DATE OF ISSUE: July 2024
INTO University Partnerships Group
Supplementary Privacy Notice for Users of our Services based in California, USA
INTO North America, Inc. is part of INTO University Partnerships Group (“INTO,” “we,” “us,” “our”), a global organization that complies with various data protection regimes around the world, including the California Consumer Privacy Act (CCPA).
We are providing this CCPA-specific privacy notice (“California Notice”) to supplement the information and disclosures in our Privacy Notice. This California Notice applies to residents of California who access our websites (“Sites”) and any of our online and, where required, offline Services and from whom we collect Personal Information.
We reserve the right to update this California Notice at any time by changing it as it applies to your use of our services. We will use reasonable efforts to notify you in the event material changes are made to our processing activities and/or this California Notice, such as by posting an online notice or sending you an email.
Notice of Collection and Use of Personal Information
We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“Personal Information”). In addition, we may collect data that is not identifiable to you or otherwise associated with you, such as aggregated or anonymized data, and is not Personal Information. To the extent this data is stored or associated with Personal Information, it will be treated as Personal Information; otherwise, such data is not considered Personal Information and may not be subject to this notice.
I. Categories of Personal Information
The examples of Personal Information provided below for each category are taken from the CCPA; they are included to help you understand what the categories mean and are not meant to indicate the precise pieces of information we collect.
We currently collect and, in the last 12 months, have collected the following categories of Personal Information:
Personal Identifiers (e.g., name, address, IP address, account name)
Categories of Personal Information in Cal. Civ. Code 1798.80(e) (e.g., social security number, signature, physical characteristics)
Characteristics of Protected Classifications Under California or Federal Law (e.g. race, national original, sex, age)
Commercial Information (e.g., record of purchases)
Internet or Other Electronic Network Activity Information (e.g., browsing history, search history)
Geolocation Information (e.g., device location)
Audio and Visual Information (e.g., recording of remote proctoring sessions)
Professional or employment-related information (e.g., resume, job history)
Education Information (Types of data defined in 20 U.S.C. section 1232g, 43 C.F.R. Part 99.)
Inferences Drawn from Personal Information (e.g., Profiles reflecting a consumer’s preferences, characteristics, intelligence)
Sensitive Personal Information.
II. Sources of Personal Information
We collect Personal Information from general sources including you, your use of our websites or services, your devices, our university partners, recruitment counsellors who you engage to act on your behalf, our vendors, and our service providers.
We do not collect all the categories of Personal Information listed above from each identified source.
III. Use of Personal Information
INTO collects and processes your Personal Information for the following business and commercial purposes:
to register your interest when you submit an enquiry to us in order that we can respond to you as necessary for the performance of a contract with you or to take steps at your request before entering into a contract and/or where such processing is necessary for the purposes of our legitimate interests;
to provide you with information regarding our partnership services and opportunities to perform a contract with you and/or or where such processing is necessary for the purposes of our legitimate interests;
to accept and process payments for services as necessary for the performance of a contract with you;
to collect and process any payments you may owe to us in accordance with the relevant terms and conditions for the services that you have selected as necessary for the performance of a contract with you, and where such processing is necessary for the purposes of our legitimate interests;
to deliver our services to you and to provide you with information about them, including letting you know about any new offers and services which may be of interest to you;
to enable us to personalise our communications to you where such processing is necessary for the purposes of our legitimate interests;
to enable us to conduct analysis, historical research, budget forecasting and management planning where such processing is necessary for the purposes of our legitimate interests in the smooth running of our business;
to monitor emails to enable us to comply with payment card data security standards;
to enable you to participate in any surveys or any other promotions we may be running where such processing is necessary for the purposes of our legitimate interests;
to administer and protect our business and sites where such processing is necessary for the purposes of our legitimate interests;
to deliver relevant content to you via our sites where such processing is necessary for the purposes of our legitimate interests;
to understand the way visitors to our sites use them which will help us improve and develop them; and
to deal with any requests from you regarding your rights under this notice and comply with our legal obligations.
We will not use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you with notice.
IV. Disclosure of Personal Information
Your Personal Information may be disclosed to reliable third parties that provide us with administrative or technical support which include auditing, security, debugging, customer service, account maintenance, marketing, processing transactions, online payment providers, and internal research.
We may also share your personal data with government authorities or law enforcement bodies if required by law, with external advisors, or with other personnel who are subject to a confidentiality obligation.
For more information about our specific practices, please see our Privacy Notice.
The CCPA defines “sale” as the transfer of Personal Information for monetary or other valuable consideration.
Although we do not “sell” Personal Information as that term may be commonly interpreted, we engage in online activities that may constitute a sale or a share of Personal Information under California law. This may include showing you advertisements on other websites.
The following table outlines the categories of Personal Information that we may have sold or shared with third parties in the last 12 months and, for each category, the categories of third parties with whom we shared Personal Information:
Category of Personal Information | Categories of Third Parties |
Unique Personal Identifiers (device identifier; cookies; beacons; pixel tags; other similar technology ; or other forms of persistent or probabilistic identifiers that can be used to identify a particular customer’s device). | Data analytics providers |
Internet or Other Electronic Network Activity Information (browsing history, search history, information regarding a user’s interaction with an INTO website, application, or advertising). | Data analytics providers |
Geolocation Information (device location). | Data analytics providers |
We shared the above categories of Personal Information to these third parties to advance our business interests.
The following table outlines the categories of Personal Information that we have collected and/or disclosed for our business operations in the last twelve (12) months and, for each category, the categories of recipients to whom we disclosed Personal Information:
Category of Personal Information | Categories of Recipients |
Identifiers: Name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers. | Public and Private Universities; INTO Group companies & affiliates; Email and Operating System Providers; Website Platform Providers; Social Networks; Recruitment Counsellors; Law enforcement/legal requests |
Categories of Personal Information in Cal. Civ. Code 1798.80(e): Signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment history, medical information, or health insurance information. | Public and Private Universities; INTO Group companies & affiliates; Email and Operating System Providers; Website Platform Providers; Social Networks; Recruitment Counsellors; Law enforcement/legal requests |
Characteristics of Protected Classifications Under California or Federal Law: Race, national origin, sex, age, or disability. | Public and Private Universities; INTO Group companies & affiliates; Email and Operating System Providers; Website Platform Providers; Law enforcement/legal requests |
Commercial Information: Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies, or payment information (not bank account or payment card details). | Public and Private Universities; INTO Group companies & affiliates; Email and Operating System Providers; Website Platform Providers; Recruitment Counsellors; Law enforcement/legal requests |
Internet or Other Electronic Network Activity Information: Browsing history, search history, information regarding a user’s interaction with an INTO website, application or advertisement. | Email and Operating System Providers; Website Platform Providers; Social Networks; Law enforcement/legal requests |
Geolocation Information: Device location. | Email and Operating System Providers; Website Platform Providers; Law enforcement/legal requests |
Professional or employment-related information: Resume information, past and current job history, and performance information. | Public and Private Universities; Email and Operating System Providers; Website Platform Providers |
Education Information: Types of data defined in Family Education Rights and Privacy Act (FERPA) (20 U.S.C. s.1232g, 34 CFR Part 99) | Public and Private Universities; Email and Operating System Providers; Website Platform Providers Recruitment Counsellors; Law enforcement/legal requests |
Inferences Drawn from Personal Information: Profiles reflecting a consumer’s preferences, characteristics, predispositions, behaviors, attitudes, intelligence, abilities, and aptitudes. | INTO Group companies & affiliates |
For more information about our business or commercial purposes and why we disclose Personal Information with the identified recipients, please see our Privacy Notice.
Please note:
We do not disclose all the categories of Personal Information listed above to each identified recipient.
We do not knowingly collect or share the Personal Information of consumers under 16 years of age.
We do not use sensitive Personal Information for purposes other than those allowed by the CCPA and its regulations.
V. Retention of Personal Information
We retain your Personal Information for as long as necessary to fulfil the purposes for which we collect it, such as to provide you with the service you have requested, and for the purpose of satisfying any legal, accounting, contractual, or reporting requirements that apply to us.
VI. Your California Privacy Rights
California’s “Shine the Light” law permits our users who are California residents to request and obtain from us a list of what Personal Information (if any) we disclosed to third parties for their own direct marketing purposes in the previous calendar year and the names and addresses of those third parties. Requests may be made only once per year per person, must be sent to privacy@intoglobal.com, and are free of charge. However, we do not disclose Personal Information protected under the “Shine the Light” law to third parties for their own direct marketing purposes.
The CCPA provides California residents with the following rights with respect to their Personal Information:
The Right to Know what Personal Information we collected, used, and disclosed about you, including any or all of the following:
categories of Personal Information collected or disclosed by us;
purposes for which categories of Personal Information are collected by us;
categories of sources from which we collect Personal Information; and
specific pieces of Personal Information we have collected about you.
The Right to Delete Personal Information that we collected from you, subject to certain exceptions. Please note that we may deny your request or may retain certain elements of your Personal Information if it is necessary for us or our service providers to:
Complete the transaction for which the Personal Information was collected, provide goods or a service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between our business and you.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
Debug to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the deletion of information is likely to render impossible or seriously impair such research, if you have provided informed consent.
Complete solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
Comply with a legal obligation.
Otherwise use the Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the information.
The Right to Opt-Out if we sell or share of your Personal Information. As advised above in section IV. Disclosure of Personal Information, although we do not “sell” Personal Information as that term may be commonly interpreted, we engage in some online activities that may constitute a sale or a share of Personal Information under California law.
The Right to Limit Use or Disclosure of Sensitive Personal Information by us for purposes other than those allowed by CCPA and its regulations.
The Right Not to Receive Discriminatory Treatment by us when you exercise any of your CCPA privacy rights. Unless permitted by the CCPA, we will not:
Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
How to Submit a Rights’ Request
To exercise your Right to Know, Delete, and/or Correct, you must provide us with sufficient information so we can verify your identity, and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. Once we receive the information you provide, we will review it and determine if more information is necessary to verify your identity as required by law, and we may request additional information in order to do so. We will verify your identity either to a “reasonable degree of certainty” or a “reasonably high degree of certainty” depending on the sensitivity of the Personal Information and the risk of harm to you by unauthorized disclosure, deletion, or correction as applicable.
To exercise any of your Rights, please submit a verifiable request to us by:
completing our Online Rights' Request form
emailing us at privacy@intoglobal.com
If you submit a request to delete via your online account or profile, you may be asked to confirm separately that you want your Personal Information deleted.
If you do not have a current account or profile or if you are unable to access, control, or delete your information from within your account or profile, you can contact us through either of the above methods.
Only you, or a person authorized by you to act on your behalf, may make a verifiable consumer request related to your Personal Information.
We may deny your request if we are unable to verify your identity or have reason to believe that the request is fraudulent.
If an Authorized Agent submits a Rights’ Request on your behalf, the agent must send an email to privacy@intoglobal.com with additional information to verify that they have your authority to submit the request.
Handling your Request
We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us.
We will acknowledge receipt of your request within ten (10) business days of its receipt.
We will respond to a verifiable request within forty-five (45) days of its receipt.
If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.
We will deliver our written response by mail or electronically, at your option.
Any disclosures we provide will only cover the 12-month period preceding the receipt of the verifiable consumer request.
We reserve the right to deny requests to provide disclosures for Personal Information collected prior to the preceding 12-month period, to the extent such request would be impossible to fulfil or would involve a disproportionate effort.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
VII. Universal Opt-Out Mechanisms and “Do Not Track” Signals
We use analytics systems and providers that may process your Personal Information to help us understand your online activities over time, and these systems and providers may provide some of this information to us.
Our sites recognize the Global Privacy Control (“GPC”) signal that can automatically communicate your preferred privacy settings. If you are using a browser setting or plug-in that sends an opt-out preference signal to each website you visit, we will treat that as a valid request to opt-out. To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/orgs. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.
Some of the cookies and tracking technologies that we use are strictly necessary to technically enable the website and its components, as well as enabling essential security measures. Strictly necessary cookies are activated without user consent because they are considered essential for the website to function effectively and securely. All cookies and other tracking technologies that are not classified as strictly necessary are subject to consent from website visitors on their first visit. You will find information about the different categories of cookies used, in our Cookie Policy.
VIII. Contact Information and Assistance
If you have any questions, comments, or concerns about our processing activities, please email us at privacy@intoglobal.com
For more information about how users with disabilities can access this California Notice in an alternative format, please email us at privacy@intoglobal.com