CollegeXpress California and EEA, Switzerland, and UK Privacy Policy

Last Updated: March 21, 2025

CollegeXpress and similar services that link to this Privacy Policy are operated and provided by Carnegie Dartlet LLC (“Carnegie”). Carnegie and its affiliates appreciate your trust and respect your right to privacy. This California and EEA, Switzerland, and UK Privacy Policy consists of (1) a notice for California residents and (2) a notice for individuals located in the European Economic Area, Switzerland, and the United Kingdom.

1. California Privacy Rights Notice

This California Privacy Rights Notice (“California Privacy Notice”) applies to the processing of personal information of residents of the State of California by Carnegie and its affiliates as required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the “CCPA”). We fully describe our practices in our Privacy Policy but use this separate notice to ensure we meet the CCPA’s requirements. If this California Privacy Notice and any provision of our Privacy Policy conflict, then this California Privacy Notice controls for the processing of personal information of residents of the State of California. In the CCPA, California residents are referred to as “consumers,” and we refer to them in this California Privacy Notice as “California Consumers.”

HOW WE COLLECT AND USE PERSONAL INFORMATION

Our Privacy Policy describes the personal information we collect and its sources, along with our retention policies regarding such information. This California Privacy Notice organizes that description around the personal information categories set forth in the CCPA. For each category, we list examples of the types of personal information that we may have collected from California Consumers within the past 12 months.

Sensitive personal information is a subtype of personal information consisting of specific information categories. While we collect information that falls within the sensitive personal information categories listed in the table above, the CCPA does not treat this information as sensitive because we do not collect or use it to infer characteristics about an individual.

As further described in “How We Use Your Personal Information” section of our Privacy Policy, we generally collect and use each of the categories of personal information listed above to provide and manage the Services, and for other business or commercial purposes, such as advertising, marketing, and to improve our products and services.

We retain each of the categories of personal information listed above for as long as we have a legitimate business need, such as for the duration of our contract with you or to comply with applicable legal, tax, or accounting requirements.

When we no longer have a legitimate business need to process your personal information, we follow our data retention policy and either delete or anonymize your personal information. If we cannot delete or anonymize your personal information, then we will securely store your personal information until deletion or anonymization is possible.

Once we anonymize your personal information, it is no longer personal information. We use anonymized data subject to applicable law.

HOW WE DISCLOSE, SHARE, AND SELL PERSONAL INFORMATION

Our Privacy Policy describes how and why we disclose your personal information. We may disclose your personal information to a third party for a business purpose. In the preceding twelve (12) months, Carnegie has disclosed personal information of California Consumers as described in the chart below.

We do not “sell” or “share” personal information from users of CollegeXpress or similar services that link to this California Privacy Notice, as such terms are defined by the CCPA.

YOUR CALIFORNIA PRIVACY RIGHTS

The CCPA offers California Consumers the following key privacy rights:

• Right to Know and Right to Data Portability – You have the right to request that we disclose certain information to you about our collection and use of your personal information (“Right to Know”). Once we receive your request and confirm your identity, we will disclose to you:
  • The categories of personal information we collected about you.
  • The sources from whom we collect personal information about you.
  • Our business or commercial purpose for collecting or selling that personal information.
  • The categories of third parties with whom we share that personal information.
  • If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
    • sales, identifying the personal information categories that each category of recipient purchased; and
    • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
  • The specific pieces of personal information we collected about you ( “Right to Data Portability”).
• Right to Delete – Subject to certain exceptions, you have the right to request that we delete certain personal information that we have collected from you (“Right to Delete”). Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. We may deny your request to delete if retaining the information is necessary for us or our service providers to:
  • Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
  • Debug products to identify and repair errors that impair existing or intended functionality.
  • Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  • Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
  • We will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.
• Right to Correct – You have the right to request that we correct inaccurate personal information that we have collected (“Right to Correct”). Once we receive your request and confirm your identity, we will use commercially reasonably efforts to correct any inaccurate personal information.

You may also make a request related to a right to know, right to data portability, a right to delete, or a right to correct personal information on behalf of your child by contacting us as provided below.

In the CCPA, “sale” means transferring or making available personal information to third parties for monetary or other valuable consideration, and “sharing” means disclosing your personal information to third parties for cross-context behavioral advertising purposes. Disclosing your personal information with our service providers for a business purpose does not constitute “selling” or “sharing” your personal information because we make sure that our service providers are contractually obligated to use the personal information only to provide services on our behalf. We do not “sell” or “share” personal information from users of CollegeXpress or similar services that link to this California Privacy Notice, including from California Consumers under the age of 16. As we do not “sell” or “share” personal information from users of CollegeXpress or similar services that link to this California Privacy Notice, we do not provide a mechanism to opt out.

We will not discriminate against you for exercising any of your CCPA rights. However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

OTHER CALIFORNIA PRIVACY RIGHTS

California’s “Shine the Light” law (California Civil Code Section 1798.83) permits California Consumers to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. If you would like to exercise this right, please contact us as provided below.

HOW TO SUBMIT A REQUEST TO EXERCISE YOUR CALIFORNIA PRIVACY RIGHTS

To submit a request to exercise your privacy rights:

1. Send an email to privacy@carnegiehighered.com with the subject line “California Privacy Rights Request”;
2. Fill out our Personal Information Request Form;
3. Send us a letter at Carnegie Dartlet LLC, Attn: Privacy and Legal, 210 Littleton Road, Suite 100, Westford, MA 01886;
4. Fill in the contact form at https://www.collegexpress.com/contact; or
5. Call us at 978-692-5092 or toll free at 888-562-4440

Only you or your authorized agent may make a request to exercise your privacy rights. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests by contacting us as provided above.

We will confirm receipt of your request within 10 business days. If you do not receive confirmation within this timeframe, please contact us as provided above.

We try to substantively respond to a request within 45 days of its receipt. If we require more time, we will inform you of the reason and extension period. We cannot respond to your request or provide you with personal information unless we can verify your identity or authority to make the request and confirm the personal information relates to you. To do so, we may ask that you log into your account or that you provide us with your name, address, email address, and/or phone number. You may also be asked to answer a few questions about yourself to help us verify your identity. In the event more documentation is necessary to verify your identity, we will notify you directly. If we cannot verify your request within 45 days of its receipt, we may deny your request.

If we do not honor your request, we will explain why when we respond to you.

FINANCIAL INCENTIVES

We offer certain programs, benefits, and other offerings that may be deemed a “financial incentive” under the CCPA, including a monthly scholarship contest to registered users of CollegeXpress who answer a question related to each monthly scholarship contest.

When a user registers, we typically ask them to provide their name, email address, date of birth, high school GPA, and potential college major of interest. Users may also choose to provide race and gender information upon registration. Registration and participation in each monthly scholarship contest is voluntary, and no purchase is required.

While we cannot calculate the precise value of your information, our programs generally reflect the value of the relationships that we have with the individuals who participate in them. Participation in these programs is governed by this Privacy Policy, the CollegeXpress Terms of Use, and the related scholarship rules.

Entry in each monthly scholarship contest is voluntary. To opt out of the monthly scholarship contest or otherwise withdraw from financial incentives, you may refrain from answering the monthly scholarship question, or you may contact us by email at privacy@carnegiehighered.com.

2. Privacy Rights Notice for Individuals Located in the EEA, Switzerland, and the UK

This Privacy Rights Notice for Individuals Located in the EEA, Switzerland, and the UK (“EEA, Switzerland, and UK Notice”) supplements our Privacy Policy. If this EEA, Switzerland, and UK Notice and any provision of our Privacy Policy conflict, then this EEA, Switzerland, and UK Notice controls for the processing of personal data of individuals located in the European Economic Area (“EEA”), Switzerland, or the United Kingdom (“UK”).

In this EEA, Switzerland, and UK Notice, “personal data” means any information about an identified or identifiable individual person.

The data controller for the personal data that we collect directly from or about you (and not on behalf of our clients) is:

Carnegie Dartlet LLC
210 Littleton Road, Suite 100
Westford, MA 01886
privacy@carnegiehighered.com

Please note that when we collect personal data on behalf of a client and use it solely for the benefit of that client, we are acting as a data processor. In this case, we will direct you to contact our client, which is the organization that is the data controller.

When we are the data controller of personal data, we need to inform individuals in the EEA, Switzerland, or the UK about the legal bases for our processing of their personal data. Our legal bases depend on the context in which the personal data is collected and processed. Generally, we only collect personal data when we need the personal data to perform a contract with an individual in the EEA, Switzerland, or the UK, when we have consent to do so, or when the processing is in our legitimate business interests and not overridden by the privacy or other fundamental rights and freedoms of individuals in the EEA, Switzerland, or the UK.

If we collect and use your personal data in reliance on our legitimate interests (or those of any third party), this interest is typically to provide our Services and communicate with you as necessary to provide our Services to you, such as when we respond to your queries, improve our Services and develop new ones, and for our marketing activities. We may have other legitimate interests and we will make clear our legitimate interests at the relevant time when necessary.

In some cases, we also may have a legal obligation to collect personal data from or about certain individuals. If we ask you to provide personal data to comply with a legal obligation or to perform a contract with you, we will make this clear at the relevant time and advise you whether providing your personal data is mandatory and the possible consequences if you do not provide your personal data.

If you have questions about or need further information concerning which organization is acting as the data controller of your personal data or the legal bases on which your personal data is processed, please contact us using the contact details provided below.

We want to make sure you are fully aware of all of your data protection rights, which include the following rights:

• Right to Access. You have the right to request copies of your personal data. If you require more than one copy, we may charge you a reasonable fee.
• Right to Rectify. You have the right to request that we correct any inaccurate personal data, or to complete any personal data which is incomplete.
• Right to Erase. You have the right to request that we erase your personal data, under certain circumstances.
• Right to Restrict Processing. You have the right to request that we restrict the processing of your personal data, under certain circumstances.
• Right to Object to Processing. You have the right to object to our processing of your personal data, under certain circumstances.
• Right to Data Portability. You have the right to request we transfer data that we have collected to you or directly to another organization, under certain circumstances.
• Right to Withdraw Consent. You have the right to withdraw your consent, explicit or otherwise, at any time. If we rely on your consent as the legal basis for our processing of your personal data, we will refrain from processing your personal data.
• Right to Object to Automated Decision-Making. You have the right not to be subject to automated decision-making, though note that we do not currently engage in any automated decision-making.

If you would like to exercise any of these rights, please submit your request to us by filling out our Personal Information Request Form, contacting us by email at privacy@carnegiehighered.com with the subject line of “EEA Privacy,” or contacting us by mail at:

Carnegie Dartlet LLC
Attn: EEA Privacy
210 Littleton Road, Suite 100
Westford, MA 01886

In your request, please make clear the personal data you would like to have changed, whether you would like to have your personal data suppressed from our database, or the other limitations you would like to put on the processing of your personal data. You have the right to withdraw your consent to processing of personal data at any time. For your protection, we may need to verify your identity before fulfilling your request. If we need more information to process a request, we will contact you by email or, if we do not have your email address on file, by the same method the request was made. We will try to comply with your request as soon as reasonably practicable and within the time periods required by applicable law. If we do not honor a request for legal or other reasons, we will explain why we did not honor the request, the right to appeal, and any right to file a complaint.

When we collect personal data on behalf of a client and use it solely for the benefit of that client as a data processor, we will direct you to contact our client which is the organization that is the data controller.

We often need to retain certain personal data for record keeping purposes and/or to complete any transaction that you began prior to requesting a change or deletion (e.g., when you make a purchase or enter our sweepstakes, you may not be able to change or delete the personal data provided until after the completion of the purchase or sweepstakes). Our databases and other records may have residual personal data which will not be removed. We also may not allow you to review certain personal data for legal, security, or other reasons.

In the EEA, you have the right to lodge a complaint with your local data protection supervisory authority. In Switzerland, you have the right to lodge a complaint with the Federal Data Protection Information Commissioner. In the UK, you have the right to lodge a complaint with the Information Commissioner’s Office. Please see https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-are-data-protection-authorities-dpas_en, https://www.edoeb.admin.ch/en/report-form-data-subjects, or https://ico.org.uk/make-a-complaint for more information.

International Transfers of Personal Data

Our servers are located in the United States, which may be outside the jurisdiction where your personal data is collected. Also, some of the third-party service providers with which we may share personal data are located in and may transfer personal data to various jurisdictions. If you are located outside of the United States, please note that we may transfer data, including personal data, to the United States, which may not have the same data protection laws as your jurisdiction. You consent to the transfer of your personal data to, and the storage and further processing of your personal data in, the United States.