The "not more than 12 characters" part is a sign that they may be storing passwords as plain text instead of hashes. You may wish to be a little careful about what information you give that organization access to.