Privacy Policy

Last updated: October 2026

This Privacy Policy explains how the Oregon Restaurant & Lodging Association ("ORLA," "we," "us," or "our") collects, uses, shares, and protects personal information when you use oregonalcoholserver.com (the "Site"), including our online Oregon alcohol server education course, exam, and completion reporting services. It also explains the privacy rights available to you, including under the Oregon Consumer Privacy Act (ORS 646A.570–646A.589).

1. Who We Are

ORLA is a nonprofit trade association serving Oregon's hospitality industry. ORLA is the controller of the personal information collected through this Site.

Oregon Restaurant & Lodging Association
8565 SW Salish Lane, Suite 120
Wilsonville, OR 97070
Phone: 503-682-4422
Email: [email protected]

2. Personal Information We Collect

Information you provide to us:

• Account and identity information: first and last name, username, email address, password (stored in encrypted form), and mailing address and phone number if you provide them.
• Date of birth: required by the OLCC to process alcohol server permits and to confirm you meet the minimum age.
• Training and completion information: course progress, exam attempts and scores, completion dates, and completion or certificate numbers.
• Purchase information: billing name and address, order details, and any coupon or employer code you use. Card payments are processed directly by our payment processor (Authorize.net). We do not store full card numbers on our Site.
• Communications: messages you send us, including support requests and conversations with the chat assistant on our Site.

Information collected automatically:

• Device and usage information: IP address, browser type, device type, pages visited, referring pages, and the date and time of your visits.
• Cookies and similar technologies: see Section 6.

We do not intentionally collect sensitive data as defined by Oregon law (such as health information, precise geolocation, or information about racial or ethnic origin, religion, sexual orientation, or citizenship or immigration status).

3. How We Use Personal Information

• To create and manage your account and deliver the training course and exam.
• To process payments and provide proof of course completion.
• To report your course completion to the OLCC, as required for your alcohol server permit. We send the OLCC your name, date of birth, completion date, and related identifiers.
• To provide customer support, including through our chat assistant.
• To send transactional messages, such as receipts, password resets, completion confirmations, and permit renewal reminders.
• To report course usage to employers or organizations that purchase or sponsor training for you, such as through a corporate coupon code.
• To send you information about ORLA programs, training, and resources (see Section 7).
• To protect the security and integrity of the Site, prevent fraud and abuse, and comply with legal obligations.
• To analyze and improve our Site, course, and services.

We will not use your personal information for purposes that are not reasonably necessary for, or compatible with, the purposes described in this Policy unless we first obtain your consent.

4. How We Share Personal Information

We do not sell your personal information. We do not share your personal information for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects.

We share personal information only with:

• Service providers (processors) who handle data on our behalf under contracts that limit how they may use it. These include web hosting and database providers, website security and content delivery providers, our payment processor, email delivery and customer support providers, our AI chat service provider, and the developers who maintain the Site.
• Employers or sponsoring organizations that pay for or provide a code for your training. We share only the information needed to confirm your enrollment or completion.
• The OLCC, to report your course completion as required by Oregon law.
• Government authorities or other parties when required by law, court order, or legal process, or when needed to protect the rights, property, or safety of ORLA, our users, or others.
• A successor organization in connection with a merger, reorganization, or transfer of the program, subject to this Policy.

You may request a list of the specific third parties to which we have disclosed personal data (see Section 9).

5. Data Retention

We keep course completion and order records for at least five years, as required for OLCC validation. We keep other account information for as long as your account is active and as needed to meet legal, tax, and accounting requirements, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it.

6. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your cart and course progress, protect the Site from abuse, and understand how the Site is used. You can set your browser to refuse or delete cookies, but some parts of the Site, such as login, the course, and checkout, will not work without them.

We honor Global Privacy Control (GPC) and similar universal opt-out signals. If your browser sends one, we treat it as a request to opt out of any sale of personal data or targeted advertising.

7. Email Communications (CAN-SPAM)

We send two types of email:

• Transactional and account email, such as receipts, completion confirmations, password resets, and permit renewal reminders. These relate to the service you requested and cannot be turned off while you have an account.
• Informational and promotional email about ORLA training, programs, and resources. ORLA complies with the federal CAN-SPAM Act. Every promotional email we send:
  • identifies ORLA as the sender, with accurate "From" and subject lines;
  • includes ORLA's valid postal address;
  • includes a clear way to unsubscribe.

You can unsubscribe at any time with the link in any promotional email or by emailing [email protected]. We process unsubscribe requests within 10 business days and do not sell or transfer email addresses of people who have opted out.

8. Age Requirement

The course is intended for people who meet the OLCC's minimum age for an alcohol server permit, and the Site is not directed to children. We do not knowingly collect personal information from children under 13, and we do not sell personal data of anyone under 16 or use it for targeted advertising. If you believe a minor has provided us information in error, contact us and we will delete it, except where we must keep it by law.

9. Your Privacy Rights

Subject to Oregon law, you have the right to:

• confirm whether we are processing your personal data and access it;
• get a list of the specific third parties to which we have disclosed your personal data, or to which we have disclosed personal data in general;
• correct inaccurate personal data;
• delete personal data we hold about you;
• get a copy of your personal data in a portable format;
• opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects (we do not engage in these activities);
• revoke any consent you have given us.

Some data may need to be kept even after a deletion request, for example, completion records we must keep for OLCC validation. We will tell you if this applies.

How to make a request: Email [email protected] with the subject line "Privacy Request," call 503-682-4422, or write to us at the address in Section 1. You can also update most account information yourself under My Account. We will verify your identity, usually by confirming details on your account, before acting on a request. An authorized agent may submit a request for you with your written permission.

We respond within 45 days. If we need more time, we may extend that by another 45 days and will tell you why. Requests are free, once per 12-month period. We will not discriminate against you for exercising your rights.

Appeals: If we deny your request, you may appeal by replying to our decision or emailing [email protected] with the subject line "Privacy Appeal" within 45 days. We will respond to your appeal within 45 days. If you are not satisfied with the outcome, you may contact the Oregon Department of Justice at doj.state.or.us/consumer-protection.

10. Data Security

We use administrative, technical, and physical safeguards to protect personal information. These include encrypted connections (HTTPS), encrypted password storage, restricted administrative access, firewall and login protections, and a PCI-compliant payment processor. No system is completely secure, but if a security breach affects your personal information, we will notify you as required by the Oregon Consumer Information Protection Act.

11. Links to Other Websites

The Site may link to websites we do not control, such as the OLCC. This Policy does not apply to those sites. Please review their privacy policies.

12. Changes to This Policy

We may update this Policy from time to time. We will post the updated version on this page with a new "Last updated" date. If we make material changes to how we use personal information, we will notify you by email or with a notice on the Site before the change takes effect.

13. Contact Us

Questions about this Policy or our privacy practices:
Oregon Restaurant & Lodging Association
8565 SW Salish Lane, Suite 120, Wilsonville, OR 97070
503-682-4422 · [email protected]