PRIVACY NOTICE
Last Updated:
Educational Computer Systems,
Inc., a Global Payments company, ("ECSI,"
"us", "we" or "our") respects your rights and
preferences regarding data privacy. In this Privacy Notice
("Notice"), we describe how we collect, use, disclose, and dispose of
the personal information that we collect from users of our U.S. websites,
forums and blogs ("Sites") that link to this Notice, as well as from
our U.S. prospects and customers and their personnel.
Please note that this Notice
does not describe our processing of borrower personal information in
connection with our provision of student loan processing services. If you are a
borrower, and your loan is serviced by ECSI, you should refer to the separate
privacy notice available here. That separate notice
describes the personal information that we collect and process about you as a
borrower, as well as whether and when we disclose that personal information,
and what rights you may have with respect to such disclosure.
ECSI also maintains specific
privacy notices for job applicants, employees, and contractors through Global
Payments, Inc. If you are a job applicant, employee, or contractor and need a
copy of the applicable privacy notice, please contact us at privacy@globalpay.com.
In this Notice, we provide
the following information about our collection and processing of personal
information from and about users of our Sites, as well as our U.S. prospects
and customers and their personnel:
●
PERSONAL INFORMATION WE
COLLECT AND HOW WE USE IT
●
HOW WE DISCLOSE
PERSONAL INFORMATION
●
TRANSFERRING PERSONAL
INFORMATION GLOBALLY
●
DATA SECURITY AND DATA
RETENTION
●
COOKIES AND OTHER
TRACKING TECHNOLOGIES
●
CHILDREN
“Personal information” is
information that identifies or relates to an identifiable individual. Subject
to your consent if required by law, we may collect the following types of
personal information about you:
● Basic Identifying Information, including your full name, postal
address, e-mail address, phone number, username or other account credentials,
or other similar identifiers.
● Device Information and Other Unique Identifiers, including device
identifier, internet protocol (IP) address, cookies, pixel tags, or similar
unique identifiers.
● Internet or Other Network Activity, including browsing or search
history and information regarding your interactions with our Sites.
● Commercial Information, including information about the
products and services we provide to you, your access and purchase history, and
other information about your commercial activity.
● Professional and Employment-Related Information, including your role or
status with the school or other organization with which you are affiliated.
● Information You Provide, including your communications with
us and any other content you provide (such as if you report a problem or
otherwise engage with our Sites).
● Audio and Visual Information, including videos and recordings of
your voice (such as when we record calls or videos for quality assurance or
other business activities).
●
Create, maintain or provide service for your account
●
Process or fulfill requests from you
●
Respond to customer service requests from you
●
Verify your information
●
Process payments
●
Undertake activities to maintain the quality, safety or
integrity of the Sites or our services, including to repair, improve, upgrade,
or enhance the Sites or our services
● To conduct our operations and for other general business purposes
● To conduct audits and enable internal record keeping and administration of records
●
Maintain data security, including detecting and responding to
security incidents, protecting you and us from fraud or other illegal activity,
and prosecute individuals responsible for that activity
●
Monitor our Sites and track information about our
interactions with you, including gathering usage data and other analytic
information
● To personalize your experience when you use the Sites
●
Other uses that are required for us to meet our legal,
contractual or regulatory requirements
Sources of personal information. We collect information from various
sources, including the following:
●
Information that you provide
to us: We
collect personal information that you provide to us when you set up an account
with us, visit our Sites, use our services, or communicate with us. For
example, if you register for an account with us, we may request your name,
contact information and other information.
●
Information collected from
third parties:
We may collect information about you from third parties in the course of
providing our services. For example, we may collect personal information like
your name, contact information and employment status from your college or
university in order to provide you with access to our Sites and services as an
authorized user.
● Information collected through technology: When you visit our Sites or interact with an email we send to you, we may collect certain information automatically, such as your account or device identifier, and usage information such as pages that you visit, information about links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our services. You have the ability to express your preference regarding some of the ways we collect information through technology in some of our services (see “Cookies and Other Tracking Technologies” for more information).
The business purpose for our processing of personal
information.
Our primary business purpose for processing personal information about you is
to perform the services outlined in our contracts with our customers. We may
also use personal information about you to enable the following additional
business purposes: (1) detecting and managing security incidents or fraudulent
activity, (2) providing customer service, fulfilling requests, and other
functions directly related to the services, (3) maintaining our software
including debugging and repairing errors, and (4) maintaining the quality of
the services and developing enhancements and improvements to meet our customer needs.
When we rely on your consent as the legal basis for our processing of personal
information, you may withdraw your consent as may be instructed in the Sites
and Apps, or by contacting us using the information in the “
Data anonymization and aggregation. Subject to your consent if required
by law, we may anonymize or aggregate personal information about you so that
you are not identified or identifiable from it, in order to use the anonymized
or aggregated data. For example, we may use anonymized or aggregated data for
statistical analysis including to analyze trends, for product development, and
for risk assessments and cost analysis. We may disclose anonymized or
aggregated data to our parent companies, subsidiaries, affiliates or with other
third parties. This Notice does not restrict ECSI's use or disclosure of any
anonymized or aggregated information.
We disclose personal
information as necessary to operate our Sites and provide the services. Except
as otherwise specified, we may disclose any of the categories of personal
information about you in the manner and for the purposes described below:
●
With ECSI affiliates where such disclosure is necessary to
provide you with our services or to manage our business.
●
With non-affiliated service providers. For example, we
disclose personal information to information technology (IT) service providers
who help manage our back office systems or administer our Sites and services.
Non-affiliated service
providers may also include (without limitation) legal, accounting, auditing,
consulting, or other professional service providers.
●
With our customer on whose behalf we interact with you in the
provision of the services. For example, ECSI may disclose the personal
information relating to customer personnel to the relevant customer, consistent
with the terms of our contractual agreement(s) with that customer.
●
With banks and payment providers to authorize and complete
card payments.
●
With logistics service providers to enable the delivery of
packages to individuals.
●
With social media management providers that enable us to
manage and analyze our branded social media account content, including tags,
mentions, posts, comments, and direct messages.
● With other non-affiliated entities to whom you direct us to disclose defined categories of personal information about you.
● With regulators including state and federal agencies, and other parties required to enable compliance with laws, regulations and industry standards related to our services.
●
In response to a court order or a request for cooperation
from a regulatory, law enforcement, or other government agency; to establish or
exercise our legal rights; to defend legal claims; or as otherwise required or
permitted by applicable laws and/or regulations.
●
When we believe that disclosure is appropriate in connection
with efforts to investigate, prevent, or take action regarding actual or
suspected illegal activity, fraud, or other wrongdoing; to protect and defend the
rights, property or safety of ECSI, its customers, staff,
suppliers or others.
●
To third parties in connection with any proposed or actual
reorganization, merger, sale, joint venture, assignment, transfer or other
disposition of all or any portion of our assets or stock
(including in
connection with any bankruptcy or similar proceedings).
Subject to your consent if
required by applicable law, we may appoint an affiliate company to process
personal information in a service provider role. Our affiliates are located
around the globe. This means that personal information about you may be
transferred to and stored in the United States or in another country outside of
the country in which you reside, which may be subject to different standards of
data protection than your country of residence. Where applicable, we will take
appropriate steps to transfer personal information in accordance with
applicable law.
We take the security and privacy
of personal information seriously. We maintain administrative, technical and
physical safeguards designed to protect the personal information you provide
against accidental, unlawful or unauthorized destruction, loss, alteration,
access, disclosure or use.
Any suspected attempt to
breach our policies and procedures, or to engage in any type of unauthorized
action involving our information systems, is regarded as potential criminal
activity. Suspected computer mischief may be reported to the appropriate
authorities.
Please remember that
communications over the internet such as emails are not secure. We seek to keep
secure personal information submitted to us through the Sites in accordance
with our obligations under applicable laws and regulations. However, like all
website operators, we cannot guarantee the security of any data transmitted
through the internet, including the Sites.
We retain the personal
information we collect for different periods of time depending on what it is
and how we use it. In some contexts, we will provide additional information
about retention as you use the services. When we collect personal information,
we will retain it only for as long as is necessary to complete the legitimate
business or legal purposes for which we collected it. The criteria used to
determine our retention periods include:
● The length of time we have an
ongoing relationship with you and provide services to you, for example, for as
long as you have an account with us or continue to use our services, and the
length of time thereafter during which we may have a legitimate need to
reference personal information to address issues that may arise;
● Whether there is a
contractual obligation to which we are subject, for example, our contracts with
our customers may specify a certain period of time during which we are required
to maintain the information on behalf of our customers;
● Whether there is a legal
obligation to which we are subject, for example, certain laws require us to
keep records for a certain period of time before we can delete them; and
● Whether retention is
advisable in light of our legal position, such as in regard to applicable
statutes of limitations, litigation, or regulatory investigations.
A "cookie" is a
text file that is stored to your browser when you visit a website.
Unique device identifiers
like IP address or UDID recognize a visitor's computer or other device used to
access the internet. Unique device identifiers are used alone and in conjunction
with cookies and other tracking technologies for the purpose of
"remembering" computers or other devices used to access the Sites.
We may also use other
technologies like pixels or tags that allow us to measure responses to our
email communications.
Cookies and similar tracking
technologies are used to help us retain information about your use of our
Sites. Using cookies, we collect information like country location, language
preference and other settings. Cookies can also help us to operate our services
more efficiently and securely, remember you for future visits and enhance your
user experience by providing real-time tools including user guides and chatbots. We also gather statistical information about the
use of our services in order to continually improve their design and
functionality, understand how they are used, and assist us with resolving
questions regarding them.
Cookies can be classified by
duration and by source:
●
Duration. The Sites use both
"session" and "persistent" cookies. Session cookies are
temporary - they terminate when you close your browser or otherwise end your
"active" browsing session. Persistent cookies remember you on
subsequent visits. Persistent cookies are not deleted when you close your
browser, and they will remain on your computer or other device unless you
choose to delete them (see below for "How to Delete or Block Cookies and Other Tracking Technologies").
● Source. Cookies can be "first-party" or
"third-party" cookies, which means that they are either issued by or
on behalf of ECSI or by a third-party operator of another website. The Sites
use both first-party and third-party cookies.
The cookies that we may use
on the Sites fall into the following categories:
●
Strictly Necessary Cookies. These cookies are necessary
for the website to function and cannot be switched off in our systems. They are
usually only set in response to actions taken by you such as logging in or
filling in forms. You can set your browser to block or alert you about these
cookies, but blocking them may impede the functionality of the Sites.
●
Performance Cookies. These cookies allow us to
count visits and traffic sources so we can measure and improve the performance
of our site. They help us to know which pages are the most and least popular
and see how visitors move around the site. All information these cookies
collect is aggregated. If you do not allow these cookies we will not know when
you have visited our site, and will not be able to monitor its performance.
● Functionality Cookies. These cookies enable the Sites to
provide enhanced functionality and personalization. They may be set by us or by
third-party providers whose services we have added to our pages. If you do not
allow these cookies then some of these services may not function properly.
We adhere to the standards
set out in this Notice and do not currently monitor or respond to browser
Do-Not-Track signals. If you do not want information collected through the use
of cookies, you can use the Cookie Settings banner or icon on the Site to make
selections about the use of cookies, where applicable on some Sites.
Additionally, most browsers allow you to automatically decline cookies or be given
the choice of declining or accepting a particular cookie (or cookies) from a
particular website.You may also refer to
http://www.allaboutcookies.org/manage-cookies/index.html. If, however, you do
not accept cookies, you may experience some inconvenience in your use of our
services. You also may not receive advertising from us that are relevant to
your interests and needs. Additionally, some browsers and browser extensions
support the Global Privacy Control (“GPC”) that can send a signal to the
websites you visit indicating your choice to opt out of certain types of data
processing. Through our consent management platform, administered by our vendor
OneTrust, the Sites recognize and respond to opt-out
requests made using GPC.
ECSI may provide links on our
Sites to other third-party websites or services that are not under our control.
We do not endorse or make any warranty of any type regarding the content
contained on such third-party websites or services or regarding the products
and services they offer. Please be aware that we are not responsible for the
privacy practices of the operators of other websites or services. We encourage
our users to be aware when they leave our Sites You should read any other
applicable privacy and cookies notices carefully before accessing and using
third-party websites or services.
The Sites and our services
are not intended for use by children. We do not solicit or knowingly accept any
personal information from persons under the age of 18. Please do not use the
Sites or our services if you are under the age of 18.
● Know whether we process personal information about you;
● Know how the personal information is used;
● Access, request and receive the personal information we have collected in a portable manner;
● Opt out of having your personal information sold, “shared”;
● Request that we correct inaccuracies in the personal information; and
● Request that we delete personal information about you.
You may contact us using the
information in the “Contact Us” section of this Notice for
additional information about how to exercise your rights. In addition, if you
are a resident of California or another jurisdiction with similar laws, please
see the “Region-Specific
Information” section below for further details on how to exercise your privacy
rights.
Privacy Act Notice. The Privacy Act of 1974 requires that the following
notice be provided to you: The authorities for collecting the requested
information from and about you are §421 et seq., §451 et seq., or §461 of the
Higher Education Act of 1965, as amended (20 U.S.C. 1071 et seq., 20 U.S.C.
1087a et seq., or 20 U.S.C. 1087aa et seq.) and the authorities for collecting
and using your Social Security Number (SSN) are §§428B(f) and 484(a)(4) of the
HEA (20 U.S.C. 1078-2(f) and 1091(a)(4)) and 31 U.S.C. 7701(b). Participating
in the Federal Perkins Loan (Perkins Loan) or Health Profession Loan Program
and giving us your SSN are voluntary, but you must provide the requested
information, including your SSN, to participate. The principal purposes for
collecting the information, including your SSN, are to verify your identity, to
determine your eligibility to receive a loan or a benefit on a loan (such as a
deferment, forbearance, discharge, or forgiveness) under the Perkins Loan and
Health Profession Loan Program, to permit the servicing of your loans, and, if
it becomes necessary, to locate you and to collect and report on your loans if
your loans become delinquent or default. We also use your SSN as an account
identifier and to permit you to access your account information electronically.
The information in your file may be disclosed, on a case-by-case basis or under
a computer matching program, to third parties as authorized under routine uses
in the appropriate systems of records notices. The routine uses of this
information include, but are not limited to, its disclosure to federal, state,
or local agencies, to private parties such as relatives, present and former
employers, business and personal associates, to consumer reporting agencies, to
financial and educational institutions, and to guaranty agencies in order to
verify your identity, to determine your eligibility to receive a loan or a
benefit on a loan, to permit the servicing or collection of your loans, to
enforce the terms of the loans, to investigate possible fraud and to verify
compliance with federal student financial aid program regulations, or to locate
you if you become delinquent in your loan payments or if you default. To
provide default rate calculations, disclosures may be made to guaranty
agencies, to financial and educational institutions, or to state agencies. To
provide financial aid history information, disclosures may be made to
educational institutions. To assist program administrators with tracking
refunds and cancellations, disclosures may be made to guaranty agencies, to
financial and educational institutions, or to federal or state agencies. To
provide a standardized method for educational institutions to efficiently
submit student enrollment statuses, disclosures may be made to guaranty
agencies or to financial and educational institutions. To counsel you in
repayment efforts, disclosures may be made to guaranty agencies, to financial
and educational institutions, or to federal, state, or local agencies. In the
event of litigation, we may send records to the Department of Justice, a court,
adjudicative body, counsel, party, or witness if the disclosure is relevant and
necessary to the litigation. If this information, either alone or with other
information, indicates a potential violation of law, we may send it to the
appropriate authority for action. We may send information to members of
Congress if you ask them to help you with federal student aid questions. In
circumstances involving employment complaints, grievances, or disciplinary
actions, we may disclose relevant records to adjudicate or investigate the
issues. If provided for by a collective bargaining agreement, we may disclose
records to a labor organization recognized under 5 U.S.C. Chapter 71.
Disclosures may be made to our contractors for the purpose of performing any
programmatic function that requires disclosure of records. Before making any
such disclosure, we will require the contractor to maintain Privacy Act
safeguards. Disclosures may also be made to qualified researchers under Privacy
Act safeguards.
Changes and Updates. We reserve the right, in our sole discretion, to
modify, update, or otherwise change this Notice. The “Last Updated” legend at
the top of this Notice indicates when this Notice was last revised. Any changes
will become effective when we post the revised Notice on our services,
including our Sites. Where required by applicable law, to the extent we make
material or significant changes to the Notice, we will notify you of the update
via a pop-up, email, notification in the Sites, or other method through which
we communicate with you.
If you have questions about
this Notice, or if you want to exercise your rights as described in this
Notice, you can submit a request by completing this form or may contact us as follows:
ECSI
1200 Cherrington
Pkwy, Suite 200
Moon Township, PA 15108
privacy@globalpay.com
866-313-3797
If you make a request to
exercise a privacy right, we will verify and respond to your request consistent
with applicable law, taking into account the type and sensitivity of the
personal information subject to the request. We may decline to honor your request
where an exception applies. In order to honor any access, deletion, or similar
request, we will require you to provide enough information for us to verify
your identity. For example, we may ask you for information associated with your
account, including your contact information or other identifying information.
If you would like your agent to make a request on your behalf, if permitted
under applicable law, the agent may exercise those rights as noted above. We
will process the agent’s request consistent with applicable law. As part of our
verification process, we may request that the agent provide, as applicable,
proof concerning their status as an authorized agent. In addition, we may
require that you verify your identity as described in this section or confirm
that you provided the agent permission to submit the request.
Information for Residents of
California and Other Similar Jurisdictions
This
section supplements the above Notice and further describes how we collect, use,
and disclose the personal information we collect about residents of California
and other similar jurisdictions.
|
Categories of Personal Information (See the “Personal Information We Collect and How We Use
It”
section for a description of each category of Personal Information) |
Disclosed to Which Categories of Recipients for Operational
Business Purposes |
Processing Purposes |
|
Basic Identifying
Information; Device Information and Other Unique Identifiers; Internet or
Other Network Activity; Commercial Information; Professional and
Employment-Related Information; Information You Provide |
Please see the “How We Disclose Personal Information” section for a list of the
categories of recipients to whom we may disclose these categories of personal
information. |
Please see the “How We Use the Personal Information We
Collect” section for a list and description of the applicable processing
purposes for these categories of personal information. |
|
Audio and Visual
Information |
Affiliates; distributors of
our products and services; service providers; regulators; legal authorities
and other third parties in order to comply with laws, regulations, and
standards; other parties in litigation |
● Provide our services and
customer support ● Operations and general
business purposes ● Improve and develop new
products and services ● Fraud prevention and
security ● Legal and compliance |
The
non-borrower-facing Sites may use cookies, including some cookies that are
created by other companies and placed on your browser when you visit our
website. We use those cookies to improve your experience and to gather
information about our customers and the performance of our website. However,
the companies who provide those cookies to us also have access to the data
collected through them, and they may use that data for targeted advertising
purposes. Our use of those third-party cookies could therefore be considered a
“share” of your personal information under California law or processing for
targeted advertising under other privacy laws. If you are a resident of
California or another jurisdiction with similar laws, that
means you have the right to opt out. If you have not done so already, you can
opt out of the placement of all non-necessary cookies by adjusting your Cookie
Settings.
You
can also use the GPC to indicate your choice to opt out of certain types of
data processing, including sales and “shares” of personal information. Through
our consent management platform, administered by OneTrust,
the Sites recognize and respond to opt-out requests made using GPC.
Collection, Use, and
Disclosure of Sensitive Personal Information. Subject to your consent
where required by applicable law, we collect, process, and disclose sensitive
personal information for purposes of: providing goods or services as requested;
ensuring safety, security, and integrity; countering wrongful or unlawful
actions; short term transient use such as displaying first party,
non-personalized advertising; performing services for our business, including
maintaining and servicing accounts, providing customer service, processing or
fulfilling orders and transactions, verifying customer information, processing
payments, providing financing, providing analytic services, providing storage,
or providing similar services on behalf of our business; activities relating to
quality and safety control or product improvement; and other collection and
processing that is not for the purpose of inferring characteristics about an
individual. We do not use sensitive personal information beyond these purposes.
Right to know
about personal information collected,
used, disclosed, sold, and “shared”
|
You have the right to know whether we process
personal information about you, and to access such personal information. If
you are a California resident, you may also request that we disclose to you:
● the categories
of personal information we have collected about you and the categories of
sources from which we collected such personal information;
● the business
or commercial purpose for which we collected, “shared,” or sold the personal
information about you;
● the categories of personal
information about you that we “shared” or sold and the categories of third
parties with whom we “shared” or to whom we sold the personal information
about you; and
● the
categories of personal information about you that we disclosed for a business
purpose, and the categories of third parties to whom we disclosed that
information for a business purpose.
|
Right to receive a copy of personal
information
|
You have the right to request that we provide
the specific pieces of personal information, including a copy of such
personal information in a portable format.
|
Right to opt-out of the sale of personal
information
|
You may request that we do not sell personal
information about you to third parties. See the “
|
Right to opt-out of targeted advertising,
including the “sharing” of personal information for cross-context behavioral
advertising
|
You may request that we opt you out of
targeted advertising, including that we stop “sharing” personal information
about you for purposes of cross-context behavioral advertising. See the “Do Not Sell or Share My Personal Information” section for
more information.
|
Right to request deletion
|
In some circumstances, you have the right to
have personal information about you deleted.
|
Right to equal service and prices
(“non-discrimination”)
|
Your choice to exercise your privacy rights
will not be used as a basis to discriminate against you in services offered
or pricing.
|
Right to request correction
|
You have the right to request that we correct
inaccuracies in your personal information.
|
Right to limit the use and disclosure of
sensitive personal information
|
In some circumstances, you may request that
we limit the use and disclosure of your sensitive personal information.
|
Right to appeal
|
Depending on your state of residence, if we
refuse to take action on your request, you may appeal this refusal within a
reasonable period after you have received notice of the refusal. To appeal,
you can contact us at privacy@globalpay.com or complete this form and select
“Appeal a decision about a previous request” under “Type of Request.”
|
You
can submit a request for any of the above rights by using the contact
information in the “Contact Us”
section of this Notice.
If
you are a resident of California, you may request information concerning the
categories of personal information (if any) we share with third parties or
affiliates for their direct marketing purposes. If you would like more
information, please submit a written request to us using the information
provided in the above “Contact Us” section of this Notice.