Privacy Notice

Last update 23 April 2024

Ellucian is committed to maintaining your confidence and trust, and accordingly complies with the following Privacy Notice to protect the personal information you provide to Ellucian Company L.P. and all of its related worldwide affiliates and subsidiaries (collectively, “Ellucian”). As used in this Privacy Notice, “Personal Data”, means any information about an identified or identifiable natural person.

This notice is divided into sections based on your relationship with Ellucian. Please select the appropriate section(s) below for information that applies to your Personal Data. Keep in mind that more than one section might apply to you. Note that this Privacy Notice does not apply to Ellucian employees or job applicants.

Description of Ellucian’s Cloud Services System – Ellucian System and Organization Controls 3 (SOC 3) Report

General Terms
Terms that apply to website visitors & representatives of potential customers
Terms that apply to Ellucian customers
Terms that apply to California Residents
Terms that apply to people in the European Economic Area (“EEA”), United Kingdom ("UK") or Switzerland
Ellucian Binding Corporate Rules

General Terms

These General Terms apply to anyone whose Personal Data is processed by Ellucian as a “controller” or “business” (as those terms are defined by applicable data protection law), excluding Ellucian employees and job applicants.

Additionally, these General Terms do not apply to the personal data processed through the products and services Ellucian delivers to its customers. If you are a student (current, former and prospective), parent or benefactor of a student, alumni, faculty member or other employee of an Ellucian customer, or any other individual employed by, or that interacts with, Ellucian customers, please see Terms that apply to Ellucian customers for information about your personal data when processed by Ellucian customers through the use of Ellucian products and services.

Collection of Personal Data

Ellucian may collect and otherwise receive the following categories of Personal Data:

Name, contact details and identification numbers
Professional and employment information
Education and professional qualifications
Personal characteristics
Application, website or information technology access and usage information – this may include cookies as described below and in our Cookie Declaration
Account or transaction information

The Personal Data collected by Ellucian will depend on the individual’s relationship to Ellucian as further described in the sections below.

Ellucian collects Personal Data from the following sources:

You
Your device – this may include information collected automatically as further described in the sections below
Other sources – we collect Personal Data from third parties as needed to accomplish the purposes described below.

Purposes of Personal Data Collection and Use

Ellucian collects, uses and processes Personal Data for the purposes of:

Providing information about our products, services and events
Providing products, services and support to our customers
Administrative purposes relating to processing transactions with our customers
Communicating with business partners, vendors, agents and contractors about business matters
Analysis of information in order to improve business practices, products and services
Conducting related tasks for legitimate business purposes
Other purposes disclosed at the time of collection
Compliance with legal requirements and protection of rights and property

Security of Personal Data

Ellucian is committed to safeguarding the Personal Data that it receives. While Ellucian cannot guarantee the security of Personal Data, Ellucian has implemented reasonable technical and organizational measures to protect Personal Data in Ellucian’s possession from loss, misappropriation and unauthorized access, disclosure and destruction.

Ellucian utilizes a combination of online and offline security technologies, procedures and organizational measures to help safeguard Personal Data. For example, facility security is designed to prevent unauthorized access to Ellucian computers. Electronic security measures — including, for example, network access controls, passwords and access logging — provide protection from hacking and other unauthorized access. Ellucian also protects Personal Data through the use of firewalls, role-based restrictions and, where appropriate, encryption technology. Ellucian limits access to Personal Data to employees, subcontractors, and third-party agents that have a specific business reason for accessing such Personal Data. Individuals who have been granted access to Personal Data will be made aware of their responsibilities to protect such information and will be provided training and instruction on how to do so.

If Ellucian learns of an unauthorized disclosure of Personal Data that is within Ellucian’s possession or control, Ellucian will perform all actions required by applicable laws, including taking prompt measures to remedy the unauthorized disclosure and providing required notices.

Ellucian hires other companies to provide certain services on our behalf; for example, to process event registrations. Ellucian will provide these companies only with the information they need to deliver the services, and they are contractually prohibited from using that information for any other purpose.

Because Ellucian is a global company, Personal Data may be stored and processed in the United States or any other country in which Ellucian and its affiliates and agents maintain facilities or personnel.

Ellucian’s products and services are not intended for children under the age of 13. Ellucian does not knowingly collect any information from children. If we learn that we have collected or received Personal Data from a child under 13 without verification of parental consent, we will delete that information.

Under certain circumstances, we may be required to disclose your Personal Data in response to valid requests by public authorities, including to meet national security or law enforcement requirements.

Your Access to and Control Over Your Personal Data

You may do the following at any time by contacting us at [email protected]:

Opt out of any future contacts from us
See what information we have about you, if any
Change, correct, or, in certain circumstances, request that we delete any Personal Data we have about you
Express any concern you have about our use of your Personal Data

Ellucian will comply with these requests when required by law. We may request additional information from you in order to process your request.

Contact Us

Should you have any questions or concerns about this Privacy Notice, please contact our data protection officer by any of the following means:

By Mail:
Ellucian Company L.P.
Attn: Data Protection Officer
4 Country View Road
Malvern, PA 19355, USA

By Email:
[email protected]

By Phone:
+1 703 261 2161

Requests to unsubscribe from ("opt-out" of) communications from Ellucian can be managed using the link in email communications. You may also mail your enquiry/request to the above address.

Changes to this Privacy Notice

Ellucian may revise this Privacy Notice from time to time in order to comply with new laws and regulations; to conform to industry best practices; to reflect changes in Ellucian product and service offerings; and for other reasons. The revised Privacy Notice will become effective when it is posted on the Ellucian website.

Website Visitors & Representatives of Potential Customers

This section of the Privacy Notice describes our practices in connection with information we may collect through your use of our website (collectively, our “Site”). By using our Site, you consent to our collection and use of the information described in this Privacy Notice. This section also describes our practices about Personal Data of representatives of potential customers, whether we interact with those representatives directly through the Site or in other ways.

Although Ellucian has endeavored to create a secure and reliable Site for you, the confidentiality of any communication or material transmitted to or from Ellucian via the Site or email cannot be guaranteed.

Collection and Use of Information

Ellucian collects your Personal Data (such as your name, address, or telephone number) through our Site if you provide it to us voluntarily.

In addition, as you use our Site we automatically collect certain information regarding your visit, including information about your equipment, operating system, browsing actions including log data and usage patterns. We use this information for internal purposes, such as to improve our Site. We may use cookies to assist us in collecting this information. A cookie is a small file placed on the hard drive of your computer. You have the ability to delete cookie files from your hard drive at any time or avoid cookies by configuring your browser to reject them or to notify you when a cookie is being placed on your hard drive. Ellucian, on its own or through third-party vendors, uses first-party and third-party cookies together for lead generation purposes and to inform, optimize and serve ads based on your past visits to our Site. For information on the specific cookies we use on our Site, please visit our Cookie Declaration. You can also visit this page, this page and this page to opt out of some such advertising. We also use certain cookies for website functionality.

Our Site uses Google Analytics Demographics and Interest Reporting to help us understand, in aggregate, the age, gender and interests of Site visitors. This Google Analytics tool does not reveal to Ellucian your name. Ellucian does not combine the information collected through use of Google Analytics with Personal Data. The information received from Google Analytics is used improve our Site and the type of information displayed to Site visitors so we can better serve those interested in Ellucian. You can prevent Google Analytics from recognizing you on return visits to our Site by using Google Analytics’ Opt-out Browser Add-on, available here.

Ellucian may also use Facebook features and tools, including pixel tags added to the Site, that allow data about actions of Site visitors to be sent to Facebook to track conversions and to allow Ellucian to create custom audiences for the products or services Ellucian may advertise on Facebook. We may also provide Facebook with other data we have collected about you for this purpose, using Facebook tools that allow data such as email addresses and phone numbers to be locally hashed on our system before we upload and pass such data to Facebook. Facebook’s use of such data is governed by Facebook’s Data Use Policy. You can adjust Facebook ad settings here.

You can also manage the interest-based advertising you receive or completely opt-out of receiving such advertising by indicating your choice here.

At any time, while accessing our Site, any user may decline participation in any activity that would require active submission of Personal Data (e.g., responding to a survey email or engaging in an e-commerce transaction). Your decision not to participate will not affect your ability to use any other feature on our Site. When choosing to provide Personal Data through our Site, you acknowledge that Ellucian may store, process or transfer your Personal Data outside your country.

Ellucian may offer you opportunities to engage in blogs, forums, and social media accounts that are designed to be visible to other users, including comments and postings. You should be aware that any Personal Data you choose to submit via those media can be read, collected, and used by other participants, and could be used to send you unsolicited messages. We are not responsible for the Personal Data you choose to submit when you engage in such activities.

External Websites

Some hyperlinks and banner advertisements may link to third-party websites. You should be aware that these third-party websites are not controlled by Ellucian and are not subject to this Privacy Notice. You should check the privacy policies of the third-party websites to see how your Personal Data will be collected and used.

Ellucian Customers

The contracts between Ellucian and its customers may contain terms regarding the protection of Personal Data. When that is the case, the applicable contract provision shall supersede any conflicting provision in this Privacy Notice.

Ellucian’s Role as a Processor or a Service Provider to Its Customers

Ellucian offers enterprise resource planning, constituent relationship management, integration and analytics solutions, and other products and services to its customers, which process the Personal Data of customers’ students (current, former and prospective), parents or benefactors of students, alumni, faculty members and other employees of Ellucian’s customers, or any other individuals employed by or that interact with customers’ (“Customer Personal Data”) relevant to managing an institution of higher education. Ellucian may also process Customer Personal Data when providing development services, solution engineering services, professional technical services and product technical support services to its customers. Ellucian is a global organization and may provide these solutions and services from any country in which Ellucian has facilities or personnel. When processing Customer Personal Data, Ellucian is a Processor or Service Provider (as those terms are defined by applicable data protection laws) to its customers and Ellucian processes Customer Personal Data only in accordance with the customer’s instructions.

The Customer’s Responsibilities with Respect to Its Personal Data

Ellucian processes Customer Personal Data that its customers have chosen to share with Ellucian. Ellucian has no direct or contractual relationship with the subjects of this Personal Data (the “Customer Data Subjects”), who include, but are not limited to, Customers’ employees, applicants, current and former students, parents or benefactors of students, and others with whom Customers interact. As a result, the customer is solely responsible for satisfying all legal obligations owed directly to Customer Data Subjects under applicable data protection laws.

It is the Ellucian customer's responsibility to ensure that Personal Data it collects or directs Ellucian to collect can be legally collected. The customer also is responsible for providing to Customer Data Subjects any notices required by applicable law and for responding appropriately to Customer Data Subjects’ requests to exercise their rights with respect to Personal Data. In addition, the customer is responsible for ensuring that its disclosure of Personal Data to Ellucian is consistent with any privacy policy the customer has established and any notices it has provided or is required to provide to Customer Data Subjects.

Ellucian is not responsible for its customers’ privacy policies or practices; or for customers’ compliance with such policies/practices. Ellucian does not review, comment upon, or monitor its customers’ privacy policies or its customers’ compliance with such policies. Ellucian does not review instructions or authorizations sent to Ellucian by customers or other parties to determine whether the instructions or authorizations are in compliance with, or conflict with, the terms of a customer's published privacy policy or of any notice provided to Customer Data Subjects.

Sharing of Personal Data with Third-Parties

Ellucian shares Personal Data with our subcontractors, business partners and third-party agents and contractors only to the extent required in order to deliver products or services requested by customers. Before transferring Personal Data to these third-parties, Ellucian will obtain assurances from the recipient that it will safeguard Personal Data in a manner consistent with this Privacy Notice and otherwise to support Ellucian business activities. If Ellucian learns that a recipient is using or disclosing Personal Data in a manner contrary to this Privacy Notice, Ellucian will take steps to prevent such use or disclosure.

Ellucian also may disclose Personal Data as required by law, for example, in response to a court order, an administrative proceeding or subpoena. Ellucian will, as soon as practical, inform the customer when permitted by law, so the customer may take such actions as it deems necessary to protect the rights of Customer Data Subjects.

You can find a list of the third parties Ellucian works with to deliver its products and services here.

Data Integrity

Ellucian’s customers are responsible for ensuring that they collect only that Personal Data needed to accomplish the purposes disclosed to Customer Data Subjects. They also are responsible for providing Ellucian with instructions for the processing of Personal Data consistent with the purposes stated in the customers’ notice to Customer Data Subjects. Ellucian will process Personal Data only in accordance with the customer’s instructions.

Ellucian will retain Personal Data as necessary to fulfill the purposes described in this Privacy Notice or in our customer agreements. Ellucian will return or destroy Personal Data stored by Ellucian in accordance with applicable law.

Access to and Correction of Personal Data

Customers have the right to access and review, correct or amend and, in certain circumstances, delete their Personal Data that Ellucian holds by contacting Ellucian. Customers are responsible for providing Ellucian with accurate and complete Personal Data, and for contacting Ellucian if correction of such information is required. Ellucian will cooperate with its customers’ reasonable requests for assistance in permitting Customer Data Subjects to exercise their rights under applicable data protection laws to amend or delete their Personal Data. Please note that, where permitted, we may charge a fee for fulfilling access requests and that we reserve the right to disallow unreasonable requests for access. If a Customer Data Subject’s Personal Data was provided to us by an Ellucian customer, we may facilitate access to such data by directing the Customer Data Subject to the customer that provided the Personal Data to us.

How Ellucian Uses Customer Personal Data

Ellucian uses Customer Personal Data submitted to us for general business purposes, including:

To deliver or provide products and services ordered by customers, including administering the delivery of electronic products and services requiring logins and passwords, confirming compliance with licensing terms, and responding to technical queries
To perform accounting and export compliance functions
To notify customers of new products and services from Ellucian and our business partners and for other general marketing purposes, such as advertising Ellucian’s customer events and engaging with customers via online communities and social media
For our business purposes, such as data analysis, audits, fraud monitoring and prevention, developing new products, services and offerings, enhancing, improving or modifying our products and services, and operating and expanding our business activities and
To comply with legal requirements.

Ellucian uses analytics functionality in certain of its software products. The information received from these analytics tools is used to improve our products and services. You can consent to, and revoke your consent, to the collection of such information for the purposes set forth in this paragraph by accessing the consent form in the settings of the Ellucian software product and turn-off or turn-on consent at any time.

California Residents

This section of the Privacy Notice applies to California residents who are “Consumers” as defined in the California Consumer Privacy Act or “CCPA”.

Ellucian does not knowingly collect personal information from California Consumers under the age of 16.

California Consumers have the right to request the following information:

The categories of personal information Ellucian collects about you;
The categories of sensitive personal information Ellucian collects about you;
The categories of sources from which your personal information is collected;
If Ellucian sells or shares your sensitive personal data;
Limit the use of your sensitive personal data;
The business purpose(s) for collecting your personal information;
The categories of third parties with whom Ellucian shares your personal information; and
The specific pieces of personal information Ellucian has collected about you.

California Consumers may also have the right to request that Ellucian delete certain personal information.

California Consumers may exercise these rights by emailing [email protected] or calling 1-800-984-2198. Ellucian will verify your request using information you provide, which may include your email address. We may need to see government identification in order to validate your request. California Consumers may also designate an authorized agent to exercise these rights on their behalf. Ellucian will not discriminate against California Consumers who exercise these rights.

Please see the other sections of this Privacy Notice which have additional information about:

The categories of personal information Ellucian collects;
The categories of sources from which your personal information is collected;
The categories of third parties with whom Ellucian shares personal information; and
The business purpose for collecting your personal information.

Ellucian does not sell personal information for money, but we may share personal information with third parties who have provided other consideration. For example, sponsors and exhibitors at certain Ellucian events may receive Personal Data about attendees. This sharing may be considered a “sale” under the CCPA. California Consumers who would like to opt out of this kind of sharing can do so here.

People in the European Economic Area (“EEA”), United Kingdom ("UK") or Switzerland

Ellucian collects Personal Data from individuals in the EEA, UK or Switzerland (collectively, “EEA, UK or Swiss Data”) (i) from individuals who visit our Site, and (ii) from our customers, vendors, contractors and agents, including the following specific types of information:

Contact information, including name, address, email address and phone number
Student records provided by Ellucian’s higher education customers
Professional and employment information
Financial information
Identification information, including driver’s license and passport numbers
Information regarding use of Ellucian's Site or products and services as described in this Privacy Notice

Information on how Ellucian uses cookies on our Site is available in our Cookie Declaration and in the pop-up window you may have seen when you first visited our Site. You can make changes to your cookie preferences within the pop-up window or by visiting the Cookie Declaration.

Ellucian recognizes that the EEA, UK and Switzerland have established strict protections regarding the handling of EEA, UK or Swiss Data, including requirements to provide adequate protection for EEA, UK or Swiss Data transferred outside of the EEA, UK and Switzerland.

Ellucian’s Site is maintained in the United States. By visiting Ellucian’s Site or using Ellucian’s products and services, you acknowledge that your EEA, UK or Swiss Data may be transferred to, processed and retained in the United States and other destinations outside the EEA, UK and Switzerland. You explicitly consent and agree to such transfer, processing and retention of your EEA, UK or Swiss Data outside the EEA, UK and Switzerland. You understand that personal data stored in the United States may be subject to lawful requests by the courts or law enforcement authorities in the United States. The United States may not have data protection laws that are as comprehensive or protective as those in your country of residence; however, our collection, storage and use of your EEA, UK or Swiss Data will at all times be in accordance with this Privacy Notice. In appropriate cases, Ellucian will enter into standard contractual clauses as approved by the European Commission or other authorized body for the transfer of personal data from the EEA, UK or Switzerland to the United States or another third country.

Ellucian will only process EEA, UK or Swiss Data in ways that are compatible with the purpose for which Ellucian collected the EEA, UK or Swiss Data, or for purposes that the individual or entity providing the EEA, UK or Swiss Data later authorizes. Before we use your EEA, UK or Swiss Data for a purpose that is materially different than the purpose for which it was collected or that you later authorized, we will provide you with the opportunity to opt out. Ellucian maintains reasonable procedures to help ensure that EEA, UK or Swiss Data is reliable for its intended use, accurate, complete, and current.

We may collect, or our customers may provide to us when using Ellucian services, certain EEA, UK or Swiss Data that is regarded as “sensitive,” including data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, ideological views or activities, trade-union membership, administrative or criminal proceedings/sanctions, information on social security measures, or data concerning health or sex life. When we directly collect sensitive EEA, UK or Swiss Data, we will obtain opt-in consent where required, including if we disclose sensitive EEA, UK or Swiss Data to third-parties, or before we use sensitive EEA, UK or Swiss Data for a different purpose than we collected it for or than the data subject later authorized.

EU Binding Corporate Rules

Binding Corporate Rules are a legally binding set of internal rules, recognized by the European Union (“EU”) Data Protection Authorities (“DPAs”), to ensure a consistent approach to privacy and data protection across Group Companies with the same parent, including those located outside of the EU.

Ellucian has adopted Binding Corporate Rules as a Data Processor (“BCR-P”) where it processes Customer Personal Data of Data Subjects in the EEA. The Ellucian BCR-P can be found EU Binding Corporate Rules – Processor.pdf.

EU Binding Corporate Rules as a Data Processor (“BCR-P”) translated versions:
EU Binding Corporate Rules – Processor.pdf (Dutch Netherlands)
EU Binding Corporate Rules – Processor.pdf (French)
EU Binding Corporate Rules – Processor.pdf (Norwegian)

Where Ellucian processes Personal Data of EEA job applicants, employees, website visitors and personnel and staff of our customers, partners, vendors, third-party suppliers and contractors for Ellucian’s own purposes (as opposed to on behalf of our customers), Ellucian has adopted Binding Corporate Rules as a Data Controller (“BCR-C”). The Ellucian BCR-C can be found EU Binding Corporate Rules – Controller.pdf.

If any provision of this Privacy Notice conflict with the provisions of the BCRs, the applicable provision of the BCRs shall supersede any conflicting provision in this Privacy Notice.

These BCRs are effective as of 16 June 2023.

Access Rights

You may have the right to access the EEA, UK or Swiss Data that we hold about you and to request that we correct, amend, or delete it if it is inaccurate. These access rights may not apply in some cases, including where providing access is unreasonably burdensome or expensive under the circumstances or where it would violate the rights of someone other than the individual requesting access. If you would like to request access to, correction, amendment, or deletion of your EEA, UK or Swiss Data, you can submit a written request to the contact information provided under General Terms above. We may request specific information from you to confirm your identity. In some circumstances we may charge a reasonable fee for access to your information. If your EEA, UK or Swiss Data was provided to us by an Ellucian customer, we may facilitate your access to such data by directing you to the customer that provided your Personal Data to us.

Security

Ellucian maintains reasonable and appropriate security measures to protect EEA, UK or Swiss Data from loss, misuse, unauthorized access, disclosure, alteration, or destruction.

Data Retention

Ellucian will retain Personal Data as necessary to fulfill the purposes described in this Privacy Notice or in our customer agreements. Ellucian maintains a Records Management Policy and a Records Retention Schedule. Personal Data is retained in accordance with the Records Retention Schedule. Personal Data is securely deleted or destroyed in accordance with Ellucian’s Records Management Policy or is otherwise de-identified or anonymized at the end of the retention period.

Data Transfers to Third-Parties

Third-Party Agents or Service Providers. We may transfer EEA, UK or Swiss Data to our third-party agents or service providers that perform functions on our behalf. Where required by applicable law, we enter into written agreements with those third-party agents and service providers requiring them to protected EEA, UK or Swiss Data and limiting their use of the data to the specified services provided on our behalf. We take reasonable and appropriate steps (i) to ensure that third-party agents and service providers process EEA, UK or Swiss Data in accordance with our agreements and (ii) to stop and remediate any unauthorized processing. Under certain circumstances, we may remain liable for the acts of our third-party agents or service providers that perform services on our behalf for their handling of EEA, UK or Swiss Data that we transfer to them.

Third-Party Data Controllers. In some cases, we may transfer EEA, UK or Swiss Data to unaffiliated third-party data controllers. These third-parties do not act as agents or service providers and are not performing functions on our behalf. We may transfer your EEA, UK or Swiss Data to third-party data controllers for the following purposes:

Sponsors and exhibitors at certain Ellucian events receive EEA, UK or Swiss Data about attendees, which the sponsors and exhibitors may use for their own promotional purposes.
To facilitate provision of services to Ellucian customers, Ellucian may provide EEA, UK or Swiss Data to third-party software and services companies whose products interact with Ellucian products and services in certain instances where an Ellucian customer is also a client of such third-party.

We enter into written contracts with any unaffiliated third-party data controllers requiring them to protect EEA, UK or Swiss Data. We also limit their use of your EEA, UK or Swiss Data so that it is consistent with any consent you have provided and with the notices you have received. If we transfer your EEA, UK or Swiss Data to one of our affiliated entities within our corporate group, we will take steps to ensure that your EEA, UK or Swiss Data is transferred in accordance with applicable law.

Enforcement

Ellucian conducts periodic reviews of its relevant practices to verify adherence to this Privacy Notice. Any data subject in the EEA, UK or Switzerland with a complaint concerning Ellucian’s processing of Personal Data may contact Ellucian’s data protection officer at [email protected].

Questions or Complaints

You can direct any questions or complaints about the use or disclosure of your EEA, UK or Swiss Data to us as noted above (Contact Us). We will investigate and attempt to resolve any complaints or disputes. If you are located in the EEA, UK or Switzerland you may contact your local data protection authority in respect of any complaints you may have.