VARS Privacy Policy

1. Overview

VARS is a volunteer and event management system built for GeorgiaFIRST robotics events. This policy explains what information VARS collects, how it is stored and protected, who can access it, and what rights you have.

For most in-season FIRST Robotics events, volunteer information is imported into VARS after you apply and are accepted through FIRST Headquarters’ Volunteer Management System (VMS). In that case you do not register directly in VARS. For some offseason events or other programs, you may register or provide information directly through VARS. Either way, you acknowledge that your information will be handled as described here.

2. Information we may collect

Depending on how you interact with VARS, we may collect and keep information such as:

• Identity and contact: name, preferred name, email address, phone number.
• Role information: volunteer role, assigned team or event, positions applied for, availability, and answers to event questions.
• Logistics: meal selections, dietary needs, sizing, travel and lodging assignments.
• Event access: badge details and check-in/check-out and scan timestamps.
• Program status: FIRST youth protection and certification status, and coordinator notes.
• Accounts: coordinator/admin accounts use a username and password stored in hashed form, never in plain text. Volunteer Portal accounts use a simplified login tied to information already on file. The portal does not expose other volunteers’ information, except that a volunteer with lodging can see their assigned roommate’s name.
• Technical: device, browser, network and sign-in details used to keep the system working and secure.

We do not knowingly collect financial information, government ID numbers, or health information beyond basic dietary needs voluntarily provided for meal planning.

3. Minors

Some FIRST Robotics events involve participants and volunteers under 18. Where VARS holds information about a minor, it is provided by a parent, guardian or authorized event coordinator on the minor’s behalf and is used only for event logistics (badge, meals, check-in). We do not use minors’ data for any purpose beyond the event it was collected for, and we do not knowingly collect information directly from children under 13.

4. How we use information

• Assign and coordinate volunteer roles and shifts.
• Manage event logistics such as meals, lodging, badge printing and check-in.
• Communicate event-related updates and maintain records for event organizers.
• Meet legal, safety and program requirements, and resolve disputes.
• Protect the system, our volunteers and our events from misuse and other harm.

We do not sell, rent, or use your information for advertising or marketing.

5. Where your data is stored

VARS data is stored on Cloudflare’s secure cloud infrastructure, with Google services used for email delivery and backups. Access for coordinators and administrators is limited to designated people with individual credentials. We do not grant blanket access to volunteer data. The Volunteer Portal is a separate, lower-privilege system limited to a volunteer’s own meal, dietary and lodging information.

6. Sharing

• Event coordinators and staff who need information to assign roles or manage logistics.
• FIRST Robotics, event partners and service providers when needed to run events and programs, or when required by law.
• Service providers: Cloudflare (hosting and database), Google (email, backups, fonts), and a third-party AI service provider used for limited supporting features (for example processing dietary, lodging or event-related context). The AI feature is not core to VARS and does not receive authentication credentials or account security data.
• Public and roster pages show limited information only. Email addresses and phone numbers are never shown there or included in exports.

We do not share your information with sponsors or any third party for marketing or unrelated purposes, and we do not sell it.

7. How we contact you

Contact details usually come from FIRST HQ’s VMS after you are accepted for a role, and are imported into VARS to coordinate your participation. We may email you to:

• Confirm your role or event assignment.
• Send registration forms and logistics details (badge, meals, lodging, check-in).
• Send reminders about your upcoming event.
• Share program updates, new volunteer opportunities or grant/application windows.
• Send thank-you messages after an event.

Essential vs. non-essential: emails tied to your event registration or logistics are essential. Program updates, opportunity announcements and appreciation messages are non-essential and include an option to opt out. You may contact us any time to be removed from non-essential messages or from VARS entirely.

VARS is largely automated, so messages are generated from imported event and role data. If an email looks wrong (wrong event, wrong role), please tell us at vars@gafirst.org.

8. How long we keep it

We keep volunteer and event data only as long as reasonably necessary for the event and for historical record-keeping, such as year-over-year volunteer tracking. Backups are kept on a rolling basis. You may request deletion at any time, subject to records we must keep for event or safety purposes.

9. Your rights

• Request a copy of the information VARS holds about you.
• Request correction of inaccurate information.
• Request deletion of your data, subject to records we are required to keep.

To make a request, contact us using the details below.

10. How we protect your information

• VARS is protected by Cloudflare’s security infrastructure, including encryption in transit and network-level protections.
• Server-side authentication and authorization for sensitive operations; unauthenticated requests are rejected.
• Time-limited sessions and scoped access, so access expires and is limited to what a role needs.
• Restricted administrative functions with unique credentials, and a separate restricted-scope Volunteer Portal login.
• Audit logging, backups, and confidential credentials kept server-side and never exposed to public pages.
• Regular review of who holds admin access.
• People who handle volunteer data complete advanced data security training through FIRST Robotics.

These safeguards follow the principles of least privilege, data minimization and secure-by-default access.

Important: no system can be guaranteed 100% secure. Despite our safeguards, information could be lost, accessed, altered, used or disclosed without authorization through events outside our reasonable control. These statements describe safeguards we have implemented and are not a representation of formal certification, independent audit, or compliance with any particular statute or framework unless separately documented. If a breach affects your personal information, we will work to limit the impact and notify affected individuals and GeorgiaFIRST leadership as promptly as reasonably possible, and as required by law.

11. Cookies and local storage

We store a sign-in session and a few display preferences in your browser. They are needed for the site to work. We do not use advertising cookies or analytics trackers.

12. Your responsibilities

You agree to provide accurate information, keep your sign-in details private, and not misuse, copy, scrape or interfere with VARS or the information in it. You are responsible for activity under your account.

13. Consent

By applying, registering, signing in or otherwise using VARS, you consent to the collection, use and sharing of your information as described here, including event-related emails and messages.

14. Disclaimer of warranties

VARS is provided “as is” and “as available.” To the fullest extent permitted by law, GeorgiaFIRST makes no warranties, express or implied, about availability, accuracy, reliability or fitness for a particular purpose.

15. Limitation of liability

To the fullest extent permitted by law, GeorgiaFIRST, its directors, staff, volunteers, partners and service providers are not liable for any indirect, incidental, special, consequential or punitive damages, or for loss of data, profits or opportunity, arising from your use of VARS or from events outside our reasonable control, including outages, third-party failures, or unauthorized access despite our safeguards. Where liability cannot be excluded, it is limited to the maximum extent permitted by law.

16. Indemnification

To the extent permitted by law, you agree to hold harmless GeorgiaFIRST and its directors, staff, volunteers and partners from claims arising from your misuse of VARS or violation of this policy.

17. Legal requirements

We may access, preserve or disclose information when we believe it is required by law, legal process or a government request, or is necessary to protect the rights, safety or property of GeorgiaFIRST, our volunteers, participants or the public.

18. Other sites

VARS may link to other websites or services with their own policies, which we do not control.

19. Governing law and disputes

This policy, and any questions relating to it, are governed by the laws of the State of Georgia, USA, without regard to conflict-of-law principles. Disputes will be brought in the state or federal courts located in Georgia, and you consent to that jurisdiction. If any part of this policy is found unenforceable, the rest remains in effect.

20. Changes to this policy

We may update this policy at any time. The “Last updated” date reflects the most recent version, and continued use of VARS means you accept the updated policy.

21. Contact

For questions about this policy, or to make any system, data, access or deletion request, contact GeorgiaFIRST at vars@gafirst.org.