Privacy

Who is responsible

DRHS Band Parent Organization, an Arizona nonprofit corporation, at 9221 E Baseline Rd, Ste A109 Box 240, Mesa, AZ 85209-8314. For anything on this page, write to board@desertridgebands.org.

What we collect

Browsing this site does not require you to tell us anything. We do not run analytics, we do not build profiles, and we do not track you across other sites.

Our host keeps standard server logs, which include your IP address, the page you asked for, and your browser type. Those exist to keep the site running and to spot attacks.

If you email us or use a contact form, we get whatever you put in it. That is normally your name, your email address, and your message.

Photographs of students appear on this site. That is covered separately on the photo and media page.

Why, and on what basis

Server logs: our legitimate interest in keeping the site available and secure. Messages you send us: to answer you, which is your consent and our legitimate interest in running a band program. Photographs: the school district’s annual media release, which parents complete each year.

We do not make automated decisions about you and we do not profile you.

Who else sees it

Vercel hosts this site and processes server logs on our behalf. Resend delivers messages sent through our contact form to the board’s inbox, on our behalf. Our calendar page links out to CutTime, where the band keeps its schedule — nothing loads from CutTime until you follow that link, and once you do you are on their site under their privacy notice, not ours. If you say yes to cookies, Google Analytics counts your visit, and any video or map we show you comes from YouTube or Google. Nobody else receives your information.

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We never have, and there is no version of this site where that changes.

Where it goes

We are in Arizona and our systems are in the United States. If you are writing to us from the European Economic Area or the United Kingdom, your information is transferred to the US. We rely on your explicit consent for that transfer, which you give by choosing to contact us.

How long we keep it

Our host keeps standard server logs and sets how long to hold them. On the plan this site runs, that is about an hour. We do not keep a copy of our own, so once the host discards them there is nothing left for anyone to retrieve or delete.

Messages you send us are kept for as long as the conversation is useful and no longer than one school year, unless you have asked us something we need to keep on file. Ask us to delete yours sooner and we will. Resend, which delivers contact form messages, keeps its own record of each one for 30 days and then deletes it.

Your rights

These are the rights the European General Data Protection Regulation gives people it covers. We extend all of them to everyone who contacts us, wherever you live.

• Ask what we hold about you and get a copy of it.
• Have anything wrong about you corrected.
• Have it deleted.
• Ask us to stop using it while a dispute is sorted out.
• Get it in a portable format, or sent to someone else.
• Object to us using it at all.
• Withdraw consent whenever you like, without it affecting what we did before you withdrew.

Email the board address above. We will reply within 30 days and we will not charge you or treat you differently for asking.

If you are in California

California law gives residents specific rights, and while it applies to for-profit businesses rather than nonprofits like us, we honour them anyway.

• Know what categories of personal information we have collected, where it came from, and why.
• Get a copy of it.
• Have it deleted.
• Have it corrected.
• Opt out of sale or sharing. There is nothing to opt out of, because we do neither.
• Limit how we use sensitive personal information. We do not collect any.
• Not be discriminated against for exercising any of this.

In the past twelve months we have collected identifiers such as name, email address, and IP address, and the contents of messages people chose to send us. We collected them from those people directly, and from our host’s server logs. We used them to answer messages and keep the site running. We disclosed them only to the service providers named above, which handle them on our behalf.

Cookies and embedded content

Nothing is set until you say yes. A notice on your first visit asks, and until you answer, no cookie is written and nothing loads from anywhere but this site. You can change your answer any time from the link in the footer, and saying no later removes what saying yes allowed.

Say yes and Google Analytics writes one cookie, on this site’s own address rather than Google’s, to count how many people read which pages. It does not tell us who you are and we do not combine it with anything else. Say no and it is never loaded at all.

Say yes to videos and maps and we may show you a video from YouTube or a map from Google, and those set their own cookies when they load. We say may because there are none on the site today and we expect to add them. Say no and they are replaced by a link, which sets nothing until you follow it.

The calendar is not one of them. Our server asks Google for the events and sends you the finished page, so opening it tells Google nothing about you and sets no cookie, whatever you answered. If you would rather read it at the source, it is on Google’s own site, where their terms apply and ours do not.

We do not sell or share your personal information, so there is nothing here to opt out of under California law. The links to our Facebook, Instagram, and X accounts are ordinary links: nothing from those services runs on this site, and they hear from you only if you follow one.

Children

This site is written for parents and students at a high school. It is not directed at children under 13 and we do not knowingly collect anything from them. If you believe a child under 13 has sent us something, email us and we will delete it.

If something goes wrong

If our host suffers a breach affecting Arizona residents, Arizona law requires us to notify affected people within 45 days, and to notify the Attorney General and the credit bureaus if it reaches 1,000 people. We will do that.

If you are in the EEA or UK and think we have handled your information badly, tell us first, then complain to your national data protection authority if we have not fixed it. You do not need our permission to go to them.

Changes

If this page changes materially we will say so here rather than quietly revise it.

Last updated 28 September 2026.