Student Privacy Policy

CARNEGIE LEARNING STUDENT PRIVACY POLICY

Updated and Effective: October 31, 2022

This Privacy Policy applies to the collection of information from students by Carnegie Learning, Inc. (“Carnegie Learning”) through access-controlled learning platforms we provide, including through any related websites, software, applications, or interactive features or online services, and that post a link to or include this Privacy Policy (collectively, our “Learning Platforms”). This Privacy Policy also applies to any student information we collect offline in connection with use of the Learning Platforms.

OVERVIEW

The Learning Platforms include teaching and learning resources designed for students in pre-K through college. Typically students will access the Learning Platforms through agreements Carnegie Learning has with teachers, or representatives of schools, learning institutions, school districts, state or local boards of education or other educational organizations (collectively, “Schools”).

The Learning Platforms are made available to students and others authorized by the Schools, who have been provided access by the Schools, such as by adding a student’s name and email address to their class roster or by syncing class rosters through third-party services authorized by a School. Teachers or administrators may also provide other information to us about their students who participate in the Learning Platforms. We may also disclose information to the Schools pursuant to our agreements with the Schools. When we provide access to the Learning Platforms through a School agreement, we collect, process, disclose, and store student information in order to provide learning services through the Learning Platforms and on behalf of Schools  and only in the ways permitted by the applicable School  agreement. We otherwise use information as set forth in this policy.

Certain students may obtain access through Private Providers. If you are accessing the Learning Platforms through a Private Provider, please see below for additional information.

Students Younger than 13

Some students that access our Learning Platforms may be younger than the age of 13 (“Children”) and the online collection of personal information from those students may therefore be subject to the Children’s Online Privacy Protection Act (“COPPA”) and other applicable law. Carnegie Learning collects personal information about Children for the use and benefit of Schools, and for no other commercial purpose. When a School provides access to the Learning Platforms to students who are Children, the School represents that it has secured all necessary consent from the parents of those Children or is providing that consent on the parents’ behalf. We limit the use of information about Children to the educational context authorized by the contracting School. If you are the parent of a Child who uses our Learning Platforms through his/her/their School and have questions about our privacy practices, please contact us as indicated in the “Contact Us” section below.

What Information Do We Collect from Students?

We may collect information from you directly, automatically when you visit the Learning Platforms, and sometimes from third parties, such as your teacher or School administrator. Some of this information may be considered “personal information” under various applicable laws. We consider information that identifies you as a specific, identified individual (such as your name and email address) to be personal information. We will also treat additional information, including IP addresses and cookie identifiers, as “personal information” where required by applicable law. Note that we may de-identify personal information so that it is non-personal, such as aggregating or converting it to a code, sometimes using a function commonly known as “hash”. We will treat de-identified information as non-personal to the fullest extent allowed by applicable law. If we combine non-personal information with personal information, then we will treat the combined information as personal information under this Privacy Policy.

Information collected directly from students

Carnegie Learning may ask you to provide certain information to us directly, depending on which product(s) you are using, including:

• Full Name
• Date of Birth
• Email address
• Student identifier 
• Student login ID and password (unique to our system)
• The grade, class, school where a student is enrolled, and any relevant programs such as English Language Learner (ELL) or English as a Second Language (ESL) or Special Education
• Certain demographic information, such as race/ethnicity and additional learning classifications
• Student-generated content, including text, videos, voice-recordings, and other responses to questions, prompts, assignments, suggestions, or other content
• Feedback about any of our products and services
• Records of interactions with customer support
• Data generated from student activity within the Learning Platforms, including answers provided, errors, hint requests, preferences, timing information, progress within the system, and inferences made from this data about student knowledge.
• External assessment scores used to customize instruction

Information collected automatically through use of the Learning Platforms

In addition to any personal information that you choose to submit to the Learning Platforms, we and our third-party service providers may use a variety of technologies that automatically or passively collect certain information whenever you visit or interact with the Learning Platforms ("Usage Information"). Usage Information may include the following, among other information:

• Web browser type and version
• Operating system
• All pages and activities viewed on the Learning Platforms
• Date and time of use
• Length of stay on certain courses or pages
• We also automatically collect your IP address or other unique identifier (“Device Identifier”) for any computer, mobile phone or other device you may use to access the Learning Platforms. A Device Identifier is a number that is automatically assigned to your device used to access the Learning Platforms, and our servers identify your device by its Device Identifier. We may be able to collect or infer your approximate location through information we collect, such as IP address.

Any Usage Information, Device Identifier, or other persistent identifier we collect is used for the sole purposes of providing our Learning Platforms to students and their Schools and to support the Learning Platforms’ internal operations. 

The technologies that may be used to collect Usage Information include the following:

Cookies. When you use our Learning Platforms, Carnegie Learning may store data in “cookies” or similar technology on your devices, which are data files placed on your computer or other device when you visit the Learning Platforms or otherwise access our online content.  Carnegie Learning may use cookies for many purposes, including, without limitation, to remember you and your preferences, to collect information about how you use our Learning Platforms, personalize content within the Learning Platforms, and track the pages you’ve visited. We use both session and persistent cookies (which remain on your computer after the browser has been closed). This information allows us to customize your Carnegie Learning experience so that your visit is as relevant and as valuable to you as possible.

For more information on cookies, visit http://www.allaboutcookies.org.

Web Beacons. We may use web beacons (small graphic images or other web programming code, also known as "1x1 GIFs" or "clear GIFs") and similar technologies on our Learning Platforms. Web beacons can recognize certain types of information on your computer such as cookies, the time and date a page is viewed, and a description of the page where the web beacon is placed. Web beacons or similar technologies may be used for a number of purposes, including, without limitation, to count visitors to the Learning Platforms, to monitor how users navigate the Learning Platforms, to count how many e-mails that were sent were actually opened or links were actually viewed and to improve your experience on the Learning Platforms.

Embedded Scripts. An embedded script is programming code that is designed to collect information about your interactions with the Learning Platforms, such as the links you click on. The code is temporarily downloaded onto your device from our web server or a third party service provider, is active only while you are connected to the Learning Platforms, and is deactivated or deleted thereafter.

In addition, we may use a variety of other technologies that collect similar information for security and fraud detection purposes.

 

Information We Receive from Schools

We may receive information about you from your School(s). For example, the School may provide us your name and email address to set up an account on your behalf and/or so that we may contact you, such as to send you an invitation to create a password and log-in. The School may also provide us with your parent or legal guardian’s email address and phone number, such as to communicate with them about the Learning Platforms, including to send course reminders and ask for feedback about our products and services. The information we collect is subject to this Privacy Policy. The information collected and stored by a School remains subject to the School’s privacy practices.

How Does Carnegie Learning Use Information Collected about Students?

• Allow students to access and use the service as designated by the School
• Help students reset their passwords
• Investigate information security and information asset protection-related incidents
• Test, correct and improve our content, applications and services
• Develop new applications, products and services
• Analyze academic and learning outcomes and preferences
• Personalize the teaching and learning resources available across the Learning Platforms to improve student instruction and meet individual student needs
• Allow students to participate in features or activities we offer, including sweepstakes, contests, or other prize promotions
• Communicate with and provide reports to you, your parents or legal guardians, teachers or School or school district administrators at the student, class, School, or district level, or as otherwise directed by the School, based on your use of and activities on the Learning Platforms, including reminders and other informational messages
• Support teachers or School or school district administrators in implementing our products or using our services
• Monitor the use of our products and perform such analyses as might be necessary or helpful in improving product performance, efficiency, and security
• Research how students use the Learning Platforms and analyze the educational effectiveness of our products and services to contribute to general knowledge about how students learn
• For external academic research and scholarship
• Enforce our Terms of Use
• Use the information as may be required or permitted by legal, regulatory, industry self-regulatory, insurance, audit or security requirements.

Carnegie Learning will not use any information collected about students to advertise or market to students or their parents.

How Does Carnegie Learning Share Information Collected about Students?

To And On Behalf Of Schools

As discussed above, we provide the Learning Platforms to students through agreements with Schools and on behalf of those Schools. Accordingly, Schools (and those who obtain authorized access from the Schools) and have access to all of the information we collect via registration and the Learning Platforms from students associated with that School.

In some cases, a School (including teachers or administrators) may enter into additional reporting or research agreements for the provision of reports or analyses that require data to be associated with demographic categories (gender, ethnicity, free or reduced lunch status, etc.) or other individual student information, such as test scores. In such cases, the teachers, Schools and/or school district administrators provide Carnegie Learning and specified service providers with the information required, which may personally identify students. When such agreements are in place, reports containing student information are provided only to the teachers, Schools and school district administrators authorized to receive that information. In such cases, data is held securely and only Carnegie Learning employees and service providers directly involved in producing these reports have access to students’ personal information.

Service Providers

In order to provide and support our products, Carnegie Learning may contract with third parties and share information required to carry out these services with these third parties. These service providers provide support services, such as hosting the Learning Platforms and operating their features, or performing other administrative services. In such cases, all third parties are required to abide by this policy. Carnegie Learning takes reasonable steps to release personal information collected from students only to service providers and third parties who are capable of and have agreed to maintain the confidentiality and security of that information and to use that personal information only to provide the applicable service to us or on our behalf. You may view a list of our current service providers here: Link

Administrative and Legal Reasons

We may disclose personal information about students to third parties when necessary to protect the security or integrity of the Learning Platforms; take precautions against liability; respond to judicial process; or provide information to law enforcement agencies or for an investigation on a matter related to public safety. We may also disclose personal information about students in connection with a merger or the sale of Carnegie Learning’s assets or interest in the Learning Platforms, or other similar change in ownership (including, during the course of any due diligence process), provided that any subsequent owner of student’s personal information has agreed to abide by Carnegie Learning’s then-current student privacy policy.

Research and Statistical Purposes

Carnegie Learning uses de-identified and aggregate data about students’ use of our Learning Platforms for product development, research or other purposes. To de-identify data, we remove all direct and indirect personal identifiers. These identifiers include, but are not limited to, name, ID number, birth date, teacher name, class and school identifications. Carnegie Learning agrees not to attempt to re-identify any de-identified data, and to restrict any third parties to whom it discloses such data from attempting to re-identify any de-identified data. We may store de-identified data indefinitely. Schools, school districts, and individuals may ask for their data to be excluded from any de-identified data sets. To request such exclusion, please email privacy@carnegielearning.com.

In addition, for research and other purposes, Carnegie Learning may transfer de-identified data to third parties.  For example, we may share information such as problems attempted, answers or hint requests for each step of the problem, and associated time stamps. We review all requests for such de-identified data sets, and we require all recipients of de-identified data sets to agree to the Carnegie Learning Private Dataset Terms of Use, which prohibit, among other things, any attempts to re-identify the de-identified data and any commercial use of the data.

In connection with research studies, Carnegie Learning and/or its partners may publish or discuss aggregate data about student performance and results. Such publications never reference individual information, only aggregate statistics. Research projects that make use of student data may be reviewed by an Institutional Review Board (IRB) which is responsible for approving the goals and procedures of the study, including those related to maintaining privacy of information. The IRB may or may not require parental or student notification or approval. Schools or school districts provide prior consent to any research that involves interaction with the schools and their students’ information. Carnegie Learning is committed to abiding by IRB recommendations and requirements.

As part of our commitment to continual improvement, Carnegie Learning may field test new application content and test versions of features within our products, including through studies which employ random assignment. We may also partner with third-party researchers to conduct such research. If the research is not exempt from IRB review, an Institutional Review Board (IRB) will review the goals and procedures of the study, including those related to maintaining privacy of information.

Sweepstakes, Contests, and Promotions

We may offer sweepstakes, contests or other promotions (any, a "Promotion"), that may require registration. By participating in a Promotion, you are agreeing to the provisions, conditions, or official rules that govern that Promotion, which may provide for the sharing of information collected in connection with the Promotion beyond those instances described elsewhere in this Privacy Policy.

Third-Party Analytics Services

We may work with analytics providers to provide us with information regarding the use of our Learning Platforms. These third parties may set and access their own tracking technologies on your devices (including cookies and web beacons), and they may otherwise collect or have access to information about you, including Usage Information. With respect to Children, to the extent there is any collection of information through tracking technologies, it is used only for providing support for internal operations as needed to provide the Learning Platforms.

Data Retention & Access

You may be able to review, modify, and delete certain information related to your use of our Learning Platforms through your account.  Schools may ask to review the information that Carnegie Learning has collected and retained about a particular student, or request its deletion, by contacting us at privacy@carnegielearning.com. If you are a parent or student and would like to access or request deletion of any information collected by Carnegie Learning as a result your or your student’s use of our Learning Platforms, please contact your School

 Carnegie Learning will retain personal information about students as long as required by our agreement with a School or as required by law. Carnegie Learning may otherwise retain personal information as required by applicable law or its contractual obligations to a School. Carnegie Learning may also delete personal information or other data when requested by a School or as provided under a School agreement. The School may request a copy of the data or that we retain the data on their behalf by emailing their request to privacy@carnegielearning.com within 60 days of such notification.

Unless otherwise prohibited by an agreement with a School, Carnegie Learning may retain aggregated, de-identified, or other non-personal data, including curriculum or other content submitted by users when using the Learning Platforms as long as needed for our business purposes.

Security

Carnegie Learning takes commercially reasonable steps to help protect and secure personal information. We have implemented an information security program with numerous measures, including administrative, technical and physical controls that are designed to reasonably safeguard personal information under our control against loss, misuse and unauthorized alteration.  However, please remember that no data storage or data transmission over the Internet, or by other means, can be guaranteed to be 100% secure. Thus, while we strive to protect your personal data, Carnegie Learning cannot ensure or warrant the security of any information you transmit to us. Therefore, each School and any student user accessing the Learning Platforms under the School’s authorization understands, acknowledges, and agrees that you transmit personal information to the Learning Platforms at your own risk.

Third-Party Links or Content

The Learning Platforms may contain links to other web sites or include other content hosted and served by third parties that Carnegie Learning does not control. Likewise, our content, including some of our Learning Platforms, may be provided through or be included on third parties’ web pages and web sites that are not associated with Carnegie Learning and over which we have no control. We may collect Usage Information through Carnegie Learning content appearing on third-party sites. Carnegie Learning is not responsible for the privacy practices of any third party.

Consent to Transfer of Data

Carnegie Learning is a United States company. If you are a user of the Learning Platforms outside of the United States, by using the Learning Platforms and/or providing us with information, you acknowledge and agree that your personal information may be processed for the purposes identified in the Privacy Policy. In addition, your personal information may be processed in the country in which it was collected and in other countries, including the United States. By providing your information, you fully understand and unambiguously consent to this transfer, processing, and storage of your information in the United States and other jurisdictions, where laws regarding processing of personal information may be less stringent than the laws in your country, and where governments, courts or law enforcement or regulatory agencies in those other countries may be able to obtain disclosure of that personal information through the laws of those countries.

Contact Us

Carnegie Learning, Inc. is the operator of these Learning Platforms and any questions regarding this Privacy Policy and the collection or use of personal information should be directed to:

Carnegie Learning, Inc.

4 Smithfield Street, Floor 8

Pittsburgh, PA 15222

privacy@carnegielearning.com

(877) 401-2527

Accessing the Learning Platforms through Private Provider

The Learning Platforms may be made available through agreements we have with organizations who provide specialized education services to students, but who are not directly associated with a School (“Private Provider”). In those cases, we or the Private Provider (rather than the School) will obtain any necessary consent from a student’s parent or legal guardian as required by law.

When students access the Learning Platforms through a Private Provider, Carnegie Learning acts as a service provider on behalf of and in the ways permitted by the agreement with the Private Provider. Accordingly, Private Providers  may have access to all of the information we collect from students that is associated with  the students’ accounts with the  Private Provider. If a Private Provider is working in connection with a student’s School, they may share or ask us to share student information about students associated with that School.

If you are the parent of a Child who uses our Learning Platforms through a Private Provider and have questions about our privacy practices, or would like to request to access or delete your Child’s information, please contact us as indicated in the “Contact Us” section above. If you would like more information about how the Private Provider handles your personal information, please contact the Private Provider.

Information for California Residents

Carnegie Learning collects personal information from users of the Learning Platforms as a service provider on behalf of and only in the ways permitted by the applicable School agreement.  Carnegie Learning does not sell personal information collected through the Learning Platforms or share that information with third parties for their own direct marketing purposes. If you are a California consumer and would like to submit a request to access or delete information under the California Consumer Privacy Act (CCPA), please direct your request to your School administrator.