Privacy Policy

K6VEC Amateur Radio Group, Inc. / HamClubOnline

Last Updated: September 22, 2026

Section 1Overview

HamClubOnline (“HCOL,” “we,” “us,” or “our”) is a free membership management platform for amateur radio clubs, operated by K6VEC Amateur Radio Group, Inc., a California 501(c)3 nonprofit corporation (EIN: 85-2465633). This Privacy Policy describes how we collect, use, store, and protect personal information provided to us through the HamClubOnline platform and associated websites, including hamclubonline.com and secure.hamclubonline.com. References to “the Service” or “the platform” in this Privacy Policy include both the HamClubOnline application at secure.hamclubonline.com and the HamClubOnline website at hamclubonline.com.

By using the HamClubOnline platform, you agree to the collection and use of information in accordance with this policy.

Section 2Who We Are

K6VEC Amateur Radio Group, Inc.
10 Sage Hill
Laguna Hills, CA 92653
United States
[email protected]

K6VEC is registered with the California Attorney General’s Registry of Charities and Fundraisers. Financial information about this organization may be obtained by contacting us at the address above or by visiting the California Attorney General’s Registry of Charities at oag.ca.gov/charities.

Section 3Information We Collect

3.1Information You Provide Directly

When you register for a HamClubOnline account or are added to the platform by a club administrator, we may collect the following:

Full name (synchronized from FCC ULS — not directly editable in HamClubOnline)
Mailing address (synchronized from FCC ULS for licensed members — not editable by members; club administrators may update addresses for members not associated with a callsign)
Account email address (personal login email; receives account security notifications and membership notifications; published on the roster if no Club Email is provided and the member has not opted out of email display)
Club email address (optional club-specific email used for club communications and event notifications; when provided, this is the address published on the roster; if not provided, the Account Email is published instead; marking email as do not publish suppresses both addresses from the roster)
Phone number(s) — members may have multiple numbers on file. Only the primary number is published on the roster unless the member has opted out of phone display
Birth date (month and day only, without year) where the club has elected to collect this information
Emergency contact information, where provided by the member or club administrator (optional)
Nickname or preferred name, where provided (optional)
Club join date (optional)
Club position or office held (optional)
Delegate or affiliation status with other organizations or clubs (optional)
Relationship to other club members, such as spouse, sibling, or family member, where provided (optional). Relationship information is informational only, is visible to club administrators and members only, and is not shown publicly
FCC Registration Number (FRN) or Canadian amateur radio license equivalent
Amateur radio callsign (optional)
Membership type, dues status, and expiration dates
Club-assigned roles and ranks
Member notes and club-specific files uploaded by club administrators
Skills and certifications assigned to members by the club, including emergency communications qualifications such as ARES, RACES, CERT, and Net Control, as well as organizational roles and committee designations. Skills records include the skill name, date assigned, and expiration date where applicable
Club asset records, for clubs that use the asset management feature. Asset records describe physical equipment owned by the club and include asset type, description, manufacturer, model, serial number, current location or assigned member (for assignable assets), and assessed value. Assets are club property; asset records are not member personal data. For assignable assets, the member currently holding the item is recorded as part of the club’s equipment custody tracking
Survey responses, for clubs that use the Elections & Surveys feature to conduct member surveys. Survey responses may be attributed or anonymous depending on how the club has configured the survey
Event registration, RSVP, and attendance records
Voting participation records for club elections (whether a member has voted) — vote content is never stored in association with member identity; see Club Elections and Voting Privacy below for full details
Club registration information, collected when a new club applies to join HamClubOnline, including the club’s legal name, physical address, year founded, and club website
Club membership application responses, where a club has configured custom application questions for prospective members. Application questions are set entirely by the individual club — HamClubOnline does not control, review, or approve the questions asked. Responses are stored as part of the club’s membership data and are accessible to club administrators. Members and prospective members should contact their club administrator with questions about why specific information is being requested
Repeater coordination records, for clubs that have been approved for the optional frequency coordination feature. Coordination records include repeater frequency, offset, CTCSS/DCS tone, location, sponsoring club, and trustee callsign. Repeater contact information is linked to the trustee’s HamClubOnline member record. Full coordination records are accessible only to authorized coordinators within the coordinating body. A subset of coordination data — including repeater callsign, frequency, offset, and, where the coordinating body has elected to share them, location and tone — may be visible to club members and the general public

3.2Information Collected Automatically from External Sources

HamClubOnline synchronizes certain information from public government databases to keep license records current:

FCC Universal Licensing System (ULS): License class, expiration date, and address of record for United States amateur radio licensees.
Innovation, Science and Economic Development Canada (ISED): Equivalent license data for Canadian amateur radio operators.

This data originates from public government databases and is used solely to maintain accurate member records within the platform. Amateur radio license data, callsigns, and licensee addresses of record are maintained as public records by the FCC and ISED pursuant to their respective statutory mandates. Removal, correction, or suppression of this data within HamClubOnline does not alter the public record maintained directly by the FCC or ISED. Requests to modify FCC license records must be submitted directly to the FCC through the Universal Licensing System at fcc.gov/uls. State privacy law rights of deletion do not extend to information that originates from and remains part of a public government record.

3.3Information Collected Automatically from Your Use of the Platform

When you access HamClubOnline, our servers and infrastructure providers may automatically collect:

IP address
Browser type and version
Pages visited and features used
Date and time of access
Referring URL

This information is used for security monitoring, troubleshooting, and platform performance analysis. It is not used to build advertising profiles.

3.4Security and Activity Logs

In addition to general access data, HamClubOnline records security and activity events associated with your account. For each recorded event, the following information is captured:

The nature of the action or event
The date and time of the event
The IP address from which the action was taken

Categories of events that are logged include: successful account logins, failed login attempts, account and profile changes, club administrative actions, data export events, payment events, and SMS and voice alert activations. Security and activity logs are retained for 24 months from the date of each event and are then deleted.

Members may review their own activity log through the HamClubOnline application. Club administrators may review activity logs for actions taken within their club through the club administration interface. Members can only see their own logs; club administrators can only see logs relating to their own club. HamClubOnline staff may review logs in connection with a security investigation, account compromise report, or legal obligation.

3.5Payment Information

Not all clubs collect membership dues through HamClubOnline. Use of the platform’s payment processing features is entirely at the discretion of each club administrator. Clubs may also collect dues outside of HamClubOnline entirely — for example by check, cash, or through their own payment systems — in which case no payment data is transmitted to or processed by HamClubOnline in connection with those transactions.

For clubs that do collect dues through HamClubOnline: HamClubOnline does not store credit card numbers, debit card numbers, or bank account information. All payment transactions are processed directly by PayPal or Square. We store only the customer ID and transaction reference numbers returned by those payment processors after a transaction is completed. Credit card information is transmitted directly to the payment processor and never passes through HamClubOnline’s servers in unencrypted form.

Section 4How We Use Your Information

We use the information we collect for the following purposes:

To create and maintain your HamClubOnline account
To provide membership management services to the amateur radio clubs you belong to
To synchronize and display your FCC or Canadian license data
To process membership dues and donation payments on behalf of clubs you belong to, or donations made directly to K6VEC
To send membership renewal reminders, expiration notices, and club communications authorized by your club administrator to club members in good standing (Active or Expiring Soon status) and designated non-member affiliates only. Inactive members are excluded from mass club communications. HamClubOnline communication features may not be used for marketing, advertising, or promotional purposes, or to communicate with former members who have left the club
To send SMS and voice alerts when activated by authorized club coordinators or at the direction of civil or governmental authorities
To facilitate club elections, surveys, event RSVPs, and attendance tracking
To track and display amateur radio skills, emergency communications certifications, and organizational roles
To maintain club equipment asset records on behalf of clubs that use the asset management feature. Asset records track club-owned equipment and are not member personal data
To provide club administrators with membership trend and financial revenue reports
To respond to support requests
To maintain the security and integrity of the platform
To comply with applicable law
To reference club names, general location (city, state, and country), website where provided, and aggregate member counts in promotional and marketing materials about HamClubOnline. This use is limited to club-level information (club name and number of members) and does not include any individual member personal information. Clubs that donate to support platform operations will additionally be recognized as HamClubOnline Supporting Clubs. Clubs may opt out of promotional use of their information at any time by contacting [email protected]

We do not use your personal information for advertising, marketing by third parties, or the sale of personal data.

Section 5How Your Information Is Shared

5.1With Your Club

A club administrator is a club member who has been assigned the Club Administrator role within HamClubOnline. A club may have one or more club administrators. The club is responsible for maintaining appropriate club administrators — see our Terms of Service for full details of club administrator responsibilities.

Personal information you provide is visible to your club’s administrators and, depending on the display settings your club has configured, to other members of your club or to the general public. Roster field visibility is configured by club rank — members, officers, and directors may each be configured to see different sets of fields. The public roster is hidden by default and must be explicitly enabled by a club administrator. Regardless of how a club configures its roster, HamClubOnline automatically prevents the following fields from ever appearing on a publicly accessible roster: street addresses, email addresses, phone numbers, and birth dates. These fields may be visible to members or higher club ranks depending on configuration, but are never shown publicly.

Members have the following individual opt-out rights for roster display:

Full roster opt-out: You may exclude yourself from the club roster entirely at all visibility levels.
Phone number opt-out: You may suppress your phone number from the roster regardless of rank-based visibility settings.
Email address opt-out: You may suppress your email address from the roster regardless of rank-based visibility settings.

All three opt-outs can be exercised directly from your club profile page. Your club administrator can also apply these settings on your behalf.

Relationship information between members — such as spouse or family member designations — is informational only and is visible to club administrators and members only. It is not shared publicly or used for any automated purpose within the platform.

Your club administrator is your primary point of contact for questions about your membership record, your data, and your use of the HamClubOnline platform. HamClubOnline support is intended for club administrators. Club members seeking assistance should contact their club administrator in the first instance. If your concern cannot be resolved by your club administrator, you may contact HamClubOnline support at [email protected].

Clubs may also designate non-member affiliates — individuals or organizations added to the club’s roster for the purpose of receiving club communications, but who are not club members and have no voting rights. Examples include affiliated amateur radio clubs, government officials, and emergency management coordinators. Non-member affiliates are subject to the same opt-out rights as regular members and may unsubscribe from club communications at any time.

5.2Repeater Coordination Data

For clubs that have been approved for the optional frequency coordination feature, certain repeater coordination data may be visible to club members and the general public. The coordinating body controls which data fields are shared publicly. Publicly visible data may include repeater callsign, frequency, offset, and, where the coordinating body has elected to share them, repeater location and CTCSS/DCS tone. Full coordination records — including repeater contact information linked to a trustee’s HamClubOnline member record — are accessible only to authorized coordinators within the coordinating body and are not shared publicly.

5.3Via the Club Read-Only API

HamClubOnline provides a read-only API that allows clubs to integrate their club data with external websites or systems. API access must be explicitly enabled by a club administrator and is not active by default. When enabled, authorized external systems can retrieve club data through three endpoints: member roster data, club calendar events, and club asset records. API access is limited to the data of the club that granted access and is governed by the conditions described in our Terms of Service. Club administrators are responsible for managing which external systems have been granted API access to their club’s data and for revoking that access when it is no longer required. Personal information accessible through the member roster endpoint is subject to the same privacy protections and use restrictions that apply to all member data under this Privacy Policy.

5.4With Third-Party Service Providers

We share personal information with third-party service providers only to the extent necessary to provide the platform. Service providers fall into two categories: those that are required for all users as a condition of using HamClubOnline, and those that are engaged only when a club administrator or member has enabled a specific feature or provided information that requires that service.

5.5Required Service Providers

The following service providers are engaged for every user of HamClubOnline regardless of club configuration. Use of HamClubOnline constitutes consent to data being processed by these providers:

Akamai / Linode (Cloud Infrastructure and Object Storage): Our servers are hosted at Linode’s data center in Fremont, California. All platform data is stored and processed on Linode infrastructure. Server infrastructure and data storage are provided by Linode, an Akamai company. Files uploaded by club administrators and members through HamClubOnline are stored in Linode Object Storage. Uploaded files may include member documents, club files, and other content submitted through the platform.
Backblaze B2 (Offline Backup Storage): HamClubOnline transmits encrypted offline backup copies of platform data to Backblaze B2 cloud storage as part of our data backup and recovery program. Backups are encrypted prior to transmission and storage. These backups may contain personal information stored in the platform, including member records, club data, and uploaded files. Backup data is retained solely for the purpose of platform disaster recovery and is subject to Backblaze’s privacy policy and terms of service.
Cloudflare: We use Cloudflare for web application firewall (WAF) protection, content delivery, and automated bot and threat management. All traffic to hamclubonline.com and secure.hamclubonline.com is routed through Cloudflare’s network. Cloudflare’s bot management features analyze request patterns, browser characteristics, and behavioral signals to distinguish legitimate users from automated or malicious traffic. This analysis may involve the use of challenge pages, JavaScript fingerprinting, and cookies set by Cloudflare on your device. Information processed by Cloudflare in connection with these security functions is subject to Cloudflare’s privacy policy.
SparkPost (Bird): We use SparkPost to deliver transactional emails to all users, including membership notifications, renewal reminders, and club communications. Email addresses are transmitted to SparkPost for the purpose of message delivery. SparkPost’s privacy policy governs the handling of that information.
SMTP2Go: We use SMTP2Go as an additional outbound email delivery provider for transactional emails, including membership notifications, renewal reminders, and club communications. Email addresses are transmitted to SMTP2Go for the purpose of message delivery. SMTP2Go’s privacy policy governs the handling of that information.
Google APIs (Google LLC): We use Google Maps, Google Geocoding, and Google Time Zone APIs to display maps, resolve member and club addresses to geographic coordinates, and determine time zone information. Member and club mailing addresses may be transmitted to Google for geocoding purposes. The geographic coordinates (latitude, longitude, and altitude) derived from this geocoding are stored in association with the member record and are used to display member location to other club members and to calculate bearing and distance between members for radio communications purposes. This information is subject to Google’s privacy policy and the Google Maps Platform terms of service.
Woomaps: We use Woomaps to generate what3words three-word location codes for all members whose addresses have been geocoded to GPS coordinates. The GPS coordinates derived from a member’s address via Google geocoding are transmitted to Woomaps solely for this purpose. The resulting what3words code is displayed to other club members as a convenience and for use in radio communications and emergency operations. No other personal information is transmitted to Woomaps. Woomaps’ privacy policy governs the handling of that information.

5.6Optional Service Providers

The following service providers are engaged only when a club administrator has enabled the relevant feature or when a member has provided information that requires the service. If your club has not enabled a feature, or you have not provided the relevant information, that provider does not receive your personal data.

Mailgun (Sinch): Engaged when inbound email is routed to club administrators or platform staff. Mailgun receives and forwards email messages as necessary to operate the service. Email content and sender information are subject to Mailgun’s privacy policy.
PayPal: Engaged when a club administrator has enabled PayPal payment processing. Payment information submitted through the PayPal interface is transmitted directly to the club’s own PayPal account as configured by the club administrator. HamClubOnline does not have the ability to review or alter transactions after submission. PayPal’s privacy policy governs the handling of payment information submitted through their payment interface.
Square: Engaged when a club administrator has enabled Square payment processing. Payment information submitted through the Square interface is transmitted directly to the club’s own Square account as configured by the club administrator. HamClubOnline does not have the ability to review or alter transactions after submission. Square’s privacy policy governs the handling of payment information submitted through their payment interface.
Groups.io: Engaged when a club administrator has enabled Groups.io integration. Member email addresses are submitted to Groups.io solely to facilitate automatic mailing list membership for that club.
Infobip: Engaged when a club administrator has enabled SMS or voice TTS alerting and a member has provided a phone number for that purpose. Phone numbers are transmitted to Infobip solely for the purpose of alert message delivery. Infobip’s privacy policy governs the handling of that information.
Nexmo (Vonage): Engaged when a club administrator has enabled SMS or voice TTS alerting and a member has provided a phone number for that purpose. Nexmo, now part of Vonage (an Ericsson company), is used to deliver outbound SMS and voice TTS alert messages and to perform phone number validation and number insights lookups to verify number type, reachability, and carrier information in order to optimize alert delivery. Nexmo’s privacy policy governs the handling of that information.

We do not knowingly sell, rent, or trade personal information with third parties for their own marketing or commercial purposes.

5.7Legal Requirements

We may disclose personal information when required to do so by law, court order, or valid legal process, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of K6VEC, HamClubOnline, its users, or the public.

5.8Organizational Successors

K6VEC Amateur Radio Group, Inc. is a California nonprofit public benefit corporation. In the event of a merger, dissolution, or transfer of assets to another nonprofit organization, personal information held by K6VEC may be transferred to the successor organization, provided that the successor organization is bound to use such information only in a manner consistent with this Privacy Policy.

Section 6SMS and Voice Alerting

HamClubOnline supports SMS and voice text-to-speech (TTS) alerting for clubs participating in ARES, RACES, CERT, or other communications programs, and for activations requested by civil or governmental authorities. These features are enabled only when a club administrator has configured alerting for their club. Phone numbers and consent are managed at the club level — members opt in separately for each club they wish to receive alerts from, through their club profile for that club. Phone numbers provided for alerting purposes are used solely for that purpose. Alert messages are sent only when an authorized club coordinator initiates an activation. Alerts may or may not involve an emergency situation.

SMS messages are delivered to mobile numbers only. Voice text-to-speech calls are delivered to both mobile and landline numbers. Members who provide a landline number will receive voice TTS calls but will not receive SMS messages.

In accordance with the Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227, HamClubOnline collects prior express written consent before sending automated SMS messages or voice TTS calls to any member. Consent is obtained at the club level — through an affirmative checkbox on the phone number entry page within your club profile for each club. By checking that box, you consent to receive automated SMS messages (mobile numbers only) and automated voice text-to-speech calls (mobile and landline) from that club’s authorized coordinators through the HamClubOnline platform.

Your consent, including the date, time, and IP address of your submission, is recorded and retained in accordance with TCPA requirements. You may withdraw consent at any time through any reasonable method that clearly expresses your desire to stop receiving messages or calls. Valid revocation methods include replying STOP to any SMS message, removing your phone number from your account profile, contacting your club administrator, or contacting HamClubOnline support at [email protected]. Under FCC rules implementing the TCPA, we must honor revocation requests received through any reasonable means within a reasonable time not to exceed 10 business days. Revocation of consent applies to all automated SMS messages and voice TTS calls from HamClubOnline across all clubs the member belongs to, regardless of the category of message that prompted the opt-out. To comply with TCPA requirements, an opt-out is honored at the platform level and removes the member from SMS and voice alerting for all clubs within HamClubOnline.

Section 7Club Elections and Voting Privacy

HamClubOnline provides online voting functionality for club elections where clubs have enabled this feature. The voting system is designed from the ground up to ensure that vote content cannot be traced back to any individual member, while still preventing duplicate voting and verifying voter eligibility.

7.1How Voting Works

When a member casts a ballot in a club election, the following process occurs:

A unique, one-time token is generated and associated with the member’s identity to verify that they are an eligible voter and have not already voted in that election
The member casts their ballot, and the token is marked as used to prevent duplicate voting
The actual vote — the member’s selection — is recorded in a separate database table with no reference to the token, the member’s account, or any other identifying information
The token is retained solely to enforce the one-vote-per-member rule and is never used to identify how any member voted

7.2Architectural Separation

The anonymity of vote content is enforced at the database architecture level, not merely as an operational policy. Voting participation records (who has voted) and vote content records (what was selected) are stored in entirely separate database tables with no shared key between them. There is no technical path — including for HamClubOnline administrators or database administrators with full system access — to associate any vote record with any individual member.

7.3What Club Administrators Can See

Club administrators managing an election can see which members have cast a ballot (participation) and which members have not yet voted. Club administrators cannot see how any individual member voted. This distinction is enforced at the application level and at the database level.

While the technical architecture prevents any direct association between a vote and a member, practical anonymity is not guaranteed in all circumstances. In elections with very low participation or with write-in responses, a club administrator may be able to infer how a member voted based on context, the number of eligible voters, or the content of write-in answers. Members should be aware of this limitation when deciding how to vote in small or low-turnout elections.

7.4Election Results

Election results are reported in aggregate only. Final tallies show the total votes cast for each candidate or option. Individual vote selections are never displayed, exported, or associated with any member identity at any point during or after the election.

Section 8Data Security

We take the security of personal information seriously and implement the following measures:

All communications between your browser and HamClubOnline are encrypted using TLS/SSL
Account passwords are hashed using bcrypt with both salt and pepper; plaintext passwords are never stored
The application server and database server are separated; the MySQL database is not directly accessible from the internet
The HamClubOnline website and the application server are hosted on separate server instances to limit the impact of any potential vulnerability in either system
Payment card information is encrypted and stored by our payment processors under PCI DSS standards; only transaction reference numbers are stored in our database
Our infrastructure is protected by Cloudflare’s web application firewall
We periodically test our website and code for known threats and vulnerabilities using a variety of industry-standard security tools and practices
Platform data is backed up regularly on Linode infrastructure, with encrypted offline backup copies transmitted to Backblaze B2 cloud storage for disaster recovery purposes

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect personal information, we cannot guarantee absolute security.

If you believe you have discovered a security vulnerability in HamClubOnline, please review our Security Vulnerability Disclosure Policy for guidance on how to report it responsibly.

Section 9Data Retention

We retain your personal information for as long as your HamClubOnline account is active or as needed to provide services to the clubs you belong to. Expired member records may be retained in club databases at the discretion of club administrators. If you request deletion of your account, we will delete or anonymize your personal information within a reasonable time, except where retention is required by applicable law or legitimate club record-keeping purposes.

Club accounts that have had no recorded activity for a continuous period of 24 months may be removed from the Service in accordance with our Terms of Service. Club administrators of inactive accounts are notified prior to removal where contact information is available and current. Following removal of an inactive club account, recovery of club data cannot be guaranteed. Club administrators are encouraged to maintain regular data exports as described in the Terms of Service.

Club administrators may also voluntarily request removal of their club from the platform at any time by contacting [email protected]. Upon inactivation of a voluntarily removed club, all data associated with that club is subject to the standard retention periods described in this section. Data categories that would otherwise be retained indefinitely — including club membership records, financial records, election records, and asset records — will be deleted 24 months after the date of inactivation. Email and SMS opt-out records are retained in accordance with CAN-SPAM and TCPA requirements following inactivation.

Club membership records and financial records — including dues payment history, transaction references, and membership status history — are retained indefinitely to support club record-keeping, financial reporting, and audit requirements. These records represent the historical operational data of each club and are maintained at the direction of club administrators. Where deletion of a record would cause data integrity issues — such as account balances or interdependent records becoming inaccurate — personal identifying information will be removed from the record while non-identifying data necessary to maintain integrity is retained.

Club election records — including participation tokens, aggregate vote tallies, and election configuration data — are retained indefinitely to support club governance, dispute resolution, and historical record-keeping. As described in the Club Elections and Voting Privacy section, vote content is stored separately from member identity and individual vote selections cannot be traced back to any member at any point during or after retention.

Club asset records — including equipment descriptions, serial numbers, assignment history, and audit trails — are retained indefinitely to support the club’s ongoing asset management and historical record-keeping needs.

Repeater coordination records for clubs using the optional frequency coordination feature are retained indefinitely to support the historical coordination record of the coordinating body. Coordination records for retired repeaters are retained for 36 months from the date of retirement, after which they are deleted.

Security and activity logs are retained for 24 months from the date of each recorded event, after which they are deleted. Email delivery logs — including records of emails sent to member addresses and delivery status — are retained for 24 months and then deleted. Email opt-out events are retained in accordance with CAN-SPAM and applicable anti-spam law requirements. SMS and voice alert delivery logs — including records of messages and calls sent and delivery status — are retained for 24 months and then deleted. SMS and voice opt-out events are retained in accordance with TCPA requirements. Club file download attachment logs — including records of files downloaded by club administrators and members — are retained for 24 months and then deleted. TCPA consent records are retained for a minimum of 4 years after account closure in accordance with the TCPA statute of limitations.

Event attendance records — including RSVPs, check-ins, and participation history for club events — are retained for 36 months from the date of the event, after which they are deleted.

The following table summarizes the retention periods described in this section:

Data Category	Retention Period
Club membership records	Indefinite
Club financial records	Indefinite
Club election records	Indefinite
Club asset records	Indefinite
Email opt-out events	Indefinite (CAN-SPAM requirement)
SMS and voice opt-out events	Indefinite (TCPA requirement)
Active repeater coordination records	Indefinite
TCPA consent records	Minimum 4 years after account closure
Event attendance records	36 months
Retired repeater coordination records	36 months from date of retirement
Security and activity logs	24 months
Email delivery logs	24 months
SMS and voice alert delivery logs	24 months
Club file download attachment logs	24 months

Section 10Your Rights and Choices

10.1Access and Correction

You may log in to your HamClubOnline account at any time to review and update your personal information. For information controlled by your club administrator, contact your club administrator directly.

Club administrators may update the email address associated with a member’s record until that member has signed in to HamClubOnline and established a password. Once a member has activated their account by signing in and setting a password, the email address on the account is controlled by the member and can no longer be modified by a club administrator. After account activation, only the member themselves or HamClubOnline staff can update the email address associated with the account.

10.2Account Deletion

To request deletion of your HamClubOnline account and associated personal information, contact us at [email protected]. Note that certain membership records may be retained by your club administrator independently of your account status.

Where deletion of a record would cause data integrity issues — such as causing account balances, transaction histories, or other interdependent records to become inaccurate or inconsistent — we are unable to delete those records in full. In such cases, we will remove personal identifying information — such as name and email address — from the affected records while retaining non-identifying data necessary to maintain the integrity of the affected system. Financial records are one example where this approach may apply; transaction amounts and dates may be retained while identifying details are removed. Anonymized records of this nature are no longer associated with any identifiable individual.

10.3Email Communications

You may opt out of almost all email communications from HamClubOnline. The only emails that cannot be disabled are password reset emails and password changed notification emails, both of which are sent only in direct response to account security events and do not include an unsubscribe mechanism.

Please be aware that opting out of club communications may mean you do not receive email notification that a club election ballot is available for you to cast. If you have opted out of club communications and your club is conducting an election, you will need to log in to your HamClubOnline account directly to check for and cast any available ballot. Opting out may also mean you do not receive membership renewal reminders — if your membership lapses as a result, you will need to log in to your HamClubOnline account to renew. Opting out may additionally mean you do not receive event reminders for club events, activities, or meetings. HamClubOnline is not responsible for missed election participation, membership lapses, or missed events resulting from a member’s opt-out of club communications.

Every email sent through HamClubOnline — with the exception of password reset and password changed notification emails — includes an unsubscribe or opt-out mechanism in the email footer. Members may also manage their email notification preferences directly through their HamClubOnline account profile. To stop receiving a particular category of email communication, use the opt-out method provided in the footer of those emails, log in to your account and update your notification preferences, or contact us at [email protected] for assistance. Club administrators can configure which types of communications are sent by the club but cannot reverse or override an individual member’s opt-out. Once a member opts out, only the member themselves or HamClubOnline staff can reinstate their email subscription.

HamClubOnline periodically validates the email address reputation and deliverability of email addresses associated with member accounts. Email addresses identified as high risk, invalid, or undeliverable — including addresses associated with known spam traps, disposable email services, or repeated bounce or complaint signals — may be flagged. Accounts associated with flagged email addresses may be restricted from receiving or triggering email communications through the platform until a valid email address is provided. If you believe your address has been incorrectly flagged, please contact [email protected].

Please do not report HamClubOnline emails as spam to your email provider as a substitute for using the opt-out mechanisms provided. Spam reports damage the email sending reputation of the platform for all clubs and members. Members who no longer wish to receive club emails are asked to use the unsubscribe links in the email footer or update their notification preferences in their account profile. Repeated or abusive spam complaints against verified opt-in communications may result in review or suspension of email dispatch to that address.

10.4CAN-SPAM Act Compliance

HamClubOnline complies with the CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq.) in connection with commercial electronic mail messages sent through the platform. Our compliance practices include the following:

Accurate header information: All emails sent through HamClubOnline accurately identify the sender. The “From,” “To,” and “Reply-To” fields reflect the actual origin of the message and are not falsified or misleading.
Honest subject lines: Subject lines used in emails sent through HamClubOnline must accurately reflect the content of the message. Club administrators are prohibited from using deceptive or misleading subject lines.
Physical address: Every email sent through HamClubOnline — including both commercial and transactional emails, with the exception of password reset and password changed notification emails — includes a valid physical postal address in the email footer. While CAN-SPAM requires this only for commercial email, HamClubOnline applies this standard to all outbound email as a matter of policy.
Opt-out mechanism: Every commercial email includes a clear and conspicuous mechanism for recipients to opt out of future messages. Opting out is free and requires no more than a single action — clicking the unsubscribe link in the email footer or updating notification preferences through the HamClubOnline account profile. Email replies are directed to the sending club’s administrator and are not monitored by HamClubOnline for opt-out requests; to unsubscribe, use the link in the email footer, log in to your account, or contact us at [email protected].
Opt-out honored within 10 business days: We process opt-out requests within 10 business days of receipt. Once you opt out, we will not send you further commercial email messages. We cannot require you to pay a fee, provide information beyond your email address, or take any step other than sending an opt-out request. Club administrators cannot reverse or override a member’s opt-out. Only the member themselves or HamClubOnline staff can reinstate an email subscription following an opt-out.
Opted-out addresses not sold or transferred: Email addresses of users who have opted out of commercial communications are not sold, transferred, or provided to any third party for email marketing purposes.

10.5Transactional vs. Commercial Email

Most emails sent through HamClubOnline are transactional in nature — membership renewal notices, dues confirmations, event notifications, alert confirmations, and account security messages — and are largely exempt from CAN-SPAM’s commercial email requirements. Club newsletters sent through HamClubOnline are treated as commercial email for CAN-SPAM purposes regardless of their content. This means all newsletters include a valid physical address and an unsubscribe mechanism in the footer, and opt-out requests are honored within 10 business days.

Although transactional emails are largely exempt from CAN-SPAM footer requirements, HamClubOnline includes a valid physical address and unsubscribe mechanism in the footer of all outbound emails — including transactional emails — as a matter of policy. The only exceptions are password reset emails and password changed notification emails, which are account security notifications sent in response to specific account events and do not include an unsubscribe mechanism. All other emails sent through the platform carry the same disclosures and opt-out mechanism regardless of type.

By joining a club and providing your email address, you consent to receive club communications and newsletters from that club through HamClubOnline. Regardless of message classification, all outbound emails from HamClubOnline include a valid physical postal address and an opt-out mechanism in compliance with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.) and California’s anti-spam law (Cal. Bus. & Prof. Code § 17529 et seq.). You may opt out of club newsletters at any time using the unsubscribe mechanism in the email footer or by logging in to your HamClubOnline account and updating your notification preferences.

By joining a club and providing your email address, you also provide implied consent to receive event reminders and related event communications from that club through HamClubOnline. Event reminders are transactional in nature and are sent to facilitate club activities you may participate in as a member. You may opt out of event reminder communications at any time using the unsubscribe mechanism in the email footer or by logging in to your HamClubOnline account and updating your notification preferences.

Club administrators are responsible for ensuring that newsletter content complies with the CAN-SPAM Act and all applicable anti-spam laws. HamClubOnline’s indemnification provisions in our Terms of Service apply to CAN-SPAM violations arising from a club’s use of the platform.

Section 11Data Breach Notification

In the event of a security breach involving personal information stored in HamClubOnline, we will take prompt action to assess, contain, and remediate the breach. We will notify affected users and applicable state authorities in accordance with the data breach notification laws of the states in which affected members reside. All 50 U.S. states have enacted breach notification requirements, and our obligations vary by state.

As a California-based organization, we are subject to California’s breach notification statute as amended by SB 446, effective January 1, 2026. Under California law, we will notify affected California residents within 30 calendar days of discovering a qualifying breach. Where a breach affects more than 500 California residents, we will also notify the California Attorney General within 15 calendar days of notifying affected individuals. For residents of other states, we will provide notification consistent with the applicable law of their state, which may specify timelines ranging from 30 to 60 days or require notification without unreasonable delay.

Breach notifications will be delivered to the email address associated with your HamClubOnline account. If your account does not have a valid email address on file, we will use reasonable alternative means of notification. Notification will include a description of the nature of the breach, the categories of personal information involved, the steps we have taken to address the breach, and guidance on steps you may take to protect yourself.

If you have concerns about a potential security incident involving your personal information or your club’s data, please contact us immediately at:

K6VEC Amateur Radio Group, Inc. — Security
10 Sage Hill
Laguna Hills, CA 92653
United States
[email protected]

Section 12California Residents

HamClubOnline is operated by a California nonprofit corporation based in Laguna Hills, California. Although HamClubOnline serves amateur radio clubs throughout the world except where prohibited by law, California residents have specific rights under California law that are described in this section.

Under the California Online Privacy Protection Act (CalOPPA), California residents have the right to know what categories of personal information are collected, how that information is used, whether it is shared with third parties, and how they can review and request changes to their personal information.

As described in this policy, we collect contact information, amateur radio license data, club membership data, payment transaction references, and platform usage data. We use this information solely to provide the HamClubOnline service. HamClubOnline does not knowingly sell personal information, does not share personal information for cross-context behavioral advertising purposes, and does not use personal information for any purpose other than operating the HamClubOnline platform and fulfilling the charitable mission of K6VEC Amateur Radio Group, Inc.

To exercise your rights to access, correct, or request deletion of your personal information, or to file a privacy-related complaint, contact our Privacy Compliance Officer:

Privacy Compliance Officer
K6VEC Amateur Radio Group, Inc.
10 Sage Hill
Laguna Hills, CA 92653
United States
[email protected]

The California Consumer Privacy Act (CCPA) and its successor, the California Privacy Rights Act (CPRA), define a covered “business” under California Civil Code § 1798.140(d) as a legal entity organized or operated for the profit or financial benefit of its shareholders or owners. K6VEC Amateur Radio Group, Inc. is a recognized 501(c)(3) nonprofit public benefit corporation and is excluded from the definition of a covered business as a matter of law, independent of revenue or data processing thresholds. However, we are committed to honoring the spirit of those laws and will respond to access, correction, and deletion requests from California residents.

Section 13Residents of Other U.S. States

As of the date this policy was last updated, twenty U.S. states have enacted comprehensive consumer data privacy laws, with additional states expected to follow. The number of states with active laws changes as new legislation takes effect; for a current count, consult an authoritative tracker such as the IAPP’s U.S. State Privacy Legislation Tracker. Most of these laws explicitly exempt 501(c)3 nonprofit organizations such as K6VEC Amateur Radio Group, Inc. However, a growing number of states — including Colorado, Delaware, Maryland, Minnesota, New Jersey, and Oregon — do not provide a general nonprofit exemption and may apply to HamClubOnline depending on the number of residents of those states whose personal data we process.

Rather than attempt to track applicability thresholds state by state as our membership grows, we have elected to honor the core privacy rights established under those laws for all users regardless of state of residence. These rights include:

Right to access: You may request a copy of the personal information we hold about you.
Right to correction: You may request that we correct inaccurate personal information we hold about you. Members may also update most information directly through their HamClubOnline account.
Right to deletion: You may request that we delete your personal information, subject to our data retention obligations and the rights of your club administrator to maintain club records.
Right to opt out of data sales: HamClubOnline does not knowingly sell personal information. No opt-out is required, but you may confirm this with us at any time.
Right to non-discrimination: We will not discriminate against you for exercising any privacy right. Because the platform is free, there are no pricing consequences to exercising your rights.

To exercise any of these rights, contact our Privacy Compliance Officer at [email protected] or at the mailing address below. We will respond to verifiable requests within 45 days, with an extension of up to an additional 45 days where reasonably necessary. We may need to verify your identity before processing your request.

Privacy Compliance Officer
K6VEC Amateur Radio Group, Inc.
10 Sage Hill
Laguna Hills, CA 92653
United States
[email protected]

Section 14Children’s Privacy

HamClubOnline is not directed to children under the age of 13. We do not knowingly permit self-registration by anyone under 13. If we discover that an account has been self-registered by a user under 13 without verifiable parental consent, we will terminate that account and delete associated personal information.

Club administrators may add members of any age to the platform on behalf of their club, including minors. Club administrators are required to comply with the following when entering personal data for minors:

Under 13: Club administrators must obtain verifiable parental or guardian consent before entering any personal data for a child under 13, in compliance with the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq. Personal data for children under 13 must not be entered into the platform without such consent. Where consent cannot be obtained, the child’s data must not be added to the platform.
Ages 13 to 17: Club administrators must obtain parental or guardian consent before entering personal data for members between 13 and 17 years of age. This requirement is a platform policy of HamClubOnline and applies in addition to any obligations under applicable state law. Club administrators are responsible for maintaining records of consents obtained for minors and for ensuring that data entered for minors is handled in accordance with applicable law.

The FTC’s 2025 amendments to the COPPA Rule, effective June 23, 2025, explicitly prohibit indefinite retention of personal data collected from children under 13 and require operators to maintain a written data retention policy for such data. HamClubOnline’s data retention schedule, described in the Data Retention section of this Privacy Policy, governs all member data including data entered for minor members, and satisfies this requirement. Club administrators are responsible for ensuring that their own recordkeeping for consents obtained for minor members is maintained for as long as those records are needed and then disposed of appropriately.

HamClubOnline relies on club administrators to comply with these requirements and does not independently verify the age of individuals whose data is entered by club administrators. If you believe personal data for a child under 13 has been entered into the platform without verifiable parental consent, please contact us at [email protected] and we will take steps to remove that information.

Section 15Third-Party Websites

HamClubOnline may contain links to third-party websites, including the FCC ULS, PayPal, Square, Groups.io, and other external resources. This Privacy Policy applies only to the HamClubOnline platform. We encourage you to review the privacy policies of any third-party sites you visit.

Section 16Cookies and Tracking Technologies

16.1What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. They allow the website to recognize your browser, maintain your session, and remember certain information between pages. HamClubOnline uses cookies as described below.

16.2Cookies We Set

HamClubOnline sets the following cookies on the secure.hamclubonline.com application:

Session cookies: When you log in to HamClubOnline, a session cookie named PHPSESSID is placed on your device to maintain your authenticated session. This cookie contains a session identifier only — it does not store your password or personal information directly. Session cookies expire when you close your browser or are logged out due to inactivity. These cookies are strictly necessary for the platform to function. You cannot use any authenticated feature of HamClubOnline without accepting session cookies.

16.3Cookies Set by Third Parties

The following third-party services may set cookies or use similar tracking technologies when you access HamClubOnline:

Cloudflare: Cloudflare’s bot management and security services may set cookies on your device to distinguish legitimate users from automated or malicious traffic. These cookies may include the __cf_bm cookie used for bot management and the cf_clearance cookie set after a challenge is successfully completed. These are security infrastructure cookies. They do not track you for advertising purposes and are set to protect the platform and its users. Cloudflare’s cookie use is governed by Cloudflare’s privacy policy.
WordPress (HamClubOnline website at hamclubonline.com): The HamClubOnline website at hamclubonline.com may set cookies related to site preferences, session management, and any active WordPress plugins. These cookies are separate from those set by the HamClubOnline application at secure.hamclubonline.com.

16.4Cookie Categories

All cookies used by HamClubOnline and its infrastructure fall into the following categories:

Strictly necessary: Session and authentication cookies required for the platform to function. These cannot be disabled without preventing login and use of the Service.
Security: Cookies set by Cloudflare for bot detection and threat protection. These are not advertising cookies and do not track behavior across other websites.

HamClubOnline does not use advertising cookies, behavioral tracking cookies, or cookies that follow you across third-party websites. We do not share cookie data with advertising networks.

16.5Managing Cookies

You can manage or delete cookies through your browser settings. Most browsers allow you to view, block, or delete cookies through their privacy or settings menus. However, blocking or deleting session cookies will prevent you from logging in to HamClubOnline and using any features that require authentication. Instructions for managing cookies in common browsers can be found at the browser provider’s support pages.

16.6Do Not Track

Some browsers transmit a Do Not Track (DNT) signal to websites. HamClubOnline honors DNT signals to the extent practicable. Because HamClubOnline does not engage in cross-site behavioral tracking or advertising, enabling DNT has no material effect on your experience beyond what is already described in this policy. Session and security cookies required for platform functionality are set regardless of DNT status, as they are necessary for authentication and platform security rather than for tracking purposes.

California’s Online Privacy Protection Act (CalOPPA) requires websites to disclose how they respond to DNT signals. We disclose our practices here: HamClubOnline does not alter its data collection or use practices in response to DNT signals beyond the practices already described in this policy, because we do not engage in the type of cross-site tracking that DNT is designed to address.

Section 17Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date at the top of this page. Your continued use of HamClubOnline after changes are posted constitutes your acceptance of the revised policy. If you do not agree with a material change to this policy, you may request deletion of your account in accordance with the account deletion process described in our Terms of Service. We encourage you to review this policy periodically.

We make every effort to keep this policy accurate and current. However, this policy may contain errors or omissions. If you have questions about a specific provision or believe information in this policy is incorrect, please contact us at [email protected].

The data privacy regulatory landscape in the United States and internationally is evolving rapidly. New state privacy laws are being enacted and existing laws are being amended on an ongoing basis. We monitor applicable law and update our privacy practices and this policy as new obligations come into effect. The rights and disclosures described in this policy reflect the legal environment as of the Last Updated date shown above and will be revised as the law changes.

Section 18Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact:

K6VEC Amateur Radio Group, Inc.
10 Sage Hill
Laguna Hills, CA 92653
United States
[email protected]