Last update 26 May 2020
Ellucian is committed to maintaining your confidence and trust, and accordingly complies with the following Privacy Notice to protect the personal information you provide to Ellucian Company L.P. and all of its related worldwide affiliates and subsidiaries (collectively, “Ellucian”). As used in this Privacy Notice, “Personal Data”, means any information about an identified or identifiable natural person.
This notice is divided into sections based on your relationship with Ellucian. Please select the appropriate section(s) below for information that applies to your Personal Data. Keep in mind that more than one section might apply to you. Note that this Privacy Notice does not apply to Ellucian employees or job applicants.
Description of Ellucian’s Cloud Services System – Ellucian System and Organization Controls 3 (SOC 3) Report
Terms that apply to website visitors & representatives of potential customers
Terms that apply to Ellucian customers
Terms that apply to California Residents
Terms that apply to people in the European Economic Area (“EEA”), United Kingdon ("UK") or Switzerland
These General Terms apply to anyone (except Ellucian employees and job applicants) whose Personal Data is processed by Ellucian.
Collection of Personal Data
Ellucian may collect and otherwise receive the following categories of Personal Data:
- Name, contact details and identification numbers
- Professional and employment information
- Education and professional qualifications
- Personal characteristics
- Application, website or information technology access and usage information – this may include cookies as described below and in our Cookie Declaration
- Account or transaction information
The Personal Data collected by Ellucian will depend on the individual’s relationship to Ellucian as further described in the sections below.
Ellucian collects Personal Data from the following sources:
- Your device – this may include information collected automatically as further described in the sections below
- Other sources – we collect Personal Data from third parties as needed to accomplish the purposes described below.
Purposes of Personal Data Collection and Use
Ellucian collects, uses and processes Personal Data for the purposes of:
- Providing information about our products, services and events
- Providing products, services and support to our customers
- Administrative purposes relating to processing transactions with our customers
- Communicating with business partners, vendors, agents and contractors about business matters
- Analysis of information in order to improve business practices, products and services
- Conducting related tasks for legitimate business purposes
- Other purposes disclosed at the time of collection
- Compliance with legal requirements and protection of rights and property
Security of Personal Data
Ellucian is committed to safeguarding the Personal Data that it receives. While Ellucian cannot guarantee the security of Personal Data, Ellucian has implemented reasonable technical and organizational measures to protect Personal Data in Ellucian’s possession from loss, misappropriation and unauthorized access, disclosure and destruction.
Ellucian utilizes a combination of online and offline security technologies, procedures and organizational measures to help safeguard Personal Data. For example, facility security is designed to prevent unauthorized access to Ellucian computers. Electronic security measures — including, for example, network access controls, passwords and access logging — provide protection from hacking and other unauthorized access. Ellucian also protects Personal Data through the use of firewalls, role-based restrictions and, where appropriate, encryption technology. Ellucian limits access to Personal Data to employees, subcontractors, and third-party agents that have a specific business reason for accessing such Personal Data. Individuals who have been granted access to Personal Data will be made aware of their responsibilities to protect such information and will be provided training and instruction on how to do so.
If Ellucian learns of an unauthorized disclosure of Personal Data that is within Ellucian’s possession or control, Ellucian will perform all actions required by applicable laws, including taking prompt measures to remedy the unauthorized disclosure and providing required notices.
Ellucian hires other companies to provide certain services on our behalf; for example, to process event registrations. Ellucian will provide these companies only with the information they need to deliver the services, and they are contractually prohibited from using that information for any other purpose.
Because Ellucian is a global company, Personal Data may be stored and processed in the United States or any other country in which Ellucian and its affiliates and agents maintain facilities or personnel.
Ellucian’s products and services are not intended for children under the age of 13. Ellucian does not knowingly collect any information from children. If we learn that we have collected or received Personal Data from a child under 13 without verification of parental consent, we will delete that information.
Under certain circumstances, we may be required to disclose your Personal Data in response to valid requests by public authorities, including to meet national security or law enforcement requirements.
Your Access to and Control Over Your Personal Data
You may do the following at any time by contacting us at [email protected]:
- Opt out of any future contacts from us
- See what information we have about you, if any
- Change, correct, or, in certain circumstances, request that we delete any Personal Data we have about you
- Express any concern you have about our use of your Personal Data
Ellucian will comply with these requests when required by law. We may request additional information from you in order to process your request.
Should you have any questions or concerns about this Privacy Notice, please contact our data protection officer as follows:
Ellucian Company L.P.
Attn: Data Protection Officer
4 Country View Road
Malvern, PA 19355, USA
Requests to unsubscribe from ("opt-out" of) communications from Ellucian can be managed using the link in email communications. You may also mail your enquiry/request to the above address.
Changes to this Privacy Notice
Ellucian may revise this Privacy Notice from time to time in order to comply with new laws and regulations; to conform to industry best practices; to reflect changes in Ellucian product and service offerings; and for other reasons. The revised Privacy Notice will become effective when it is posted on the Ellucian website.
Website Visitors & Representatives of Potential Customers
This section of the Privacy Notice describes our practices in connection with information we may collect through your use of our website (collectively, our “Site”). By using our Site, you consent to our collection and use of the information described in this Privacy Notice. This section also describes our practices about Personal Data of representatives of potential customers, whether we interact with those representatives directly through the Site or in other ways.
Although Ellucian has endeavored to create a secure and reliable site for you, the confidentiality of any communication or material transmitted to or from Ellucian via the Site or email cannot be guaranteed.
Collection and Use of Information
Ellucian collects your Personal Data (such as your name, address, or telephone number) through our Site if you provide it to us voluntarily.
Our Site uses Google Analytics Demographics and Interest Reporting to help us understand, in aggregate, the age, gender and interests of Site visitors. This Google Analytics tool does not reveal to Ellucian your name. Ellucian does not combine the information collected through use of Google Analytics with Personal Data. The information received from Google Analytics is used improve our Site and the type of information displayed to Site visitors so we can better serve those interested in Ellucian. You can prevent Google Analytics from recognizing you on return visits to our Site by using Google Analytics’ Opt-out Browser Add-on, available here.
Ellucian may also use Facebook features and tools, including pixel tags added to the Site, that allow data about actions of Site visitors to be sent to Facebook to track conversions and to allow Ellucian to create custom audiences for the products or services Ellucian may advertise on Facebook. We may also provide Facebook with other data we have collected about you for this purpose, using Facebook tools that allow data such as email addresses and phone numbers to be locally hashed on our system before we upload and pass such data to Facebook. Facebook’s use of such data is governed by Facebook’s Data Use Policy. You can adjust Facebook ad settings here.
You can also manage the interest-based advertising you receive or completely opt-out of receiving such advertising by indicating your choice here.
At any time, while accessing our Site, any user may decline participation in any activity that would require active submission of Personal Data (e.g., responding to a survey email or engaging in an e-commerce transaction). Your decision not to participate will not affect your ability to use any other feature on our Site. When choosing to provide Personal Data through our Site, you acknowledge that Ellucian may store, process or transfer your Personal Data outside your country.
Ellucian may offer you opportunities to engage in blogs, forums, and social media accounts that are designed to be visible to other users, including comments and postings. You should be aware that any Personal Data you choose to submit via those media can be read, collected, and used by other participants, and could be used to send you unsolicited messages. We are not responsible for the Personal Data you choose to submit when you engage in such activities.
Some hyperlinks and banner advertisements may link to third-party websites. You should be aware that these third-party websites are not controlled by Ellucian and are not subject to this Privacy Notice. You should check the privacy policies of the third-party websites to see how your Personal Data will be collected and used.
The contracts between Ellucian and its customers may contain terms regarding the protection of Personal Data. When that is the case, the applicable contract provision shall supersede any conflicting provision in this Privacy Notice.
Ellucian’s Role as a Service Provider to Its Customers
Ellucian offers product solutions to its customers to store and manage their electronic documents, document metadata, and data relevant to managing an institution of higher education. Ellucian is a global organization and may provide product development services, solution engineering services, professional technical services and product technical support services to its customers from any country in which Ellucian has facilities or personnel. As a result, customers’ Personal Data may be transferred, accessed and stored globally as necessary for the uses stated in this Privacy Notice. Whenever Ellucian handles Personal Data, regardless of where this occurs, we take appropriate steps to ensure that customers’ information is treated securely and in accordance with this Privacy Notice and all applicable laws and regulations.
The Customer’s Responsibilities with Respect to Its Personal Data
Ellucian’s customers may choose to include Personal Data with the customer data provided to Ellucian. This Personal Data may include employee name and contact details for the purpose of administering the customer’s account with Ellucian.
Ellucian processes Personal Data that its customers have chosen to share with Ellucian. Ellucian has no direct or contractual relationship with the subjects of this Personal Data (the “Customer Data Subjects”). As a result, when customer data includes Personal Data, the customer is solely responsible for satisfying all legal obligations owed directly to Customer Data Subjects under applicable data protection laws.
Sharing of Personal Data with Third-Parties
Ellucian shares Personal Data with our subcontractors, business partners and third-party agents and contractors only to the extent required in order to deliver products or services requested by customers. Before transferring Personal Data to these third-parties, Ellucian will obtain assurances from the recipient that it will safeguard Personal Data in a manner consistent with this Privacy Notice and otherwise to support Ellucian business activities. If Ellucian learns that a recipient is using or disclosing Personal Data in a manner contrary to this Privacy Notice, Ellucian will take steps to prevent such use or disclosure.
Ellucian also may disclose Personal Data as required by law, for example, in response to a court order, an administrative proceeding or subpoena. Ellucian will, as soon as practical, inform the customer when permitted by law, so the customer may take such actions as it deems necessary to protect the rights of Customer Data Subjects.
Ellucian’s customers are responsible for ensuring that they collect only that Personal Data needed to accomplish the purposes disclosed to Customer Data Subjects. They also are responsible for providing Ellucian with instructions for the processing of Personal Data consistent with the purposes stated in the customers’ notice to Customer Data Subjects. Ellucian will process Personal Data only in accordance with the customer’s instructions.
Ellucian will retain Personal Data as necessary to fulfill the purposes described in this Privacy Notice or in our customer agreements. Ellucian will return or destroy Personal Data stored by Ellucian in accordance with applicable law.
Access to and Correction of Personal Data
Customers have the right to access and review, correct or amend and, in certain circumstances, delete their Personal Data that Ellucian holds by contacting Ellucian. Customers are responsible for providing Ellucian with accurate and complete Personal Data, and for contacting Ellucian if correction of such information is required. Ellucian will cooperate with its customers’ reasonable requests for assistance in permitting Customer Data Subjects to exercise their rights under applicable data protection laws to amend or delete their Personal Data. Please note that, where permitted, we may charge a fee for fulfilling access requests and that we reserve the right to disallow unreasonable requests for access. If a Customer Data Subject’s Personal Data was provided to us by an Ellucian customer, we may facilitate access to such data by directing the Customer Data Subject to the customer that provided the Personal Data to us.
How Ellucian Uses Customer Data
Ellucian uses Personal Data submitted to us for general business purposes, including:
- To deliver or provide products and services ordered by customers, including administering the delivery of electronic products and services requiring logins and passwords, confirming compliance with licensing terms, and responding to technical queries
- To perform accounting and export compliance functions
- To notify customers of new products and services from Ellucian and our business partners and for other general marketing purposes, such as advertising Ellucian’s customer events and engaging with customers via online communities and social media
- For our business purposes, such as data analysis, audits, fraud monitoring and prevention, developing new products, services and offerings, enhancing, improving or modifying our products and services, and operating and expanding our business activities and
- To comply with legal requirements.
Ellucian uses Google Analytics in certain of its software products. The information received from Google Analytics is used improve our products and services. You can prevent Google Analytics from recognizing you on return visits to our software by using Google Analytics’ Opt-out Browser Add-on, available here.
This section of the Privacy Notice applies to California residents who are “Consumers” as defined in the California Consumer Privacy Act or “CCPA”.
Ellucian does not knowingly collect personal information from California Consumers under the age of 16.
California Consumers have the right to request the following information:
- The categories of personal information Ellucian collects about you;
- The categories of sources from which your personal information is collected;
- The business purpose(s) for collecting your personal information;
- The categories of third parties with whom Ellucian shares your personal information; and
- The specific pieces of personal information Ellucian has collected about you.
California Consumers may also have the right to request that Ellucian delete certain personal information.
California Consumers may exercise these rights by emailing [email protected] or calling 1-800-984-2198. Ellucian will verify your request using information you provide, which may include your email address. We may need to see government identification in order to validate your request. California Consumers may also designate an authorized agent to exercise these rights on their behalf. Ellucian will not discriminate against California Consumers who exercise these rights.
Please see the other sections of this Privacy Notice which have additional information about:
- The categories of personal information Ellucian collects;
- The categories of sources from which your personal information is collected;
- The categories of third parties with whom Ellucian shares personal information; and
- The business purpose for collecting your personal information.
Ellucian does not sell personal information for money, but we may share personal information with third parties who have provided other consideration. For example, sponsors and exhibitors at certain Ellucian events may receive Personal Data about attendees. This sharing may be considered a “sale” under the CCPA. California Consumers who would like to opt out of this kind of sharing can do so here.
People in the European Economic Area (“EEA”), United Kingdom ("UK") or Switzerland
The EU-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield Frameworks (collectively, “Privacy Shield”) governs how Ellucian collects, uses, and discloses Personal Data that we receive in the United States (“U.S.”) from the EEA, UK and Switzerland. In this Privacy Notice we refer to Personal Data from the EEA, UK or Switzerland as “EEA, UK or Swiss Data”.
Ellucian collects EEA, UK or Swiss Data (i) from individuals who visit our Site, and (ii) from our customers, vendors, contractors and agents, including the following specific types of information:
- Contact information, including name, address, email address and phone number
- Student records provided by Ellucian’s higher education customers
- Professional and employment information
- Financial information
- Identification information, including driver’s license and passport numbers
- Information regarding use of Ellucian's Site or products and services as described in this Privacy Notice
Ellucian recognizes that the EEA, UK and Switzerland have established strict protections regarding the handling of EEA, UK or Swiss Data, including requirements to provide adequate protection for EEA, UK or Swiss Data transferred outside of the EEA, UK and Switzerland.
To provide adequate protection for certain EEA, UK or Swiss Data relating to website visitors, customers, prospective customers, partners, vendors, third-party suppliers and contractors that Ellucian receives in the U.S., Ellucian complies with the Privacy Shield as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data transferred from the EEA, UK and Switzerland to the U.S. Ellucian has certified to the Department of Commerce that it adheres to the Privacy Shield. Ellucian adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. If there is any conflict between the terms in this Privacy Notice and the Privacy Shield, the Privacy Shield shall govern.
Ellucian will only process EEA, UK or Swiss Data in ways that are compatible with the purpose for which Ellucian collected the EEA, UK or Swiss Data, or for purposes that the individual or entity providing the EEA, UK or Swiss Data later authorizes. Before we use your EEA, UK or Swiss Data for a purpose that is materially different than the purpose for which it was collected or that you later authorized, we will provide you with the opportunity to opt out. Ellucian maintains reasonable procedures to help ensure that EEA, UK or Swiss Data is reliable for its intended use, accurate, complete, and current.
We may collect, or our customers may provide to us when using Ellucian services, certain EEA, UK or Swiss Data that is regarded as “sensitive,” including data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, ideological views or activities, trade-union membership, administrative or criminal proceedings/sanctions, information on social security measures, or data concerning health or sex life. When we directly collect sensitive EEA, UK or Swiss Data, we will obtain opt-in consent where the Privacy Shield requires, including if we disclose sensitive EEA, UK or Swiss Data to third-parties, or before we use sensitive EEA, UK or Swiss Data for a different purpose than we collected it for or than the data subject later authorized.
You may have the right to access the EEA, UK or Swiss Data that we hold about you and to request that we correct, amend, or delete it if it is inaccurate or processed in violation of the Privacy Shield. These access rights may not apply in some cases, including where providing access is unreasonably burdensome or expensive under the circumstances or where it would violate the rights of someone other than the individual requesting access. If you would like to request access to, correction, amendment, or deletion of your EEA, UK or Swiss Data, you can submit a written request to the contact information provided under General Terms above. We may request specific information from you to confirm your identity. In some circumstances we may charge a reasonable fee for access to your information. If your EEA, UK or Swiss Data was provided to us by an Ellucian customer, we may facilitate your access to such data by directing you to the customer that provided your Personal Data to us.
Ellucian maintains reasonable and appropriate security measures to protect EEA, UK or Swiss Data from loss, misuse, unauthorized access, disclosure, alteration, or destruction in accordance with the Privacy Shield.
Data Transfers to Third-Parties
Third-Party Agents or Service Providers. We may transfer EEA, UK or Swiss Data to our third-party agents or service providers that perform functions on our behalf. Where required by the Privacy Shield, we enter into written agreements with those third-party agents and service providers requiring them to provide the same level of protection that the Privacy Shield requires and limiting their use of the data to the specified services provided on our behalf. We take reasonable and appropriate steps (i) to ensure that third-party agents and service providers process EEA, UK or Swiss Data in accordance with our Privacy Shield obligations and (ii) to stop and remediate any unauthorized processing. Under certain circumstances, we may remain liable for the acts of our third-party agents or service providers that perform services on our behalf for their handling of EEA, UK or Swiss Data that we transfer to them.
Third-Party Data Controllers. In some cases, we may transfer EEA, UK or Swiss Data to unaffiliated third-party data controllers. These third-parties do not act as agents or service providers and are not performing functions on our behalf. We may transfer your EEA, UK or Swiss Data to third-party data controllers for the following purposes:
- Sponsors and exhibitors at certain Ellucian events receive EEA, UK or Swiss Data about attendees, which the sponsors and exhibitors may use for their own promotional purposes.
- To facilitate provision of services to Ellucian customers, Ellucian may provide EEA, UK or Swiss Data to third-party software and services companies whose products interact with Ellucian products and services in certain instances where an Ellucian customer is also a client of such third-party.
We enter into written contracts with any unaffiliated third-party data controllers requiring them to provide the same level of protection for EEA, UK or Swiss Data that the Privacy Shield requires. We also limit their use of your EEA, UK or Swiss Data so that it is consistent with any consent you have provided and with the notices you have received. If we transfer your EEA, UK or Swiss Data to one of our affiliated entities within our corporate group, we will take steps to ensure that your EEA, UK or Swiss Data is protected with the same level of protection that the Privacy Shield requires.
Ellucian will conduct periodic (no less frequently than annually) self-assessments of its relevant practices to verify adherence to this Privacy Notice and the Privacy Shield Principles. Any data subject in the EEA, UK or Switzerland with a complaint concerning Ellucian’s processing of Personal Data may contact Ellucian’s data protection officer at [email protected].
For purposes of enforcing compliance with the Privacy Shield, Ellucian is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission. For more information about the Privacy Shield, see the U.S. Department of Commerce's Privacy Shield website located at https://www.privacyshield.gov. To review Ellucian's Privacy Shield certification, see the U.S. Department of Commerce's list of Privacy Shield certified companies located at https://www.privacyshield.gov/list.
Questions or Complaints
You can direct any questions or complaints about the use or disclosure of your EEA, UK or Swiss Data to us as noted above (Contact Us). We will investigate and attempt to resolve any complaints or disputes regarding the use or disclosure of your EEA, UK or Swiss Data within 45 days of receiving your complaint. If you are located in the EEA, UK or Switzerland and have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://www.jamsadr.com/eu-us-privacy-shield. If you wish, you may also contact your local data protection authority in respect of any complaints you may have.
You may have the option to select binding arbitration for the resolution of your complaint under certain circumstances, provided you have first taken the following steps: (1) raised your complaint directly with Ellucian and provided us the opportunity to resolve the issue; (2) made use of the independent dispute resolution mechanism identified above; and (3) raised the issue through the relevant data protection authority and allowed the U.S. Department of Commerce an opportunity to resolve the complaint at no cost to you. For more information on binding arbitration, see U.S. Department of Commerce's Privacy Shield Framework: Annex I (Binding Arbitration) at http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016D1250&from=EN.