CA and EU Privacy Policy

This Privacy Rights Notice consists of (1) a notice for California residents and (2) a notice for individuals located in the European Union.

1. California Privacy Rights Notice

This California Privacy Rights Notice (“California Privacy Notice”) applies to the processing of personal information of residents of the State of California by Carnegie Dartlet LLC and its affiliates (“Carnegie” or “we”) as required by the California Consumer Privacy Act of 2018 (“CCPA”).

This California Privacy Notice supplements our Privacy Policy. If this California Privacy Notice and any provision of our Privacy Policy conflict, then this California Privacy Notice controls for the processing of Personal Information of residents of the State of California. In CCPA, California residents are referred as “consumers” and we refer to them in this California Privacy Notice as “California Consumers.”

If you are a California Consumer, this California Privacy Notice explains your privacy rights and how and why we collect and process your Personal Information. In this California Privacy Notice, “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California Consumer or household.

Your California Consumer Privacy Rights

CCPA offers California Consumers the following key privacy rights:

  • You have the right to request information about categories and specific pieces of Personal Information that we have collected about you (see table below), as well as the categories of sources from which the personal information is collected, the purpose for collecting personal information, and the categories of third parties with whom we share personal information.
  • You have the right to request information about our disclosure for business purposes of your Personal Information to third parties.
  • You have the right to request that we delete certain Personal Information that we have collected from you.
  • If we offer a financial incentive or price or service difference in exchange for your Personal Information, we will notify you in advance before collecting your Personal Information for this purpose and explain how you can opt-in to the financial incentive or price or service difference.
  • You have the right to opt-out of our sale of your Personal Information if and when we determine the purpose and means of processing of your Personal Information. (In CCPA, “sale” means transferring or making available Personal Information to third parties for monetary or other valuable consideration.) Sharing your Personal Information with our service providers is not a sale of your Personal Information because we make sure that our service providers are contractually obligated to use the Personal Information only to provide services to us and not to sell it. Please click here for details about how to opt-out of sale.
  • If you are a California Consumer age 13, 14, or 15, we cannot make available to third parties the Personal Information that we collect from or about you for monetary or other valuable consideration (e.g., in exchange for showing students information about colleges and universities) unless you opt-in. Please click here for details about how to opt-in. If you are under age 13, you are not eligible to use any of our websites and services.
  • You have the right to not receive discriminatory treatment from us for exercising any of these rights. That is, we cannot treat you differently for exercising any of these rights unless we demonstrate that the value of the Personal Information that you provide to us is reasonably related to the difference in price or service that we offer.

The following table lists categories of Personal Information that generally match the categories in the definition of Personal Information in CCPA. We indicate for each listed category the specific types of Personal Information in the category that we have collected within the past 12 months and why we collect it. We provide information about how we use and disclose Personal Information in our Privacy Policy and in the table below.

Category of Personal Information Under CCPA Personal Information in Category as Listed in CCPA That Carnegie Collected in Past 12 Months Why Carnegie Collects This Personal Information
A. Identifiers A name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, Social Security number, account name, or other similar identifiers We collect this Personal Information:

  • To create an account for you or complete a transaction with you, such as when you request a white paper, subscribe to our newsletters, attend one of our webinars or conferences, or otherwise access our resources
  • When you complete our surveys or other online forms
  • When you enter one of our sweepstakes
  • To understand more about you so that we can customize your experience of our websites and services, develop new features for the websites and services, and improve our websites and services
  • To communicate with you about our websites and services by responding to your correspondence and requests and sending you information and updates about our websites and services that we think will interest you, such as targeted advertising based on your online activity and inferred interests
  • To obtain your feedback regarding our websites and services
  • To monitor and enforce compliance with the terms and conditions that apply to users of our websites and services or with a client contract
  • For customer support for our services and to troubleshoot problems
  • If you otherwise choose to give it to us
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) Name, signature, address or telephone number, educational information We collect this Personal Information for the reasons described in Row A above.

We collect high school, grade point average, test scores, extracurricular activities, and expected major to help match students and colleges/universities through CollegeXpress.
C. Protected classification characteristics under California or federal law Race, citizenship, sex (including gender, gender identity, or gender expression) When you choose to give it to us, we collect race (optional). We collect citizenship (for international students) and gender (male/female/non-binary) in order to provide our services, such as to help match students and colleges/universities through CollegeXpress.

We collect information associated with purchase of our services, such as business address and email address, to complete your purchase of our services.
D. Commercial information Records of products or services purchased or considered and other purchasing or consuming histories or tendencies We do not process credit card transactions. Credit card transactions are processed by a third-party credit card processing service, which is currently PayPal. (For more information about how PayPal processes personal information, please see PayPal’s privacy policy at https://www.paypal.com/us/webapps/mpp/ua/privacy-full.)
E. Biometric information NONE – We do not collect biometric information. NONE – We do not collect biometric information.
F. Internet or other similar network activity Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement. We automatically collect information about your browsing history, search history, and information regarding your interactions when you use our websites and services.
G. Geolocation data None listed in CCPA As you use our website and services, we may determine general physical location or movements from IP address and Wi-Fi access (when your device’s operating system settings allow collection).
H. Audio, electronic, visual, thermal, olfactory, or similar information None listed in CCPA If you contact us via telephone, we may record the telephone call, such as for quality assurance purposes. We will notify you if we are recording at the beginning of the telephone call when required by applicable law. We do not collect any thermal, olfactory, or similar information.

We collect your photograph if you choose to give it to us.
I. Professional or employment-related information None listed in CCPA Depending on how and why you use our websites and services, we collect professional or employment-related information, including:

  • Your current employer (e.g., college or university or advertiser) who/that is our client or prospective client
  • If you are a school counselor using CollegeXpress

We also collect this Personal Information:

  • To create your account or complete a transaction with you
  • When you complete our surveys or other online forms
  • To improve our websites and services and develop new features
  • To understand more about you in order to customize your experience and provide you with relevant information about our websites and services, including targeted advertising based on your online activity and inferred interests
  • To communicate with you about our services
  • If you otherwise choose to give it to us
J. Non-public education information per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99)(“FERPA”)) Carnegie collects education-related information as described above, but Carnegie is not subject to FERPA. Carnegie collects education-related information as described above, but Carnegie is not subject to FERPA.
K. Inferences drawn from other categories (A. – L above) to create a profile* about a consumer Profile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes Certain services (such as TeamChem teamchem.us) collect Personal Information to better understand team dynamics in the workplace, such as communication styles and risk profiles. We may also analyze your actual or likely preferences through the Personal Information we collect and process as described in our Privacy Policy

 

Since we may share Personal Information with other businesses and this sharing enables Carnegie to generate valuable consideration, it is possible that some of these categories were “sold” in the past 12 months.

HOW TO SUBMIT A REQUEST TO EXERCISE YOUR CALIFORNIA PRIVACY RIGHTS

To submit a request to exercise your privacy rights:

  1. Send an email to privacy@carnegiehighered.com with the subject line “California Privacy Rights Request.”
  2. Fill out our Personal Information Request Form.
  3. Call us at 978-692-5092.

Please note:

  • We may (and in some cases are required to) verify your identity before we can act on your request to exercise your privacy rights.
  • When we collect Personal Information on behalf of a client and use it solely for the benefit of that client, we are acting as a service provider under CCPA. In this case, we will direct you to contact our client.
  • We may not honor part or all your request. For example:
    • Certain information we collect may be exempt from this California Privacy Notice, such as public information made available by a government entity or information covered by another privacy law. Also, not-for-profit organizations are not subject to CCPA.
    • Personal Information collected in many types of B2B transactions is exempt from most of CCPA’s requirements until January 1, 2021.

If we do not honor your request, we will explain why when we respond to you.

A different California law permits California residents to request a notice disclosing the categories of personal information about you that we have shared with third parties for their direct marketing purposes during the preceding calendar year. (For these purposes, third parties include entities that are owned directly or indirectly by Carnegie.) If you would like to exercise your rights under this California law, please send a written request to the email address or postal address below or call us at the telephone number below. Within 30 days of receiving your request, we will provide you with the relevant information.

Address:
Carnegie Dartlet LLC
Attn: California Privacy
210 Littleton Road, Suite 100
Westford, MA 01886

Telephone: 978-692-5092
Email: privacy@carnegiehighered.com with a subject line of “California Privacy”

2. Privacy Rights Notice for Individuals Located in EU

This Privacy Rights Notice for Individuals Located in EU (“EU Notice”) supplements our Privacy Policy. If this EU Notice and any provision of our Privacy Policy conflict, then this EU Notice controls for the processing of personal data of individuals located in the EU.

In this EU Notice, “personal data” means any information about an identified or identifiable individual person.

The data controller for the personal data that we collect directly from or about you (and not on behalf of our clients) is:

Carnegie Dartlet LLC
210 Littleton Road, Suite 100
Westford, MA 01886
privacy@carnegiehighered.com

Please note that when we collect personal data on behalf of a client and use it solely for the benefit of that client, we are acting as a data processor. In this case, we will direct you to contact our client which is the organization that is the data controller.

When we are the data controller of personal data, we need to inform individuals in the EU about the legal bases for our processing of their personal data. Our legal bases depend on the context in which the personal data is collected and processed. Generally, we only collect personal data when we need the personal data to perform a contract with an individual in the EU, when we have consent to do so or when the processing is in our legitimate business interests and not overridden by the privacy or other fundamental rights and freedoms of individuals in the EU.

If we collect and use your personal data in reliance on our legitimate interests (or those of any third party), this interest is typically to provide our services and communicate with you as necessary to provide our services to you, such as when we respond to your queries, improve our services and develop new ones, and for our marketing activities. We may have other legitimate interests and we will make clear our legitimate interests at the relevant time when necessary.

In some cases, we also may have a legal obligation to collect personal data from or about certain individuals. If we ask you to provide personal data to comply with a legal obligation or to perform a contract with you, we will make this clear at the relevant time and advise you whether providing your personal data is mandatory and the possible consequences if you do not provide your personal data.

If you have questions about or need further information concerning which organization is acting as the data controller of your personal data or the legal bases on which your personal data is processed, please contact us using the contact details provided below.

If you would like to review, correct, update, suppress, restrict, or delete personal data that you have previously provided to us or if you would like to receive an electronic copy of your personal data for purposes of transmitting it to another organization (if and when this right to portability is provided to you by law), please submit your request to us by filling out our Personal Information Request Form, contacting us by email at privacy@carnegiehighered.com with the subject line of “EU Privacy,” or contacting us by mail at:

Carnegie Dartlet LLC
Attn: EU Privacy
210 Littleton Road, Suite 100
Westford, MA 01886

In your request, please make clear the personal data you would like to have changed, whether you would like to have your personal data suppressed from our database, or the other limitations you would like to put on processing of your personal data. For your protection, we only fulfill requests for the personal data associated with the particular email address that you use to send us your request, and we may need to verify your identity before fulfilling your request. We will try to comply with your request as soon as reasonably practicable and within the time periods required by applicable law.

When we collect personal data on behalf of a client and use it solely for the benefit of that client as a data processor, we will direct you to contact our client which is the organization that is the data controller.

We often need to retain certain personal data for record keeping purposes and/or to complete any transaction that you began prior to requesting a change or deletion (e.g., when you make a purchase or enter our sweepstakes, you may not be able to change or delete the personal data provided until after the completion of the purchase or sweepstakes). Our databases and other records may have residual personal data which will not be removed. We also may not allow you to review certain personal data for legal, security, or other reasons.

If you are an individual located in the EU, you have the right to lodge a complaint with a data protection authority about how we process your personal data. Please see https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-are-data-protection-authorities-dpas_en for more information.

International Transfers of Personal Information
Our servers are located in the United States, which may be outside the jurisdiction where personal data is collected. Also, some of the third-party service providers with which we may share personal data are located in and may transfer personal data to various jurisdictions. These other jurisdictions may have data protection laws that are different from the laws of your place of residence (and, in some cases, not as protective).