This Privacy Rights Notice consists of (1) a notice for California residents and (2) a notice for individuals located in the European Union.
1. California Privacy Rights Notice
This California Privacy Rights Notice (“California Privacy Notice”) applies to the processing of personal information of residents of the State of California by Carnegie Dartlet LLC and its affiliates (“Carnegie” or “we”) as required by the California Consumer Privacy Act of 2018 (“CCPA”).
If you are a California Consumer, this California Privacy Notice explains your privacy rights and how and why we collect and process your Personal Information. In this California Privacy Notice, “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California Consumer or household.
Your California Consumer Privacy Rights
CCPA offers California Consumers the following key privacy rights:
- You have the right to request information about categories and specific pieces of Personal Information that we have collected about you (see table below), as well as the categories of sources from which the personal information is collected, the purpose for collecting personal information, and the categories of third parties with whom we share personal information.
- You have the right to request information about our disclosure for business purposes of your Personal Information to third parties.
- You have the right to request that we delete certain Personal Information that we have collected from you.
- If we offer a financial incentive or price or service difference in exchange for your Personal Information, we will notify you in advance before collecting your Personal Information for this purpose and explain how you can opt-in to the financial incentive or price or service difference.
- You have the right to opt-out of our sale of your Personal Information if and when we determine the purpose and means of processing of your Personal Information. (In CCPA, “sale” means transferring or making available Personal Information to third parties for monetary or other valuable consideration.) Sharing your Personal Information with our service providers is not a sale of your Personal Information because we make sure that our service providers are contractually obligated to use the Personal Information only to provide services to us and not to sell it. Please click here for details about how to opt-out of sale.
- If you are a California Consumer age 13, 14, or 15, we cannot make available to third parties the Personal Information that we collect from or about you for monetary or other valuable consideration (e.g., in exchange for showing students information about colleges and universities) unless you opt-in. Please click here for details about how to opt-in. If you are under age 13, you are not eligible to use any of our websites and services.
- You have the right to not receive discriminatory treatment from us for exercising any of these rights. That is, we cannot treat you differently for exercising any of these rights unless we demonstrate that the value of the Personal Information that you provide to us is reasonably related to the difference in price or service that we offer.
|Category of Personal Information Under CCPA||Personal Information in Category as Listed in CCPA That Carnegie Collected in Past 12 Months||Why Carnegie Collects This Personal Information|
|A. Identifiers||A name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, Social Security number, account name, or other similar identifiers||We collect this Personal Information:
|B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))||Name, signature, address or telephone number, educational information||We collect this Personal Information for the reasons described in Row A above.
We collect high school, grade point average, test scores, extracurricular activities, and expected major to help match students and colleges/universities through CollegeXpress.
|C. Protected classification characteristics under California or federal law||Race, citizenship, sex (including gender, gender identity, or gender expression)||When you choose to give it to us, we collect race (optional). We collect citizenship (for international students) and gender (male/female/non-binary) in order to provide our services, such as to help match students and colleges/universities through CollegeXpress.
We collect information associated with purchase of our services, such as business address and email address, to complete your purchase of our services.
|E. Biometric information||NONE – We do not collect biometric information.||NONE – We do not collect biometric information.|
|F. Internet or other similar network activity||Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.||We automatically collect information about your browsing history, search history, and information regarding your interactions when you use our websites and services.|
|G. Geolocation data||None listed in CCPA||As you use our website and services, we may determine general physical location or movements from IP address and Wi-Fi access (when your device’s operating system settings allow collection).|
|H. Audio, electronic, visual, thermal, olfactory, or similar information||None listed in CCPA||If you contact us via telephone, we may record the telephone call, such as for quality assurance purposes. We will notify you if we are recording at the beginning of the telephone call when required by applicable law. We do not collect any thermal, olfactory, or similar information.
We collect your photograph if you choose to give it to us.
|I. Professional or employment-related information||None listed in CCPA||Depending on how and why you use our websites and services, we collect professional or employment-related information, including:
We also collect this Personal Information:
|J. Non-public education information per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99)(“FERPA”))||Carnegie collects education-related information as described above, but Carnegie is not subject to FERPA.||Carnegie collects education-related information as described above, but Carnegie is not subject to FERPA.|
Since we may share Personal Information with other businesses and this sharing enables Carnegie to generate valuable consideration, it is possible that some of these categories were “sold” in the past 12 months.
HOW TO SUBMIT A REQUEST TO EXERCISE YOUR CALIFORNIA PRIVACY RIGHTS
To submit a request to exercise your privacy rights:
- Send an email to email@example.com with the subject line “California Privacy Rights Request.”
- Fill out our Personal Information Request Form.
- Call us at 978-692-5092.
- We may (and in some cases are required to) verify your identity before we can act on your request to exercise your privacy rights.
- When we collect Personal Information on behalf of a client and use it solely for the benefit of that client, we are acting as a service provider under CCPA. In this case, we will direct you to contact our client.
- We may not honor part or all your request. For example:
- Certain information we collect may be exempt from this California Privacy Notice, such as public information made available by a government entity or information covered by another privacy law. Also, not-for-profit organizations are not subject to CCPA.
- Personal Information collected in many types of B2B transactions is exempt from most of CCPA’s requirements until January 1, 2021.
If we do not honor your request, we will explain why when we respond to you.
A different California law permits California residents to request a notice disclosing the categories of personal information about you that we have shared with third parties for their direct marketing purposes during the preceding calendar year. (For these purposes, third parties include entities that are owned directly or indirectly by Carnegie.) If you would like to exercise your rights under this California law, please send a written request to the email address or postal address below or call us at the telephone number below. Within 30 days of receiving your request, we will provide you with the relevant information.
Carnegie Dartlet LLC
Attn: California Privacy
210 Littleton Road, Suite 100
Westford, MA 01886
2. Privacy Rights Notice for Individuals Located in EU
In this EU Notice, “personal data” means any information about an identified or identifiable individual person.
The data controller for the personal data that we collect directly from or about you (and not on behalf of our clients) is:
Carnegie Dartlet LLC
210 Littleton Road, Suite 100
Westford, MA 01886
Please note that when we collect personal data on behalf of a client and use it solely for the benefit of that client, we are acting as a data processor. In this case, we will direct you to contact our client which is the organization that is the data controller.
When we are the data controller of personal data, we need to inform individuals in the EU about the legal bases for our processing of their personal data. Our legal bases depend on the context in which the personal data is collected and processed. Generally, we only collect personal data when we need the personal data to perform a contract with an individual in the EU, when we have consent to do so or when the processing is in our legitimate business interests and not overridden by the privacy or other fundamental rights and freedoms of individuals in the EU.
If we collect and use your personal data in reliance on our legitimate interests (or those of any third party), this interest is typically to provide our services and communicate with you as necessary to provide our services to you, such as when we respond to your queries, improve our services and develop new ones, and for our marketing activities. We may have other legitimate interests and we will make clear our legitimate interests at the relevant time when necessary.
In some cases, we also may have a legal obligation to collect personal data from or about certain individuals. If we ask you to provide personal data to comply with a legal obligation or to perform a contract with you, we will make this clear at the relevant time and advise you whether providing your personal data is mandatory and the possible consequences if you do not provide your personal data.
If you have questions about or need further information concerning which organization is acting as the data controller of your personal data or the legal bases on which your personal data is processed, please contact us using the contact details provided below.
If you would like to review, correct, update, suppress, restrict, or delete personal data that you have previously provided to us or if you would like to receive an electronic copy of your personal data for purposes of transmitting it to another organization (if and when this right to portability is provided to you by law), please submit your request to us by filling out our Personal Information Request Form, contacting us by email at firstname.lastname@example.org with the subject line of “EU Privacy,” or contacting us by mail at:
Carnegie Dartlet LLC
Attn: EU Privacy
210 Littleton Road, Suite 100
Westford, MA 01886
In your request, please make clear the personal data you would like to have changed, whether you would like to have your personal data suppressed from our database, or the other limitations you would like to put on processing of your personal data. For your protection, we only fulfill requests for the personal data associated with the particular email address that you use to send us your request, and we may need to verify your identity before fulfilling your request. We will try to comply with your request as soon as reasonably practicable and within the time periods required by applicable law.
When we collect personal data on behalf of a client and use it solely for the benefit of that client as a data processor, we will direct you to contact our client which is the organization that is the data controller.
We often need to retain certain personal data for record keeping purposes and/or to complete any transaction that you began prior to requesting a change or deletion (e.g., when you make a purchase or enter our sweepstakes, you may not be able to change or delete the personal data provided until after the completion of the purchase or sweepstakes). Our databases and other records may have residual personal data which will not be removed. We also may not allow you to review certain personal data for legal, security, or other reasons.
If you are an individual located in the EU, you have the right to lodge a complaint with a data protection authority about how we process your personal data. Please see https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-are-data-protection-authorities-dpas_en for more information.
International Transfers of Personal Information
Our servers are located in the United States, which may be outside the jurisdiction where personal data is collected. Also, some of the third-party service providers with which we may share personal data are located in and may transfer personal data to various jurisdictions. These other jurisdictions may have data protection laws that are different from the laws of your place of residence (and, in some cases, not as protective).