FARA’s Policies

This Privacy Policy (“Policy”) is provided by The Friedreich’s Ataxia Research Alliance (“FARA,” “we” or “our”) and applies to all users of our website, https://curefa.org/ (“Website”), and our social media accounts. For information on how we use other Personal Information collected from donors to FARA, please see “Donor Privacy” Section below. 

We take your privacy very seriously.  Please read this Policy carefully as it contains important information on who we are, how and why we access, collect, process, store, use and share your personal information, which is any information that may be associated with a particular individual (“Personal Information”).   

CHANGES TO THIS POLICY

We reserve the right to amend this Notice at our discretion and at any time. When we make material changes, we will notify you in a manner in which we regularly interact with you, such as by email, or through a notice on our Website’s homepage.  You will also be able to determine the date that our current Policy has become effective, by viewing the Effective Date at the top of this document. 

FARA’s  computer systems are based primarily in the United States and the content of our Website is directed to U.S. residents and is not directed to residents of other countries. FARA closely collaborates with FARA Europe in our mission to focus resources and relationships to cure Friedreich’s ataxia. While FARA does not market our services to non-U.S. residents, under certain circumstances we may collect or process personal information of non-U.S. residents.  Below are the situations in which FARA may collect personal information of non-U.S. residents: 

• FA Global Patient Registry –Individuals with FA (or parents of children with FA) residing anywhere in the world have an ability to enter their personal data into the FA global registry platform, subject to their informed consent.  Enrollment into the FA Global Patient Registry allows individuals to receive recruitment notices for any clinical trials for which they may be eligible and allows individuals to be kept up-to-date on the progress of clinical trials. The FA Global Patient Registry data is operated by our service providers pursuant to data sharing agreements, with data stored in Canada and accessed by FARA employees in the US and FARA Europe in Europe.  

• FARA grant program - Researchers throughout the world may apply for FARA grants. As part of their application, researchers share their name, work email, work phone, work address. This information is shared with FARA’s Scientific Review Board and the Board of Directors for the purposes of review of the grant applications. Data collection for the FARA grant program  is operated by our service provider pursuant to a data sharing agreement with FARA, with data stored in the US. 

• FARA Ambassador program - This is a voluntary program, where individuals who have FA can become spokespeople for FARA, contributing blogs, speaking at events, thanking donors, and participating in similar engagements. FARA collects the following personal information from Ambassadors: name, address, contact information. Individuals may voluntarily provide their date of birth at their election, in order to receive a greeting card from FARA on their birthday.  

If you visit our Website or subscribe to our services, including FA Global Patient Registry, we will collect and process your personal data in the United States, where data protection and privacy regulations may or may not be equal to the level of protection as in other parts of the world, such as in Canada and the European Union. BY VISITING OUR WEBSITE OR SUBSCRIBING TO OUR SERVICES, YOU UNEQUIVOCALLY AND UNAMBIGUOUSLY CONSENT TO THE COLLECTION AND PROCESSING IN THE UNITED STATES OF YOUR PERSONAL INFORMATION COLLECTED OR OBTAINED BY US THROUGH YOUR VOLUNTARY SUBMISSIONS, AND THAT UNITED STATES LAW GOVERNS ANY SUCH COLLECTION AND PROCESSING. 

We may collect, use, and/or share some or all of the following Personal Information categories:  

• Identifiers, such as your name, preferred alias, address, email address, telephone number, e-contact, account name and similar identifiers, age, t-shirt size;  

• Transactional history, such as records of transactions; donations; event registration; and emails intended for FARA; 

• Internet activity, such as browsing history, IP address, search history, cookies and similar technologies, information about your browser and operating system, information on a consumer’s interaction with a website, application, or advertisement.  

• Financial information, such as partial debit or credit card information to facilitate transactions and donations made to FARA.  

• Sensitive information, such as certain limited medical diagnosis information from individuals with FA that our programs support that individuals input into FA Global Patient Registry. Limited genetic testing information may be provided by individuals through the FA Global Patient Registry. Additionally, with respect to participants in our Ambassador program, Ataxian Athlete Initiative (AAI) and/or advocacy program, we collect information on ataxia diagnosis, which is self-reported by applicants.   

This Personal Information is required to provide services to you and information that may be of interest to you, such as research to reach treatments and cures for FA, as well as to provide education, raise funds for research, and promote public awareness.  If you do not provide the Personal Information we ask for, it may delay or prevent us from providing services to you. 

We collect the majority of your Personal Information directly from you through our Website, and, under certain circumstances, via our web store service provider when providing the products you request from us, via email, a form on our Website, by telephone or at in-person or virtual events. We may also supplement the data collected through our Website with Personal Information from data analytics providers in order to understand how our Website visitors engage with our content and to improve our content.  

PURPOSES OF COLLECTION 

FARA’s mission is to marshal and focus the resources and relationships needed to cure Friedreich’s Ataxia by raising funds for research, promoting public awareness, and aligning scientists, patients, clinicians, government agencies, pharmaceutical companies and other organizations. We may collect Personal Information in furtherance of these objectives for the following purposes: 

• To provide the services you request from us and products you purchase from our online store, which is operated on our behalf by our service provider; 

• To process donations; 

• To communicate with you and/or your authorized representatives about the requested products or services; 

• To personalize, troubleshoot or improve our online content and experiences; 

• To market and inform you about FARA’s projects; 

• To comply with our legal obligations and to enforce our rights; 

• To combat fraud and prosecute bad actors. 

We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you with an advance notice, including by updating this Policy.  

NO SALE OF PERSONAL INFORMATION 

We do not sell your Personal Information and have not sold your Personal Information to any third party in a traditional sense of that term. However, as some laws broadly interpret the term “sale” to include any sharing of personal information to third parties in exchange for any valuable consideration, please note that we may allow certain third parties, such as data analytics or online advertising service providers, to collect information about your browsing activity on our Website. For more information about these practices and how to limit information-sharing with third parties, see Cookies and Similar Technologies section below.  

We may disclose your Personal Information if required to do so by law or in the good-faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on us, (b) protect and defend our rights or property or our customers or users, or (c) under exigent circumstances to protect the personal safety of our users, customers, or the general public. 

FARA may disclose or share some, or all, of the Personal Information we collect about you to third parties such as service providers who aid us in processing and protecting your Personal Information to host the Website, send email or other communications, manage our events, generate leads, raise funds, process payments, maintain financial accounting, provide analytics and advertising services. Our service providers are given only that Personal Information they need to perform their designated functions, and we do not authorize them to use or disclose Personal Information for any other purposes. 

Additionally, our online store, https://www.bonfire.com/store/curefa/ (“Store”), is operated by Bonfire Funds, Inc. When you make purchases from the Store, including via clicking on the link “Shop the FARA Store” on our Website, your personal information necessary to process the purchase will be collected directly by Bonfire Funds, Inc. subject to their privacy policy, available at https://www.bonfire.com/privacy-policy/.  When you make a purchase from the Store, the funds go to Bonfire Funds, Inc. and they fulfill the order. FARA has access to a report on the Bonfire website that lists the purchaser’s name, email address, phone number, mailing address, the amount of the purchase and of any applicable fees, and the percentage that FARA will receive from the sale of the merchandise. All merchandise is maintained and supplied by Bonfire Funds, Inc.  

We may aggregate data we acquire about our Website visitors.  If we aggregate such data and provide it to external parties, our customers’ Personal Information will not be attached to or included in such aggregated data. 

This privacy notice should be read in conjunction with our Privacy Policy. This section is intended to inform European residents of their rights and to provide disclosures as required under European Union’s (“EU”) General Data Protection Regulation (“GDPR”). FARA is the data controller for the Website and/or app you are currently accessing. For more information on how to contact us, please see section labeled “Contact Information” below. 

For information on what personal data we collect and for what purposes, please go to the section labeled “Information We May Collect and Use” and “Purposes of Collection” in our Privacy Policy. 

For more information on how we collect personal data, please go to the section labeled “How Your Personal Information Is Collected” and “Territoriality”.  

For information on what personal information we may disclose to third parties, please go to the section labeled “Sharing Your Information.” 

For more information on what are cookies, how FARA uses cookies, what types of cookies we use, and how to manage your cookies, please go to the section labeled “Cookies and Similar Technologies”. 

To exercise your rights, please go to the section labeled “Data Protection Officer Contact Information & How to Exercise Your Rights.” 

LEGAL BASIS FOR PROCESSING DATA 

We recognize that your personal data belongs to you, and you have the right to control how it is used. Therefore, we rely on your freely given, informed, and explicit consent as the lawful basis for processing your personal data. 

When you provide your consent, you are granting us permission to process your personal data for specific purposes that are set forth in our Privacy Policy and clearly explained to you at the time of data collection. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. 

Here are some key points to understand about consent as the basis for processing personal data: 

Voluntary Consent: Your consent is entirely voluntary, and you are not obligated to provide it. If you choose not to consent or withdraw your consent, it may limit our ability to provide certain services or engage with you in specific ways. 

Informed Consent: We will provide you with clear and accessible information about the processing activities that require your consent. This information will include the purposes of processing, the types of data involved, and the duration for which your consent is valid. 

No Pre-Ticked Boxes: We will not use pre-ticked boxes or other default settings that assume your consent. You will actively and affirmatively provide consent through a clear and unambiguous action, such as ticking a box, clicking a button, or signing a consent form. 

Withdrawal of Consent: You have the right to withdraw your consent at any time by contacting us using the contact details provided in this Privacy Policy. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. 

EUROPEAN RESIDENT’S RIGHTS AND CHOICES 

This section describes your privacy rights if you live in the European Union and how to exercise those rights. 

If you no longer wish to receive communications from us, please contact info@curefa.org. You can also unsubscribe at any time from emails we may send to you related to FA that we think will be of interest to you. 

Right to Access 

EU residents have the right to request a copy of the information we hold about you. Before we provide a substantive response to your request for information, we will verify your identity to make certain you are who you say you are. We will respond within 30 days of receiving your written request. 

We will not disclose in response to an access request your government-issued identification number, financial account number, health insurance or medical identification number, an account password, or security questions and answers. We will, however, inform you or your representative with sufficient particularity if we have collected that type of information.  

Right to Erase 

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, permanently and completely erasing your personal information from our existing systems, except archive or backup systems, or de-identifying the personal information such that it cannot reasonably be used to infer information about, or otherwise be linked to you. 

Right to Rectification 

You have the right to request that we update any information about you that is inaccurate or incomplete. Once we receive and confirm your rectification request, we will update (and direct our service providers to update) your personal information in our records, except archive or backup systems. In the alternative, we may provide you with instructions as to how you may correct your personal information yourself, such as via a player portal. We may request documentation supporting that your requested correction is accurate. You also have the right to require us to restrict processing of your personal information in certain circumstances, e.g. if you contest the accuracy of the personal information.  

Right to Restrict Processing, Right to Object 

The right to restrict processing allows individuals to temporarily halt the processing of their personal data by us under certain circumstances. This right can be exercised when the accuracy of the data is disputed, the processing is unlawful, or you object to processing while awaiting verification of the legitimate grounds for processing. During the restriction period, the data can only be stored, and certain limited operations may be conducted with the data, such as for legal claims or to protect the rights of another person. This provision aims to give individuals more control over their data and protect their interests when concerns or disputes arise regarding the processing of their personal information. 

You also have a right to object to the processing of your personal data for direct marketing purposes, scientific or historical research purposes, or statistical purposes. When an objection is raised, we will cease processing your data unless we demonstrate compelling legitimate grounds for the processing or if the processing is necessary for establishment, exercise or defense of legal claims. 

Right to Data Portability 

You have the right to receive your personal data in format that is structured, commonly used, and machine-readable. This right is designed to enhance your control over your data by allowing you to easily transfer it to other service providers or organizations of your choice. 

This notice should be read in conjunction with the rest of our Privacy Policy. This section is intended to inform Canadian residents of their rights. This Privacy Notice applies to personal data that FARA collects or processes about an individual resident of Canada. 

For information on what personal data we collect and for what purposes, please go to the section labeled “Information We May Collect and Use” and “Purposes of Collection” in our Privacy Policy. 

For more information on how we collect personal data, please go to the section labeled “How Your Personal Information Is Collected” and “Territoriality”.  

For information on what personal information we may disclose to third parties, please go to the section labeled “Sharing Your Information.” 

For more information on what are cookies, how FARA uses cookies, what types of cookies we use, and how to manage your cookies, please go to the section labeled “Cookies and Similar Technologies”. 

To exercise your rights, please go to the section labeled “Data Protection Officer Contact Information & How to Exercise Your Rights.” 

CANADIAN RESIDENT’S RIGHTS AND CHOICES 

Right to Access 

Canadian residents have the right to request a copy of the information we hold about you. Before we provide a substantive response to your request to access your personal information, we will verify your identity to make certain you are who you say you are. We will respond within 30 days of receiving your written request. 

We will not disclose in response to an access request your government-issued identification number, financial account number, health insurance or medical identification number, an account password, or security questions and answers. We will, however, inform you or your representative with sufficient particularity if we have collected that type of information.  

Right to Accurate Data 

You have the right to request that we update any information about you that is inaccurate or incomplete. Once we receive and confirm your rectification request, we will update (and direct our service providers to update) your personal information in our records, except archive or backup systems. In the alternative, we may provide you with instructions as to how you may correct your personal information yourself, such as via a player portal. We may request documentation supporting that your requested correction is accurate. You also have the right to require us to restrict processing of your personal information in certain circumstances, e.g. if you contest the accuracy of the personal information. 

If you are a resident of a jurisdiction other than United States, Europe, or Canada, please be aware that the laws of your jurisdiction may confer upon you similar or additional rights with respect to your personal information compared to the rights outlined in this Privacy Policy. To learn more about your specific rights and how to exercise them, we encourage you to contact us at info@curefa.org. Your privacy is important to us, and we are dedicated to assisting you in understanding and exercising your privacy rights.

This section is intended to provide information on how FARA collects and uses Personal Information relating to our donors. FARA takes the protection of integrity and privacy of personal information gathered from our donors very seriously. Please also see FARA’s Donor Bill of Rights for a list of your rights as a donor. 

A. Information We May Collect And Use  

We may collect, use, and/or share some or all of the following Personal Information categories:  

• Identifiers, such as your name, preferred alias, address, email address, telephone number, e-contact, account name and similar identifiers. 

• Transactional history, such as records of transactions; donations; event registration; and emails intended for FARA; 

• Internet activity, such as browsing history, IP address, search history, cookies and similar technologies, information about your browser and operating system information on a consumer’s interaction with a website, application, or advertisement.  

• Financial information, such as partial debit or credit card information to facilitate transactions and donations made to FARA.  

• Sensitive information is collected in limited circumstances, such as complete financial account information.  

B. Purposes Of Collection 

FARA’s mission is to marshal and focus the resources and relationships needed to cure Friedreich’s Ataxia by raising funds for research, promoting public awareness, and aligning scientists, patients, clinicians, government agencies, pharmaceutical companies and other organizations. We may collect Personal Information in furtherance of these objectives for the following purposes: 

• To process donations; 

• To communicate with you about our programs and your donations, and to provide you with the information you request from us.  

C. No Sale Of Personal Information 

FARA will not sell or trade, your personal information with outside entities. FARA may share your information with third-party service providers (such as but not limited to event coordinator contractors and donor software companies). FARA has data-sharing agreements in place with these services providers. Cookies may be collected through FARA event or donation pages, which are operated by a third party, Classy, Inc. To learn more visit: https://www.classy.org/terms/privacy/. Cookies may also be collected through our Website. Please see the section below, COOKIES AND SIMILAR TECHNOLOGIES.    

D. Sharing Your Information 

Solely for the purpose of acknowledging and thanking you for your donation, FARA may share your contact information with volunteer fundraising event hosts or families to whom you’ve given a tribute gift.  

FARA may also share your contact information with volunteer FARA Ambassadors for the purpose of acknowledging your contribution on behalf of the FA community. Donation amounts for a respective campaign may be shared with volunteers acting with FARA to hold a fundraising event or campaign and who sign a non-disclosure agreement.  

You have a right to opt out from sharing your information in this manner. If you would like to do so, please contact us at info@curefa.org and let us know that you prefer that your contact information should not be shared with the volunteer fundraising event hosts, FARA Ambassadors or families. 

Cookies are small text files placed on your device to store data that can be recalled by a web server in the domain that placed the cookie. We may use cookies, web beacons, and other tracking technologies (such as scripts and tags) on our online services. We collect information from cookies via third party technology platforms such as Google Analytics. We also use cookies, web beacons, and other tracking technologies to help our online services function properly, to collect information about how users interact and use our online services, and to ensure the security of our network and related networks.  

We classify cookies in the following categories: 

• Essential/necessary cookies: These cookies are necessary for the functions of our Website and cannot be switched off as otherwise our Websites will not work. 

• Advertisement cookies: These cookies may be set through our Website by advertisers and may be used by them to limit the number of times you see an ad, to mute unwanted ads, and to measure effectiveness of ads. They are based on uniquely identifying your browser and internet device. If you disable or block these cookies, you will experience less targeted advertising.  

• Analytics cookies: These cookies collect information about your use of the Websites and enable us to improve the way they work. These cookies give us aggregated information that we use to monitor site performance, count page visits, spot technical errors, see how users reach the Websites, and measure the effectiveness of advertising. 

• Other technologies may be used for the same purposes as our cookies, to allow us and third parties to know when you visit the Websites, and to understand how you interact with emails or advertisements. 

Through our use of these third-party tools, we may have shared with such third parties the following categories of personal information of our website users: 

• Internet or other electronic network activity information, information identifying your browser and device. 

You have a variety of tools to control the data collected by cookies and similar technologies. For example, you can use controls in your internet browser to limit how the websites you visit are able to use cookies, alert you about th

Our Website may contain links to other sites (“Third Party Websites”). These links are provided solely for the convenience of our Website visitors.  We do not necessarily endorse, sanction or verify the accuracy of the information contained on Third Party Websites. Once you access a Third-Party Website through a link on our Website, you are no longer covered by this Policy. Concerns regarding a Third-Party Website should be directed to the Third-Party Website itself. We bear no responsibility for any action associated with any Third-Party Website. 

One of FARA’s missions is to inform the discussion about Friedreich’s Ataxia. Certain descriptions of medical conditions and their progression may be upsetting to children. Our Website is not directed to individuals under the age of 13; however, we encourage parents and guardians to monitor and review their children’s online activity. For additional tips on how to help children stay safe on the internet, we recommend the following site: https://consumer.ftc.gov/identity-theft-and-online-security/protecting-kids-online. 

Our Website is not directed to individuals under the age of 13. While we will never knowingly request personal information from children, we advise all visitors to Our Website under the age of 13 not to disclose or provide any Personal Information. In the event that we discover that a child under the age of 13 has provided Personal Information to us, we will delete the child’s Personal Information in accordance with the Children’s Online Privacy Protection Act of 1998. Please see the Federal Trade Commission’s website for this Act, available at https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa.  

Notwithstanding the foregoing, pursuant to 47 U.S.C. Section 230 (d), as amended, we hereby notify you that parental control protections are commercially available to assist you in limiting access to material that is harmful to minors. More information on the availability of such software can be found through publicly available sources. You may wish to contact your Internet Service Provider for more information. 

We collect Personal Information on minors, when provided by their parents or legal guardians, or by institutions or government entities that have provided services to the minors, for the purposes of requesting services from us for the benefit of such minors.  

Consistent with our record retention policy, legal, and contractual obligations, we will keep your Personal Information for the duration of the time necessary to provide the services or products you requested from us.  

 Thereafter, we may retain your Personal Information only to the extent necessary to: 

• Respond to any questions, complaints or claims made by you or on your behalf; 

• Provide services to you as contracted for by you; 

• Show that we treated you fairly; and/or 

• Keep records, as required by law. 

We will not retain your Personal Information for longer than necessary for the purposes set out in this Privacy Policy. Different retention periods apply for different types of Personal Information. When it is no longer necessary to retain your Personal Information, we will delete or anonymize it.  

We have implemented reasonable technical, physical, and administrative security measures to prevent Personal Information from being accidentally lost, used, or accessed in an unauthorized way. These measures offer appropriate reasonable security levels, taking into account the state of the technology, the implementation costs and also the nature, the scale, the context and the processing purposes. We limit access to your Personal Information to those who have a genuine business need to access it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality. The measures are also intended to prevent unnecessary collection and further processing of Personal Information. The Personal Information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems and are required to keep the information confidential. We also have procedures in place to deal with a suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so. 

PLEASE KEEP YOUR DEVICES AND PASSWORDS SECURE 

You are also responsible for taking reasonable steps to protect your personal information against unauthorized disclosure or misuse. Please keep your devices secure and do not share devices, logins or passwords to such devices with others as there is a risk that they make access Personal Information that you stored on your device or that you request be transmitted to you from us to your device. If you receive login information, including passwords, to an encrypted account or application, please do not share this information with others.  PLEASE SECURE YOUR INFORMATION AND DO NOT DISCLOSE YOUR PASSWORDS AND ANY SENSITIVE INFORMATION TO ANYONE ELSE.  If you believe that your Personal Information was compromised while requesting or receiving services from us, or if your device or login and password have been stolen, please notify us immediately at info@curefa.org. We will not be responsible for anyone accessing your information if they use your device or login and password. 

For residents of the United States, to the extent permitted by the laws of your State of residence, by using our online services, you are agreeing to our practices described in this Policy, which includes the collection and use of your Personal Information.  Your continued use of our online services following the posting of changes to this Privacy Policy will be deemed your acceptance of those changes. Our Privacy Policy will contain the Effective Date, indicating the date it was last updated.  If you have any questions about our Privacy Policy or seek to make any changes, please contact us at the contact information below. 

 FARA’s privacy program is managed by FARA’s in-house privacy officer. If you have any questions or comments about this Policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, please do not hesitate to contact us at: 

By email: info@curefa.org
By phone: 484 879 6160
By mail: FARA
533 W Uwchlan Ave
Downingtown, PA 19335 

Exercising Your Rights  

If you would like to exercise the rights described above in this Privacy Policy, please submit your request to us by either: 

In person by visiting our office located at: 

FARA
533 W Uwchlan Ave
Downingtown, PA 19335 

Via e-mail to info@curefa.org. Please identify yourself and indicate which right you would like to exercise, and we will guide you through the identity verification process. 

If you are a European Union resident and would like to exercise the rights described above in this Privacy Policy or have questions/concerns, you can reach out to FARA’s Data Protection Officer, based in the Netherland via email at: dpo.fara.europe@curefa.org 

If you are a European Union resident and remain unhappy with a response you receive from FARA or FARA’s Data Protection Officer, you have a right to contact your data protection supervisory authority (see http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm – for Europe, or https://ico.org.uk/make-a-complaint – for the United Kingdom). 

We cannot respond to your request or provide you with personal information if we cannot authenticate your identity or authority to make the request and confirm the personal information relates to you. Making an access request does not require you to create an account with us. We will only use personal information provided in a consumer request to authenticate the requestor’s identity or authority to make the request. 

Under certain circumstances, we may deny your request for the reasons permitted by the applicable law, which we will specifically identify for you. You have the right to appeal our denial of a rights request. If you would like to appeal a denial of a rights request, please contact us via email at info@curefa.org. 

Response Timing and Format 

We endeavor to respond to a verifiable consumer request within 30 days of its receipt or within the time frame permitted by the law in your jurisdiction. If we require more time, we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. 

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. For example, in cases where requests from a consumer are distinctly unsubstantiated or excessive, in particular because of their repetitive character, FARA may either charge a reasonable fee, in FARA’s discretion, taking into account the administrative costs of providing the information or communication or taking the action requested; or refuse to act on the request altogether