New Mexico PFAS Reporting System (NMPRS)

Privacy Policy

Last Updated: March 17, 2026

The New Mexico Environment Department ("NMED," "we," "us," or "our") values your privacy. This Privacy Policy explains how we collect, use, share, and protect information when you visit or interact with NMED's public websites, web pages, and online services that link to this Privacy Policy (collectively, the "Site").

1. Scope

This Privacy Policy applies to information collected through the Site.

Some NMED online services may publish service-specific privacy notices (for example, certain portals or hosted services). If a service-specific privacy notice applies, it governs for that service to the extent of any conflict with this Privacy Policy.

2. Information We Collect

We aim to minimize collection of personal information while still operating the Site effectively.

2.1. Information collected automatically (technical and usage data)

When you visit the Site, our servers and security tools may automatically record:

• Internet Protocol (IP) address and related network information
• Date/time of access, pages visited, and referring/exit pages
• Browser type, operating system, device characteristics
• Requests, errors, and performance data (e.g., server logs)

2.2. Information you choose to provide

You may choose to provide information when you:

• Submit forms, requests, comments, applications, uploads, or inquiries
• Subscribe to email updates and alerts
• Submit an Inspection of Public Records Act (IPRA) request via NMED's records request process
• Contact us by phone or via web-based request tools

This may include your name, email address, phone number, mailing address, organization, and the content of your message or submission.

2.3. Cookies and similar technologies

The Site may use cookies or similar technologies (e.g., session cookies, persistent cookies, tags) to:

• Maintain session continuity and user preferences
• Support form functionality
• Improve site functionality and performance
• Understand aggregated site usage trends

Like many public websites, you can usually control cookies through your browser settings, including blocking or deleting cookies.

2.4. Analytics

NMED uses Matomo for web analytics. Matomo helps us understand how visitors use the Site (for example, page visits, approximate traffic volumes, and site performance) so we can improve public services. See Appendix A (Technology Appendix) for more detail.

3. Personal Information Minimization

NMED follows a data minimization approach:

• We collect only the information reasonably necessary to provide the service you request, operate the Site, protect security, and meet legal obligations.
• Unless a specific program requires it through an official channel, do not submit sensitive personal information through general webforms (examples: Social Security numbers, driver's license numbers, financial account numbers, or medical information).
• If a form requests information that appears unnecessary for the stated purpose, you may contact NMED using the information in Section 12 before submitting.

(Program-specific portals may require additional information for statutory or regulatory purposes; those services may provide additional notices.)

4. How We Use Information

We may use information collected through the Site to:

• Provide and operate Site features and requested services
• Respond to inquiries, requests, and submissions
• Improve Site content, usability, and performance
• Monitor, detect, investigate, and prevent fraud, abuse, and cybersecurity incidents
• Maintain system integrity and comply with legal obligations
• Support program administration and public communications consistent with NMED's mission

5. Public Records and Disclosure (IPRA)

NMED is a public body. Records and communications related to Site use (including emails, form submissions, attachments, and certain system records) may be subject to disclosure under the New Mexico Inspection of Public Records Act (IPRA) unless an exemption applies. (NMED Public Records Requests)

6. When We Share Information

We do not sell personal information. We may share information:

1. With service providers that support Site operations (e.g., hosting, security monitoring, analytics, email delivery, form processing, and records-request platforms). Providers are authorized to access information only as needed to perform services for NMED and are expected to protect it.
2. With other governmental entities when necessary to fulfill your request, administer programs, or coordinate interagency work.
3. As required by law, regulation, court order, subpoena, or public records obligations (including IPRA, as applicable).
4. For security and integrity to investigate or prevent misuse, fraud, or cybersecurity threats (including sharing with law enforcement where appropriate).

7. Your Choices and Controls

7.1. Cookies

You can usually control cookies through your browser settings. Disabling cookies may affect some Site features (including some form workflows).

7.2. Email subscriptions (GovDelivery)

If you subscribe to NMED email updates delivered through GovDelivery, you can manage subscription preferences and unsubscribe using links provided in those emails. See Appendix A for details.

7.3. Reviewing/correcting information

If you believe personal information you submitted through a Site form is inaccurate, you may contact NMED using Section 12 to request correction where feasible and consistent with records requirements. (Many state agencies provide a similar review/correction pathway.)

8. Do Not Track

Some browsers transmit "Do Not Track" (DNT) signals. Because there is no universally accepted standard for interpreting DNT signals, NMED does not respond to DNT signals as a signal to change Site data collection practices. You can still use the controls described in Section 7 (cookies, browser settings, and subscription controls).

9. Data Retention

NMED retains information collected through the Site in accordance with applicable New Mexico records retention requirements, operational needs, and security requirements. Retention periods vary by record type (e.g., general inquiry vs. IPRA request record vs. security logs).

10. Security

NMED uses administrative, technical, and physical safeguards designed to protect information collected through the Site. However, no system can be guaranteed 100% secure.

If NMED experiences a security incident involving certain categories of personal information, notification obligations may be governed by applicable New Mexico law (as applicable to the incident and data involved).

11. Links to External Sites and Third-Party Services

The Site may link to third-party websites or platforms. NMED does not control third-party privacy practices. When you follow a link to another site, you are subject to that site's privacy policy and terms.

12. Contact Us

For questions about this Privacy Policy or NMED's website privacy practices:

New Mexico Environment Department (Headquarters)

(New Mexico Environment Department)
Phone: 505-827-2855
Toll-Free: 1-800-219-6157
Environmental Emergencies (24 hours): 505-827-9329
Physical Address: Harold Runnels Building, 1190 St. Francis Dr., Suite N4050, Santa Fe, NM 87505
Mailing Address: PO Box 5469, Santa Fe, NM 87502-5469 (New Mexico Environment Department)

Appendix A. Technology Appendix (Key Site Tools and Data Practices)

This Appendix describes major Site tools used by NMED and the typical information they process. Actual configurations may vary by page/service.

A.1. Matomo (Web Analytics)

Purpose: Measure and improve Site performance, content effectiveness, and usability.
Typical data elements: Page views, approximate visit counts, referrer pages, device/browser metadata, and IP address (or truncated/anonymized IP depending on configuration).
How used: Analytics reporting and troubleshooting, generally in aggregate form.
User choices: Browser cookie controls (Section 7.1). Where Matomo opt-out mechanisms are deployed on the Site, users may opt out using that control (if presented).
Sharing: Used by NMED and authorized service providers supporting analytics operations.

A.2. WordPress Gravity Forms (Online Forms)

Purpose: Collect information you submit via NMED webforms (e.g., inquiries, requests, meeting requests, program contact or action request forms).
Typical data elements: Any fields you complete (e.g., name, email, phone, message text, attachments if enabled), plus basic metadata needed to operate and secure submissions (e.g., submission timestamp, IP address for abuse prevention, and form identifiers).
How used: Routing and responding to your submission; operational recordkeeping; spam/abuse prevention; audit/security as needed.
User choices: Choose what information to provide (subject to program needs). Do not include sensitive personal information unless explicitly required by the specific form/program (Section 3).
Sharing: May be accessible to NMED staff and contractors/service providers supporting Site operations, consistent with Section 6.

A.3. GovDelivery (Email Subscription and Mass Emails)

Purpose: Deliver email alerts, newsletters, and topic-based updates to subscribers.
Typical data elements: Email address, subscription topics/preferences, delivery and engagement signals (e.g., whether an email was delivered/opened/clicked), and related system identifiers.
How used: Manage subscriptions; deliver messages; measure high-level campaign effectiveness; maintain compliance and security.
User choices: Unsubscribe or change preferences using links included in GovDelivery emails (Section 7.2).
Sharing: Used by NMED and the email service provider to deliver messages and manage the subscriber list.

A.4. JustFOIA (IPRA / Records Request Platform)

Purpose: Receive, process, track, and respond to IPRA requests and related communications.
Typical data elements: Requester name/contact information, request content, correspondence, uploaded records and attachments, status history, and timestamps.
How used: Manage the records-request workflow; communicate with requesters; maintain the official file and audit trail for the request.
Public records note: IPRA requests and related communications may themselves be public records, subject to applicable exemptions.
User choices: Provide only information required to process the request; avoid including sensitive personal information not necessary to describe the requested records.
Sharing: Used by NMED and authorized platform/service provider(s) to operate the records-request process; disclosures may occur as required by law.