Effective Date: January 1, 2020
Last Revised: January 1, 2020

Applicability of this Privacy Notice

This Privacy Notice for California Residents (this “California Privacy Notice”) is provided by Keypath Education, LLC (who we refer to, together with our affiliates, as “Keypath,” “us,” “we,” or “our,” depending on the context). It applies to information we collect through the sites that link to this California Privacy Notice (referred to collectively as the “Site”), as well as through any other contact you have with Keypath through or on behalf of St. Bonaventure University (our “Partner School”) in connection with the educational programs they offer with our assistance (referred to generally as a “Program” or the “Programs”).

This California Privacy Notice applies only to California residents (who are referred to as “you” or as “consumers” in this California Privacy Notice), and it supplements the information contained in our general Privacy Notice.

This California Privacy Notice has been adopted to address the requirements of the California Consumer Privacy Act of 2019, referred to as the CCPA, and any terms defined in the CCPA will have the same meaning when used in this California Privacy Notice.

The Personal Information We Collect and How We Use It

We collect personal information as defined in the CCPA, which generally means any information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device. Please note that personal information does not include the following:

• Publicly available information that we access from government records;
• Deidentified or aggregated consumer information; and
• Other information that is expressly excluded from the CCPA’s scope such as personal information covered by certain sector-specific privacy laws, such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, or the Driver’s Privacy Protection Act of 1994.

The table below describes the categories of personal information we collect, the categories of sources of that information, and our business or commercial purpose for collecting the information, all with respect to the last 12 months.

Category of Personal Information	Do We Collect Information in This Category (Yes or No)?	If Yes, What Type of Information In This Category Do We Collect?	If Yes, Where Do We Obtain This Information?	If Yes, What is Our Business Purpose or Commercial Purpose For Collecting It?
Identifiers	Yes	Real name, postal address, online identifier, IP address, email address, Social Security number, driver’s license number, student ID	Directly from the consumer and from lead generation services	We collect this information as necessary for us to do business with you (for example, as necessary to verify your identity). We also collect this information so that we can operate our business and provide services to you and to others, as described below.
Personal information categories listed in the California Consumer Records statute (Cal. Civ. Code §1798.80(e))	Yes	Name, Social Security number, address, telephone number, driver’s license number, education, employment, employment history, financial aid status, estimated household income, financial information, medical information, or health insurance information, languages/first language	Directly from the consumer and from third party marketing demographic data providers	We collect this information as necessary for us to do business with you (for example, as necessary to verify your identity). We also collect this information so that we can operate our business and provide services to you and to others, as described below.
Protected classification characteristics under California or federal law	Yes	Age (40 years or older), marital status, gender, veteran or military status, citizenship, race	Directly from the consumer and from third party marketing demographic data providers	We collect this information so that we can operate our business and provide services to you and to others, as described below.
Commercial information	No	N/A	N/A	N/A
Biometric information	No	N/A	N/A	N/A
Internet or other similar network activity	Yes	IP address, inquiry source provider and details, cookies, preferences, etc.	Directly from the consumer’s browser, including through the use of cookies, web beacons, and other tracking technology, and (subject to device settings) through communications from the device’s mobile provider	We collect this information so that we can operate our business and provide services to you and to others, as described below.
Geolocation data	Yes	Geo-location data	Directly from the consumer’s browser, and (subject to device settings) through communications from the device’s mobile provider	We collect this information so that we can operate our business and provide services to you and to others, as described below.
Sensory data	No	N/A	N/A	N/A
Professional or employment-related information	Yes	Employer and employment status	Directly from the consumer	We collect this information so that we can operate our business and provide services to you and to others, as described below.
Non-public education information (per the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g, 34 C.F.R. Part 99)	Yes	Education level, degrees held, prior schools attended, reason for study, prior qualifications and assessments, risk factors (academic, financial, personal, technical), transcripts, and applicant/application information	Directly from the consumer	We collect this information so that we can operate our business and provide services to you and to others, as described below.
Inferences drawn from other personal information	Yes	Responsiveness to outreach efforts, interest in Programs	Directly from the consumer, from lead generation services, and from third party demographic data providers	We collect this information so that we can operate our business and provide services to you and to others, as described below.

Where we say above that we collect information so that we can operate our business and provide services to you and to others, we mean that we use the information for one or more of the following purposes:

• To provide resources and expertise to our Partner School.
• To create, maintain, customize, and secure our students’ online enrollment with our Partner School.
• To provide, support, personalize, and develop our services.
• To launch, maintain, and improve Programs.
• To contact prospective, current, and former students regarding Programs.
• To research, design, and develop Programs and course offerings.
• To market Programs and courses.
• To recruit, support, retain, and place students.
• To assess the effectiveness of our outreach and marketing efforts.

In addition to the business and commercial purposes of collection of personal information described above, we may use any of the personal information we collect for the following purposes:

• To prevent transaction or user fraud, and to help maintain the safety, security, and integrity of the Site and our and our Partner School’s business.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets in which personal information held by use about our Site users is among the assets transferred.
• As otherwise described to you when collecting your personal information.

We will not use the personal information we have collected for any materially different, unrelated, or incompatible purposes not disclosed in this California Privacy Notice without providing you notice and, if required by the CCPA, the opportunity to consent to such use.

How and Why We Share Personal Information

Disclosures of Personal Information for a Business Purpose

With respect to the personal information we have collected, in the past 12 months we have shared information in the following categories (which are listed by reference to the categories identified above) with third parties, in each case for a business or commercial purpose:

• Category 1 – Identifiers
• Category 2 – Personal information categories listed in the California Consumer Records statute (Cal. Civ. Code §1798.80(e))
• Category 3 – Protected classification characteristics under California or Federal law
• Category 6 – Internet or other similar network activity
• Category 7 – Geolocation data
• Category 9 – Professional or employment-related information
• Category 10 – Non-public education information (per the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g, 34 C.F.R. Part 99
• Category 11 – Inferences drawn from other personal information

The categories of third parties with whom we share this information (other than our contracted service providers as described below) are our Partner School, your employer (if your employer is paying for your enrollment in a Program), our business partners, and our corporate affiliates in the Keypath Group of companies.

In addition to the above, we also share personal information in the categories identified above with our service providers, such as companies who handle our data management and/or email distribution, parties who provide us with data enrichment services, our website and infrastructure hosting providers and our managed information technology support service provider, and also to third parties to whom you authorize us to disclose your personal information in connection with our services.

Other Disclosures of Personal Information

In addition, you should be aware that we may share information with third parties in the following circumstances:

• We will share personal information with third parties for other purposes if we have your express “opt-in” consent to do so.
• We may disclose non-personal, aggregate, anonymous data in a de-identified format for any legitimate business purpose.
• We may disclose personal information at the request of law enforcement or government agencies or in response to subpoenas, court orders, or other legal process to establish, protect, or exercise our legal or other rights or to defend against a legal claim, or as otherwise required or allowed by law.
• We may disclose personal information if we believe that such action is appropriate to (a) protect the rights, property, or safety of a user of the Site or any other person, (b) investigate or prevent a violation by you of any contractual or other relationship with us or our Partner School, (c) investigate or prevent your actual or potential illegal, fraudulent, or harmful activity, or (d) detect, prevent, or otherwise address fraud, security, or technical issues.
• We may share information, including personal information, in connection with, during negotiations of, or as a part of the closing of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Sales of Personal Information

In the preceding 12 months, we have not sold personal information to third parties.

California Consumers' Rights and Choices

The CCPA provides California residents with specific rights regarding their personal information. If you are a California resident, this section describes your CCPA rights, and explains how to exercise them.

Rights to Access Certain Information

You have the right to ask up to provide you with information about our collection and use of your personal information over the past 12 months. You may request the following information:

1. The categories of personal information we collect about you;
2. The categories of sources of personal information we collect about you;
3. Our business or commercial purpose for collecting or selling that personal information’
4. The categories of third parties with whom we share that personal information;
5. The specific pieces of personal information we collected about you (also called a “data portability right”); and
6. If we disclosed your personal information for a business purpose, or if we sold your personal information, two separate lists describing:
   • Disclosures for a business purpose, identifying the categories of personal information that each category of recipient obtained; and
   • Sales identifying the categories of personal information that each category of recipient purchased.

Rights to Request Deletion of Certain Information

You have the right to ask us to delete any of your personal information that we collected from you and have retained. However, there are certain exceptions to our obligation to delete the information, which we describe below.

We may deny your deletion request if we or our service providers need to keep the information to:

• Complete the transaction for which we collected the personal information, provide you with a product or service you have requested, take other actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract with you;
• Detect security incidents, protect against illegal or fraudulent behavior, or engage in legal actions with persons responsible for such activities;
• Debug products to identify and repair errors impacting the functionality of our Site or services;
• Exercise free speech or ensure other consumers’ rights to free speech, or otherwise exercise rights provided by law;
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code §1546)
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
• Comply with a legal obligation; or
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

How to Submit a Verifiable Consumer Request and Exercise Your Rights

To exercise any of the rights described above, you must submit a verifiable consumer request to us by either:

• Calling us at 1-844-348-5248;
• Visiting us at www.keypathedu.com and submitting a request through our Contact Us feature; or
• Emailing us at CST@keypathedu.com.

Only you, or a person registered with the California Secretary of State that you expressly authorize to act on your behalf, can make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within any 12-month period. The verifiable consumer request must:

- Provide sufficient information that allows us to reasonably verify that you are the person about whom we requested personal information, or are an authorized representative of that person, which may include (by way of example, but not limited to) verification of your current address, Student ID, date of birth, email address, or telephone number; and

- Describe your request with sufficient detail that enables us to understand, evaluate, and respond to it.
We cannot respond to your request or provide you with information if we cannot identify you or confirm your authority to make the request.

We will only use any personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

How and When We Will Respond to Verifiable Consumer Requests

We will confirm receipt of a verifiable consumer request within 10 days, and with that confirmation, we will include a description of our verification process and will provide an expected response timeframe. Generally, we will respond to each verifiable consumer request within 45 days of receipt. If we require more time, subject to the limitations imposed by the CCPA, we will inform you of the reason and extension period in writing.

We will deliver our written response by mail or electronically using the contact information you have provided.

Any disclosure we provide in response will only cover the 12-month period preceding our receipt of the request. If we cannot comply with your request, we will explain why. If you request that we provide you with a copy of your data, we will select a format in which to provide your personal information that is readily usable, and should allow you to transmit the information from one entity to another without undue difficulty.

We do not generally charge a fee to process or respond to requests, unless the request is excessive, repetitive, or manifestly unfounded. If we determine that a fee is warranted by the circumstances, we will tell you why, and will provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. This means that unless we are permitted to do so by the CCPA, we will not:

1. Deny you any goods or services;
2. Charge you different prices or rates for goods or services, including by granting discounts or other benefits, or imposing penalties;
3. Provide you with a different level or quality of goods or services; or
4. Suggest that you may receive a different price or rate for goods or services, or a different level or quality of goods or services.

Other California Privacy Rights

In addition to the CCPA, California’s “Shine the Light” law permits California residents to request certain details about our disclosure of their personal information to third parties for those third parties’ own direct marketing purposes. If are a California resident and you would like to make such a request, please contact us at CST@keypathedu.com. Please note that there are legal limits on how often you can make such a request, and we are only obligated to respond to one information request per customer per year.

In addition, if any California residents under the age of 18 have used the Site, created an account (if applicable), and posted content or information on the Site, they can request removal by contacting us at CST@keypathedu.com, detailing where the content is posted and confirming that they posted it. Following such as request, we will terminate any unauthorized account, and will make reasonable good faith efforts to remove the post from public view, or anonymize it so that the minor cannot be individually identified. However, as noted above in this privacy policy, removal of public postings cannot ensure complete or comprehensive removal, as third parties may republish, archive, or cache web content in a manner that is out of our control.

Changes to this California Privacy Notice

Because of changes in Internet technology and practices, this California Privacy Notice may change from time to time. We will post any changes we make to this California Privacy Notice on this page, and any changes will be effective once the new notice is posted. It is your responsibility to check this for updates. You can determine when this California Privacy Notice was last updated by referring to the “Last Modified” legend at the top. By using the Site after we post any changes to this California Privacy Notice, you agree to accept those changes, whether or not you have reviewed them.

How to Contact Us with Questions

If you have any questions or comments about this California Privacy Notice, please do not hesitate to contact us as provided below:

• By phone, at 1-844-348-5248
• Through our website, at www.keypathedu.com
• By email, at CST@keypathedu.com