My College Options States Privacy Notice

Information for Residents of States with Applicable Privacy Laws

This Privacy Notice (“States Notice”) is part of and incorporated into, both the My College Options, Inc. (“Company” “we,” “us,” “our,” etc.) general Privacy Policy available at /privacy-policy/, and our Terms of Use available at /terms-of-use/. It applies to all Personal Data (defined below) from California, Virginia, and Nevada residents from whom we receive Personal Data (“Consumers,” “you,” or “your”) from the use of encourageme.com, encourage.myoptions.org, myoptions.org, mycollegeoptions.org, admitted.ly and/or admittedly.com websites and Company mobile apps, and any other online service location (e.g., website or mobile app) that posts a link to this Privacy Policy (collectively the “Service”), regardless of how you access or use it, whether via computer, mobile device, consumer electronics device, or otherwise. A separate policy related to information received from employees and job applicants and independent contractors and business contacts can be made available upon request. The purpose of this States Notice is to provide California and Virginia Consumers with information regarding how we handle and use Personal Data and of their rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and the Virginia Consumer Data Protection Act, as amended or superseded from time to time (“VCDPA”).

Our Primary purpose is to help colleges, universities, and other providers of Education-related Products and Services (defined below) connect with students that participate in our Programs, such as voluntary educational and occupational interests and opportunities surveys so that students can receive information and resources directly from them. “Education-related Products and Services” means from colleges and universities, as well as other education-related products and services such as:

• Financial planning, student loans, and scholarships
• Enrichment opportunities such as travel programs, camps, extra-curricular activities, and conferences
• Curriculum materials, books, Internet-based educational programs, and educational magazines providing low-cost literary products
• Academic assistance, remedial help, and preparation for college-entrance examinations
• Recognition for high levels of performance
• Participation in community service
• Learning about civic responsibilities; and
• Employment, career options, and the military
• Additional purposes include Processing Interactions and Transactions Managing Interactions and Transactions Performing Services Research and Development Quality Assurance Security Debugging

For the purposes of this States Privacy Notice, “Personal Data” generally means information that is linked or reasonably linkable to a particular individual or household, and other information is not Personal Data. In addition, the following categories of information are not considered Personal Data unless combined with Personal Data:

• Publicly available information;
• Deidentified or aggregated data; or
• Information otherwise excluded from the scope of the law (e.g., certain health benefits information covered by HIPAA and information subject to FCRA).

This Privacy Notice does not apply to the information of individuals acting in commercial or employment contexts, such as job applicants to the Company or employees or contractors. Persons acting in those roles should review the applicable States Limited Privacy Notice made available by the Company.

This Privacy Notice provides the following information to Consumers:

• Categories of Personal Data we collect;
• Purposes for which we use Personal Data;
• Categories of Personal Data we disclose to third parties;
• Categories of third parties to which we disclose Personal Data; and
• How Consumers can exercise their rights under their applicable state’s privacy laws, including:
• The right to access, correct, or delete Personal Data;
• The right to obtain a portable copy of Personal Data;
• The right to limit the use of sensitive personal data in certain circumstances; and
  • The right to opt out of the disclosure of Personal Data for cross-platform behavioral advertising, sales of personal data, or certain profiling.

How My College Options Collects Personal Data

The Company collects Personal Data in a number of ways, including, for example, the following:

• Personal Data you provide to us. We will collect Personal Data when you interact with us.  We also will collect Personal Data when you subscribe to receive marketing materials, submit applications or other information through our website, apps or otherwise.
• Personal Data provided by our Clients. We receive Personal Data from our clients, such as colleges and universities who are using our services or who wish for us to provide you information or services. We receive that information by various means, including information that clients provide to us directly.
• Information automatically collected by our website and apps. We may collect information about our websites and apps, and how you use them. This information includes:
  • Computer, tablet, or mobile telephone information. We may collect device-specific information (such as your hardware model, operating system version, unique device identifiers, device sensors and mobile network information including phone number) and device sensors and related information. The Company may associate your device identifiers or phone number with your account. We will comply with the usage/license restrictions and requirements applicable to the device from which the information comes.
  • Log information. When you use the websites or apps or view content provided by us, we may automatically collect and store certain information in server logs. This may include, for example:
    • details of how you used the website or app.
    • Internet protocol address.
    • device event information such as crashes, system activity, hardware settings, browser type, browser language, the date and time of your request, and referral URL.
  • Location information. When you use websites or apps, we may collect and process information about your actual location, such as GPS signals sent by a mobile device. We also may use various technologies to determine location, such as sensor data from your device that may, for example, provide information on nearby Wi-Fi access points and cell towers.
  • Unique application numbers. The websites or apps may include a unique application number. This number and information about your installation (for example, the operating system type and application version number) may be sent to us when you install or uninstall an application or utilize the website or when the website or app periodically contacts our servers, such as for automatic updates.
  • Local storage. We may collect and store information (including Personal Data) locally on your device using mechanisms such as browser web storage (including HTML 5) and application data caches.
  • Cookies and anonymous identifiers. We use various technologies to collect and store information when you visit the Platform as described below, and this may include sending one or more cookies or anonymous identifiers to your device.

Use of Personal Data

We use Personal Data for the purposes described in our general Privacy Policy (see /privacy-policy/). Personal Data may also be used or disclosed as otherwise permitted or required by applicable law. As permitted by applicable law, we do not treat de-identified data or aggregated consumer information (that does not disclose individual information) as Personal Data, and we reserve the right to convert or permit others to convert, your Personal Data into de-identified data or aggregated consumer information and may elect not to treat publicly available information as Personal Data. We have no obligation to re-identify information or keep it longer than we need it to respond to your requests. 

Disclosing Personal Data

We disclose Personal Data with the following categories of third parties:

• Processors: We use processors to securely handle Personal Data on our behalf and only on our instructions. We require that these companies not use your Personal Data for their own purposes.
• Affiliates: We may disclose your information to our affiliates, subsidiaries, and representatives as part of providing our services.
• Other Users: Content you post on our systems, such as comments or reviews, may be displayed by us or the systems to other users.
• Our Analytics and Advertising Partners: We use analytics services to collect and process certain data and to provide you with relevant advertising. These services may also collect information about your use of certain other websites, apps, and online resources.
• Our Business Partners: We may disclose relevant personal data to our business partners to provide you with exclusive offers for products and services that may interest you.

Categories of Personal Data

Personal Data we might collect includes data such as the following:

CATEGORIES OF PERSONAL INFORMATION WE SELL OR DISCLOSE FOR TARGETED ADVERTISING

The following chart provides information about the types of Personal Data we disclose and the purposes for which we sell or disclose the information where disclosure is for the purpose of targeted or cross-context advertising (under California law, this is called “sharing”), and the categories of third parties to whom we disclosed the information for business purposes in the last 12 months.

The Company does not sell or share the Personal Data of minors under 13 years of age and does not sell or share the Personal Data of minors under 16 years of age without authorization.

Exercising Your Personal Data Rights

California Consumers have the following rights under the CCPA:

• The right to know,
• The right to receive (“access”) a copy of your Personal Data
• The Right to Correct
• The right to request deletion of your Personal Data
• The right to obtain a portable copy of Personal Data
• The right to limit the use of sensitive Personal Data in certain circumstances; and
• The right to opt out of the sale and certain disclosures (“sharing”) of Personal Data for behavioral advertising. For more information about your right to opt out, please see our Notice of Right to Opt-Out.

Virginia Consumers have the following rights under the VCDPA:

• The rights to access, correct, or delete Personal Data
• The right to obtain a portable copy of Personal Data; and
• The right to opt out of targeted advertising, sales of personal data, or profiling.

Consumers can submit a request to exercise personal data rights under the applicable state’s privacy policies as follows:

• If a consumer is requesting information about their data, use our Consumer Rights Request page
• If an authorized representative is requesting information about someone else’s data, use our Authorized Agent Request page
• You may also call us at 1-877-360-0833 or email us at privacy@encoura.org, and respond to any follow-up inquiries we may make.

Please note that exercising your right to opt out of the sale of Personal Data will terminate our ability to continue to provide your Personal Data to providers of Education-related Products and Services so that they may contact you. To protect your privacy, we may need to authenticate your identity before we respond to your rights request. We will use commercially reasonable efforts to verify your identity for this purpose. Any information you provide to authenticate your identity will only be used to process your rights request.  Please be aware that we do not accept or process rights requests through means other than direct email (e.g., via fax or social media).

Your Right to Know. When you make a request under your Right to Know, you can expect the following:

• We will verify your identity. You will need to provide us with certain information such as your name, email address, physical address, or other information, as relevant, so we can verify that you are who you say you are. Which information may depend on the type and sensitivity of information requested.
• We will confirm receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the email address listed in the “Contact Us” section.
• We will respond to your request within the legally required amount of time. If necessary, we may need additional time to respond where allowed by law, but we will reply either way within the legally required period and, if we need an extension, we will explain why.
• In certain cases, a Request to Know may be denied. For example, if we cannot verify your identity or if providing you the information could create an unreasonable risk to someone’s security (for example, we do not want very sensitive information disclosed inappropriately). If we deny your request, we will explain why we denied it. If we deny a request, we will still try to provide you as much of the information as we can, but we will withhold the information subject to denial.

The Right to Access and Receive your Specific Personal Information. The right to request that the Compny provide a portable copy of the Personal Data it collects, uses, discloses, and sells. You can request a listing of the types of Personal Data we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting or selling personal information), other individuals and business with whom we share personal information, and the specific pieces of personal information we have collected about you. For further details about this information, please visit the Categories of Information We Collect.

When you request a portable copy of your information, you can expect the following:

• We will verify your identity. You will need to provide us with certain information such as your name, email address, physical address, or other information, as relevant, so we can verify that you are who you say you are. Which information may depend on the type and sensitivity of information requested.
• We will confirm receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the email address listed in the “Contact Us” section.
• We will respond to your request within 45 days. If necessary, we may need additional time to respond, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.
• In certain cases, a Request to Know may be denied. For example, if we cannot verify your identity or if providing you with the information could create an unreasonable risk to someone’s security (for example, we do not want very sensitive information disclosed inappropriately). If we deny your request, we will explain why we denied it. If we deny a request, we will still try to provide you with as much of the information as we can, but we will withhold the information subject to denial.

The Right to Correct Personal Information Collected, Disclosed, or Sold. The right to request that the Company correct the Personal Data it collects, uses, discloses, and sells. This is called the “Right to Correct”. Under the Right to Correct, you can request a correction of any inaccurate personal information, and we will use commercially reasonable efforts to correct this information.When you make a request under your Right to Correct, you can expect the following:

• After you request the correction, you will need to specify the information you believe we have recorded incorrectly.
• We will verify your identity. You will need to provide us with certain information such as your name, email address, physical address, or other information, in order for us to confirm that you are who you say you are.
• We will confirm receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the email address listed in the “Contact Us” section.
• We will respond to your request within 45 days. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.
• In most cases, you will need to submit documentation to support your requested correction. For example, if you believe your mailing address is incorrect in our records, you will need to provide evidence of the correct mailing address. If we deny your request, we will explain why we denied it.

The Right to Request Deletion of Personal Information about You. The right to request the deletion of their personal information collected or maintained by the Company.

When you make a request for deletion, you can expect the following:

• After you request deletion, you will need to confirm that you want your information deleted.
• We will verify your identity. You will need to provide us with certain information such as your name, email address, physical address, or other information, as relevant, in order for us to verify that you are whom you say you are. Which information may depend on the type and sensitivity of the information you would like to have deleted.
• We will confirm receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the email address listed in the “Contact Us” section.
• We will respond to your request within 45 days. If necessary, we may need an additional period, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.
• In certain cases, a request for deletion may be denied, for example, if we cannot verify your identity, the law requires that we maintain the information, or if we need the information for internal purposes such as to continue to provide you services. If we deny your request, we will explain why we denied it, and delete any other information that is not protected from deletion.

The Right to Opt-Out of the Sale or Cross-Context Behavioral Advertising of Personal Information. You may have a right to opt out of the sale and/or cross-context behavioral advertising or certain “profiling” uses of your personal information by the Company. You can make such requests using our Consumer Rights Request pages, phone number, or email described above. For more information about your right to opt-out, please see our Notice of Right to Opt-Out.

The Right to Limit the Use or Disclosure of Sensitive Personal Information. The right to opt out of the use or disclosure of sensitive Personal Data. For more information about your right to opt-out, please see our Notice of Right to Opt-Out.

For all of the above requests, after submitting your request online, you will receive a follow-up email, which may include a link you must click on in order to verify your identity. If you do not click on that link, we may be unable to complete your request due to a lack of verification. It is important that you provide a valid email address in order for us to be able to process your request.

We reserve the right to decline to process or charge a reasonable fee for, requests from a Consumer that is manifestly unfounded, excessive, or repetitive.

Authorized Agent Requests

You are allowed to designate an authorized agent to make a rights request on your behalf. Your authorized agent may submit such a request by following the same method described above. We may require verification from your authorized agent in addition to the information for verification above for Consumers and households. Authorized agents may submit on behalf of the consumer using the Authorized Agents Request Form.

Sales of Personal Data

In this policy, we define a “sale” as the exchange of Personal Data to a third party for money or anything of value. In certain situations, we sell Personal Data to third parties. You can opt out of the sale of your Personal Data by submitting a rights request as described above. We will pass on your request to opt out of the sale of Personal Data to our service providers and others to whom we sell information. For requests to our Affiliates, including without limitation, My College Options, Inc. and ACT, Inc., you will need to make a separate request to each such Affiliate.

Although we do not think we sell Consumer Personal Data in the traditional sense, because we disclose the Personal Data of our Affiliates’ voluntary program participants, under a restricted use license, to colleges, universities, and other providers of Education-related Products and Services to learn about and directly contact them, as more fully explained above, doing so can be seen as a “sale” under the CCPA’s expansive definition of sale. In addition, data collection by certain Cookie Operators, as more fully explained below, may be deemed to be a sale by us. However, we will not knowingly sell the Personal Data of Consumers under 16 without obtaining an opt-in.

There may be cookies and other tracking technologies associated with our online services operated by third-party service providers (“Cookie Operators”) that may collect Personal Data that falls under the identifiers and internet usage categories. We do not believe that we sell Personal Data collected by Cookie Operators. However, we will honor opt-out requests for Personal Data collected by Cookie Operators based on your Global Privacy Controls, if we have not obtained a commitment from Third Parties who associate cookies with our online properties that they will restrict the collection, use, or disclosure of Personal Data collected via our online services to performing services for us or as otherwise permitted by a Service Provider, we provide the option to opt-out of such collection and use of your Personal Data if you exercise cookie preferences in the cookie preference center available on our online services where such activities occur.

Behavioral Advertising

In this policy we define “sharing” as disclosing Personal Data to a third party for behavioral advertising, sometimes referred to as “targeted advertising.” An example of this is displaying advertisements to a consumer where the advertisement is selected based on Personal Data obtained from that consumer’s activities over time and across nonaffiliated websites or online applications to predict such consumer’s preferences or interests. We share some Personal Data for behavioral advertising as listed above. You can opt out of the sharing of your Personal Data for behavioral advertising by submitting a rights request as described above. For more information about your right to opt-out, please see our Notice of Right to Opt-Out.

Limiting the Use of Sensitive Personal Data

Your state’s privacy laws may provide you with the right to limit some uses of Sensitive Personal Data. In particular, you may direct us not to use sensitive Personal Data except as necessary to provide goods or services you have requested. You may submit a request to limit the use of your Sensitive Personal Data by submitting a rights request as described above. For more information about your right to opt-out, please see our Notice of Right to Opt-Out.

Tracking Technologies – Your Additional Choices

Browser Settings: You can also exercise control over browser-based cookies by adjusting the settings on your browser, and mobile devices may offer ad and data limitation choices.  Please note that when you use cookie control tools, you will have to change your settings for each browser and device you use, and your limitation on cookies can limit the functionality of online services you use, including our services. Use the help function on your browser to learn more.

Ad Industry Tools: Some third parties may collect Personal Data in association with your use of our online services for advertising, analytics, and other purposes, and may sell that Personal Data downstream. You may opt out of their sales. Please visit https://www.privacyrights.info/ to opt out of the sale of Personal Data by participating third parties. You must opt out of every device and browser you use in order to effectuate your “Do Not Sell” requests from these parties. However, opting out does not mean you will stop seeing ads and you may continue to still see interest-based ads.   You can also learn more about how to exercise certain choices regarding cookies and interest-based advertising at http://www.aboutads.info/choices/, http://www.aboutads.info/appchoices, and http://www.networkadvertising.org/choices/.

In addition, third-party tools may enable you to search for and opt out of some of these trackers, such as the Ghostery browser plug-in available at https://www.ghostery.com/. We do not represent that these third-party tools, programs, or statements are complete or accurate. Clearing cookies or changing settings may affect your choices and you may have to opt out separately via each browser and other devices you use. Cookie-enabled opt-outs signals may no longer be effective if you delete, block, or clear cookies. We are not responsible for the completeness, accuracy, or effectiveness of any third-party notices or choices.

Some browsers have signals that may be characterized as “do not track” signals. You may also receive tracking mechanisms from other parties prior to visiting our websites that will continue to track your activity while on our websites. Such data would be subject to the privacy policy of the other party from whom you received the mechanism if you are not using a browser plugin or do not opt out of cookies collection.

Contact Us

If you have any questions or concerns regarding this States Privacy Notice, contact us as described in our general Privacy Policy (see https://encoura.org/privacy-policy/) or email us at privacy@encoura.org.

Last updated: January 1, 2023