Privacy Policy

myWaypoint (fka Credit Counseling Center)
a Pennsylvania nonprofit organization

Effective Date: September 27, 2026

1. Purpose of this Privacy Policy

myWaypoint (“myWaypoint,” “we,” “us,” or “our”) respects the privacy and confidentiality of individuals who interact with our organization.

We provide nonprofit credit counseling, financial education, budgeting assistance, debt counseling, bankruptcy counseling and related services, primarily in Pennsylvania. In connection with these activities, we may receive sensitive personal and financial information concerning individuals seeking assistance with their finances.

myWaypoint does not provide, administer, or operate debt-management plans (“DMPs”) and does not receive or distribute payments to creditors on behalf of clients as part of a debt-management plan.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information. It applies to information concerning:

  • prospective and current credit counseling clients;
  • individuals who contact us for information or assistance;
  • individuals who participate in educational programs or other services;
  • visitors to our websites and online services;
  • donors and prospective donors;
  • supporters and community partners;
  • volunteers;
  • officers and directors;
  • employees and prospective employees; and
  • contractors and service providers, as applicable.

Certain information concerning clients and prospective clients may be subject to the federal Gramm-Leach-Bliley Act (“GLBA”), including its Privacy Rule and Safeguards Rule. Where GLBA applies, we comply with the applicable requirements governing the privacy and security of nonpublic personal information.

This Privacy Policy is intended to supplement, and not replace, any specific privacy notice or consent that we may provide in connection with a particular service or transaction.

2. Information we collect

Depending on our relationship with you and the services you receive or request, we may collect information including:

A. Identification and contact information
  • name;
  • mailing address;
  • telephone number;
  • email address;
  • date of birth;
  • identification information; and
  • other contact information.

B. Financial information

For credit counseling and related services, we may collect:

  • Social Security number;
  • income and employment information;
  • bank and financial-account information;
  • account balances;
  • credit-card information;
  • loan information;
  • mortgage information;
  • housing information
  • debt information;
  • employment information;
  • payment history;
  • creditor information;
  • credit reports and credit scores;
  • information concerning assets and liabilities;
  • information concerning household finances, including household composition;
  • demographic information (e.g., race/ethnicity, preferred language, marital status, veteran status, gender, citizenship, education level, etc.); and
  • other information reasonably necessary to provide requested counseling or financial education services.

C. Information concerning services

We may collect information concerning:

  • counseling sessions;
  • financial assessments;
  • budgets and financial worksheets;
  • debt and credit obligations;
  • communications with counselors;
  • credit reports;
  • educational programs;
  • service preferences; and
  • other information necessary to provide our services.

D. Donor and supporter information

For donors and supporters, we may collect:

  • name and contact information;
  • donation history;
  • payment information;
  • correspondence;
  • event participation;
  • communication preferences; and
  • information necessary to process and acknowledge donations.

E. Employment and organizational information

For employees, applicants, officers, directors, volunteers, and contractors, we may collect information necessary for employment, volunteer service, governance, compliance, compensation, benefits, background screening, administration, and other legitimate organizational purposes.

F. Website and electronic information

When you use our website or online services, we may collect information such as:

  • IP address;
  • browser type;
  • device information;
  • operating system;
  • pages visited;
  • referring website;
  • dates and times of visits;
  • information submitted through online forms; and
  • other technical information collected through cookies, analytics, or similar technologies.

See our separate Cookie Policy for more information: Cookie Policy

3. How we collect information

We may collect information:

  • directly from you;
  • from applications and forms you complete;
  • during counseling sessions;
  • through telephone, email, mail, or other communications;
  • from creditors or financial institutions when appropriate and authorized;
  • from consumer reporting agencies;
  • from service providers;
  • from public records;
  • through our website and online services;
  • from donors and fundraising activities;
  • from employees and applicants; and
  • from other sources as permitted by law.


We collect only information that we reasonably believe is necessary or appropriate for legitimate organizational, legal, regulatory, operational, service, or security purposes.

4. Nonpublic personal information under the GLBA

For purposes of the GLBA, “nonpublic personal information” or “NPI” generally includes personally identifiable financial information that is not publicly available and that is obtained in connection with providing financial products or services.

Examples may include information about your income, debts, account balances, credit history, Social Security number, financial accounts, payment history, and information obtained from a consumer reporting agency.

We treat NPI with heightened confidentiality and security. 

5. How we use information

We may use personal information for legitimate purposes, including:

  • providing credit counseling and financial education;
  • evaluating an individual’s financial circumstances;
  • preparing budgets and financial assessments;
  • providing debt and credit counseling;
  • reviewing credit reports and credit information;
  • providing referrals or information concerning other financial resources;
  • communicating with clients concerning requested services;
  • providing requested services;
  • responding to questions and requests;
  • maintaining client and organizational records;
  • administering donations and fundraising;
  • processing employment and volunteer matters;
  • maintaining and improving our website;
  • conducting organizational analytics and quality assurance;
  • preventing fraud and unauthorized activity;
  • protecting our clients, employees, systems, and property;
  • complying with legal and regulatory requirements;
  • responding to subpoenas, court orders, or governmental requests;
  • enforcing agreements and organizational policies; and
  • performing other activities permitted or required by law.


We do not use sensitive financial information and nonpublic personal information for unrelated purposes without appropriate authorization or another lawful basis.

6. When we may disclose information

We do not sell clients’ nonpublic personal information.

We may disclose personal information, including NPI, when permitted or required by law or when necessary to provide requested services.

Depending upon the circumstances, disclosures may include information provided to:

A. Service providers

We may disclose information to vendors and service providers that perform services for us, such as:

  • information-technology providers;
  • secure document-storage providers;
  • payment processors;
  • software providers;
  • mailing and communications providers;
  • accounting and auditing professionals;
  • legal counsel;
  • consultants;
  • cybersecurity providers; and
  • other contractors necessary to operate our organization.

When appropriate, we require service providers to protect information and use it only for authorized purposes.

B. Creditors, lenders, and financial institutions

In providing credit counseling, we may communicate with creditors, lenders, financial institutions, or other entities concerning a client’s financial circumstances when reasonably necessary to provide requested services and when authorized by the client or otherwise permitted by applicable law.

Such communications are not part of a debt-management plan because myWaypoint does not provide or administer debt-management plans.

C. Consumer reporting agencies

We may obtain information from consumer reporting agencies as permitted by applicable law and as necessary to provide requested services.

We may also provide information to consumer reporting agencies when authorized by the client or otherwise permitted or required by law.

D. Client-authorized parties

We may disclose information to third parties when you specifically authorize or direct us to do so.

E. Referrals and third-party resources

When requested or appropriate, we may provide information or referrals concerning other organizations, programs, professionals, or financial resources.

We will disclose client information to another organization or professional only when authorized by the client, permitted by law, or otherwise appropriate under applicable legal requirements.

F. Legal and regulatory purposes

We may disclose information when reasonably necessary or required to:

  • comply with federal, state, or local law;
  • respond to a subpoena or court order;
  • respond to a government investigation or regulatory inquiry;
  • comply with legal process;
  • protect the rights, property, or safety of myWaypoint or another person;
  • investigate suspected fraud or unlawful activity; or
  • otherwise comply with applicable law.

G. Aggregated Information

We may aggregate and anonymize information you give to us with that of other clients for the purpose of evaluating our services, gathering valuable research information and designing future programs.

7. GLBA opt-out rights

Where required by the GLBA Privacy Rule, we will provide eligible consumers with notice of their right to opt out of certain disclosures of nonpublic personal information to nonaffiliated third parties.

Certain disclosures are not subject to the opt-out requirement. These may include disclosures necessary to effect, administer, or enforce a transaction requested or authorized by the consumer; disclosures to service providers performing services on our behalf; disclosures required or permitted by law; disclosures for fraud prevention or detection; and other disclosures permitted under applicable law.

If an opt-out right applies to information we hold about you, we will provide the required notice and instructions for exercising that right.

You may contact us using the information in Section 20 of this Privacy Policy with questions concerning your GLBA privacy rights.

8. Information security

We maintain an information-security program designed to protect the confidentiality, integrity, and availability of information in our possession.

Our safeguards may include, as appropriate:

  • access controls;
  • authentication procedures;
  • multifactor authentication where appropriate;
  • encryption;
  • secure transmission methods;
  • physical security controls;
  • employee confidentiality obligations;
  • security awareness training;
  • vendor and service-provider oversight;
  • system monitoring;
  • vulnerability management;
  • backup and recovery procedures;
  • secure disposal procedures;
  • incident-response procedures; and
  • periodic assessment and improvement of our security practices.

Access to sensitive information is limited to persons who have a legitimate business, service, legal, or organizational need to access it.

Our security practices are reviewed and updated as appropriate in response to changes in technology, threats, legal requirements, and organizational operations.

9. Employee and representative confidentiality

Employees, officers, directors, volunteers, contractors, and other representatives who have access to confidential information are expected to maintain the confidentiality of that information.

Access to client information is limited according to job responsibilities and legitimate business need.

Personnel may not access, use, copy, disclose, or retain confidential client information except as authorized by myWaypoint and applicable law.

Violations of confidentiality requirements may result in disciplinary or other appropriate action.

10. Website privacy

As referenced in Section 2.F. above, our website may collect limited technical information automatically when you visit.

We may use this technical information, including cookies and similar technologies, pursuant to our separate Cookie Policy.

We do not intentionally collect sensitive financial information through ordinary website browsing.

11. Online applications and secure communications

If we offer an online client portal or other secure electronic service, information submitted through that service may be protected by additional authentication and security measures.

You are responsible for maintaining the confidentiality of your account credentials and for promptly notifying us if you believe your account has been accessed without authorization.

We will never ask you to disclose your password through an unsolicited email.

Individuals should not submit Social Security numbers, bank-account numbers, credit-card numbers, passwords, or other highly sensitive information through ordinary email.

Where sensitive information must be submitted electronically, we will use secure methods when reasonably available, including via secured website forms.

12. Donors and supporters

We respect the privacy of donors and supporters.

We may use donor information to:

  • process and acknowledge contributions;
  • maintain appropriate financial records;
  • communicate about donations;
  • provide information about our programs and activities;
  • administer fundraising activities; and
  • comply with legal and accounting requirements.

We do not sell or rent donor mailing lists containing personal information.

Unless otherwise disclosed or authorized, we will not publicly identify an individual donor by name in a manner that suggests an endorsement or contribution without appropriate permission, except where disclosure is required by law or the donor has otherwise made the information public.

13. Employees, applicants, officers, directors, and volunteers

Personal information concerning employees, applicants, officers, directors, and volunteers is collected and used for legitimate organizational purposes, including:

  • recruitment;
  • employment administration;
  • payroll;
  • benefits;
  • tax reporting;
  • background screening where permitted;
  • scheduling;
  • performance management;
  • governance;
  • legal compliance;
  • insurance;
  • safety;
  • organizational communications; and
  • other legitimate administrative purposes.

Such information is handled in accordance with applicable law and organizational policies.

14. Information about former clients

We continue to protect confidential information concerning former clients in accordance with applicable law and our information-security and records-retention practices.

We do not disclose former clients’ nonpublic personal information except as permitted or required by law or as otherwise authorized.

15. Data retention and secure disposal

We retain information for as long as reasonably necessary to fulfill the purposes for which it was collected, satisfy legal and regulatory requirements, resolve disputes, maintain appropriate business and financial records, and enforce agreements.

When information is no longer required and may appropriately be destroyed, we use reasonable measures designed to prevent unauthorized access or reconstruction.

Retention periods may differ depending upon the type of information and our legal and operational obligations.

16. Security incidents and data breaches

We maintain procedures for identifying, investigating, responding to, and documenting suspected or confirmed security incidents.

If a security incident results in unauthorized acquisition or disclosure of personal information, we will evaluate the incident and provide notices when required by applicable federal or state law.

17. Children’s information

Our services are generally directed toward adults.

We do not knowingly collect personal information from children through our website or other methods.

If we learn that we have collected information from a child in circumstances where parental consent or another legal basis was required by applicable law, we will take reasonable steps to address the situation in accordance with applicable law.

18. Third-party websites and services

Our website may contain links to websites or services operated by third parties.

We are not responsible for the privacy or security practices of third-party websites.

We encourage users to review the privacy policies of third-party websites before providing personal information.

19. Your privacy choices and requests

Depending on the nature of our relationship with you and applicable law, you may contact us to:

  • ask questions about our privacy practices;
  • request information concerning how we use or disclose your information;
  • update inaccurate contact information;
  • request that certain communications cease;
  • exercise an applicable GLBA opt-out right;
  • raise a privacy or confidentiality concern; or
  • report a suspected unauthorized disclosure.

Some requests may be subject to legal, regulatory, contractual, or record-retention limitations.

We may need to verify your identity before responding to requests involving confidential information.

20. How to contact us

Questions, privacy requests, or concerns should be directed to:

myWaypoint
Telephone: 215-348-8003
Email: info@mywaypoint.org

Please do not send Social Security numbers, complete bank-account numbers, passwords, or other highly sensitive financial information by ordinary email.

21. Changes to this privacy policy

We may revise this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or privacy practices.

When we make material changes, we will provide notice as required by applicable law.

The effective date shown at the beginning of this Privacy Policy indicates when the current version became effective.

22. Applicable law

This Privacy Policy is intended to be interpreted consistently with applicable federal and state law.

Nothing in this Privacy Policy is intended to limit any privacy right or protection that cannot lawfully be waived or restricted.

Where federal or state law imposes a greater privacy or security obligation than described in this policy, myWaypoint will comply with the applicable legal requirement.

23. Separate information-security program

This Privacy Policy describes our public privacy practices. It does not constitute our complete internal information-security program.

myWaypoint maintains internal policies and procedures governing information security, risk assessment, access controls, employee training, incident response, vendor management, secure disposal, and other safeguards as required or appropriate to our operations.

24. GLBA annual privacy notice

For individuals who are entitled to receive a GLBA annual privacy notice from myWaypoint, we will provide the disclosures required by applicable law, including how we collect, use, share and protect your nonpublic personal information, and any applicable opt-out rights.

Where permitted by law, myWaypoint may provide the annual notice electronically or through another legally permissible method.