Privacy Policy
Summary
This Privacy Policy describes how Hillsdale College collects, uses, and shares personal data. Below, you will find four main sections. First, our General Privacy Policy describes what information we collect, how we use it, and how we share it.
Second, our User Categories explain these same things in more detail for different categories of people: website visitors, prospective students, current students, free online course participants, alumni, donors, prospective employees, and current employees.
Third, there are two addendums that apply to people in certain geographic areas—specifically, the European Economic Area and United Kingdom, and also Colorado.
Last, we let you know how to contact us if you have any questions, or if you want to opt-out of certain uses of your personal information. Please make sure to provide your mailing address when you contact us, so that we can ensure that you are correctly identified and opted out, at:
Phone Number: 1-800-659-0020
Email: [email protected]
Opt-out Request Form
General Privacy Policy
Updated October 23, 2023
This Privacy Policy describes the types of information Hillsdale College may collect from or about you. The policy also describes our practices for collecting, using, maintaining, protecting, and disclosing collected information:
- when you access and use Websites owned and operated by the College (“Websites”);
- in email, text, and other electronic messages between you and our Websites;
- when you interact with our advertising and applications on third-party websites and services, if those applications or advertising include links to this Privacy Policy;
- when you submit information to us or otherwise contact us;
- when you fill out surveys, or enter into contests or other promotions;
- when you apply for admission to Hillsdale College;
- in connection with your current or prior enrollment at Hillsdale College or its free online courses;
- when you seek employment or are employed by Hillsdale College;
- when you make a donation online, over the phone, or by mailing a check to our postal address; and
- from third parties and publicly available sources.
Our privacy practices may vary depending on where you live. Please refer to the applicable privacy addendum for your jurisdiction that is attached to this Privacy Policy.
Please read this Privacy Policy carefully. By accessing or using our Websites or services or otherwise providing us with your information, you agree to this Privacy Policy.
Hillsdale College collects and processes information that identifies, relates to, or could reasonably be linked with you (“Personal Information”) in a variety of contexts. We collect several different categories of Personal Information, including information you provide to us directly, information collected automatically, and information from third-party sources.
The ways we collect and use your information vary depending on the relationship between you and Hillsdale College, and on the College function with which you interact. We have categorized these relationships and functions as follows:
- Website Visitors
- Prospective Students
- Students
- Free Online Course Participants (Non-Students)
- Alumni
- Donors (Current and Prospective)
- Prospective Faculty, Staff, and Other Employees
- Current Faculty, Staff, and Other Employees
For more details on each of these categories, please see User Categories below. Depending on your User Category, we may use your Personal Information for:
- Conducting our operations and administering our educational offerings;
- Maintaining relationships with College alumni and friends of the College, providing services to alumni and friends of the College, raising funds to support the College’s mission and programs, and in communicating information regarding the College’s programs and operations;
- Administering fellowships, grants and other programs in support of individual study and research projects;
- Contacting you to respond to your requests or inquiries;
- Processing and completing your transactions including course registration, order confirmation, enrollment in academic groups or other programs, processing payments for online purchases and course registration, and delivering products or services;
- Providing you with newsletters, articles, service alerts or announcements, event invitations, and other information that you request from us or that we believe may be of interest to you;
- Conducting research, surveys and similar inquiries to help us understand trends and needs of our applicants, students, and others;
- Performing internal testing, research, and analysis to develop, improve, or demonstrate our services;
- Performing marketing, promotions, and advertising, either directly or through third parties, including through interest-based and targeted advertising;
- Alerting you about a safety or security announcement;
- Preventing, investigating, or providing notice of fraud, unlawful or criminal activity, or unauthorized access to or use of Personal Information, our Websites, or data systems;
- Complying with our legal, regulatory, and contractual obligations, including responding to subpoenas, court orders, or other legal process; enforcing our agreements; and protecting the health, safety, rights or property of you, us, or others; and
- For any other purpose with your consent or as otherwise permitted by law.
Service Providers
We may disclose your Personal Information with our business partners and other third-party service providers who complete transactions or perform services on our behalf or for your benefit, such as:
- Payment and donation processing;
- Customer relationship management (CRM) services;
- Marketing and analytics;
- Printing and mailing;
- Advertising or social networking;
- Processing employment and admissions applications;
- Alumni and donor outreach and engagement;
- Event registration and coordination;
- Providing course platforms or tools that enable or enhance our offerings;
- Course registration and coordination, as well as evaluations and assessments;
- Enrollment verification;
- Research insights and analytics;
- Educational operations and collaborations;
- Recruiting and admissions;
- Performing human resources administration;
- Assisting with our legal compliance; and
- System maintenance and security.
We do not share Personal Information in exchange for money. To help us reach individuals likely to appreciate and respond with support to our charitable communications, we do share Personal Information with limited and select third-party marketing and analytics vendors, who also use that information to assist other parties. This assistance might include donor research, management of donor databases, targeted mailings, or other analysis. This information may include your name, address, e-mail address, and donation and transaction history. You may request at any time that we do not share your name, address, or other information with such third-party vendors by reaching out to us at the Contact Information below. SMS OPT-IN Consent and Data will not be shared with third parties.
Affiliates
We may share your Personal Information with affiliated legal entities within our schools, centers, institutes, and other Hillsdale College units and affiliates for purposes and uses that are consistent with this Privacy Policy.
Other Academic Institutions
We may share your Personal Information with other institutions for the purposes of administering programs and services, including but not limited to:
- Cross-registration for courses with other universities;
- Course registration and administration;
- Course evaluations and assessments;
- Study at other universities including study abroad at foreign universities;
- Online education offerings through online platforms;
- Research arrangements with other universities or partners; and
- Events and activities of Hillsdale College-affiliated clubs and special interest groups.
Legal Process, Safety, and Rights Enforcement
We may disclose your Personal Information to legal or government regulatory authorities as required by applicable law. We may also disclose your Personal Information to third parties as required by applicable law in connection with claims, disputes or litigation, when otherwise required by applicable law, or if we determine its disclosure is necessary to protect the health and safety of you or us, or to enforce our legal rights or contractual commitments that you have made.
Social Media Platforms and Social Networks
We may display targeted advertising to you through social media platforms, such as Facebook, Instagram, or other social media forums. These companies have interest-based advertising programs that allow us to direct advertisements to users who have shown interest in our services while those users are on the social media platform, or to groups of other users who share similar traits, such as likely commercial interests and demographics.
We may share certain a unique identifier, such as a user ID or hashed email address, with these platform providers or they may collect information from our Websites’ visitors through a first-party pixel, in order to direct targeted advertising to you or to a custom audience on the social media platform. These advertisements are governed by the privacy policies of those social media companies that provide them. If you do not want to receive targeted ads on your social networks, you may be able to adjust your advertising preferences through your settings on those networks.
Third-Party Advertising, Audience/Traffic Measurement Services
We use third-party advertising, analytics, and measurement partners (“Advertising, Marketing, and Analytics Partners”) to serve you advertisements on our Websites as well as across other sites and services. We also partner with these companies to assist us with our marketing efforts. These third parties may set their own cookies or similar web technologies on the Websites and elsewhere online to collect information about users’ online activities over time and across different websites. In some cases, the use of these third-party solutions involves the sharing of your information for purposes of serving you targeted advertising (as defined below).
These partners may use cookies and other tracking technologies to collect information about your activities across different websites and services to build a profile of your interests and provide you with relevant advertising (“targeted advertising”). This is typically done based on uniquely identifying your browser and internet device.
We may also disclose non-cookie-based information for advertising purposes, including for targeted advertising. For example, as noted above, we may disclose information to social networking platforms, so that they may send tailored communications on our behalf via their platforms.
We strive to provide you with choices regarding the Personal Information you provide to us. We have created mechanisms to provide you with control over your Personal Information.
- Browser Controls for Cookies: Most web browsers allow some control of most cookies through the browser settings. For more information about how to reject, disable or delete cookies, please review your browser’s help menu or visit www.aboutcookies.org. If you choose to reject cookies, you may not be able to take advantage of certain features, services, applications or tools available through our Websites or other online services that are only available through the use of these technologies.
- Opt-Out of Receiving Promotional Emails from Hillsdale College: If you do not wish to have your email address used by Hillsdale College to promote our own products and services, you can opt-out at any time by clicking the unsubscribe link at the bottom of any email or other marketing communications you receive from us. This opt-out does not apply to information provided to Hillsdale College as a result of a product purchase, your use of our services, or other transaction.
In addition to the choices made available to you with regard to the Personal Information that you provide to us, you may also contact us at the below contact information to request access to, correct, or delete any Personal Information that we have collected about you. You may also notify us of errors or changes in any Personal Information we have about you to ensure that it is complete, accurate, and as current as possible.
The law in some jurisdictions may provide you with additional rights regarding our use of Personal Information. To learn more about any additional rights that may be applicable to you as a resident of one of these jurisdictions, please see the privacy addendum for your jurisdiction that is attached to this Privacy Policy.
- For Individuals Located within the European Economic Area or the United Kingdom: If you are located in the European Economic Area or the United Kingdom, you have the additional rights described in our GDPR Privacy Addendum.
- For Residents of Colorado: If you are a resident of Colorado, you have the additional rights described in our Colorado Privacy Addendum.
PLEASE NOTE THAT AS A NONPROFIT ENTITY AND HIGHER EDUCATION INSTITUTION, HILLSDALE COLLEGE IS NOT SUBJECT TO CERTAIN STATES’ COMPREHENSIVE CONSUMER PRIVACY LAWS, SUCH AS THOSE IN CALIFORNIA, VIRGINIA, UTAH, AND CONNECTICUT.
We may obtain certain Personal Information about you from third-party sources (as noted in How We Collect and Use Personal Information above). Third-party sources include:
Partners and Service Providers
We use partners and service providers, such as payment processors and analytics providers, to perform services on our behalf. Some of these partners have access to Personal Information about you that we may not otherwise have (for example, if you sign up directly with that provider) and may share some or all this information with us. We use this information to administer the services and conduct marketing and advertising campaigns, and to process transactions that you request.
Single Sign-On
Some of our online services or research activities may allow you to register and login to those services through a third-party platform. When you login to our service through a third-party platform, you allow us to access and collect any Personal Information from your third-party platform account permitted under the settings and privacy statement of that platform.
Supplemental Information
We may receive additional Personal Information from third-party sources, such as credit reference agencies and public databases, which we may append to existing Personal Information, such as email address verification. We may use this supplemental information to process transactions that you request and to prevent fraud, deliver relevant offers and advertising to you, and to improve our operations, services, and our advertising and marketing campaigns.
Our Websites may contain links to third party websites or services that are not owned or controlled by us. We are not responsible for the privacy practices of such websites or services. The privacy practices of these third parties, including details on the information they may collect about you, are subject to the privacy statements of these parties.
We have implemented measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.
Unfortunately, the transmission of information via the Internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to our Website. Any transmission of Personal Information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Website or in your operating system.
Some web browsers permit you to broadcast a signal to websites and online services indicating a preference that they “do not track” your online activities. Since there is no accepted standard for how a website or online service should respond to this signal, at this time we do not take any action in response to such a signal.
Our Websites are not intended for children under 16 years of age. No one under age 16 may provide any information to or on the Websites. We do not knowingly collect Personal Information from children under 16. If you are under 16, do not register on the Websites, make any purchases through the Websites, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received Personal Information from a child under 16 without verification of parental consent, we will delete that information. If you believe we might have any information from a child under 16, please contact us at the contact information below.
We may change this Privacy Policy at any time. If we make material changes to how we treat our users’ Personal Information, we will notify you by email to the email address specified in your account, through a notice on the Websites’ home pages, or using a similar method. The date this Privacy Policy was last revised is identified at the top of the page. Your continued use of our Websites or services, or submission of information to us, after we make changes is deemed acceptance of those changes, so please check this Privacy Policy periodically for updates.
User Categories
As you interact with our Websites, we may collect information directly from you when you provide it to us, such as information provided when you apply to or enroll at Hillsdale College, fill out a survey, create an account with us, enroll in our free online courses, sign up to receive newsletters and marketing communications from us, or make a purchase or donation.
We may also use automatic data collection technologies to collect Personal Information about you, or information that becomes Personal Information if combined with other information. This information may be collected through the use of cookies, which are small data files placed on your computer or mobile device that allow us to collect certain information whenever you visit or interact with our websites or online services. Some of these cookies are managed by us (first-party cookies), while others are managed by third parties that we do not control (third-party cookies). This information may also be collected through the use of other data collection technologies (such as web beacons, pixels or tags) that embed graphic files in our websites and online services. These graphic files contain a unique identifier that enables us to recognize when someone has visited our website or online services, or in the case of web beacons, opened an email that we have sent them.
For example, we may collect:
| Categories of Personal Information | Purposes of Processing | Legal Bases for Processing |
|---|---|---|
Identifiers (e.g., name, mailing address, email address, telephone number, date of birth, online or unique identifier) |
|
|
Log Files (e.g., IP address, browser type, device details, location information, information collected through cookies and other tracking technologies, clickstream data, information about the equipment you use to access our Websites |
|
|
Financial Account Information (e.g., bank account number or credit or debit card information provided in connection with an order or donation made on our Websites) |
|
|
Information collected by us, or on our behalf, during the admissions process and any subsequent enrollment as a student at Hillsdale College is collected for the primary purpose of considering your application, evaluating your eligibility for financial aid and, if admitted, facilitating your education. Aggregated data derived from this information may be used for statistical reporting. For example, we may collect:
| Categories of Personal Information | Purposes of Processing | Legal Bases for Processing |
|---|---|---|
Identifiers (e.g., name, mailing address, email address, telephone number, date of birth) |
|
|
Government-Issued Identification Numbers (e.g., Social Security, driver’s license, state ID card, tax ID, or Visa/passport numbers) |
|
|
Demographic Information (e.g., your date of birth, country of citizenship, citizenship status, gender, and Visa/passport information) |
|
|
Education History (e.g., including your prior schools, transcripts, school activities, and disciplinary records) |
|
|
Testing History (e.g., standardized testing scores) |
|
|
Employment History (e.g., job title, location, work experience) |
|
|
Personal Interests (e.g., interests, extracurricular activities) |
|
|
Financial Aid Information (e.g., wages, scholarships and grants, and family support; family member occupations, wages, and savings) |
|
|
The information collected by us, or on our behalf, throughout your enrollment as a student at Hillsdale College is collected for the primary purpose of facilitating your education at Hillsdale College and providing the programs for which you are enrolled. Personal Information may also be used for quality improvement research and analysis to evaluate program performance to improve education quality. For example, we may collect:
| Categories of Personal Information | Purposes of Processing | Legal Bases for Processing |
|---|---|---|
Identifiers (e.g., name, mailing address, email address, telephone number, date of birth, emergency contact details) |
|
|
Government-Issued Identification Numbers (e.g., Social Security, driver’s license, state ID card, tax ID, or Visa/passport numbers) |
|
|
Education History (e.g., your prior schools, transcripts, school activities, and disciplinary records) |
|
|
Assignment and Testing History (e.g., course grades and standardized testing; photo ID, digital signature, and identity validation responses) |
|
|
Academic Record (e.g., information contained in or otherwise related to your academic record, such as grades, awards, disciplinary actions, degrees, majors, sports participation, clubs and activities) |
|
|
Health or Medical Information (e.g., doctor’s records, surgical records, immunization records, vaccinations and medications; information related to physical or mental disabilities) |
|
|
Internet or Other Electronic Network Activity Information (e.g., information on your (i) use of our computers and other information technology systems and assets, and (ii) interaction with a website or application that occurs on our networks (including via VPN)) |
|
|
Residential Information (e.g., personal preferences, security key card activity, facility monitoring, and personal monitoring) |
|
|
Personal Interests (e.g., interests and extracurricular activities) |
|
|
Employment History (e.g., job title, location, and work experience) |
|
|
Financial Aid Information (e.g., bank account and routing number(s) or credit or debit card information, as well as information related to tuition payments) |
|
|
International Student Information (e.g., visa status, citizenship, funding information, dependent information) |
|
|
Audio, Visual, or Other Electronic Information (e.g., a photograph of you, video surveillance or camera footage of our campus) |
|
|
Hillsdale College collects your Personal Information when you sign up to take or take one of our free online educational course offerings—primarily to provide the online education courses. For example, we may collect:
| Categories of Personal Information | Purposes of Processing | Legal Bases for Processing |
|---|---|---|
Identifiers (e.g., name, mailing address, email address, telephone number, date of birth, online or unique identifier) |
|
|
Course Assessment Data (e.g., assignment responses, test scores, and course interactions, photo ID, digital signature, and identity validation responses) |
|
|
Health or Medical Information (e.g., physical or mental disabilities) |
|
|
The primary way Hillsdale College collects and maintains Personal Information about alumni is when you provide it to us—for example, when you update your alumni profile, connect with us on social media, or register to attend alumni events. We may also collect Personal Information from publicly available sources or third-party sources. The main purpose for Hillsdale College’s collection of alumni Personal Information is to connect you with our College, other alumni, students, and potential students. For example, we may collect:
| Categories of Personal Information | Purposes of Processing | Legal Bases for Processing |
|---|---|---|
Identifiers (e.g., name, mailing address, email address, telephone number, date of birth) |
|
|
Employment Information (e.g., title, employer, location, work experience) |
|
|
Family Information (e.g., spouse/partner names, children's names and birth dates, familial relationships) |
|
|
Student Information Obtained from Hillsdale College Records (e.g., degrees, majors, sports participation, awards, clubs and activities) |
|
|
Hillsdale College Affiliations (e.g., group memberships and Hillsdale College-related correspondence) |
|
|
Alumni Information (e.g., event attendance, volunteer interests, organization affiliations, committee participation, awards and honors) |
|
|
Financial Account Information (e.g., payment card number or bank account and routing numbers) |
|
|
Hillsdale College collects and maintains donor Personal Information to process donations and respond to comments and questions. We may also use your information to keep you informed about Hillsdale College events and initiatives that may interest you. The main way we collect donor Personal Information is when you provide it to us – for example, when you complete a donation form or request information regarding donations. We also collect Personal Information from publicly available sources and third-party sources. For example, we may collect:
| Categories of Personal Information | Purposes of Processing | Legal Bases for Processing |
|---|---|---|
Identifiers (e.g., name, mailing address, email address, telephone number, date of birth, online or unique identifier) |
|
|
Donation Information (e.g., information regarding any donation that is made and your contribution history to the College) |
|
|
Financial Account Information (e.g., payment card number or bank account and routing numbers) |
|
|
Family & Friend Information (e.g., name, mailing address, email address, telephone number) |
|
|
Hillsdale College collects your Personal Information when you apply for employment with us. We usually collect Personal Information from you directly when you apply for a position with us. We may also collect Personal Information from publicly available sources or third-party sources. For example, we may collect:
| Categories of Personal Information | Purposes of Processing | Legal Bases for Processing |
|---|---|---|
Identifiers (e.g., name, mailing address, email address, telephone number, date of birth) |
|
|
Demographic Information (e.g., country of citizenship, citizenship status, Visa/passport information) |
|
|
Government-Issued Identification Numbers (e.g., Social Security, driver’s license, state ID card number, or Visa/passport numbers) |
|
|
Professional and Employment-related Information (e.g., employment history, skills and qualifications, certifications, job preferences, information related to compensation, education, and other relevant experience) |
|
|
Hillsdale College collects your Personal Information at the beginning of and throughout your employment at Hillsdale College to administer an employment relationship with you.
We generally collect Personal Information from you directly. Some of this information is required to enter into employment with Hillsdale College, and for Hillsdale College to create and maintain the employment relationship. If you refuse to provide such Personal Information, then we may not be able to enter into such an employment relationship or fulfill our obligations to you under it.
Hillsdale College also creates certain Personal Information about you during the course of your employment relationship with us, such as your job title, compensation details, employment status, performance history, disciplinary and grievance information, and a photo ID and badge number. We may collect Personal Information from publicly available sources and third-party sources. For example, we may collect:
| Categories of Personal Information | Purposes of Processing | Legal Bases for Processing |
|---|---|---|
Identifiers (e.g., name, title, mailing address, email address, phone number, emergency contact details) |
|
|
Financial Account Information (e.g., bank account and routing numbers) |
|
|
Government-Issued Identification Numbers (e.g., tax ID number) |
|
|
Professional and Employment-related Information (e.g., employment contract, performance evaluation data, disciplinary and grievance information, sickness records, termination details, information related to salary and employee benefits, beneficiary and dependent information, wages, filing status) |
|
|
Health or Medical Information (e.g., information on disability accommodations and information about your ability to work or your sick leave status from your health care provider or another third party you direct us to) |
|
|
Internet or Other Electronic Network Activity Information (e.g., information on your (i) use of our computers and other information technology systems and assets, and (ii) interaction with a website or application that occurs on our networks (including via VPN) |
|
|
Audio, Visual, or Other Electronic Information (e.g., a photograph of you, video surveillance and camera footage of our campus) |
|
|
Jurisdictions and Addendums
Revised October 23, 2023
Introduction
This GDPR Privacy Addendum (the “GDPR Privacy Addendum”) supplements the information contained in our Privacy Policy (our “Privacy Policy”) and applies solely to the (i) visitors of our Websites, (ii) our prospective and current students, (iii) online course participants not enrolled as students at the College, and (iv) donors and alumni of Hillsdale College who are located in the European Economic Area (“EEA”) or the United Kingdom (“UK”).
We adopt this GDPR Privacy Addendum to comply with the European Union’s General Data Protection Regulation, and any laws implementing the foregoing by the UK (including the UK Data Protection Act and the UK GDPR) or any member states of the EEA (collectively, the “GDPR”). Unless otherwise defined in this GDPR Privacy Addendum, any terms defined in the GDPR or our Privacy Policy have the same meaning when used in this GDPR Privacy Addendum. When this GDPR Privacy Addendum is applicable to you, it takes precedence over anything contradictory in our Privacy Policy.
Data Controller and Representative
Hillsdale College is the controller of your Personal Information. Hillsdale College has appointed representatives in both the European Union and the United Kingdom in compliance with the GDPR. Hillsdale College’s representatives may be contacted in any manner set forth below in the “Contact Information” section of this GDPR Privacy Addendum.
Information We Collect About You and How We Collect It
The Personal Information we collect and the ways in which we collect it is described above in our Privacy Policy and User Categories.
Lawful Basis for Processing Your information
The processing of your Personal Information is lawful only if it is permitted under the GDPR. We have a lawful basis for each of our processing activities as set forth in our Privacy Policy (except when an exception applies as described below):
- By using our Websites, you consent to our collection, use, and sharing of your Personal Information as described in our Privacy Policy. If you do not consent to the terms of the Privacy Policy, please do not use the Websites. We may also ask for your consent to process your Personal Information in certain circumstances, such as to: (i) send you marketing, promotional, and similar materials about the College and our events and offers via email, or (ii) deploy cookies (not deemed to be strictly necessary) and/or related technologies onto your browser or device when you visit our Websites.
- To Fulfill Our Obligations to You under our Contract. We process your Personal Information in order to fulfill our obligations to you pursuant to our contract with you to deliver our goods and services to you.
- Compliance with Legal Obligations. To meet our regulatory and legal obligations, we may need to process some of your Personal Information.
- Legitimate Interests. We will process your Personal Information as necessary for our legitimate interests. Our legitimate interests are balanced against your rights and freedoms and we do not process your Personal Information if your rights and freedoms outweigh our legitimate interests. We process your Personal Information only so far as is necessary to achieve the purpose outlined in our Privacy Policy. Our processing activities will not unreasonably intrude on your privacy and ultimately benefits you in optimizing our provision of Websites and services to you. Specifically, we rely on several legitimate interests for processing your Personal Information, such as:
-
- Facilitating communications between Hillsdale College and you;
- Providing, improving, and customizing our educational offerings;
- Administering our operations;
- Promoting the success of our current and former students;
- Furthering research and understanding in fields of academic study;
- Maintaining an ongoing relationship with alumni, donors and prospective donors, and helping to connect them with others;
- Requesting gifts or donations;
- Offering attendance to events and opportunities to volunteer;
- Conducting admissions research;
- Understanding how our online platforms are being used;
- Exploring ways to develop and grow our operations;
- Ensuring the safety and security of our students, faculty, fellows, employees and others;
- Safeguarding our IT infrastructure;
- Enhancing protection against fraud, spam, harassment, intellectual property infringement, crime and security risks; and
- Meeting our obligations and enforcing our legal rights.
Special Categories of Personal Information
Some Personal Information processed by Hillsdale College may be considered sensitive, including Health or Medical Information. Hillsdale College processes this information only for the following purposes described above in the How We Collect and Use Personal Information and User Categories sections of our Privacy Policy.
Specifically, we process this information only with your explicit consent or as otherwise permitted by the GDPR, including when our processing of such sensitive Personal Information:
- is carried out in the course of our legitimate activities with appropriate safeguards;
- relates to such Personal Information that you have manifestly made public; or
- is necessary for the establishment, exercise, or defense of legal claims or whenever courts are acting in their judicial capacity.
Automated Decision-Making
Hillsdale College does not use your Personal Information with any automated decision-making process, including profiling, which may produce a legal effect concerning you or similarly significantly affect you.
How We Use and Disclose Your information
With the exception of cookies and similar technologies described below, we use your Personal Information as described in our Privacy Policy and do not share or otherwise disclose your Personal Information for purposes other than to the entities and for the purposes described in our Privacy Policy.
Use of Cookies and Similar Technologies
Except for those cookies that are strictly necessary for the operation of our Websites, we will only use cookies if we have your explicit consent to use them in the UK and the EEA. Please bear in mind that if you have given your consent to a cookie, you may withdraw your consent at any time utilizing the cookie setting of the applicable website. Please see the Website Visitors section in our Privacy Policy for additional information.
Your Rights
Applicable data protection laws may provide you with additional rights with regards to our processing of your Personal Information.
- Access and Update or Corrections. You can review and change your Personal Information we have about you by notifying us through the Contact Information below of any required changes or errors in to ensure that it is complete, accurate, and as current as possible. We may not be able to accommodate your request if we believe it would violate any law or legal requirement or cause the information to be incorrect.
- Restrictions. You have the right to restrict our processing of your Personal Information under certain circumstances. In particular, you can request we restrict our use of it if you contest its accuracy, if the processing of your Personal Information is determined to be unlawful, or if we no longer need your Personal Information for processing but we have retained it as permitted by law.
- Portability. To the extent the Personal Information you provide Hillsdale College is processed based on your consent, you have the right to request that we provide you a copy of, or access to, all or part of such Personal Information in structured, commonly used and machine-readable format. You also have the right to request that we transmit this Personal Information to another controller, when technically feasible.
- Withdrawal of Consent. To the extent that our processing of your Personal Information is based on your consent, you may withdraw your consent at any time by containing us through any of the methods listed under Contact Information below. Withdrawing your consent will not, however, affect the lawfulness of the processing based on your consent before its withdrawal, and will not affect the lawfulness of our continued processing that is based on any other lawful basis for processing your Personal Information.
- Right to be Forgotten. You have the right to request that we delete all of your Personal Information. We will only delete your Personal Information when we no longer have a lawful basis for processing your Personal Information or after a final determination that your Personal Information was unlawfully processed. We may not accommodate a request to erase your Personal Information if we believe the deletion would violate any law or legal requirement or cause the information to be incorrect. In all other cases, we will retain your Personal Information as set forth in this policy. In addition, we cannot completely delete your Personal Information as some data may rest in previous backups. These will be retained for the periods set forth in our disaster recovery policies.
- Complaints. You have the right to lodge a complaint with the applicable supervisory authority in the country you live in, the country you work in, or the country where you believe your rights under applicable data protection laws have been violated. If you are located in the United Kingdom, you must lodge such a complaint with the Information Commissioner’s Office in the United Kingdom. You can also contact us directly in order to give us an opportunity to work directly with you to resolve any concerns about your privacy.
- How You May Exercise Your Rights. You may exercise any of the above rights by contacting us through any of the methods listed under Contact Information below. If you contact us to exercise any of the foregoing rights, we may ask you for additional information to verify your identity. We reserve the right to limit or deny your request if you have failed to provide sufficient information to verify your identity or to satisfy our legal and business requirements. Please note that if you make unfounded, repetitive, or excessive requests (as determined in our reasonable discretion) to access your Personal Information, you may be charged a fee subject to a maximum set by applicable law.
Data Retention Periods
We will retain your Personal Information for as long as is necessary for the purposes set out in this GDPR Privacy Addendum unless a longer period is required under applicable law, or as needed to resolve disputes or protect our legal rights or otherwise to comply with legal obligations.
Where we are processing Personal Information based on our legitimate interests, we generally will retain the data for a reasonable period of time based on the particular interest, taking into account the fundamental interests and the rights and freedoms of the data subjects.
Where we are processing Personal Information based on contract, we generally will retain the information for the duration of the contract plus some additional limited period of time that is necessary to comply with law or that represents the statute of limitations for legal claims that could arise from the contractual relationship.
Where we are processing Personal Information based on your consent, we generally will retain the information for the period of time necessary to carry out the processing activities to which you consented, subject to your right, under certain circumstances, to have certain of your Personal Information erased (see Your Rights above).
International Data Transfers
If you are a resident of the EEA or UK, in order to provide our Websites, products, and services to you, we may send and store your Personal Information outside of the EEA or the UK, including to the United States. Accordingly, your Personal Information may be transferred outside the country where you reside or are located, including to countries that may not or do not provide an equivalent level of protection for your Personal Information. Your information may be processed and stored in the United States, and United States federal, state, and local governments, courts, or law enforcement or regulatory agencies may be able to obtain disclosure of your information through the laws of the United States. By using our Websites or other services, you represent that you have read and understood the above and hereby consent to the storage and processing of Personal Information outside the country where you reside or are located, including in the United States.
Your Personal Information is transferred by Hillsdale College to another country only if it is required or permitted under applicable data protection law and provided that there are appropriate safeguards in place to protect your Personal Information. To ensure your Personal Information is treated in accordance with the Privacy Policy, Hillsdale College uses Data Protection Agreements between Hillsdale College and all other third-party recipients of your data that include, where applicable, the Standard Contractual Clauses adopted by the European Commission and/or the United Kingdom (the “Standard Contractual Clauses”). The European Commission and the United Kingdom’s Information Commissioner’s Office has determined that the transfer of Personal Information pursuant to the Standard Contractual Clauses may provide for an adequate level of protection of your Personal Information, but may need to be supplemented with additional measures on a case-by-case basis after an analysis that such supplemental measures can provide you with an essentially equivalent level of protection as afforded in the EU. When, as a result of this analysis, we believe this to be appropriate and necessary, these Standard Contractual Clauses have been supplemented in this way. Under these Standard Contractual Clauses, you have the same rights as if your data was not transferred to such third party. You may request a copy of Data Protection Agreements by contacting us through the Contact Information below.
Changes to this GDPR Privacy Addendum
Hillsdale College reserves the right to amend this GDPR Privacy Addendum at our discretion and at any time, as further described in our Privacy Policy. When we make changes to this GDPR Privacy Addendum, we will post the updated notice on the Websites and update the addendum’s effective date. If we make material changes to how we treat our users’ Personal Information, we will notify you by email to the email address specified in your account, through a notice on the Websites’ home pages, or using a similar method. Your continued use of our Websites or services, or submission of information to us, following the posting of changes constitutes your acceptance of such changes.
Contact Information
If you have any questions, concerns, complaints, or suggestions regarding our Privacy Policy or this GDPR Privacy Addendum, have any requests related to your Personal Information described in the Privacy Policy or this GDPR Privacy Addendum, or otherwise need to contact us, you may do so by contacting us and/or our EU or UK representatives (as applicable):
To Contact Hillsdale College (Controller)
Hillsdale College
33 East College Street
Hillsdale, MI 49242
Email: [email protected]
To Contact Our Representative in the EU
DataRep
The Cube
Monahan Road
Cork T12 H1XY
Republic of Ireland
www.datarep.com/data-request
[email protected]
To Contact Our Representative in the UK
DataRep
107-111 Fleet Street
London EC4A 2AB
United Kingdom
www.datarep.com/data-request
[email protected]
Revised October 23, 2023
Introduction
This Privacy Addendum for Colorado Residents (the “Colorado Privacy Addendum”) supplements the information contained in Hillsdale College’s Privacy Policy (the “General Privacy Policy”). The Colorado Privacy Addendum applies solely to the (i) visitors of our Websites, (ii) prospective and current students at Hillsdale College, (iii) online course participants not enrolled as students at the College, and (iv) donors and alumni of Hillsdale College who reside in the State of Colorado (“consumers” or “you”).
We adopt this Colorado Privacy Addendum to comply with the Colorado Privacy Act (“CPA”), which went into effect on July 1, 2023, and any terms defined in the CPA have the same meaning when used in this Colorado Privacy Addendum. We may update this Colorado Privacy Addendum at any time as necessary in the event of changes to the CPA.
Scope of This Colorado Privacy Addendum
This Colorado Privacy Addendum applies to information that we collect online (such as on our Websites) and offline (such as from a donation we received in the mail) that is linked or reasonable linkable, directly or indirectly, to you (“Personal Data”). However, certain information is excluded from the CPA and thus is not governed by this Colorado Privacy Addendum including, but not limited to, (i) publicly available information that we collect from government records or otherwise obtain while having a reasonable belief that it was lawfully made available to the general public by you, (ii) deidentified information (within the meaning of the CPA), and (iii) information covered by certain sector-specific privacy laws, including the Health Insurance Portability and Accountability Act of 1996 and its regulations (“HIPAA”).
This Colorado Privacy Addendum also does not apply to Personal Data we collect about you when you are acting in a commercial or employment context with the College, such as if you are an employee or job applicant of Hillsdale College, or a beneficiary of someone acting in an employment context with us.
Information We Collect and How we Collect It
The Personal Data we collect and the ways in which we collect it is described in our Privacy Policy. In particular, we collect the types of Personal Data described below.
Please note that that we do not disclose all examples listed to all recipients listed in the table below. Rather, the “examples” column is broad and inclusive, as is the “disclosed to” column. For more detailed information about when specified disclosures occur, please see Disclosures of Personal Information below as well as our User Categories above. For more detailed information about who our “Service Providers” are, please see Service Providers above.
| Category | Examples | Collected From | Disclosed To |
|---|---|---|---|
| A. Identifiers. | A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers. |
|
|
| B. Financial or Commercial information. | Financial account numbers, personal financial history, donation information, records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. |
| |
| C. Internet or other similar network activity. | Browsing history, search history, log files information on a consumer's interaction with a website, application, or advertisement. |
|
|
| D. Geolocation data. | General physical location or movements, based on IP address information. |
|
|
| E. Professional or employment-related information. | Current or past job history or performance evaluations. |
|
|
| F. Education information. | Transcripts, class lists, student schedules, student identification codes, student financial information, student disciplinary records. |
|
|
We will obtain your explicit consent before collecting or otherwise processing any of your Personal Data that reveals a mental or physical health condition or diagnosis or citizenship or citizenship status (“Sensitive Data”).
Use of Information
We use the Personal Data we collect for one or more of the purposes described in our Privacy Policy, including to provide our products and services to you, to improve our products and services, for targeted advertising, and, in some cases, to provide your Personal Data to third parties for the purpose of facilitating opportunities that may interest you.
Please refer to our general Privacy Policy for more detailed information regarding our use of Personal Data, specifically, the following sections: How We Collect and Use Personal Information, User Categories, and Third-Party Advertising and Audience/Traffic Measurement Services.
Disclosures of Information
We do not disclose your Personal Data other than as described in the How We Share and Disclose Personal Information section of our Privacy Policy.
With respect to the categories of data identified in the table above, we disclose Personal Data relating to our Website Visitors in categories A, B, C, and D to our advertising, marketing, and analytics partners, including with social networks, for targeted advertising purposes. We also share Personal Data we collect coming within category A (from our Online Course Participants), categories A and C (from our Website Users) and categories A and B (from our Donors) with select third parties in a manner that qualifies as a “sale” under Colorado law, for the purpose of facilitating opportunities that may be of interest to you and other persons interested in our products and services. Personal Data in categories A-F may also be disclosed to our service providers for the purpose of providing our products and services to you and improving them, but not for marketing purposes unless otherwise stated here. For more information, please follow the relevant link(s) above relating to your relationship with us.
The purposes for these disclosures are set forth in greater detail in our general privacy policy, in particular in the sections titled How We Collect and Use Personal Information and Third-Party Advertising and Audience/Traffic Measurement Services. Colorado residents who would like to opt-out of disclosures for the purposes of targeted advertising or data “sales” as defined under Colorado law may pursue their rights to do so as stated in the following “Your Rights and Choices” section.
Your Rights and Choices
Colorado law grants Colorado residents certain rights and imposes restrictions on particular business practices as set forth below.
- Right to Access: Colorado residents have a right to confirm whether we are processing their Personal Data and access the Personal Data we are processing.
- Right to Correction: Colorado residents have a right to correct inaccuracies in their Personal Data previously provided to us.
- Right to Deletion: Colorado residents have a right to request the deletion of their Personal Data that we have collected about them.
- Right to Data Portability: Colorado residents have the right to obtain a copy of their Personal Data that we have collected in a portable format.
- Right to Opt-Out: Colorado residents have a right to opt-out of the processing of their Personal Data for the purposes of (i) targeted advertising, (ii) the sale of their Personal Data, as defined under Colorado law, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects. Under Colorado law, sale means our exchange of Personal Data for monetary or other valuable consideration to a third party. While we engage in these first two activities listed above, we do not process Personal Data for the purpose of profiling. Should this change in the future, we will update this Colorado Privacy Addendum and provide you with methods to opt-out of such processing.
- Right to Non-Discrimination: We are not permitted to discriminate against a Colorado resident for exercising one of the above rights.
Submitting Requests
- Opt-Out Rights: If you wish to opt out of the sale of your Personal Data or processing of your Personal Data for targeted advertising purposes, only you or a person or entity that you authorize to act on your behalf (an “Authorized Agent”) may submit a request to us by:
- Opting-out of cookies by clicking here, and then selecting, “Cookie Settings” at the bottom of the page.
- Enabling a recognized universal opt-out mechanism on your browser, device, or platform. We will only be able to honor such signals if technologically capable, and if you are logged into an account with us that makes you identifiable. One such preference signal is called the Global Privacy Control (“GPC”), which is a browser-based opt-out preference signal that can communicate your opt-out to the websites you visit. Please note that our processing of the signal may be limited to the specific browser or device that you are using. You may need to renew your opt-out if you use a different browser or device to access our Websites.
- If you are a donor, you may opt-out of our sharing of your name, address, and other personal information to select third parties by calling, emailing, or writing us at the Contact Information below.
We may request that your Authorized Agent submit proof of identity and that they have been authorized exercise your rights on your behalf. We may deny a request from your Authorized Agent to exercise your rights on your behalf if they fail to submit adequate proof of identity or adequate proof that they have the authority to exercise your rights.
- All Other Rights: To exercise any of the remaining rights pursuant to the CPA, please submit a request (a “Consumer Request”) to us by calling, emailing, or writing to us at the contact information below.
You may not designate an Authorized Agent to submit a Consumer Request on your behalf unless it relates to your Right to Opt-Out.
If you fail to make your Consumer Request in accordance with the ways described above, we may either treat your request as if it had been submitted with our methods described above or provide you with information on how to submit the request or remedy any deficiencies with your request.
All Consumer Requests must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Data or an Authorized Agent of such a person. This may include verifying your home address, email address, and date of birth).
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with Personal Data if we cannot verify your identity or authority to make the request and confirm which Personal Data relates to you or the individual for whom you are making the request as their Authorized Agent. We will only use Personal Data provided in a Consumer Request to verify the requestor’s identity or authority to make the request.
Response Timing and Format
We will generally process these requests within 45 days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing. If we cannot comply with your request, we will provide you with an explanation of the reasons we cannot comply with a request.
Appeals Process
You may appeal a refusal by us to act on your request to exercise any of the above rights within a reasonable period of time after we provide you notice of such refusal by contacting us through the contact information listed in the Privacy Policy.
Within 45 days after we receive your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including any explanations for the reasons for the decision. If we require more time (up to 60 additional days), we will inform you of the reason and extension period in writing. If your appeal is denied, you may lodge a complaint with the Colorado Attorney General through his/her contact information available at: https://coag.gov/about-us/contact-colorado-office-attorney-general/.
Changes to This Colorado Privacy Addendum
Hillsdale College reserves the right to amend this Colorado Privacy Addendum at our discretion and at any time. When we make changes to this Colorado Privacy Addendum, we will post the updated addendum on the Websites and update the addendum’s effective date. Your continued use of our Websites and services following the posting of changes constitutes your acceptance of such changes.
Contact Information
If you have any questions or comments about this Colorado Privacy Addendum, the ways in which Hillsdale College collects and uses your information described above and in the General Privacy Policy, your choices and rights regarding such use, or wish to exercise your rights under the CPA, please do not hesitate to contact us through the Contact Information provided below.
Contact Information
If you have questions about Hillsdale College’s privacy practices or want to opt-out of certain uses of your Personal Information, please contact:
Hillsdale College
33 East College Street
Hillsdale, MI 49242
Telephone: (800) 659-0020
Email: [email protected]
Opt-out Request Form