TERMS AND CONDITIONS OF USE

Transcription

1 TERMS AND CONDITIONS OF USE N reprductin, distributin, r transmissin f the trademarked r cpyrighted materials n this site is permitted withut the permissin f Natinal Student Clearinghuse. Third parties are prhibited frm framing r therwise depicting r representing that the Clearinghuse s Web sites r their cntent have been created, endrsed, r apprved by the Clearinghuse withut the prir written apprval f the Clearinghuse. Clearinghuse trademarks and service marks, including but nt limited t, Natinal Student Clearinghuse, Natinal Student Clearinghuse Research Center TM, Clearinghuse Academy, Lan Lcatr, Meter, The Natin s Trusted Surce fr Degree and Enrllment Verificatin, StudentTracker, Student Educatinal Pathways Reprts TM, Transcript Ordering sm, Trusted & Secure, and USA Cnnect and their related design elements may nt be used withut written permissin f an authrized representative f the Clearinghuse. The fllwing sftware, accessible thrugh this site, is the cpyrighted prperty f Natinal Student Clearinghuse: Financial Aid Services: Errr Reslutin CORA sm and icora sm Schl Submissin Schedule Enrllment Ad Hcs Gainful Emplyment Student Lkup Student Reprting Verificatin Services: EnrllmentVerify sm DegreeVerify sm GradVerify sm TransitinVerify sm EnrllmentVerify Plus sm GradVerify Plus sm Dates f Attendance Verificatin Schl Prviding Degree Ad Hc Schl Respnding t Degree Verificatins Prfessinal Certificatin Verify StudentTracker: StudentTracker fr High Schls StudentTracker fr Outreach StudentTracker fr Clleges & Universities EAM: Accunt Management Student Self Service sm Transcript Services: Electrnic Transcript Exchange sm and ETX sm Transcript Ordering Center sm Transcript Dwnlad Center SIS Service Operatins Any links t external sites prvided n this Web site are fr cnvenience nly and d nt cnstitute an endrsement. The Clearinghuse is nt respnsible fr the privacy plicies f these sites. Natinal Student Clearinghuse. All rights reserved. 6/1/2018

2 PRIVACY POLICY Wh is the Clearinghuse? Each year, the nnprfit Natinal Student Clearinghuse ( Clearinghuse ) prvides hundreds f millins f dllars wrth f free services t the educatin cmmunity by serving as a trusted agent t Title IV eligible, degree granting U.S. Higher Educatin institutins ( Participating Institutins) and perfrming research t help them meet their analytical needs. Fr mre infrmatin n the Clearinghuse, please g t ur Abut Us web page, and fr infrmatin n the Clearinghuse s cmmitment t the privacy and security f the educatin recrds it hlds n behalf f Participating Institutins, please g t ur Privacy Cmmitment web page. Hw the Clearinghuse Receives Yur Persnally Identifiable Infrmatin Frm Participating Institutins, Educatin Agencies and Other Educatin Authrities The Clearinghuse cllects Educatin Recrds, which include bth Directry and Nn Directry Infrmatin, frm Participating Institutins, educatin agencies, and ther educatin authrities, under either the schl fficial r directry infrmatin exceptins t FERPA. With this delegated authrity, the Clearinghuse uses this data fr enrllment reprting f Title IV schls t the Natinal Student Lan Data System (NSLDS), verificatin f student enrllment and credentials earned, transcript services, curse exchange and research. Frm Yur Use f Our Services/Website We cllect infrmatin abut yu directly frm yu, with yur cnsent, when yu prvide us with an rder fr yur transcript r use ur ther services (e.g., Verificatin Services r Myhub sm ) and websites. We may cllect yur name, date f birth, address, phne number(s), address, and/r schl infrmatin, as well as ther accunt r user infrmatin that may be needed t prvide ur services. We d nt stre any credit card data prvided by yu t use ur services. We may cllect yur attendance, enrllment, degree, certificatin r transcript infrmatin frm the educatinal institutin hlding such infrmatin when yu request services frm the Clearinghuse. When yu register fr an accunt n ur Myhub website, we may cllect accunt infrmatin yu knwingly prvide t us frm a third party site r platfrm, such as scial netwrking sites. Unless required r authrized by law, the Clearinghuse will nt cllect r use persnally identifiable infrmatin ( PII ) frm yur use f ur services and websites fr any purpse ther than thse identified in this Privacy Plicy withut btaining further cnsent. Fr details n the type f infrmatin we cllect via ur website and n hw we use and share this infrmatin, please refer t the PII Generated frm Yur Use f Our Websites sectin f this Privacy Plicy. Frm Lan Lenders, Hlders, and Servicers We receive nnpublic persnal infrmatin frm varius lenders, hlders, and servicers f student lans fr the purpse f reprting n the enrllment status f brrwers n behalf f Participating Institutins. In cmpliance with the Gramm Leach Bliley Act, we d nt redisclse any nnpublic persnal infrmatin we receive slely frm any lenders, hlders, and servicers f student lans. 2

3 Persnally Identifiable Infrmatin (PII) Generated frm Yur Use f Our Websites The Clearinghuse generally cllects and uses PII frm r abut its website visitrs and users. Yur sle ptin, if yu d nt wish t prvide all requested infrmatin, is t nt participate in a Clearinghuse website. In additin t the infrmatin we cllect, as referenced in the Frm Yur Use f Our Services/Website sectin f this Privacy Plicy, the Clearinghuse cllects and uses the infrmatin cllected as fllws: Infrmatin Yu Prvide In many cases, we cllect PII directly frm yu when yu visit r use ur websites. Fr instance, we may cllect the fllwing types f infrmatin: Inquiries. We may cllect yur name, cntact infrmatin, address and any infrmatin yu prvide us when yu make an inquiry r cntact us thrugh ur websites. We will nly use this infrmatin t prvide yu with the infrmatin requested r t cntact yu in rder t respnd t yur questins and/r requests. Requests fr a Prduct and/r Service. The Clearinghuse cllects and stres nly the infrmatin that yu knwingly prvide t us by subscribing t blg and ther webpage updates and/r using ur websites registratin r request frms, including but nt limited t, yur name, address, phne, , jb title and jb functin. We may request additinal infrmatin if yu subscribe t ur blg and/r ther webpages, rder a prduct r service, request infrmatin, r participate in a survey r cntest via ne f ur websites. We will nly use this infrmatin t prcess and answer yur request r t manage ur business needs in cnnectin with such participatin r request, and in accrdance with this Privacy Plicy. If yu enter yur address t receive alerts n new cntent t ur site(s), the address will be used nly fr that purpse, unless authrized by law. Use f Ckies As yu navigate thrugh and interact with ur websites, we may use autmatic data cllectin technlgies t cllect certain infrmatin abut yur equipment, brwsing actins, and patterns, including: Details f yur visits t ur websites, including traffic data, lcatin data, lgs, and ther cmmunicatin data and the resurces that yu access and use n the websites. Infrmatin abut yur cmputer and internet cnnectin, including yur IP address, perating system, and brwser type. The infrmatin we cllect autmatically is statistical data and des nt include persnal infrmatin, but we may maintain it r assciate it with persnal infrmatin we cllect in ther ways r receive frm third parties. It helps us t imprve ur websites and t deliver a better and mre persnalized array f services, including by enabling us t: Estimate ur audience size and usage patterns. Stre infrmatin abut yur preferences, allwing us t custmize ur websites accrding t yur individual interests. Recgnize yu when yu return t ur websites. The technlgies we use fr this autmatic data cllectin may include: Ckies (r brwser ckies). A ckie is a small file placed n the hard drive f yur cmputer. Yu may refuse t accept brwser ckies by activating the apprpriate setting n yur brwser. Hwever, if yu select this 3

4 setting yu may be unable t access certain parts f ur websites. Unless yu have adjusted yur brwser setting s that it will refuse ckies, ur system will issue ckies when yu direct yur brwser t ur websites. Flash Ckies. Certain features f ur websites may use lcal stred bjects (r Flash ckies) t cllect and stre infrmatin abut yur preferences and navigatin t, frm, and n ur websites. Flash ckies are nt managed by the same brwser settings as are used fr brwser ckies. Web Beacns. Pages f ur websites and ur s may cntain small electrnic files knwn as web beacns (als referred t as clear gifs, pixel tags, and single pixel gifs) that permit the Clearinghuse, fr example, t cunt users wh have visited thse pages r pened an and fr ther related website statistics (fr example, recrding the ppularity f certain website cntent and verifying system and server integrity). Privacy Plicies f Third Parties This Privacy Plicy nly addresses the use and disclsure f infrmatin by the Clearinghuse. Other websites that may be accessible thrugh the Clearinghuse websites have their wn privacy plicies and data cllectin, use and disclsure practices. We encurage yu t familiarize yurself with the privacy statements prvided by all third parties prir t prviding them with infrmatin r taking advantage f an ffer r prmtin. Hw the Clearinghuse Uses Yur Persnally Identifiable Infrmatin Family Educatinal Rights and Privacy Act FERPA is a federal law that prtects the privacy f student educatin recrds. The law applies t all Participating Institutins that receive funds under an applicable prgram f the U.S. Department f Educatin. Althugh FERPA des nt directly apply t private rganizatins, unless they receive funds under an applicable prgram f the U.S. Department f Educatin, FERPA regulates what data Participating Institutins can share with the Clearinghuse, and what redisclsures f that data the Clearinghuse can make. The Clearinghuse cmmits t fllwing FERPA regulatins as a Schl Official (as that term is defined by FERPA) as appinted by Participating Institutins. This sectin intrduces sme terms used in FERPA t discuss educatin recrds, as well as hw the Clearinghuse cmplies with FERPA in its use f educatin recrds. FERPA Permissible Uses The Clearinghuse nly disclses educatin recrds under the fllwing limited FERPA permissible uses: Cnsent: An educatin recrd may be disclsed t a third party if a valid cnsent frm the student has been btained in writing (may be electrnic), signed and dated, specifying the recrds that may be disclsed, stating the purpse f disclsure, and identifying the party r class f parties t whm the disclsure may be made. Schl Official: Participating Institutins may disclse educatin recrds t Schl Officials, prvided there is a legitimate educatinal interest served by the disclsure. State and Lcal Educatinal Authrities: An educatin recrd may be disclsed withut cnsent t an authrized representative f state and lcal educatin authrities fr audit and evaluatin purpses. Financial Aid: An educatin recrd may be disclsed in cnnectin with a student s applicatin fr, r receipt f, financial aid. Research: An educatin recrd may be disclsed t an rganizatin cnducting a study fr r n behalf f an educatinal institutin, in rder t develp, validate, r administer predictive tests; administer student aid prgrams; r imprve instructin. 4

5 Directry Infrmatin: Directry infrmatin may be disclsed withut cnsent, as it cnsists f infrmatin that is generally cnsidered nt t be harmful r an invasin f privacy if disclsed. Student Rights Under FERPA Althugh FERPA allws fr disclsure f educatin recrds withut student cnsent in certain circumstances, parents f nn eligible students r eligible students (students wh are ver the age f 18 r attend pstsecndary schl) still have the fllwing rights: inspect and review the student's educatin recrds maintained by the schl request that a schl amend the student s educatin recrds cntrl wh has access t the student s recrds The first tw rights cncern hw the educatin recrds are cllected and maintained by a student s institutin. If yu believe there is an errr in yur recrds r they are incmplete, yu must cntact yur institutin directly t crrect that errr. The Clearinghuse may nly amend a recrd at the request and directin f a Participating Institutin. Yu may als inspect and review the educatin recrds kept by yur institutin. Yu can find mre infrmatin n hw t cntrl wh has access t yur educatin recrd thrugh administering directry infrmatin blcks and yur rights as a student under FERPA n the U.S. Department f Educatin s website: Eurpean Unin General Data Prtectin Regulatin The Eurpean Unin GDPR is a regulatin that prtects the privacy and security f persnal data cllected frm individuals within the territry f the Eurpean Unin ( EU data subjects ). It applies t rganizatins established utside f the EU if they: (i) prcess the persnal data f EU data subjects when ffering them gds r services; r (ii) mnitr the behavir f EU data subjects. The Clearinghuse neither ffers gds r services t EU data subjects nr mnitrs their behavir. Therefre, the GDPR des nt directly apply t the Clearinghuse. Hwever, the Clearinghuse wrks with rganizatins, including certain Participating Institutins, that cllect r prcess persnal data f EU data subjects, that are subject t the GDPR. At the request f rganizatins wh prvide persnal data cllected frm EU data subjects t the Clearinghuse fr prcessing (such rganizatins hereinafter referred t as Cntrller rganizatins ), the Clearinghuse enters int a Data Prcessing Addendum with Cntrller rganizatins whereby the Clearinghuse as a prcessr agrees t assist these rganizatins with the fulfillment f their bligatins as set ut in the GDPR. The Clearinghuse als agrees t implement apprpriate technical and rganizatinal security measures t prvide a level f security apprpriate t the risks that are presented by the prcessing and the nature f the persnal data t be prtected. In case f a persnal data breach, the Clearinghuse will ntify the Cntrller rganizatin(s) withut undue delay upn becming aware f the persnal data breach. In all such instances, the Clearinghuse is prcessing the persnal data f EU data subjects slely n behalf f and at the directin f the Cntrller rganizatins that prvide persnal data t the Clearinghuse fr prcessing. T Prvide Clearinghuse Services Financial Aid Services: The Clearinghuse partners with Participating Institutins fr the purpse f reprting enrllment statuses f students t varius lenders, servicers, guaranty agencies and the U.S. Department f Educatin (cllectively 5

6 "Lenders"). The Clearinghuse peridically receives enrllment files cntaining all enrlled students frm Participating Institutins, which it incrprates int its natinwide central repsitry f enrllment infrmatin. Lenders submit listings f their financial aid recipients t the Clearinghuse and the Clearinghuse advises the Lenders n which financial aid recipients are currently enrlled in Participating Institutins. The regularity and cntent f this prcess cnfrm t applicable federal and guaranty agency regulatins. This service benefits bth the Participating Institutins and their students. Under Title IV f the Higher Educatin Act, students receiving federal student lans are entitled t a deferment f their repayment bligatin while they are enrlled in an institutin f higher educatin, and thus institutins are required t reprt student enrllment infrmatin t these entities. By utilizing the Clearinghuse s enrllment reprting service, institutinal reprting burdens are alleviated and students are able t receive the lan deferment benefit affrded t them by law. Research: In prviding its enrllment reprting and verificatin services t Participating Institutins, the Clearinghuse cllects enrllment and degree data n students enrlled in Participating Institutins. The Clearinghuse s cverage f this data, which includes the public, private nnprfit, and private fr prfit sectrs, gives the Clearinghuse the unique capability t wrk with Participating Institutins, states, districts, high schls, and educatinal rganizatins t better infrm practitiners abut student educatinal pathways. The Clearinghuse harnesses this capability thrugh its StudentTracker services, as well as its research arm, Natinal Student Clearinghuse Research Center ( Research Center ). StudentTracker : Participating Institutins have appinted the Clearinghuse as their agent t respnd t the requests f authrized educatinal institutins, rganizatins and agencies ( Authrized Requesting Entities ) fr infrmatin n the pstsecndary enrllment f, and credentials earned by, their current and frmer students, under the directry infrmatin, audit and evaluatin, and/r studies exceptins t FERPA, as applicable. These Authrized Requesting Entities use this infrmatin fr educatinal and related purpses, including the fllwing: Pstsecndary institutins can determine whether, and at what institutins, frmer students pursued further pstsecndary educatin, prviding insight int student pathways and success fr use in institutinal imprvement. Pstsecndary institutins can identify the institutin(s) eventually attended by thse applicants wh declined their ffer f admissin, prviding assistance with student recruitment effrts. Secndary schls, schl districts and state K 12 educatinal authrities can determine the pstsecndary enrllment and credential attainment f their students, prviding insights they can use t imprve their cllege preparatin effrts. Secndary schls, schl districts and state K 12 educatin authrities can use this infrmatin in cnnectin with an audit r evaluatin f federal r state supprted educatin prgrams r fr cnducting studies t imprve instructin. Prgrams, like TRIO and GEAR UP, which prvide supprt t disadvantaged students t enable their educatinal success, can better measure their effectiveness by btaining enrllment and credential attainment data n prgram participants. Authrized researchers may btain pstsecndary enrllment and degree attainment data t cnduct research aimed at imprving the prvisin f educatin t students r administering student aid prgrams. 6

7 Additinal Infrmatin Regarding StudentTracker fr High Schls: Thrugh the Clearinghuse s StudentTracker fr High Schls Service, participating high schls, schl districts, state and lcal educatinal agencies and authrities ( STHS Participants ) prvide the Clearinghuse with data n their graduates, including PII, and the Clearinghuse returns reprts t the STHS Participants n the pstsecndary enrllment and degrees f thse graduates. Specifically, STHS Participants prvide the Clearinghuse with the fllwing types f educatin recrds as part f the service, fr the fllwing purpses: (i) (ii) (iii) (iv) (v) (vi) (vii) PII (name, date f birth) and infrmatin n the graduates high schl and graduatin date, required fr the purpse f matching the graduates f the STHS Participant with the pstsecndary recrds held by the Clearinghuse. PII (name, date f birth) and infrmatin n the graduates high schl and graduatin date, which STHS Participants are required t reprt as part f the service, and which is used fr the purpse f prviding reprts back t the STHS Participant n the pstsecndary enrllment and degrees f its graduates. Graduates prgram cdes are prvided fr this purpse at the ptin f the STHS Participant. Student ID number may be prvided at the ptin f the STHS Participant, fr the administrative cnvenience f the STHS Participant, and is included in the reprts sent back by the Clearinghuse t the STHS Participant. While Scial Security Number is nt required in the STHS service, sme STHS Participants submit it as an identifier. If available, SSN is returned with the students pstsecndary enrllment and degree infrmatin. SSN is nt used in the matching prcess within STHS. Assessment results, demgraphic data and curriculum infrmatin, which may be prvided at the ptin f the STHS Participant, fr the purpse f prviding richer aggregate reprting back t the STHS Participant. Fr the purpse f prducing aggregate research: high schl graduatin date (required fr the service) and ethnicity (at the STHS Participant s ptin). STHS Participants als are required t prvide, and may srt their submissin by, the type f diplma earned by the student. This data element serves t cnfirm students as graduates and may be used in the future fr research purpses. The Clearinghuse des nt disclse student PII prvided thrugh this service t third parties, except as necessary fr the maintenance f the service r as required by law. The Clearinghuse cntractually restricts third parties invlved in the maintenance f the service frm using the data in any unauthrized way, trains them n Clearinghuse privacy and security requirements, and mnitrs their access t PII. The Clearinghuse uses these educatin recrds t reprt data in a de identified, aggregated frm fr authrized research purpses. The Clearinghuse wrks with STHS Participants t supprt mutual cmpliance with FERPA. A parent, legal guardian r eligible student may exercise their right t review and inspect educatin recrds held by the Clearinghuse as agent fr STHS Participants by cntacting the STHS Participant. The STHS Participant may then cntact its designated accunt representative at the Clearinghuse fr supprt. Ntificatin f material changes t the Privacy Plicy will be psted t the Clearinghuse s website. Research Center: Thrugh aggregated lngitudinal data utcmes reprting, the Research Center facilitates better educatinal plicy decisins leading t imprved student utcmes. The Clearinghuse prduces several aggregate reprts annually n student enrllment, mvement and ther imprtant student utcmes. Learn mre at: 7

8 Verificatins: The Clearinghuse uses the enrllment infrmatin it receives frm Participating Institutins fr the Financial Aid Related Services utlined abve, as well as additinal degree infrmatin it receives frm Participating Institutins, t prvide verificatin services t eligible requestrs ("Requestrs"). When yu apply fr a prduct, service r emplyment that depends n yur enrllment r graduatin status, the prvider f that prduct, service r emplyment may cntact the Clearinghuse t verify the enrllment, degree, r prfessinal certificatin infrmatin yu have prvided in yur applicatin. On behalf f Participating Institutins, we will cmpare the infrmatin prvided by the Requestr with the educatin recrd infrmatin we received frm yur Participating Institutin in rder t verify the infrmatin yu prvided in yur applicatin, which can assist the Requestr in determining yur eligibility fr the prduct, service r emplyment. We never release any infrmatin abut yu fr the purpse f targeted advertising. Transcripts: The Clearinghuse delivers student transcripts t third parties nly with a student s cnsent r, if anther valid FERPA exceptin applies, at the directin f the Participating Institutin. Yur institutin electrnically sends the Clearinghuse yur transcript, which we securely transmit t the recipient(s) yu have requested (we emply electrnic and print t mail transmissin systems which yu may select frm), such as anther educatinal institutin r a prspective emplyer. As part f the electrnic transcript delivery methds ffered by the Clearinghuse, a transcript may be temprarily maintained by us until delivered and accessed by the recipient f the transcript rder. Curse Exchange: The Clearinghuse facilitates the awarding f degrees and certificates between Participating Institutins by transmitting curse data thrugh Reverse Transfer and ther curse exchange prgrams. Reverse Transfer allws students wh transfer frm a tw year institutin t a fur year institutin withut first btaining an Assciate s Degree t still receive that degree frm the tw year institutin when they have cmpleted the requisite curses t qualify. This Reverse Transfer is dne with student cnsent, cllected by the student s fur year institutin. Use f Data Pertaining t Yur Access f Our Websites The Clearinghuse generally uses the PII it cllects frm an individual s use f ur websites fr the fllwing purpses: T fulfill rders and send yur transcript r degree, certificate, r enrllment verificatin infrmatin as yu direct, when yu prvide us with a request fr such service. T cntact yu, when necessary, regarding yur crrespndence with us r yur requests. T authenticate the identity f individuals requesting ur services r individuals cntacting the Clearinghuse by telephne, electrnic means r therwise. T infrm Participating Institutins r individuals cncerning inquiries abut their educatin recrds. T help diagnse prblems with ur servers and ensure the efficiency, reliability and security f ur systems and netwrks. T present ur websites and their cntents t yu and t imprve yur experience interacting with ur websites. In aggregate and de identified frm, fr research. 8

9 T assess ur services and peratins t determine areas fr imprvement and t understand and assess the interests, wants and changing needs f website users with a view t imprving ur prducts and services and develping new nes. T meet legal and regulatry requirements and allw the Clearinghuse t meet cntractual requirements relating t the prducts and services it prvides. T ensure ur recrds are accurate. Sharing f Yur Persnally Identifiable Infrmatin With Service Prviders Yur infrmatin may be made available by the Clearinghuse t third parties assisting the Clearinghuse t fulfill the purpse fr which the infrmatin was cllected frm yu r as set frth in this Privacy Plicy. The Clearinghuse will nt sell, rent r trade yur PII t any third party. Hwever, we may share yur PII with thirdparty service prviders hired t supprt ur business and wh are bund by cntractual bligatins t keep PII cnfidential and use it nly fr the purpses fr which we disclse it t them. The Clearinghuse nly prvides them with the infrmatin they need t knw t perfrm the requested services n its behalf. They are bund by cnfidentiality bligatins prhibiting them frm using yur PII fr purpses ther than t facilitate and carry ut the services fr which they have been retained. The Clearinghuse prtects PII disclsed t third parties by cntractual agreements requiring thse third parties t adhere t cnfidentiality and security prcedures and prtectins that are, at a minimum, equivalent t thse emplyed by the Clearinghuse itself. Only thse persnnel f the Clearinghuse r third party cntractrs, with whm the Clearinghuse has cntracted and wh have a business need t knw t perfrm the services being requested by the Clearinghuse, will be granted access t PII. Fr infrmatin n hw yu can limit the type f infrmatin that we cllect, use r share abut yu when yu visit and/r use ur website, please refer t the Persnally Identifiable Infrmatin Generated frm the Yur Use f Our Websites sectin f this Privacy Plicy. Security f Yur Persnally Identifiable Infrmatin The security f the PII we huse is a pririty f the Clearinghuse. Our services are designed t cmply with the requirements f FERPA, ur agreements with Participating Institutins, all applicable federal and state privacy laws, and accepted industry best practices. Belw are sme f the highlights f ur data security. The Clearinghuse maintains a cmprehensive infrmatin security prgram based n the ISO 27001/27002, staffed by experienced prfessinals, and backed by cmprehensive security plicies that detail Operatinal, Management, and Technical cntrl requirements that are mapped t widely accepted, industry best practice security standards. All infrmatin yu prvide t us r that we receive frm Participating Institutins is stred n secure servers in the cntiguus United States. This prgram is regularly reviewed and updated n an annual basis t ensure its cntinuing suitability, adequacy and effectiveness. The Clearinghuse security plicy ensures the cnfidentiality, integrity, availability and privacy f yur data thrugh: Management and business prcesses that include and enable security prcesses; Onging persnnel awareness f security issues; Physical security requirements fr infrmatin systems; Gvernance prcesses fr infrmatin technlgy; Reprting infrmatin security events and weaknesses; 9

10 Creating and maintaining business cntinuity plans; and Mnitring fr cmpliance. Our netwrk perimeter and ther cntrls ensuring security frm external threats are regularly tested by a third party. Our emplyees underg a backgrund check, as well as mandatry annual security and privacy training. We maintain secure authenticatin prtcls and access limitatins fr external and internal users. Changes t Our Privacy Plicy As the Clearinghuse develps new services, deplys new technlgies r develps new uses f infrmatin, we review and update ur Privacy Plicy t reflect these changes. We als cmmit t mnitring the applicable privacy laws and updating bth ur Privacy Plicy and security practices t ensure nging cmpliance. In additin, frm time t time we make rganizatinal, stylistic and grammatical changes t the Privacy Plicy t present ur services in a way that makes ur Privacy Plicy easy t read. If we make material changes in the way we prcess yur PII, we will prvide yu ntice via this website r by ther means, such as via . Any revised Privacy Plicy supersedes all previus versins. Please review any changes carefully. All changes are effective immediately upn psting, unless therwise specified. By cntinuing t use ur services, yu cnsent t the terms f ur Privacy Plicy, as revised. Hwever, we will always handle yur PII in accrdance with the Privacy Plicy that was in effect at the time f cllectin. Prhibitin n the Assignment f Yur Data If the Clearinghuse r its assets are acquired by anther cmpany that is nt a majrity wned subsidiary f the Clearinghuse, r in the event f a merger, cnslidatin, change in cntrl, transfer f substantial assets, rerganizatin r liquidatin t a nn majrity wned subsidiary f the Clearinghuse, we will nt, under any circumstances, sell, transfer r assign t a third party yur educatin recrds directly cncerning yu. The educatin recrds we received frm Participating Institutins shall always be returned t the relevant Participating Institutin frm which it was riginally received. Cntact Infrmatin If yu have questins r cncerns regarding any infrmatin in this Privacy Plicy, please us at privacy@studentclearinghuse.rg. Glssary f Terms Educatin recrds: Recrds that are: (1) directly related t a student; and (2) maintained by an educatinal agency r institutin r by a party acting fr the agency r institutin. Directry Infrmatin: Under FERPA, infrmatin cntained in an educatin recrd f a student that wuld nt generally be cnsidered harmful r an invasin f privacy if disclsed, as determined and designated by institutins. FERPA: An acrnym referring t the Family Educatinal Rights and Privacy Act. 10

11 EU GDPR: An acrnym referring t the Eurpean Unin General Data Prtectin Regulatin. Nn Directry Infrmatin: Any PII that an institutin des nt designate as Directry Infrmatin is deemed Nn Directry Infrmatin. This infrmatin is assciated with a higher degree f sensitivity and thus there are stricter restrictins arund hw and when it may be used. Persnally identifiable infrmatin (PII): Includes, but is nt limited t (a) student s name; (b) name f the student s parent r ther family members; (c) address f the student r student s family; (d) a persnal identifier, such as the student s Scial Security number, student number, r bimetric recrd; (e) ther indirect identifiers, such as the student s date f birth, place f birth, and mther s maiden name; (f) ther infrmatin that, alne r in cmbinatin, is linked r linkable t a specific student that wuld allw a reasnable persn in the schl cmmunity, wh des nt have persnal knwledge f the relevant circumstances, t identify the student with reasnable certainty; r (g) infrmatin requested by a persn wh the educatinal agency r institutin reasnably believes knws the identity f the student t whm the Educatin Recrd relates. Schl Official: A cntractr, cnsultant, vlunteer, r ther party t whm an agency r institutin has utsurced institutinal services r functins may be cnsidered a schl fficial prvided that the utside party (1) perfrms an institutinal service r functin fr which the agency r institutin wuld therwise use emplyees; (2) is under the direct cntrl f the agency r institutin with respect t the use and maintenance f educatin recrds; and (3) is subject t the requirements f FERPA gverning the use and re disclsure f PII frm educatin recrds. 11