Edmentum, Inc. (“Edmentum”) places high importance on earning and keeping the trust of individuals who share information about themselves with us. In an effort to comply with all applicable privacy and data protection laws, Edmentum has certified that it abides by the Safe Harbor privacy principles as set forth by the U.S. Department of Commerce in connection with the collection, storage, use, transfer and other “processing” of Personal Information transferred from the European Economic Area (“EEA”) to the United States. This policy does not apply to personally identifiable data that Edmentum collects in the United States.
Edmentum’s Safe Harbor certification can be found at http://safeharbor.export.gov/list.aspx. For more information about the Safe Harbor privacy principles, please visit the U.S. Department of Commerce’s Web site at http://www.export.gov/safeharbor.
This Policy is effective as of March 1, 2015.
The following terms used in this Policy are defined as follows:
“Affiliate” means any entity located in the EEA that is controlled, directly or indirectly, by Edmentum.
“Personal Information” means any information that is transferred from the EEA to Edmentum in the United States and that relates to an identified or identifiable individual.
“Processing” of Personal Information means doing anything with Personal Information, whether or not by automatic means, such as collecting, recording, organizing, storing, adapting, altering, retrieving, consulting, using, disclosing, transmitting, disseminating, accessing or providing access to, combining, erasing, or destroying Personal Information.
Responsibilities of Edmentum Employees
All Edmentum functions must maintain procedures to comply this Policy.
All employees of Edmentum are required to comply with this Policy.
Although privacy and data protection laws vary from country to country, those of the EEA are based on the following privacy principles. Accordingly, Edmentum will adhere to the following privacy principles to the extent required by applicable law with respect to Personal Information (as that term is defined in this Policy):
Limitations on the Collection, Use and Disclosure of Personal Information
- Notice and Consent – We will collect and process Personal Information fairly and lawfully, and where required, with the knowledge and/or consent of the data subject. The type of notice or consent required will depend on the context and the circumstances, the sensitivity of the Personal Information and legal requirements. Edmentum may rely on its Affiliates based in the EEA to provide appropriate notice to individuals whose Personal Information is transferred to the United States.
- Specific Purpose – We willcollect and process Personal Information only for specified and lawful purposes.
- Limitations on Use – We will not process Personal Information in a manner inconsistent with the purposes for which it was collected without first obtaining the data subject’s consent. The type of consent required, if any, will depend on the context and the circumstances, the sensitivity of the Personal Information and legal requirements. Edmentum may rely on its Affiliates based in the EEA to provide data subjects with a choice as to whether their Personal Information may be used for a purpose that is inconsistent with the purposes for which the information was originally collected or subsequently authorized by the individual.
- Data Proportionality – The Personal Information we collect will be relevant and not excessive for the purposes for which it is collected or to which the data subject subsequently consents.
- Transfers to Third Parties
- We will disclose Personal Information to third parties (including our Affiliates) only for purposes consistent with those for which the Personal Information was originally collected or to which the data subject has subsequently consented. For example, we may disclose Personal Information to third parties we have retained to perform services on our behalf. Edmentum will strive to require service providers to whom it discloses Personal Information and who are not subject to laws based on the EU Data Protection Directive to either certify to the Safe Harbor privacy principles or contractually agree to provide at least the same level of protection for Personal Information as is required by the Safe Harbor privacy principles.
- Before we transfer Personal Information to a third party to use for its own marketing purposes, we will obtain the data subject’s consent. The data subject’s consent may be express or implied, “opt-out” or “opt-in,” depending on the circumstances and legal requirements. Edmentum may rely on its Affiliates based in the EEA to provide data subjects with a choice as to whether their Personal Information may be transferred to a third party for its own marketing purposes.
- There may be exceptions to these general rules, depending on applicable law, if, for example, Edmentum believes the disclosure is required by court order, to comply with a law, to prevent a crime, or to enforce a legal right. Edmentum also reserves the right to transfer Personal Information in the event the company sells or transfers all or a portion of its equity, business or assets. Should such a sale or transfer occur, Edmentum will use reasonable efforts to direct the transferee to use Personal Information in a manner that is consistent with this Policy. Following such a sale or transfer, data subjects may contact the entity to which Edmentum transferred their Personal Information with any inquiries concerning the Processing of that information.
Management of Personal Information
- Quality –We will take appropriate steps to ensure that Personal Information is reliable for its intended use and accurate, complete, and current. Edmentum may require on its customers and/or employees to update and correct their Personal Information or, in the case of customers, the Personal Information of their students and users. Edmentum may also rely on its Affiliates to take reasonable steps to ensure that the Personal Information of data subjects with whom they have a direct relationship are reliable for their intended use and are accurate, complete, and current.
- Access –We will maintain procedures to give data subjects appropriate access to their Personal Information and, when appropriate, an effective means to have their Personal Information corrected, amended, or deleted. Edmentum may limit or deny access to Personal Information where providing such access is unreasonably burdensome or expensive under the circumstances, or as otherwise permitted by the Safe Harbor privacy principles. In circumstances in which Edmentum receives Personal Information about individuals with whom it does not have a direct relationship, its Affiliates may be responsible for providing access to the Personal Information and the right to correct, amend, or delete the information where it is inaccurate.
- Security –We will implement reasonable administrative, physical and technological security measures to protect Personal Information from unauthorized access, unauthorized use, and unauthorized modification or disclosure. We will provide a level of security appropriate to the risks and the sensitivity of the Personal Information.
- Retention –We will not keep Personal Information in a form that permits identification of data subjects for longer than is necessary for the purposes for which it was collected or to which the data subject has consented, except for legitimate purposes not prohibited by applicable law, such as regulatory compliance.
Accountability and Enforcement
- Accountability –We will designate at least one individual within Edmentum to be accountable for compliance with privacy and data protection laws, this Policy and related procedures.
- Enforcement –We will provide internal controls for verifying compliance with privacy and data protection laws, this Policy and related procedures.
- Complaint Process – We will provide a fair process for investigating and resolving complaints and objections regarding our data practices.
Individuals may file a complaint concerning Edmentum’s Processing of their Personal Information using the contact information below. Edmentum will take steps to remedy any issues arising out of a failure to comply the Safe Harbor privacy principles. If the complaint cannot be resolved through our internal processes, Edmentum will cooperate in investigations by and comply with the advice of competent authorities in the EEA to the extent it is able to comply consistent with US law.
In circumstances in which Edmentum receives Personal Information about individuals with whom Edmentum does not have a direct relationship, data subjects may submit complaints concerning the Processing of their Personal Information to the relevant Edmentum Affiliate. Edmentum may participate in the resolution of this dispute at the request of the Affiliate or data subject. If the complaint cannot be resolved through the Affiliate’s internal processes, the data subject may submit the complaint to the state or national data protection or labor authority in the jurisdiction where the data subject lives and/or works.
This Policy may be amended from time to time consistent with the requirements of the Safe Harbor privacy principles. We will post any revised policy on this Web site.
To contact Edmentum about questions or concerns about this Policy or Edmentum’s practices concerning Personal Information, you may write to us at:
C/O Safe Harbor Privacy Department Edmentum, Inc.
5600 West 83rd Street, Suite 300 8200 Tower
Bloomington, MN 55437