Effective as of March 1, 2023

1. Introduction

Your privacy and security are important to QuestBridge ("QB", "us", "our" or "we"). Because we gather certain types of information about our users in order to fulfill our mission, we want you to fully understand the terms and conditions relating to the collection, use and possible disclosure of that information. This privacy policy (the "Privacy Policy") applies to your use of the www.questbridge.org website (the "QB Website"), which is owned and operated by or on behalf of QB. Questions regarding this privacy policy should be directed to [email protected]. Please note that QB will not knowingly accept information from individuals who are under 13 years of age without first obtaining verifiable parental or guardian consent.

2. About this Policy

This Policy sets out the essential details relating to your personal data relationship with QB. The aim of this Policy is to:

1. Ensure that you understand what personal data we collect about you, the reasons why we collect and use it, and who we share it with;

2. Explain the way we use the personal data that you share with us in order help you and other talented low-income students access and navigate exceptional educational and life opportunities; and

3. Explain your rights in relation to the personal data we collect and process about you and how we will protect your privacy.

We hope this helps you to understand our privacy commitments to you. 

Please note that you may be entitled to additional protections if you are a resident of California, the European Union, and certain other countries. Please see our California Privacy Addendum in Exhibit A attached hereto, and our EEA Privacy Addendum in Exhibit B for further information.

3. Your rights 

You may be aware that a European Union law, called the General Data Protection Regulation or "GDPR," and a California law called the California Consumer Privacy Act or "CCPA," gives certain rights to individuals in relation to their personal data. As available and except as limited under applicable law, the rights afforded to you are:

• Right of Access - the right to be informed of and request access to the personal data we process about you;
• Right to Rectification - the right to request that we amend or update your personal data where it is inaccurate or incomplete;
• Right to Erasure - the right to request that we delete your personal data;
• Right to Restrict - the right to request that we temporarily or permanently stop processing all or some of your personal data;
• Right to Object -
  • the right to object to us processing your personal data on grounds relating to your particular situation;
  • the right to object to your personal data being processed for direct marketing purposes;
• Right to Data Portability - the right to request a copy of your personal data in electronic format and the right to transmit that personal data for use in another party’s website; and
• Right not to be subject to Automated Decision-making - the right to not be subject to a decision based solely on automated decision making, including profiling, where the decision would have a legal effect on you or produce a similarly significant effect.

If you would like to exercise any of these rights, or have any questions about your privacy, your rights, or how to exercise them, please contact us at [email protected].

4. How do we collect your personal data?

We collect your personal data in the following ways:

1. When you register with us  

a. In order to access certain portions of the QB Website and to use certain Websites provided therein, QB may require you to register either directly with QB or through one of its Website providers. These Websites include, but are not limited to, our National College Match program which offers you an opportunity to be matched with one of our partner colleges or universities for early admission and a full scholarship (the "College Match Program"), and our College Prep Scholars program for high school juniors (the "CPS Program"). In order to participate in either our College Match Program or CPS Program, you must first register and create an online account with QB through our application site. 

b. Your use of the QB Website is conditioned on your provision of requested information in an accurate and truthful fashion. If you choose not to provide such information, you may not be able to access, apply for or utilize the College Match Program, the CPS Program, or other Websites and/or opportunities provided on the QB Website. You may cancel your account at any time by contacting [email protected]. Once QB has finished processing your cancellation request, your account will be deactivated.

2. Through your use of the QB Website  

a. When you use the QB Website, we collect personal data such as your IP address, cookies, and web interactions data. 

3. When you apply to QB programs

a. When you apply to QB programs, including but not limited to the CPS Programs and the College Match Program, QB will collect data that is necessary for our selection process. 

4. From third parties 

a. We receive personal data about you and your activity from third parties, including partners we work with in order to communicate with you and share opportunities to help you and other talented low-income students access and navigate exceptional educational and life opportunities. We will use this personal data either where you have provided your consent to the third party or to QB to that data sharing taking place or where QB has a legitimate interest to use the personal data in order to fulfill our mission and provide you with educational or life opportunities or both.

5. What personal data do we collect from you?

We have set out in the tables below the categories of personal data we collect and use about you:

Personal data collected when you sign up for the QB Website

Personal data collected through your use of the QB Website 

Personal data collected with your permission that enables us to provide you and other talented low-income students with additional access and assistance navigating exceptional educational and life opportunities

6. What do we use your personal data for?

When you use or interact with the QB Website, we use a variety of technologies to process the personal data we collect about you for various reasons. We have set out in the table below the reasons why we process your personal data, the associated legal bases we rely upon to legally permit us to process your personal data, and the categories of personal data (identified in Section 5 ‘What personal data do we collect from you?’) used for these purposes:

If you require further information about the balancing test that QB has undertaken to justify our reliance on the legitimate interest legal basis under the GDPR and the CCPA, please email [email protected].

7. Sharing your personal data

We have set out the categories of recipients of the personal data collected or generated through your use of the QB Website.

Information we may share with your permission

Information we may share

8. Data retention and deletion

We keep your personal data only as long as necessary to provide you with the QB Website and for legitimate and essential business purposes, such as maintaining the performance of the QB Website, making data-driven business decisions about new features and offerings, complying with our legal obligations, and resolving disputes. 

If you request, we will delete or anonymize your personal data so that it no longer identifies you, unless, we are legally allowed or required to maintain certain personal data.

9. Keeping your personal data safe

We are committed to protecting our users’ personal data from loss, misuse, interference and unauthorized access, modification and disclosure. We implement appropriate technical and organizational measures to help protect the security of your personal data and prevent unauthorized access to our systems; however, please note that no system is ever completely secure, and there is therefore always some risk assumed by sharing personal information online, and we recommend that you take steps to also prevent inadvertent access to your personal information. We have implemented various policies including pseudonymisation, encryption, access, and retention policies to guard against unauthorized access and unnecessary retention of personal data in our systems.

Your password protects your user account, so we encourage you to use a unique and strong password, limit access to your computer and browser, and log out after having used the QB Website.

If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of your account has been compromised), please immediately notify us.
 

10. Children

The following sets forth the QB Website information gathering and dissemination practices relating to information collected from children as per COPPA (Children Online Privacy Protection Act). The QB Website is not intended for use by children under age thirteen (13). No one under age 13 is allowed to provide any Personal Information. As a result, we do not knowingly solicit Personal Information from children and do not ask them to disclose such information, other than that information necessary to determine their age. 

If a child is between 13 and 16, they may use our website only with a parent's or guardian's consent and only to the extent such parent or guardian has agreed to our Terms of Use and Privacy Policy. We advise parents to discuss with their children restrictions regarding the disclosure of personal information on the Internet. If a child is between 13 and 16 and is located in the European Union, we are required by the General Data Privacy Regulations (“GDPR”) to obtain parental consent if the student is applying to programs which necessitate the sharing of data with our partners, including but not limited to the CPS Programs and the College Match.

Notwithstanding anything to the contrary, we may knowingly collect and use a child's personal information for the sole purpose of responding to a single request by the child.

11. Parental Access

QB is the operator of the QB Website. Please send an email or letter to QB if you would like to do any of the following: 

• Access Personal Information that has been collected from your child 
• Correct factual errors in such information 
• Request to have this information deleted 
• Request that we no longer collect or maintain such information from your child

Please be sure to include your email address and telephone number where we can reach you.

12. California Online Privacy Protection Act

CalOPPA is the first state law in the nation to require commercial websites and online services to post a privacy policy. The law's reach stretches well beyond California to require a person or company in the United States (and conceivably the world) that operates websites collecting personally identifiable information from California consumers to post a conspicuous privacy policy on its website stating exactly the information being collected and those individuals with whom it is being shared, and to comply with this policy.

See more at: consumercal.org 

According to CalOPPA we agree to the following:

• Users can visit our site anonymously.
• Users will be notified of any privacy policy changes on our Privacy Policy web page.
• Users are able to change their personal information by emailing us, calling us, or sending us a ticket.

Q: How does our site handle do not track signals?

A: We honor do not track signals and do not track, plant cookies, or use advertising when a Do Not Track (DNT) browser mechanism is in place.

Q: Does our site allow third party behavioral tracking?

A: We do not allow third party behavioral tracking.

13. Fair Information Practices

The Fair Information Practices principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.

In order to be in line with Fair Information Practices, we will take the following responsive action, should a data breach occur:

We will notify the users via in site notification within 7 business days.

• We also agree to the individual redress principle, which requires that individuals have a right to pursue legally enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or a government agency to investigate and/or prosecute non-compliance by data processors.

14. CAN-SPAM Act

The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.

We collect your email address in order to:

• Send information, respond to inquiries, and/or other requests, registrations or questions
• Market to our mailing list or continue to send emails to our vendors, resellers and clients after the original transaction has occurred

To be in accordance with CAN-SPAM, we agree to the following:

• NOT use false, or misleading subjects or email addresses
• Identify the message as an advertisement in some reasonable way
• Include the physical address of our business or site headquarters
• Monitor third party email marketing services for compliance, if one is used
• Honor opt-out/unsubscribe requests quickly
• Allow users to unsubscribe by using the link at the bottom of each email

15. Changes to this Privacy Policy

We may occasionally make changes to this Policy.

When we make material changes to this Policy, we’ll provide you with prominent notice as appropriate under the circumstances, e.g., by displaying a prominent notice within the QB Website or by sending you an email. We may notify you in advance.

Please make sure you read any such notice carefully.

16. Contact us

If you have any questions, comments or concerns regarding our Privacy Policy and/or practices, please send an email to [email protected].

Exhibit A

California Privacy Addendum

Under the California Consumer Privacy Act (“CCPA”), we are required to notify California residents about the personal information that we at QuestBridge collect about them, whether online or offline, and how we handle their personal information. Except for the Right to Opt-Out and the Right of Non-Discrimination, this addendum does not apply to California residents with whom we communicate in the context of our business relationship (e.g., when we are providing a service to the applicants, students and alumni). 

Categories of Personal Information that We Collect and Disclose

As stated in our Privacy Policy to which this Addendum is attached, we collect the following categories of personal information about you, much of which is collected: name, contact information, and other identifiers; student / applicant and alumni application and background data and the like; usage data; audio data (e.g., if you call us we may record the conversation); and professional or employment related information. With the exception of audio information, we disclose this information to service providers for business purposes, such as to assist us with maintaining our Websites; to provide services to you and to perform under contracts; for research and analytics purposes; for maintaining the security of our services, such as detecting security incidents; debugging and repairing our Websites; and as otherwise described above. We also may disclose any of the information that we collect about you to law enforcement, advisors, and other entities where necessary to protect our rights and interests and the rights and interests of other persons, as described above.

Notice at Collection

Under the CCPA, you have the right to be notified about the categories of personal information that we collect about you; if we collect additional information beyond what is described in our Privacy Policy, then we will provide an updated Policy or separate notice, as applicable.

California Resident Rights

With the exception of our use of business contact information in our capacity of providing services to you, you have the rights listed below.

• Request to Delete. You may request that we delete your personal information; please note that exceptions apply to this request.
• Request to Know/Access. You may request (up to two times per twelve-month period) and, subject to certain exemptions, a copy of the personal information that we have collected about you in the past twelve months. You have the right to receive this information (at no cost to you) either: (a) by mail, or (b) electronically in a portable and, to the extent technically feasible, readily useable format that you could provide to a different entity. California residents also have the right to request that we provide them certain information about how we have handled their personal information in the prior 12 months, including the: categories and sources of personal information collected; business and/or commercial purposes for collecting and selling their personal information; categories of third parties/with whom we have disclosed or shared their personal information for a business purpose; categories of third parties to whom the residents’ personal information has been sold and the specific categories of personal information sold to each category of third party.

Submitting Requests

Requests to Know/Access, and Requests to Delete may be submitted by contacting us. We will respond to verifiable requests received from California consumers as required by law.

Right to Non-Discrimination

The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices, rates, or penalties to residents who exercise their CCPA rights, unless doing so is reasonably related to the value provided to the business by the residents’ data.

Financial Incentives

A business may offer financial incentives for the collection, sale or deletion of California residents personal information, provided the incentive is not unjust, unreasonable, coercive or usurious, and is made available in compliance with applicable transparency, informed consent, and opt-out requirements. California residents have the right to be notified of any financial incentive offers and their material terms, the right to opt-out of such incentives at any time, and may not be included in such incentives without their prior informed opt-in consent. We do not offer any incentives at this time.

Contact Us

If you have questions about this addendum or would like to make a complaint, please contact us.

Exhibit B

EEA Addendum

Transferring EEA/UK citizens’ information outside of Europe

As part of the services offered to you through QuestBridge Websites or its products and services, and if you are located in the European Economic Area or United Kingdom (“EEA/UK”), the information that you provide to us will be transferred to countries outside the EEA/UK – principally to the United States of America. By submitting your personal data, you’re agreeing to this transfer, storing or processing.

If you use our services while you are outside the EEA/UK, your information may be transferred outside the EEA/UK in order to provide you with those services.

The Legal Bases for Using Your Personal Information

We collect your information as a data controller when we have a legal basis to do so. The following legal bases pertain to our collection of data:

• Our use of your personal information is necessary to carry out a task in the public interest.
• Our use of your personal information is in our legitimate interest as an organization (for example in order to make improvements to our products and services and to provide you with information you request); you have a right to object to processing as explained in the section below entitled Your Legal Rights;
• Our use of your personal information is necessary to perform a contract or take steps to enter into a contract with you (for example, to facilitate your participation that you have requested, where we use your personal information to respond to your requests, to provide our services through our Websites; 
• Our use of your personal information is necessary to comply with a relevant legal or regulatory obligation that we have (for example, where we are required to disclose personal information to a court or tax authority); and/or
• Our use of your personal information is in accordance with your consent (for example, when you consent to sharing your personal information with another party).

Retention of Your Personal Information

We retain your personal information for as long as necessary to provide our services to you, to fulfill the purposes described in this Policy and/or our business purposes, or as required by law, regulation, or internal policy.

Your Legal Rights

Subject to certain exemptions, and in some cases dependent upon the processing activity we are undertaking, you may have the following rights regarding your personal information:

Right to access, correct, and delete your personal information 

You have the right to request access to the personal information that we hold about you and:

1. the source of your personal information;
2. the purposes, legal basis and methods of processing;
3. the data controller’s identity; and
4. the entities or categories of entities to whom your personal information may be transferred.

You also have the right to request that we delete your information.

We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.

Right to restrict the processing of your personal information

You have the right to restrict the use of your personal information when:

1. you contest the accuracy of the data;
2. the use is unlawful but you do not want us to erase the data;
3. we no longer need the personal information for the relevant purposes, but we require it for the establishment, exercise, or defense of legal claims; or
4. you have objected to our personal information use where such use is justified on our legitimate interests and we must verify as to whether we have a compelling interest to continue to use your data.

We can continue to use your personal information following a request for restriction, where:

• we have your consent; or
• to establish, exercise or defend legal claims; or
• to protect the rights of another natural or legal person.

Right to data portability

To the extent that we process your information (i) based on your consent or under a contract; and (ii) through automated means, you have the right to receive such personal information in a structured, commonly used, machine-readable format, or you can ask to have it transferred directly to another data controller.

Right to object to the processing of your personal information

You can object to any processing of your personal information which has our legitimate interests as its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.

Right to obtain a copy of personal information safeguards used for transfers outside your jurisdiction

You can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside of the UK/EEA.

Right to lodge a complaint with your local supervisory authority

You have a right to lodge a complaint with your local supervisory authority if you have concerns about how we are processing your personal information. We ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time.

How to Exercise Your Rights

If you would like to exercise any of the rights described above, please contact us. In your message, please indicate the right you would like to exercise and the information that you would like to access, review, correct, or delete.

We may ask you for additional information to confirm your identity and for security purposes before disclosing the personal information requested to you. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive. We may not always be able to fully address your request, for example if it would affect the duty of confidentiality we owe to others or if we are legally entitled to deal with the request in a different way.