place orders or send us personal information. If a parent, teacher or youth leader would like to request a fire-safety presentation for a group of children, the adult should submit the request. If you believe a child under 13 has given us personal information, please contact us and we will delete it promptly. Online orders, donations and hall-use requests must be made by adults age 18 or older.
12. Email communications
When you contact us, place an order or submit a request, we will email you as needed to respond, confirm your order, coordinate pickup or shipping, and handle any follow-up. These are transactional or relationship messages related to your request. We do not sell or rent our email contacts.
We do not currently send a regular email newsletter. If we start one, we will only add you if you sign up or otherwise agree, every message will include a way to unsubscribe, and we will follow the federal CAN-SPAM Act. You can also ask us to stop contacting you at any time by replying to our email or contacting us as described below. We do not send text message marketing.
We will never ask you for passwords, bank account numbers or card numbers by email. The Association does not raise funds door to door. If you receive a suspicious message or visit claiming to be from us, please contact us to confirm.
13. Third-party links and services
The Site contains links to websites and services run by others, including our Facebook page, PayPal, Venmo, and government and safety websites. When you click those links, you leave our Site, and the other organization’s privacy policy and terms apply. We are not responsible for the privacy practices of other websites. For example, if you donate through PayPal or Venmo, those companies collect and use your information under their own policies; and if you interact with our Facebook page, Meta collects information under its own policies. Please review their policies before giving them your information.
14. International visitors and data transfers
The Association is based in the United States, and the Site and its data are hosted in the United States. If you visit the Site from outside the United States, your information will be transferred to, stored in and processed in the United States, where data protection laws may differ from those in your country. Where the GDPR or UK GDPR applies, we transfer information to the United States as necessary to respond to your request or fulfill your order, or under other safeguards permitted by law. Our shop ships only to U.S. addresses; please see our Donation, Shipping & Refund Policy.
15. Changes to this policy
We may update this Privacy Policy from time to time, for example if we change our website tools, add a new form or service, or if the law changes. If we add analytics tools such as Google Analytics in the future, they will only load after you give consent through our cookie banner, and we will update this policy and our Cookie Policy before doing so. When we make changes, we will update the “Last updated” date at the top of this page. If a change is significant, we will provide a more prominent notice on the Site. Your continued use of the Site after a change takes effect means the updated policy applies to information collected after that date.
16. Contact us
If you have questions about this Privacy Policy or how we handle your information, or if you want to make a privacy request, please contact us:
The DeBary Volunteer Firemen’s Association, Inc.
d/b/a The DeBary Volunteer Fire Support Team
Attn: Privacy
PO Box 530853
DeBary, FL 32753-0853
- Email: [email protected]
- Phone (non-emergency): 386-801-2469
- Online: our contact page
Our volunteers check messages regularly, but we are not staffed around the clock. For emergencies, always call 911.