Privacy Notice
Last updated: December 3, 2020
HLC is committed to informing its audiences about news, services and accreditation statuses of member institutions. HLC is committed to maintaining trust by protecting personal data and, to the extent possible, ensuring that personal data is secure.
This Privacy Notice explains how HLC collects, uses, shares and protects personal data for operations, communications (including HLC’s website), meetings and events. It also describes the choices available to individuals regarding the use of their personal data. Please read this Privacy Notice carefully to understand HLC’s policies. If an individual does not agree with the data practices described in this Privacy Notice, HLC advises them not to use HLC’s communications, meetings and events. Note: HLC’s operations, communications, meetings and events are not intended for use by or designed for children under 13, and HLC does not knowingly or intentionally collect information about children under 13.
HLC recognizes that information privacy is an ongoing responsibility and therefore will update this Privacy Notice as needed when new personal data practices or new privacy policies are adopted. HLC reserves the right to amend the Privacy Notice at any time, for any reason, without prior notice, other than the posting of the amended Privacy Notice at this site. The date the Privacy Notice was last revised is listed at the top of this page. HLC may email periodic reminders of material changes to this notice to individual users in HLC’s database, but such users should check HLC’s website frequently to review the current Privacy Notice that is in effect. To help HLC communicate with individuals, individuals are responsible for ensuring HLC’s contact information for them includes an email address that is up-to-date, active and functional.
Individuals with a question or complaint about how HLC has handled a request under this Privacy Notice should email [email protected].
HLC acknowledges that there are many potential definitions of “personal data.” HLC’s definition of personal data is any information about an identified or identifiable person, which can include direct identifiers, such as name, address, email address, phone number, credit card number, birthdate and unique government-issued identification number, or indirect identifiers such as location data or IP address, metadata, and social media accounts and posts. This list of data elements is not exhaustive, and HLC considers the definition of personal data in the broadest possible terms.
HLC collects and uses information that, alone or in combination with other information, could lead to the unique identification of individual users (“personal data”) in order to deliver HLC’s programs and services and inform users of various resources related to higher education accreditation, as described in “HLC Data Use.” This data is collected in various online forms.
HLC collects and uses personal data to ensure it provides individual users with information about news, services, community collaboration and professional learning opportunities that advance higher education. The information HLC holds enable its staff members to engage in basic communication with individuals, helps enhance individual experiences with HLC, including on the HLC website, and identifies improvement opportunities for HLC’s operations, communications, meetings and events.
HLC sometimes uses service providers (such as event contractors and registration systems) to collect and use personal data. Some examples of how HLC collects and uses data are as follows:
- When an individual user engages with HLC by creating a profile, HLC collects personal data about the individual, including (but not limited to) name, title, company name, work/home address, email address, phone number and demographics such as number of years in higher education, affiliations and professional interests. HLC asks individual users to voluntarily provide additional information related to curriculum vitae/resume, gender, ethnicity and other demographics, which is used to help HLC better understand and better advance the diversity of HLC’s community.
- HLC processes personal data to communicate about HLC-related events, content and other opportunities related to accreditation and HLC services. HLC may also use this information to understand member needs and interests to better tailor programs and services.
- HLC may use personal data to personalize user experience through recommendations on the website or in email, apps or other service platforms to provide users more relevant information.
- HLC may use personal data to reply to communications users send to HLC.
- HLC may use basic personal data from user profiles to automatically fill out forms with personal data for ease of use.
- HLC may use personal data to communicate essential information about transactions, such as an electronic receipt for a purchase or a confirmation of a conference registration, or to reimburse when necessary.
- HLC may inform individuals about HLC events, programs and services of potential interest, unless individual users have opted out of such communications (see “HLC Communications”).
- HLC includes name, organization’s name and state, contact information and photo in the HLC conference attendee directory to facilitate networking, unless an individual user opts to exclude the contact information.
- HLC retains information about transactional history and engagements, such as participation in events, webinars, volunteering, Peer Corps services and presenting at conferences to understand program and service use.
- If volunteering for an HLC working group or committee, the name, title and organization name of the volunteer may be stored in HLC’s systems and accessed on HLC’s web pages and materials produced by the group. Volunteers may request to be excluded from these listings.
- If an individual voluntarily participates in an HLC survey, interview or focus group to research a matter related to higher education or to gauge satisfaction with HLC services, the information provided is used in aggregate, unless otherwise noted, when producing research findings and reports, and to inform improvements to programs and services.
- HLC produces various publications, reports and educational materials, which are linked on the website. Much of the content is open access; however, some material requires a login for access. HLC uses login information to track how often individual users gain access to or read the content.
- HLC hosts many professional learning events throughout the year. These include in-person conferences like HLC’s annual conference, as well as live online trainings (collectively referred to as “events”). If registered for one of HLC’s events, a web profile is required (regardless of institutional membership status), and HLC will access this data to provide the individual user with information and services associated with the event. In addition, during the registration process, HLC collects voluntarily shared personal data regarding accessibility and dietary requests.
- HLC will collect information about speakers at HLC’s events including name, organization, and contact information. HLC may also collect information provided by event attendees who evaluated a speaker’s presentation and associate it with the speaker’s record in a database. In certain instances, and with the speaker’s approval, HLC will make and store a recording of the presentation.
- If submitting a proposal to present at an event, HLC will collect information about the presenter and co-presenters (if relevant) including name, organization, contact information, abstract and other information associated with the proposed session.
- HLC will collect information about individuals invited to evaluate proposals for an HLC event including name, organization, contact information and evaluations of the assigned proposals.
- HLC may share basic registration information, including name, title and institution name of a participant at particular events (e.g., webinar or preconference workshop) with the designated presenter(s) for the purpose of planning for the event and tailoring the presentation to the group.
- HLC keeps a record of attendee and presenter participation at HLC events, which may be used by HLC to provide attendees and presenters with information about other relevant HLC services, or to understand individuals’ interests and tailor offerings to meet their needs.
- In association with attending particular conferences, attendees will have the option to download the HLC conference mobile app to navigate the conference and plan a schedule. The mobile app may require the device identifier associated with the device, but does not require the collection or use of any other personal data—outside of what the user chooses to provide as part of the participant profile.
- Some of HLC’s events are sponsored. As a matter of practice, HLC does not share attendee names, email addresses and postal mail addresses with corporate participants at HLC conferences without the attendee’s consent.
- As is common practice on most websites, HLC collects certain information automatically on HLC’s website and stores it in log files. This information is erased after 26 months as noted in Google Analytics policies. As individual users interact on HLC’s website, HLC may collect information about the user’s computer or device, and his or her visits to HLC’s website (“automatically collected data”) through cookies, Internet Protocol (IP) address tracking/URL tracking and other tools (collectively referred to as “tracking technologies”). Cookies are text files placed on a user’s computer to collect standard internet log information and visitor behavior information (for further information and instructions on how to set your browser not to accept cookies, visit allaboutcookies.org). The types of automatically collected data on HLC’s website through the use of these and other tools include: the search terms used, new or returning user information, browser information, computer or device type, operating system, internet service provider, website usage, referring/exit pages, platform type, date/time stamp, number of clicks and ads viewed. HLC may use information about an IP address to help diagnose problems with HLC’s server, analyze trends, track visitor engagements, and gather information that assists HLC in identifying visitor preferences. HLC also may use an IP address to enhance security and investigate an actual or potential security incident.
- Please note that HLC’s website may offer some links to external sites, to which these privacy practices do not apply. HLC makes no representations or guarantees regarding the policies or business practices of other websites.
- Incoming correspondence to HLC whether transmitted by email, the postal service, or otherwise may be retained and used to respond to an inquiry; to notify an individual of HLC conferences, publications, or other services; or to keep a record of a complaint, accommodation request, and the like.
- HLC reserves the right to use the personal data that it collects to identify the source of any inappropriate use of information resources managed by HLC, including, but not limited to, offensive or illegal postings to online discussion lists, collaboration sites and other communication vehicles; denial-of-service actions; unauthorized use of online services and network infrastructure; misuse or unauthorized use of the HLC name, logo or other representations of HLC; and to protect the personal safety and privacy of HLC employees and service providers, members, online users and the public under the policies and practices described in this Privacy Notice.
- When HLC goods or services are purchased using a credit or debit card, or institutional dues and fees owed to HLC are paid using a credit or debit card, the information is provided directly by individual users into a PCI/DSS-compliant payment processing service (ePay or registration system) to which HLC subscribes. Neither HLC nor its websites process or store card information.
HLC may contact individuals by email, postal mail address or phone number that is on file with HLC for business purposes.
HLC sends marketing emails and, occasionally, postal mail, which contain promotional material about HLC programs, resources and services, and individuals may opt out of these communications. These communications may provide information about events, resources on higher education accreditation and member services, or new services.
Individuals may unsubscribe or withdraw their consent at any time by using the unsubscribe link located at the bottom of HLC emails, or changing communications preferences by logging in to an event profile, or contacting HLC at [email protected]. If there is a concern regarding use of personal data, HLC will immediately contact the affected individual when required to do so by law. To do this, HLC will use the email address on file.
General Sharing
HLC does not share individuals’ personal data with third parties other than HLC authorized sub-processors.
Sub-processors
HLC shares personal data with third parties that provide certain services to assist HLC in meeting business operation needs. These parties are authorized to process personal data, on HLC’s behalf and pursuant to HLC’s instructions, only as necessary to provide these services. HLC’s uses third-party sub-processors, including:
- Collaboration services to assist in HLC’s Quality Services programs
- Customer relationship management provider to help with management of business-related data
- Email hosting services to send email
- Event registration and presenter proposal submission service providers
- Discussion platform provider to manage online forums
- Providers of research and analytics services, including Google Analytics
- Email marketing service provider
- Travel and expense authorization/reimbursement provider
- Billing and credit card merchant systems to process payments
- Providers of cloud computing infrastructure services
- Survey tools
These providers are authorized by HLC for business operation needs; however, HLC makes no representations or guarantees regarding the policies or business practices of third parties.
HLC may disclose personal data to sub-processors for the purposes identified above.
- HLC will not otherwise sell, distribute or lease personal data to third parties unless required by law to do so.
- HLC may disclose personal data without an individual’s permission to the extent that it is required to do so by law or in order to establish, exercise or defend HLC’s legal rights.
A “data subject” is any person whose personal data is being collected, held or processed. For data subjects who are European Union data subjects in the European Union, this use of the information is necessary for HLC’s legitimate interests in understanding how HLC services, including this website, are being used, to improve user experience, and to ensure network and information security.
Access to Personal Data
Upon request, HLC will provide event registrants with information about whether HLC holds any personal data. Event registrants have the right to access the personal data HLC has about them and may request that such data be corrected, amended, not processed or deleted by emailing [email protected] with the subject of “Access Request.” HLC requires all such requests to be in writing. HLC will respond to an access request within a reasonable time, under 30 days. HLC may require additional information from an individual submitting an access request to confirm his or her identity or to find the personal data.
If an event registrant believes that the personal data HLC is holding is incorrect, incomplete or should not be processed, please contact HLC as soon as possible at [email protected], and HLC will promptly review.
Withdrawing Consent
Individuals have the right to withdraw their consent for any marketing material. To do this, individuals may send an email to [email protected], click on the unsubscribe link at the bottom of HLC emails, or change preferences within a profile.
Automated Processing
HLC will not use personal data for profiling, marketing research or predictive activity or to make any other decisions based solely on automated processing unless the individual gives explicit consent for this processing. HLC acknowledges that individuals have a right to withhold consent to the use of personal data for profiling activity.
Further Explanation of Data Protection Rights for Certain European Union Residents
In addition to the other information in this Privacy Notice, to the extent applicable, HLC complies with the European Union General Data Protection Regulation. As such, consistent with the other information in this Privacy Notice, for individuals who are European Union Residents in the European Union:
The right to access – Individuals have the right to request copies of their personal data from HLC.
The right to rectification – Individuals have the right to request that HLC correct any personal data they believe is inaccurate. They also have the right to request that HLC complete personal data they believe is incomplete.
The right to erasure – Individuals have the right to request that HLC erase their personal data, under certain conditions.
The right to restrict processing – Individuals have the right to request that HLC restrict the processing of their personal data, under certain conditions.
The right to object to processing – Individuals have the right to object to HLC’s processing of their personal data, under certain conditions.
The right to data portability – Individuals have the right to request that HLC transfer their collected data to another organization, or directly to them, under certain conditions.
If an individual would like to exercise any of these rights, he or she should contact HLC at [email protected]. HLC will respond to an individual’s request within one month.
HLC is committed to securing personal data. No system is 100% secure, and therefore HLC cannot provide assurance with 100% certainty that personal data will be secure. Be mindful that individuals are responsible for protecting usernames and passwords and that this information is not to be shared with others. If, despite all HLC’s efforts, a data breach does occur, HLC will take reasonable measures to limit the damage. In case of a personal data breach, and in accordance with state and federal laws, HLC will timely alert individuals about the nature of the data breach, the possible consequences of the data breach and the remedial actions that HLC undertakes to prevent any further damage. As required, HLC will inform the relevant data owner/controller and supervisory authority or authorities without undue delay.
HLC will not store personal data longer than necessary. How long personal data is retained depends on the type of data and the purpose for which HLC processes it.
For example, some individual roles specific to maintaining an institution’s accreditation relationship with HLC require that HLC maintain contact and other basic information that is essential to conducting work related to accreditation. Those roles, two or more of which are sometimes filled by the same person, include:
- The Chief Executive Officer (CEO)
- The Chief Academic Officer (CAO)
- The Accreditation Liaison Officer (ALO)
- The Chief Financial Officer (CFO)
- The Assurance System Coordinator (ASC)
- The Data Update Coordinator (DUC)
If an individual serving in one or more of the roles noted above wishes that HLC not retain basic contact information about them, they should contact [email protected] to explore options.
In addition, by nature of their service with HLC, it is essential for HLC to maintain certain data for Peer Reviewers, IAC members, Board members, and Appeals panel members. In some cases, HLC also identifies the names of these individuals publicly. If someone in one of these service roles wishes that HLC not maintain information about him or her, or not make these public identifications, they should evaluate their ability to serve in this role and contact [email protected] to explore options, which may include foregoing this service role.
Individuals having concerns related to their use of (and the data maintained by) HLC’s Assurance System, SparQ, SharePoint sites, Concur, ePay, Qualtrics or other systems are welcome to contact [email protected] but may discover that they will need to either allow basic information to be retained or simply not use the system(s).