Privacy Policy

Effective Date: September 1, 2026

Introduction
Scope
Educational Records and Student Privacy
What Information We Collect
Use of Cookies and Other Tracking Technologies
Why We Collect Information
When We Disclose Information
Children’s Privacy
Automated Decision Making
Retention of Personal Information
Links
Security
Your Choices About the Information We Collect
Visitors to the Site Outside of the United States
California Privacy Rights
Your Privacy Rights under Other US State Laws
Your Rights Under the General Data Protection Regulation
Your Rights Under the UK GDPR
Your Canadian Privacy Rights
Changes to This Privacy Policy
Contact Us

1. Introduction

Welcome. You have arrived at a website provided by Erikson Institute (“Erikson Institute,” “Erikson,” “we,” “our” or “us”). Erikson Institute is an institution of higher education dedicated to advancing the development, education, and well-being of young children, families, and communities through academic programs, professional learning, research, policy, advocacy, and related services. This website provides information about Erikson’s programs, services, admissions, financial aid, research, events, philanthropy, employment opportunities, institutional policies, and other activities. Visitors may use this website to request information, apply for programs, register for offerings or events, submit forms, make inquiries, make donations, or otherwise interact with Erikson.

Certain Erikson programs, services, portals, research activities, student records, clinical or community services, employment processes, or donor activities may be subject to additional notices, consents, policies, or legal requirements. Where another notice or policy applies to a specific interaction with Erikson, that notice or policy should be read together with this Privacy Policy.

At Erikson, we take your privacy seriously. We provide this Privacy Policy (“Policy”) to tell you what information we collect about you, how we obtain it, how we share it, and how you may limit the ways in which we use your Personal Information. If you have questions about this Policy after you review it, feel free to contact us at [email protected].

2. Scope

This Policy governs Erikson’s website(s), their subdomains, and all subdomains, online forms, portals, or other online services that link to this Policy (“Site”); as well as to Personal Information that Erikson collects when you interact with us online, in person, via by phone, by email, through events, online merchandise shop, through applications or registrations, through professional learning offerings, through donations, through employment-related processes, or other communications with our representatives or in any other instance when you contact us.

For the purpose of this Privacy Policy, “Personal Information” (sometimes referred to as “Personal Data”) means any Personal Information relating to an identified or identifiable individual that is protected by applicable privacy laws. This also includes information that relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an identified or identifiable individual, as defined by applicable privacy laws. The definition of Personal Information does not include publicly available information from federal, state, or local government records, such as professional licenses and real estate or property records.

This Privacy Policy applies to Personal Information we collect from website visitors, prospective students, applicants, students, alumni, parents or guardians where applicable, professional learning participants, event registrants, research participants, donors, community-service participants, job applicants, employees, vendors, partners, and other individuals who interact with Erikson.

This Privacy Policy does not replace any separate notice, consent, authorization, institutional policy, student handbook provision, research consent, employment notice, financial-aid disclosure, clinical-services notice, or legally required privacy notice that applies to a specific Erikson program, service, or relationship.

We refer to all the above as our “Services.” Our Services are used by our partners, vendors, donors and institutional contacts (“Partners”), current and potential students, event attendees, and alumni (“Students/Registrants”), website visitors (“Visitors”) and people who shop at our online store (“Purchasers”).

By using our Sites or otherwise using our Services, you acknowledge this Policy and agree to our Terms of Use (“Terms”).

3. Educational Records and Student Privacy

Erikson Institute is an institution of higher education. Certain records that Erikson maintains about students or former students may be “education records” protected by the Family Educational Rights and Privacy Act (“FERPA”) and Erikson’s applicable student-record policies. To the extent Personal Information is maintained as an education record under FERPA, Erikson will use, disclose, retain, and provide access to that information in accordance with FERPA and applicable institutional policies.

This Privacy Policy applies to information collected through Erikson’s websites, portals, forms, communications, events, professional learning offerings, admissions, philanthropy, employment, research, community services, and related activities. This Privacy Policy does not replace any FERPA notice, student handbook provision, financial-aid disclosure, research consent, clinical-services notice, employment notice, or other privacy notice that applies to a specific Erikson program or service. Where FERPA applies, Erikson will use and disclose education records in accordance with FERPA, including disclosures to school officials with legitimate educational interests and other disclosures permitted or required by law.

Certain Erikson clinical, counseling, health-related, or community-service programs may be subject to separate privacy notices, consent forms, authorizations, or legal requirements. Those notices apply to the specific services identified in them and should be read together with this Privacy Policy where applicable.

4. What Information We Collect

As a rule, we limit the Personal Information we collect to that which is reasonably necessary for us to provide our Services to you.

Data Sources

We collect Personal Information from the following sources:

You directly
Automatically from your Device/Browser, and via Cookies/Tracking Technologies
Third Parties (including Service Providers)

Information That You Provide to Us

As you interact with our Site or Services, we collect the following Personal Information via webforms or inputs/uploads on our Site, and through telephone calls, text messages, letters, emails and other communications with you. The types of information we collect from you may differ depending on your relationship with the Erikson and/or the Site.

Visitors and General Inquiries

Contact information such as your first and last name, email address, job title, home or business address, telephone numbers, mobile numbers.

Partners

Contact information such as your first and last name, job title, email address, business address, shipping address, telephone numbers, mobile numbers;
For donors, financial information such as financial card/credit card number, bank account information, and your payment, service and purchase/donation history (payment-card information may be processed by third-party payment processors or commerce platforms, and Erikson may receive limited transaction information such as payment status, amount, date, donor or purchaser information, order information, and related records).

Students/Registrants

Depending on your interaction with Erikson, we may collect the following information:

Contact information such as your first and last name, email address, job title, home or business address, telephone numbers, mobile numbers.
Application information, including admissions materials, academic or enrollment information, financial-aid or billing information, event or program registration information, professional background information, donation information, research-related information;
Identifiers such as a driver’s license number or passport number; demographic information; veterans’ status or disability information;
Other information, such as dates of attendance and graduation year, if applicable;
Transaction-related information for payments, such as financial card/credit card number, bank account information, and your payment, service and purchase/donation history (payment-card information may be processed by third-party payment processors or commerce platforms, and Erikson may receive limited transaction information such as payment status, amount, date, donor or purchaser information, order information, and related records);
Social media handles, content and other data shared with us through third-party features that you use on our Site or Services (such as tools, payment services, widgets and plug-ins offered by social media services like Facebook, Instagram, or LinkedIn) or posted on social media pages (such as our social media page or other pages accessible to us); and

Purchasers

If you visit or purchase merchandise from Erikson’s online shop, we or the third-party commerce platform supporting the shop may collect information such as your name, email address, shipping address, billing and payment-related information, order history, merchandise preferences, communications, and information needed to process, fulfill, ship, support, or administer your transaction.

Contact information such as your first and last name, job title, email address, business address, shipping address, telephone numbers, mobile numbers; and
Financial information such as financial card/credit card number, bank account information, and your payment, service and purchase/donation history (payment-card information may be processed by third-party payment processors or commerce platforms, and Erikson may receive limited transaction information such as payment status, amount, date, donor or purchaser information, order information, and related records).

All Users

Other information that reasonably could be used to identify you personally.

Your decision to provide us with information is voluntary, but if you choose not to provide requested information, you may not be able to take advantage of all of the Site’s features or our Services.

Website Forms and Departmental Requests

Erikson may collect Personal Information through online forms, inquiry forms, application forms, event-registration forms, professional learning forms, donation forms, financial-aid forms, contact forms, and other web-based submissions. The information requested may vary depending on the department, program, or service associated with the form. Erikson uses form submissions for the purpose identified on or near the form, to respond to requests, administer programs and services, route inquiries to the appropriate department, maintain records, and support institutional operations. Additional terms or disclosures may apply.

Information That Is Automatically Collected

Like many businesses, we and our service providers automatically collect and/or store certain information when you visit or interact with the Site or Services (“Usage Information”), including via cookies and other tracking technologies (see “Use of Cookies and Other Tracking Technologies” section below). This Usage Information may be stored and/or accessed from your personal computer, laptop, tablet, mobile phone or other device (a “Device”) whenever you visit or interact with our Site. Usage Information includes:

Your IP address, MAC address, IDFA, Android/Google Advertising ID, IMEI, or another unique identifier;
Your Device functionality (including browser, browser language, settings and behavior, operating system, hardware, mobile network information);
Your Device location or other location information, including the zip code, state or country from which you accessed the Services;
Your Device characteristics (such as device type (computer vs. mobile) and ID, operating system, hardware);
Cookies, tags, pixels and SDKs (see our Use of Cookies and Other Tracking Technologies section below);
Name and user identification or profile values of other third-party platforms or social media sites;
Referring and exit web pages and URLs;
The areas within the Site that you visit and your activities there, including remembering you and your preferences;
Certain other Device data, including the time of day you visit our Site or other information used to provide analytics or other usage information;
Information about your engagement with our emails; and
Statistical information about how unregistered and registered users, collectively, use the Site and Services.

For location information, some of our Services include features based on users’ actual locations and may report on users’ current locations (“Location-Based Services”). If you have enabled location services on the Device on which you access our Site, we and our service providers may collect and store information about your location at the time you use those Location-Based Services (in addition to some automatically collected geolocation data). This information comes from a variety of sources depending on the device you use to access the Services; for example, a mobile phone may report its GPS location at the time Location-Based Services are used.

If you do not wish for us or our service providers to collect and use location information, you may disable the location features on your device. Consult your device settings for instructions. Please note that if you disable such features, your ability to access certain features, Services, content, or information may be limited or disabled.

Where permitted by law, Erikson may collect limited audiovisual or security-related information at its premises or events for safety, security, incident response, and facilities-management purposes. Posted notices will be provided when required by law.

Information Collected from Third Parties

The Site includes functionality that allows certain kinds of interactions between the Site and your account on a third-party website or application. The use of this functionality may involve the third-party site providing information to us. For example, Erikson may operate an online shop or merchandise store through a third-party commerce platform. If you purchase merchandise or otherwise interact with the online shop, the third-party commerce platform may collect and process information such as your name, contact information, shipping information, billing and payment-related information, order details, communications, and other information needed to process, fulfill, ship, support, or administer your transaction. The third-party platform may process certain information under its own privacy policy and terms, and Erikson may receive information from the platform as needed to manage the shop, fulfill orders, respond to inquiries, maintain records, and support related operations. We encourage you to review the privacy policy and terms of any third-party platform you use in connection with Erikson’s online shop.

Similarly, we might obtain information about the traffic and usage of Erikson from third parties. We might also provide links to make it easier to send a communication from the Site, or we may use third parties to make it easier to send emails or post to social media (like a “Share” or “Forward” button). These third parties also use cookies and other tracking technologies to capture information about your interactions with Erikson.

Erikson does not have control over the information that is collected, used, and shared by these third parties. We encourage you to review the privacy statements of these third parties to understand their privacy practices.

Affiliation with Candid (GuideStar)

Erikson maintains an affiliation with Candid, a nonprofit organization that operates GuideStar (collectively “Candid”). Candid is an independent third party; it is not affiliated with, endorsed by, or operated by Erikson. Our affiliation with Candid may include referral and affiliate links, facilitation of charitable donations, and licensed use of Candid’s nonprofit data. Where Erikson facilitates charitable donations through Candid’s platform or tools, Candid’s Privacy Policy will apply and additional information will be provided. In connection with our affiliation with Candid, Erikson and Candid may use cookies, pixels, tracking links, or similar technologies to collect and share information about your interactions with our website, as detailed in our Use of Cookies and Other Tracking Technologies section below. Our affiliation with Candid and the presence of GuideStar data, referral links, or Candid-powered donation tools on our website does not constitute an endorsement by Erikson of any Candid product or service.

5. Use of Cookies and Other Tracking Technologies

We use cookies and other tools (“Tracking Technologies”) to recognize your browser or device, to understand how people use our Site, to make it work correctly, and to improve your experience. These Tracking Technologies store and collect Usage Information. Tracking Technologies may set, change, alter or modify settings or configurations on your Device. By using this Site, you consent to our use of Tracking Technologies – where required by law, we will collect your affirmative consent before using these Tracking Technologies. In jurisdictions that require prior consent, we only set non-essential cookies after you grant permission.

Erikson uses a cookie-consent management tool to help provide choices about non-essential cookies and similar tracking technologies. Where required by law, Erikson will not use non-essential analytics, advertising, or tracking cookies unless you have provided consent. You may adjust your cookie preferences through the cookie banner or cookie preference tool available on the Site.

What are Cookies?

Cookies are small files that your browser stores on your Device. They help the website remember things like your preferences or whether you’ve logged in. Some cookies are placed by us (“first-party cookies”) and some are placed by our partners (“third-party cookies”) such as companies that provide analytics, video, or advertising. Third-party cookies we use may include Google (AdSense, Analytics, DoubleClick, YouTube), Meta, Microsoft (Bing), Vimeo, GuideStar or others.

Do Cookies Contain Personal Information?

Cookies and similar technologies do not always directly identify you, but many laws treat them as “Personal Information” or “Personal Data” when the information collected, alone or combined with other data, can be linked to you or your Device. For example, if you log in to an account, we may associate cookie data with your account

Other Technologies We Use

In addition to cookies, we may use other Tracking Technologies, including:

HTML5 local or session storage: browser-based storage used to remember certain settings or behaviors;
Pixel tags, clear GIFs and web beacons: small images or snippets of code that load when you visit a page or open an email, telling us or partners that you have engaged with content;
Tags, scripts and containers (e.g., tag managers): snippets of code provided by analytics or marketing vendors to measure behavior or deliver functionality, or tools used to deploy and manage other tags (like Google Tag Manager);
Software Development Kits (SDKs): a set of tools or code provided by a third party that developers add into an app or website to enable certain features, such analytics, advertising, or login, and that may also collect information from users’ Devices.
Embedded Scripts: snippets of code that are designed to collect information about your interactions with the Site, such as the links you click on;
Click Identifiers and URL parameters: short tags added to the end of a URL that help track where website traffic comes from, including UTM parameters, such as which email, ad, or social media post a visitor clicked before landing on a page.
Device Identifiers and probabilistic identifiers: Identifiers unique to your Device (e.g., mobile advertising IDs), or technology that creates an identifier by analyzing characteristics of your Device or browser.
Server-Side Tracking and APIs: technologies that transmit interaction or event data directly from our servers to analytics, advertising or measurement partners (like conversion APIs or server-side tag management);
Analytics and Session Replay Technologies: tools that help us understand how users interact with our Services, which may record page views, clicks, scrolling, or other usage activity for analytics and service improvement purposes;
Social Media Plugins and Embedded Controls: Features such as “Like” or “Share” buttons, embedded videos, or other third-party content that may collect information when you interact with our Services;
Log Files and Network-Level Data Collection: Automatic collection of technical information when you access our Services, including IP Address, browser type, device type, operating system, referring URLs, and timestamps; and
Other data technologies may be used that collect comparable information for security and fraud detection purposes.

We may also engage third parties, such as Google Analytics or Meta, to track and analyze non-personally and personally identifiable website data and to serve advertisements. To do so, we may permit third parties to place cookies on devices of users of our Sites, where permitted by law, and subject to your right to opt out through the Sites. We use the data collected to help us administer and improve the quality of the Sites and to analyze the Site’s usage. Such third parties may combine the information that we provide about you with other information that they have collected. These third parties are required to use your information in accordance with this Privacy Policy. We will record all such disclosures and will use reasonable efforts to ensure that such third parties do not use your Personal Information for any purpose that is not expressly provided for herein.

We classify our cookies into the following categories:

Essential/Strictly Necessary Cookies. These cookies are need for the Site to work (for example, keeping you logged in or letting the Site load properly). You cannot disable this type of cookie on our Site.
Functionality Cookies. Also known as “preference cookies,” these cookies allow the Sites to remember choices you have made in the past, like what language you prefer, or what your username and password are so you can automatically log in. Disabling these cookies can cause some parts of the Site to not work properly, so we discourage you from disabling these cookies.
Performance and Analytics Cookies. These cookies collect information about how you use a website, like which pages you visited and which links you clicked on. Their purpose is to improve website functions. In some jurisdictions, you may be able to turn these cookies off.
Targeting and Advertising Cookies. These are used by us or our partners to deliver more relevant advertising, measure our marketing, or prevent you from seeing the same ad too many times. These cookies can share that information with other organizations or advertisers. In some jurisdictions, you may be able to turn these cookies off.

Depending on your browser settings or your location, you may be able to:

Adjust your cookie preferences through our cookie banner;
Block or delete cookies in your browser;
Opt out of certain analytics or advertising tools; or
Change your Device settings to limit tracking.

If you block some cookies, certain features on our Site may not work as intended.

Advertising Tools We Use

We use Google (AdSense, DoubleClick, YouTube), Meta (Facebook), Microsoft (Bing), Vimeo, GuideStar, and other companies’ tools to help us understand how people use our website and to show ads that may be more relevant to you. These tools may use cookies or other identifiers to measure how effective our ads are, learn what content is useful to visitors, or show ads based on your activity on our Site or other sites. The specific tools used may change over time. Where required by law, we will provide choices or obtain consent before using non-essential cookies or similar technologies.

6. Why We Collect Information

We use the information we collect about you in a variety of ways, including the following:

To Provide Our Services

We process certain Personal Information when you access or use our services, including to:

operate, maintain and improve the Site and its services;
enable you to access and use the Site;
send you notices, updates, security alerts and support and other messages;
provide and deliver the services and features you request, process and complete transactions, and send you related information, including purchase confirmations and invoices;

process your purchases of, or requests for, products and services;
create and verify user accounts;
process, fulfill, ship, support, and administer online shop or merchandise transactions, including orders, payments, shipping, returns, exchanges, customer support, and related communications;
facilitate the functionality of our Site, including payment-related functionality; and
customize experiences and personalization when you are on our Site.

To Communicate with You

We process certain information to communicate with you in relation to your accounts, our services, our marketing, and your requests, including to:

communicate with you about orders, purchases, returns, services, accounts, programs, contests, and sweepstakes;
respond to your customer service inquiries and requests for information;
post your comments or statements on our Site;
send you personalized promotions, content, and special offers;
communicate with you about our brands, products, events, or other promotional purposes;
implement your communications preferences, such as sharing information with our business partners so that they may email you about their promotions, products and initiatives; and provide important product safety information and notice of product recalls.

For Improvement of Our Site or Services

We want to ensure that our Site and Services are continually improving and expanding so that we meet and exceed your needs and expectations. To do so, we may process certain Personal Information, including to:

test, research, analyze, or develop products;
maintain, improve, and analyze our Site or Services; and
detect, prevent, or investigate suspicious activity or fraud.

To Comply with Applicable Laws

We may be required to process certain Personal Information under certain laws and regulations, such as tax laws, as well as to:

maintain appropriate records for internal administrative purposes; and
comply with applicable legal and regulatory obligations, and respond to lawful governmental requests, as needed.

To Enforce our Terms, Agreements, or Policies

To maintain a safe, secure, and trusted environment for you when you use our Site and Services, we use your Personal Information to ensure our terms, policies, and agreements with you and any third parties are enforced.

To Evaluate Your Application for Employment

We use your Personal Information to evaluate your application for employment or administer employment benefits.

With Your Consent

We process certain Personal Information to fulfill any other business or commercial purposes at your direction or with your consent.

7. When We Disclose Information

We do not sell Personal Information for money. However, some disclosures to advertising, analytics, social media, and measurement partners may be considered “sharing” or a “sale” under certain privacy laws, including the CCPA/CPRA, because the relevant laws define those terms broadly. Where required, we provide opt-out rights and cookie choices. To the extent permitted by law, certain Personal Information about you may be disclosed in the following situations:

Service providers. We may disclose Personal Information to our affiliates and to third-party service providers who perform services on our behalf, such as cloud hosting, data storage, payment processing, customer service, analytics, marketing support, communications delivery, IT services, and other operational functions. We require these service providers to enter into written agreements that limit their use of the information to the services they provide to us, prohibit them from using the information for their own purposes, and require them to safeguard the information and keep it confidential. These service providers may access Personal Information only as needed to perform their services.
Marketing and advertising. We may use and share your information with our affiliates, service providers, and trusted marketing partners to send you marketing communications, personalize the content you see, measure advertising performance, and offer products or services that may be of interest to you. We share only the information needed to support these activities, and these partners are required to protect your information and use it only for the purposes we specify. You can opt out of our marketing emails at any time by following the instructions in those messages or contacting us directly. Depending on your location, you may also have the right to opt out of certain types of data sharing used for targeted advertising. Erikson may use Personal Information and Usage Information to send newsletters, provide information about programs or events, measure campaign performance, understand audience engagement, improve outreach, and, where permitted by law and subject to applicable choices or consent requirements, deliver or measure advertising and marketing communications. Where required by law, Erikson will obtain consent before using non-essential cookies or tracking technologies for advertising, retargeting, or cross-site measurement.
Legal process. To comply with law, legal process, or government requests, including responding to a validly issued and enforceable subpoena, court order, summons, search warrant, regulatory inquiry or other legally enforceable demand. We may also disclose information as necessary in connection with actual or threatened legal proceedings or alternative dispute resolution proceedings either initiated by or against us. When we do so, we limit the disclosure to what is reasonably necessary and take steps to seek confidential treatment or other protections to prevent the information from becoming public, unless we are legally prohibited from doing so.
In the course of a review of our practices under the authorization of a state or federal agency, state or national licensing board, or as necessary to properly respond to an inquiry or complaint from such an agency, licensing board, or organization.
Technology, platform, and operational vendors. Erikson may disclose Personal Information to vendors and service providers that support website hosting, cybersecurity, analytics, cookie-consent management, application and enrollment systems, student information systems, learning management systems, payment processing, donation processing, event registration, email communications, marketing, advertising, research administration, data storage, and other institutional operations.
School officials and education-service providers. Erikson may disclose student information to school officials, institutional personnel, and service providers who perform services for Erikson and have a legitimate educational or institutional need to access the information, consistent with FERPA and applicable institutional policies.
Business Transfers and Corporate Transactions. We may use or share your Personal Information in conjunction with a prospective purchase, sale, or merger of all or part of our Erikson. This may include sharing information with potential or actual purchasers, investors, or other transaction partners and their advisors as part of due diligence or the transaction itself. Where appropriate, we will take steps to require those parties to protect the information and use it only for the purposes of evaluating or completing the transaction. If the transaction is completed, Personal Information may be transferred to the buyer or successor or affiliate as part of the transferred assets or ongoing business operations.

Finally, we may aggregate, de-identify, and/or anonymize any information collected through the Site or Services such that such information is no longer linked to your Personal Information. We may use and share this aggregated and anonymized information (non-Personal Information) for any purpose, including without limitation, for research and marketing purposes, and may also share such data with our affiliates and third parties, including advertisers, promotional partners and others.

8. Children’s Privacy

Our Site is not intended for use by children under the age of 18. We do not request, or knowingly collect, any personally identifiable information from children under the age of 18. For COPPA compliance, if you are the parent or guardian of a child under 13 who you believe has provided her or his information to us, please contact us using the information in the Contact Us section below to request the deletion of that information.

Erikson’s educational, research, clinical, community, or family-facing programs may involve information about children, parents, guardians, or families. Information collected in those contexts is handled under the applicable program notice, consent, authorization, institutional policy, or legal requirement. If you believe a child has provided Personal Information to us through the general website without appropriate consent, please contact us using the information in the Contact Us section.

9. Automated Decision Making

We do not use automated decision-making technologies to make decisions that produce legal or similarly significant effects about individuals, such as admissions, enrollment, financial aid, employment, or eligibility decisions, without human involvement or as otherwise permitted by applicable law. We may use automated tools to support security, fraud prevention, website functionality, analytics, communications, or operational processes.

10. Retention of Personal Information

We will retain your Personal Information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your Personal Information to comply with applicable laws), resolve disputes and enforce our legal agreements and policies.

All information you provide to us is stored on our secure servers or those of our third-party data storage providers.

We utilize the following criteria to determine the length of time for which we retain Personal Information:

How long we have had a relationship with you or provided our Services to you;

The business purposes for which the information is used, and the length of time for which the information is required to achieve those purposes;
Whether we are required to retain the information, or the information is otherwise necessary, in order to: comply with legal obligations or contractual commitments: defend against potential legal claims: detect or prevent potential illegal activity or actions in violation of our policies and procedures; secure our systems and online environment; or protect health and safety;
The privacy impact on individuals of ongoing retention; and
The manner in which information is maintained and flows through our systems, and how best to manage the lifecycle of information in light of the volume and complexity of the systems in our infrastructure.

11. Links

For your convenience, the Site and this Policy may contain links to other websites. Erikson is not responsible for the privacy practices, advertising, products, services, or the content of such other websites. None of the links on the Site should be deemed to imply that Erikson endorses or has any affiliation with the links.

12. Security

We incorporate commercially reasonable safeguards to help protect and secure your Personal Information. However, no data transmission over the Internet, mobile networks, wireless transmission, or electronic storage of information can be guaranteed 100% secure. As a result, we cannot guarantee or warrant the security of any information you transmit to or from the Site, and you provide us with your information at your own risk.

Erikson uses administrative, technical, and physical safeguards designed to protect Personal Information. These safeguards may include access controls, secure transmission, vendor controls, monitoring, and other measures appropriate to the nature of the information and the relevant system.

13. Your Choices About the Information We Collect

Updating Your Personal Information

We prefer to keep your Personal Information accurate and up to date. If you would like to change your contact information, please contact us using the information in the Contact Us section below. We will make good faith efforts to make requested changes in our then active databases as soon as reasonably practicable (but we may retain prior information as educational or institutional records). Students may have rights under FERPA and Erikson’s FERPA policy to limit certain disclosures of directory information. Alumni may also have choices regarding publication of certain contact information in Erikson alumni directories or related community resources, where applicable. These choices are governed by the applicable directory, alumni, FERPA, or institutional policy.

Communications Preferences

You can opt out of receiving marketing emails or text messages from us at any time. You will still receive transactional messages from us. To manage your email preferences with us, please click on the Unsubscribe link in any email you receive from us or contact us using the information in the Contact Us section below. Your choice will not affect our ability to share information in the other ways described in this Policy.

To opt out of text messages from us, text “STOP” to the number which you received the text from, at any time. For more information on SMS and text messaging, please see our Terms.

Do Not Track Disclosure

Do Not Track (“DNT”) is a web browser setting that requests that a web application disable its tracking of an individual user. When you choose to turn on the DNT setting in your browser, your browser sends a special signal to websites, analytics companies, ad networks, plug in providers, and other web services you encounter while browsing to stop tracking your activity. Various third parties are developing or have developed signals or other mechanisms for the expression of consumer choice regarding the collection of information about an individual consumer’s online activities over time and across third-party websites or online services (e.g., browser do not track signals), but there is no universally agreed upon standard for what a company should do when it detects a DNT signal. Currently, we do not monitor or take any action with respect to these signals or other mechanisms. You can learn more about Do Not Track here.

Opt-Out Preference Signals

Some browsers and browser extensions support opt-out preference signals such as the Global Privacy Control (“GPC”) that can send a signal to the websites you visit indicating your choice to opt-out from certain types of data processing, including data sales. GPC is a web browser-level setting, maintained by either a browser or a browser extension, that a user or privacy-focused technology can set. In certain regions, when we detect such a signal, we will make reasonable efforts to respect your choices as required by applicable law.

Controlling Your Cookies

In some jurisdictions, you can opt-out of cookies by enabling an opt-out preference signal (“OOPS”) or Global Privacy Control (“GPC”) on your browser or opting-out of cookies in our Sites’ cookie preference centers. You may also make individual selections on your Device or browser. On most web browsers, you will find a “help” section on the toolbar. Please refer to this section for information on how to receive a notification when you are receiving a new cookie and how to turn cookies off. Please see the links below to learn how to modify your web browser’s settings on the most popular browsers:

Note that if you turn cookies off, you may be unable to access certain parts or benefit from the full functionality of the Sites. To learn more about cookies and similar technologies or to opt-out of targeted advertising cookies, visit resources from the Digital Advertising Alliance (“DAA”). We do not control these opt-out links or whether any organization chooses to participate in these opt-out programs.

Please note that even if you exercise the opt-out choices above, you may continue to receive advertisements, for example, ads based on the website you are viewing (e.g., contextually based ads), or ads that are not targeted at you and may be less relevant. Also, if your browser (like some Safari browsers) is configured to reject opt-out cookies when you opt out on the DAA website, your opt-out may not be effective. We always do our best to honor your choices, but because some choices are set at the browser or device level, you may have to make these choices multiple times if you use different browsers or different Devices.

Your Choices for Google Tools

Our Google Analytics Advertising tools may include remarketing, impression reporting, demographics and interest reporting, and cross-service integrations. Google offers several ways to control how your information is used for advertising.

Google Ads Settings – You can opt out of personalized ads from Google by adjusting your settings here.
Google Analytics Opt-Out Browser Add-On – You can block Google Analytics from accessing your online activity with a browser add-on here.
Direct-Level Advertising Settings – Many mobile devices allow you to limit the use of Advertising IDs (Android Ad ID or Apple IDFA). See your Device’s settings for more information.

With respect to these advertising features, Erikson is the sole controller under all applicable data protection legislation. We will not identify users or facilitate the merging of Personal Information with additional information collected through any Google advertising product or feature unless we have your affirmative opt-in consent to that identification or merger.

Your Choices for Meta (Facebook) Tools

If we use the Meta Pixel, Meta may use information about your activity on our Site to personalize ads you see on Facebook, Instagram, and other Meta services. You can control your ad preferences directly with Meta:

Meta Ad Preferences – You can view or change your Facebook Ad Preferences here.

Your Choices for LinkedIn Tools

If we use LinkedIn Tracking Technologies, you can control your ad preferences directly with LinkedIn:

LinkedIn Link to Advertising Data Settings– You can view or change your Advertising Data settings within LinkedIn here.

Your Choices for Microsoft (Bing Ads, UET Tag) Tools

If we use Microsoft Tracking Technologies, you can control your ad preferences directly with Microsoft:

Microsoft Link to Opt-Out of Targeted Advertising – You can view or change Microsoft Personalized ads and offers settings here.

14. Visitors to the Site Outside of the United States

Our Site is not intended for visitors outside of the United States and we do not direct our activities at users outside of the United States. If you are visiting the Site from a location outside of the U.S., your connection will be through and to servers located in the U.S. All information you receive from the Site will be created on servers located in the U.S., and all information you provide will be maintained on web servers and systems located within the U.S. The data protection laws in the United States may differ from those of the country in which you are located, and your information may be subject to access requests from governments, courts, or law enforcement in the United States according to laws of the United States. By using the Site or providing us with any information, you consent to the transfer to, and processing, usage, sharing and storage of your information in the United States and in other countries, as set forth in this Policy.

15. California Privacy Rights

This section of the Policy applies solely to California residents. We adopt this Section to comply with the California Consumer Privacy Act of 2018 (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”). Any terms defined in the CCPA or CPRA have the same meaning when used in this Section.

Erikson does not sell Personal Information for money. However, Erikson uses cookies, pixels, tags, local storage, analytics, advertising, social media, and similar technologies. Certain disclosures of identifiers, cookie identifiers, device or browser information, internet or network activity, general location information, or inferences to advertising, analytics, social media, or measurement partners may be considered a “share” of Personal Information for cross-context behavioral advertising under the CCPA. Erikson provides choices through its cookie preference tool and other methods described in this Privacy Policy.

Erikson does not sell or share education records subject to FERPA, financial-aid records, clinical or community-service records, children’s information, or Sensitive Personal Information for cross-context behavioral advertising.

Notice at Collection of Personal Information We Collect and Purposes For Use

We will collect Personal Information for the business and commercial purposes outlined below. The categories of Personal Information we intend to collect and the purposes for which we use each category are set forth in the table below. We do not collect additional categories of Personal Information or use the Personal Information we collect for materially different, unrelated, or incompatible purposes without providing notice at or before the time the information is collected.

Under the CCPA, “sell” means to disclose, make available, or otherwise communicate Personal Information to a third party for monetary or other valuable consideration. This may include certain disclosures made in connection with advertising or marketing relationships, depending on how the recipient uses the information. “Share” means to disclose Personal Information to a third party for cross-context behavioral advertising. We disclose Personal Information to our service providers and contractors for business purposes (such as analytics, security, support, or website hosting), which is not considered a sale or sharing under the CCPA when the recipient is contractually restricted from using the information for its own purposes. Under the CCPA, a “third party” is an entity that is not a service provider or contractor and that is not controlled by or controlling the business.

We will retain each category of Personal Information for the period reasonably necessary to fulfill the purposes described below, unless a longer retention period is required or permitted by law. Please see our “Retention of Personal Information” section above.

If we sell or share Personal Information or use or disclose Sensitive Personal Information (“SPI”), we indicate that in the table below.

Category of Personal Information	Business Purpose for Collection or Use	Sold/Shared?	Retention Period
Identifiers: such as name, alias, postal address, email address, phone number, account username, IP address, online identifier, cookie identifier, device identifier, or similar identifiers	Respond to inquiries, provide website, portals, forms, applications, programs, events, professional learning, community services, donor services, merchandise-shop functions, institutional communications; process applications, registrations, donations, payments and transactions; send marketing communications, support analytics, advertising; enforce agreements, personalization, advertising, analytics, improve services, comply with law, account management, security/fraud prevention	No/Yes, to the extent identifiers, cookie identifiers, device identifiers, or similar information are disclosed through advertising, analytics, social media, or measurement technologies for cross-context behavioral advertising.	Retained for the period reasonably necessary for the relationship, transaction, program, service, account, application, communication, or legal/institutional purpose for which the information was collected, and as required by applicable law or institutional record-retention policies
Customer Records / Personal Information described in Cal. Civ. Code § 1798.80(e): such as contact information, billing information, account credentials or information, payment-related information, signature, or other similar records	Administer applications, enrollment, student services, donor relations, payments, donations, merchandise transactions, financial aid, student accounts, employment processes, communications, enforce agreements, contracts, personalization, vendor relationships, advertising, analytics, improve services, profiling, comply with law, account management, processing transactions, security/fraud prevention, and institutional operations	No/No, except to the extent limited identifiers associated with online interactions are shared as described in the Identifiers or Internet/Network Activity categories	Retained as needed for the applicable transaction, account, relationship, legal, tax, audit, accreditation, financial-aid, student-record, employment, or institutional purpose
Protected Classifications: such as age, race, ethnicity, sex, marital status, gender, veteran’s status, disability status, citizenship, or similar demographic information, where collected	Support admissions, enrollment, reporting, financial aid, student services, research, employment, institutional analysis, communication, personalization, improve services, profiling, comply with law, legal obligations, account management, equity-related initiatives, accreditation, security/fraud prevention; provide employment benefits, and other institutional purposes, where applicable and permitted by law.	No/No	Retained in accordance with applicable legal, accreditation, financial-aid, employment, research, student-record, and institutional record-retention requirements
Commercial Payment, Donation, and Transactions Information: such as purchases, donations, payments, tuition or account payments, event registrations, merchandise purchases, order or transaction history, transaction status, and related records	To process, fulfill, administer, record, reconcile, and support donations, payments, registrations, tuition/account payments, merchandise transactions, refunds, receipts, tax/accounting records, donor relations, communication, enforce agreements, personalization, advertising, analytics, improve services, profiling, comply with law, account management, processing transactions, security/fraud prevention, and related institutional operations	No/No, except to the extent online transaction-related identifiers are shared through analytics or advertising technologies as described in other categories.	Retained as needed for transaction processing, tax, accounting, audit, donor, student account, legal, and institutional record-retention purposes
Biometric Information: such as genetic or biological characteristics, fingerprints, faceprints, voiceprints, or other biometric identifiers	Not collected through the general website unless separately disclosed in a specific program notice or consent.	No/No	Not collected
Internet or Network Activity: such as browsing history, search history, interaction with Erikson websites, pages viewed, referring/exit pages, clicks, cookie data, device/browser information, advertising identifiers where applicable, guest Wi-Fi or network usage information, interactions with emails or digital ads, or information regarding interaction with a website	Operate and secure the Site and network resources, improve services and user experience, remember preferences and personalization, analyze website, network, and campaign performance, advertising, analytics, support embedded content, measure engagement, security/fraud prevention, deliver or measure advertising and marketing, and comply with legal obligations	No/Yes, to the extent disclosed through advertising, analytics, social media, or measurement technologies for cross-context behavioral advertising	Retained according to cookie lifecycles, consent settings, analytics/ad platform settings, network/security requirements, and Erikson’s applicable retention policies, unless a longer period is required for security, legal, compliance, or institutional purposes
Geolocation Data: such as physical location and/or movements, general location inferred from IP address or browser/device information. Erikson does not collect precise GPS location through the general website unless a feature specifically requests it and the individual provides permission	Operate, secure, analyze and improve the Site and services, understand audience engagement; comply with legal obligations; and support advertising, analytics, security/fraud prevention activities where applicable	No/Yes, or general location or region-level information used in analytics or advertising technologies OR No/No for precise geolocation unless separately disclosed	Retained according to cookie lifecycles, analytics/ad platform settings, security requirements, and applicable institutional retention policies
Sensory Data: such as security camera footage, event recordings, webinar recordings, call recordings, or similar audiovisual information where applicable, or other audio, visual, thermal or similar activity	To support safety, security, facilities management, incident response, event administration, training, program delivery, accessibility, and institutional operations	No/No	Retained for the period reasonably necessary for the purpose collected, or as required by legal, security, insurance, contractual, program, or institutional requirement
Professional/Employment Information: such as current or past job history and evaluations, professional credentials, employment application information, resume/CV information, or professional-learning information	To administer employment applications, employment relationships, professional learning, events, institutional partnerships, vendor relationships, research, directories, communications, provide benefits, enforce agreements, comply with law, security/fraud prevention, and institutional operations	No/No	Retained as needed for employment, professional learning, program, contractual, legal, compliance, and institutional record-retention purposes
Education Information: such as admissions records, application materials, enrollment records, academic records, grades, transcripts, registration records, financial-aid records, student-account records, directory information, and related student-service records, school transcripts	To administer admissions, enrollment, academic programs, registration, grades, transcripts, records, financial aid, student accounts, student services, accreditation, reporting, research where applicable, and institutional operations, subject to FERPA and applicable institutional policies where applicable, enforce agreements, comply with law, security/fraud prevention	No/No	Retained in accordance with FERPA, Erikson’s student-record policies, accreditation requirements, financial-aid requirements, legal obligations, and institutional record-retention schedules
Inferences: such as interests in programs, events, professional learning offerings, research, philanthropy, website content, marketing audiences, or engagement patterns	Improve services and outreach, communication, personalization, profiling, understanding audience engagement, measure campaigns, support advertising or analytics where permitted by law	No/Yes, to the extent inferences or audience segments are used or disclosed for cross-context behavioral advertising	Retained as needed for marketing, analytics, institutional outreach, and applicable cookie/ad platform lifecycles, unless a longer period is required or permitted by law
Sensitive Personal Information: such as government identifiers like social security number, financial-aid information, account credentials, citizenship or immigration-related information, demographic information, information about children or families in specific programs, health-related or clinical information where applicable, precise geolocation (within 1850 sq ft) where applicable, or other information defined as sensitive under applicable law	To administer admissions, enrollment, financial aid, student services, employment, security, legal compliance, clinical/community services where applicable, research where applicable, and institutional operations. Erikson does not use Sensitive Personal Information for purposes that require a right to limit under the CCPA unless separately disclosed	No/No	Retained in accordance with applicable legal, FERPA, financial-aid, employment, clinical/community-service, research, tax, accreditation, security, and institutional record-retention requirements

Notice of California Privacy Rights

In addition to the rights set forth in the “Your Choices About the Information We Collect” section above, California residents have the following additional privacy rights:

Right to Know (Categories): To know the categories of Personal Information we collect, the categories of sources from which it is collected, the purposes for which we use it, whether we sell or share it, and the categories of third parties to whom we disclose it.
Right to Know (Retention): To know the length of time we intend to retain each category of Personal Information, or the criteria used to determine such period;
Right to Know (Specific Pieces): To access the specific pieces of Personal Information we have collected about you;
Right to Delete: To request deletion of the Personal Information you have provided to us, subject to certain exceptions;
Right to Correct: To request that we correct inaccurate Personal Information that we maintain about you;
Right to Opt-Out of Sale of Personal Information: To direct us not to sell your Personal Information;
Right to Opt-Out of Sharing: To direct us not to share your Personal Information for cross-contextual behavioral advertising;
Right to Know About Sensitive Personal Information: To know whether we collect Sensitive Personal Information (“SPI”), the categories of SPI, the purposes for which we use the SPI, and whether the SPI is sold or shared;
Right to Limit the Use and Disclosure of Sensitive Personal Information: To request that we limit our use and disclosure of your SPI to the purposes permitted by the CCPA; and
Right to Non-Discrimination: Not to receive discriminatory treatment for exercising any of your CCPA privacy rights.

Please note that if we collected information about you for a single one-time transaction and do not keep that information in the ordinary course of business, that information will not be retained for purposes of a request under this section. In addition, if we have de-identified or anonymized data about you, we are not required to re-identify or otherwise link your identity to that data if it is not otherwise maintained that way in our records.

Request to Know, Correct, or Delete

California residents have the right to request, under certain circumstances, that a business that collects Personal Information about them disclose the information listed below for the preceding 12 months:

The categories of Personal Information collected about you;
The categories of sources from which the Personal Information is collected;
The business or commercial purpose for collecting, disclosing, selling or sharing Personal Information;
The categories of third parties to whom the business discloses Personal Information for a business purpose;
The categories of Personal Information that we sold or shared;
The categories of third parties to whom we sold or shared Personal Information; and
The specific pieces of Personal Information collected, disclosed, or sold or shared about you.
Whether we collected Sensitive Personal Information about you and whether such information is sold or shared, subject to applicable exceptions.

You can also request that we correct or delete your Personal Information. There may be certain exceptions to our obligation to correct or delete your information such as if you have an existing account or transaction with us or if we have a legitimate business reason to keep your information.

Personal Information Collected Within Last Twelve (12) Months

We have collected, used and disclosed the following categories of Personal Information from consumers within the last twelve (12) months:

Category of Personal Information	Sources of Information	Business Purpose for Collection, Use or Disclosure	Categories of Service Providers or other Third Parties To Whom Information is Provided for a Business Purpose	Categories of Third Parties To Whom Information is Sold or Shared
Identifiers: such as name, alias, postal address email address, phone number, account username, IP address, online identifier, cookie identifier, device identifier, or similar identifiers	You, Automatically, your browser or device; cookies and tracking technologies; service providers; application, payment, donation, commerce, event, and communications platforms; institutional partners where applicable	To provide and administer websites, forms, portals, applications, programs, events, professional learning, donations, merchandise transactions, communications, marketing, analytics, security, compliance, and institutional operations.	Website hosting providers; cybersecurity vendors; analytics providers; cookie-consent providers; application/enrollment platforms; student information systems; payment processors; donation platforms; commerce platforms; event platforms; email/CRM/communications providers; marketing vendors; institutional service providers.	Advertising, analytics, social media, and measurement partners, to the extent identifiers, cookie IDs, device IDs, or similar data are shared for cross-context behavioral advertising
Customer Records / Personal Information described in Cal. Civ. Code § 1798.80(e): such as contact information, billing information, account credentials or information, payment-related information, signature, or other similar records	You, Automatically, payment processors; donation platforms; application/enrollment platforms; commerce platforms; institutional records; service providers	To administer applications, registrations, enrollment, student services, payments, donations, merchandise orders, contracts, accounts, employment processes, compliance, and institutional operations	Data processing vendors, payment processors, donation platforms; application/enrollment platforms; student/account systems; commerce platforms; cloud hosting providers; accounting/tax/audit vendors; IT/security vendors; institutional service providers such as website hosting, security vendors, or similar vendors	None, except limited online identifiers may be shared as described in the Identifiers or Internet/Network Activity categories
Protected Classifications: such as age, race, ethnicity, sex, marital status, gender, veteran’s status, disability status, citizenship, or similar demographic information, where collected	You, application materials; employment materials; institutional records; program forms; research or survey materials where applicable	Admissions, enrollment, financial aid, student services, employment, research, institutional reporting, accreditation, compliance, equity-related initiatives, and program administration where applicable, comply with law, security/fraud prevention; provide employee benefits	Student information systems; application/enrollment platforms; financial-aid service providers; research/evaluation platforms; employment/HR vendors; accreditation, regulatory, or reporting recipients where required or permitted	None
Commercial Payment, Donation, and Transaction Information: such as purchases, donations, payments, tuition or account payments, event registrations, merchandise purchases, order or transaction history, transaction status, and related records	You, payment processors; donation platforms; commerce platforms; event-registration platforms; student-account systems; application platforms	To process, fulfill, administer, reconcile, and support payments, donations, tuition/account payments, registrations, merchandise transactions, receipts, refunds, records, compliance, accounting, and institutional operations	Payment processors; donation platforms; commerce platforms; event-registration platforms; accounting/tax/audit vendors; student-account systems; IT/security vendors; institutional service providers	Payment processors; donation platforms; commerce platforms; event-registration platforms; accounting/tax/audit vendors; student-account systems; IT/security vendors; institutional service providers
Biometric Information: such as genetic or biological characteristics, fingerprints, faceprints, voiceprints, or other biometric identifiers	Not collected through the general website unless separately disclosed	Not collected through the general website unless separately disclosed	Not applicable unless separately disclosed	None; Not collected
Internet or Network Activity: such as browsing history, search history, interaction with Erikson websites, pages viewed, referring/exit pages, clicks, cookie data, device/browser information, advertising identifiers where applicable, guest Wi-Fi or network usage information, interactions with emails or digital ads, or information regarding interaction with a website	Automatically via your browser or device; cookies; pixels; tags; local storage; analytics tools; advertising tools; social media tools; video/embedded-content tools; security tools; guest Wi-Fi or network systems where applicable	To operate, secure, analyze, and improve the Site and network resources; remember preferences; support embedded content; measure campaigns; understand engagement; deliver or measure advertising; detect fraud or abuse; comply with legal obligations; enforce network and acceptable-use policies	Website hosting providers; cybersecurity vendors; cookie-consent providers; analytics providers; advertising providers; social media providers; video/embedded content providers; network vendors; IT/security vendors; institutional service providers	Advertising, analytics, social media, and measurement partners, to the extent the information is shared for cross-context behavioral advertising
Geolocation Data: such as physical location and/or movements, general location inferred from IP address or browser/device information. Erikson does not collect precise GPS location through the general website unless a feature specifically requests it and the individual provides permission	Automatically, if provided via Device, browser or device information; IP address; cookies or analytics/ad technologies; information you provide	To understand general audience location, operate and secure the Site, improve outreach, measure campaigns, prevent fraud, and comply with legal obligations	Website hosting providers; cybersecurity vendors; analytics providers; advertising/measurement vendors; cookie-consent providers; IT service providers	Analytics, measurement and advertising vendors/partners to the extent general location information is used for cross-context behavioral advertising
Sensory Data: such as security camera footage, event recordings, webinar recordings, call recordings, or similar audiovisual information where applicable, or other audio, visual, thermal or similar activity	Security systems; event/webinar platforms; communications systems; recordings where applicable; information you provide or generate through participation	Safety, security, facilities management, incident response, event administration, training, program delivery, accessibility, compliance, and institutional operations	Security vendors; facilities vendors; event/webinar platforms; cloud hosting providers; IT vendors; legal/compliance advisors where necessary	None
Professional/Employment Information: such as current or past job history and evaluations, professional credentials, employment application information, resume/CV information, or professional-learning information	You, employers or institutional partners; job application platforms; professional learning registrations; resumes/CVs; references; public/professional sources where applicable	Employment applications, employment administration, professional learning, event participation; institutional partnerships; vendor management, communications, provide benefits, enforce agreements, comply with law, security/fraud prevention	HR/employment vendors; background-check vendors where applicable; professional learning platforms; event platforms; institutional systems; IT/cloud vendors; legal/compliance advisors	None
Education Information: such as admissions records, application materials, enrollment records, academic records, grades, transcripts, registration records, financial-aid records, student-account records, directory information, and related student-service records, school transcripts	You, Third Parties	Admissions, enrollment, academic administration, registration, grades, transcripts, financial aid, student accounts, student services, accreditation, compliance, research where applicable, reporting, provide benefits, enforce agreements, comply with law, security/fraud prevention, and institutional operations	School officials; application/enrollment platforms; student information systems; financial-aid processors; learning management systems; transcript/records vendors; accreditation/regulatory bodies; research/evaluation partners where applicable; IT/cloud vendors	None
Inferences: such as interests in programs, events, professional learning offerings, research, philanthropy, website content, marketing audiences, or engagement patterns	You, Automatically collected data; website interactions, marketing and communications engagement, application or inquiry interactions, cookie/AdTech data, Third Parties	To understand interests in programs, events, professional learning, research, philanthropy, or content; improve outreach; personalize communications; measure campaigns; support analytics and advertising where permitted by law	Analytics vendors; advertising/measurement vendors, email/CRM vendors, website and marketing service providers, security vendors, payment processing vendors, institutional service providers	Advertising, analytics, social media, and measurement partners, to the extent inferences or audience segments are shared for cross-context behavioral advertising
Sensitive Personal Information: such as government identifiers like social security number, financial-aid information, account credentials, citizenship or immigration-related information, demographic information, information about children or families in specific programs, health-related or clinical information where applicable, precise geolocation (within 1850 sq ft) where applicable, or other information defined as sensitive under applicable law	You, application materials, financial-aid materials, employment materials, program forms, research or clinical/community-service records where applicable, institutional systems	Admissions, enrollment, financial aid, student services, employment, clinical/community services where applicable, research where applicable, safety/security, legal compliance, accreditation, reporting, and institutional operations	Financial-aid processors; student information systems; application/enrollment platforms; employment/HR vendors; clinical/community-service vendors where applicable; research platforms/IRBs where applicable; legal/compliance advisors; IT/security/cloud vendors	None

Information related to how long we retain each category of Personal Information is included in the Retention of Personal Information section above.

Do Not Sell or Share My Personal Information

As a California resident, you also have the right, at any time, to tell us not to sell Personal Information – this is called the “right to opt-out” of the sale of Personal Information. Erikson does not sell Personal Information for money. Erikson may share certain identifiers, cookie identifiers, device/browser information, internet or network activity, general location information, and inferences with advertising, analytics, social media, and measurement partners for cross-context behavioral advertising. California residents may opt out of such sharing through Erikson’s cookie preference tool, applicable opt-out links, Global Privacy Control where required, or by contacting Erikson using the information in the Contact Us section. For more information about the specific cookies and similar technologies used on the Site, please review Erikson’s Cookie Policy and cookie preference tool. Cookie providers and categories may change over time.

Right to Limit Use of Sensitive Personal Information

California residents have the right to limit the use of each type of Sensitive Personal Information for each purpose with each type of third-party partner. Erikson does not use or disclose Sensitive Personal Information for purposes that require a right to limit under the CCPA unless separately disclosed. Erikson uses Sensitive Personal Information only for purposes permitted by law, such as providing requested services, administering education records, financial aid, employment, security, compliance, clinical/community services where applicable, research where applicable, and institutional operations.

Right Not to Be Discriminated Against

We will not discriminate against you for exercising any of your rights under the CCPA. Unless permitted by California law, we will not:

Deny you goods or services.

Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

Provide you a different level or quality of goods or services.

Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Verification and Authorized Agents

Erikson may need to verify your identity before processing certain California privacy requests. Depending on the request, Erikson may ask you to provide information sufficient to confirm your identity and your relationship with Erikson. If you submit a request through an authorized agent, Erikson may require proof that the agent is authorized to act on your behalf and may also require you to verify your identity directly with Erikson, unless an exception applies.

Notice of Financial Incentives

We do not offer financial incentives, price or service differences, or loyalty programs in exchange for the collection, sale, sharing, or retention of your Personal Information. If we offer such a program in the future, we will provide the required notice and obtain your opt-in consent where required by the CCPA.

Third Party Marketing (“Shine The Light” law)

We do not currently disclose Personal Information protected under this section to third parties for their own direct marketing purposes.

Exercising Your California Privacy Rights

You or your authorized agent may make a request to access, correct, delete, opt-out of the sale of your Personal Information, or limit the use of your Sensitive Personal Information by contacting us as follows:

Webform

Email Address: [email protected]

Telephone Number: (312) 755-2250

If you use an authorized agent to submit your request, we may require proof of the written authorization you have given. We also may require you to confirm your identity and your residency to obtain the information, and you are only entitled to make this request twice in a 12-month period. For emails, please include “California Privacy Rights” as the subject line. You must include your full name, email address, and attest to the fact that you are a California resident. We will acknowledge your request within 10 days and respond to your request within 45 days or let you know if we need additional time. If you make this request by telephone, we may also ask you to provide the request in writing so that we may verify your identity. If we are unable to honor your request for any reason, we will notify you of the reason within the request time period.

16. Your Privacy Rights under Other US State Laws

If you live in certain other U.S. states, such as Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have rights under applicable privacy laws. These rights are in addition to those rights set forth in the “Your Choices About the Information We Collect” section above.

Based on the applicable law in the state where you live, you may have the following rights with respect to your Personal Information:

To confirm whether or not a controller is processing your Personal Data and to access such Personal Data;

To know the categories of Personal Information we collect about you, the purposes for the collection, how long we retain your Personal Information, and whether that information is sold or shared or disclosed and to whom;

To correct inaccuracies in your Personal Data;

To delete your Personal Data;

To obtain a copy of your Personal Data that you previously provided to us in a portable, and if technically feasible, readily usable format, if processing is carried out by automated means;

To opt out of the processing of your Personal Data for purposes of (i) targeted advertising, (ii) the sale of Personal Data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer;

For Minnesota and Oregon residents, you have the right to request a list of the specific third parties to whom we have disclosed your personal data.

For Nevada residents, you have the right to request certain information from us regarding the collection and sale of your personal information during your visit to our websites or when you otherwise interact with us online. If you have sought or acquired, by purchase or lease, any goods or services for personal, family, or household purposes from us, you may ask us to disclose whether we have sold for monetary consideration certain information about you. You may also request to opt out of us sharing such information about you.

For Texas residents, you have the right to learn whether we sell your biometric data or other sensitive personal information to third parties.  We do not collect or sell this information to third parties.

Not to discriminate against you because you have exercised any of these rights, including by:

denying you Services;

charging different prices or rates for our Services, including through the use of discounts or other benefits or imposing penalties;

providing you a different level or quality of Services; and/or

suggesting that you will receive a different price or rate for Services, or at a different level or quality of Services.

To exercise any of these rights, you may make a request to confirm, access, correct, delete, obtain a copy, or opt-out of the processing of your Personal Data for targeted advertising, sale, or profiling by contacting us using the information in the Contact Us section below. Please include your state of residence.

We may require you to confirm your identity and your residency in order to obtain the information, and you are only entitled to make this request up to twice annually. For emails, please include “Privacy Rights” as the subject line. You must include your full name, email address, and attest to the state in which you are a resident.

We will process your request within 45 days or let you know if we need additional time or cannot process your request. If you make this request by telephone, we may also ask you to provide the request in writing so that we may verify your identity. If we are unable to honor your request for any reason, we will notify you of the reason within the request time period.

Right to Opt Out

You may have the right to opt out of the processing of your Personal Data for purposes of (i) targeted advertising, (ii) the sale of Personal Data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. To exercise your right, please use our cookie tools, if available to you, or use the information in the Contact Us section of this Policy to submit a request.

Appeals of Our Decisions

In some jurisdictions, you may appeal to us if we refuse to take action on your exercise of certain choices described above. In order to appeal such a refusal, please contact us using the information in the Contact Us section below with the subject line “Appeal of Refusal to Take Action on Privacy Request” and provide the relevant information in the email.

If we decline to take action on any request you make, we will provide you with the information required by the applicable law where you live. This may include an explanation of why we declined your request, information on how to appeal our decision, and/or how to make a complaint to your state Attorney General.

17. Your Rights Under the General Data Protection Regulation

This section of the Policy applies if you are a data subject who resides or is located in the European Economic Area (“EEA”). We adopt this section to comply with European privacy laws, including the General Data Protection Regulation (“GDPR”). Any terms defined in the GDPR have the same meaning when used in this section.

Under applicable law, we are considered the “data controller” of the Personal Information we handle under this Policy. In other words, we are responsible for deciding how to collect, use and disclose this information, subject to applicable law.

We have listed below the rights that you may be able to exercise in respect of the processing of your Personal Information, subject to applicable law. We take reasonable steps to ensure that the Personal Information that we process is limited to the Personal Information that are required in connection with the purposes set out in this Policy.

If you are a resident of or located within the EEA, you have certain data protection rights. These rights include:

The right to access, update or delete the information we have collected from you.

The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.

The right of erasure. You have the right to request deletion of your Personal Information, with certain exceptions.

The right to object. You have the right to object to our processing of your Personal Information.

The right of restriction. You have the right to request that we restrict the processing of your Personal Information.

The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable, and commonly used format.

The right to withdraw consent. You also have the right to withdraw your consent at any time where we relied on your consent to process your Personal Information.

The right not to be subject to automated decision-making, including profiling, that produces legal or similarly significant effects.

Legal Basis for Processing Personal Information

We rely on the following legal bases for processing your Personal Information:

Contract: To conclude or perform a contract with you; for example:

To manage applications, student data, facilitate student needs, and to provide other Services;

To manage our accounts and records;

To handle your inquiries and requests;

When you apply for employment through our Site, including third-party vendors, processing of your contact details and data about your employment history and education (as needed to evaluate your job application, to conduct job interviews, and as is otherwise needed for recruitment) is necessary to respond to your request to process your application for employment. If you do not provide this data, we will not be able to process the application that you send through our Site.

Legitimate Interests: When we process your Personal Information for our legitimate interests, we make sure to consider and balance any potential impact on you and your rights under data protection laws. Our legitimate business interests do not automatically override your interests – we will not use your Personal Information for activities where our interests are overridden by the impact on you unless we have your consent or those activities are otherwise required or permitted to by law. You have the right to object to processing that is based on our legitimate interests, as further described below. Examples of legitimate interests include:

For IT security, logging, and access monitoring;

To detect, prevent, or investigate security breaches or fraud;

To prevent unauthorized access;

To respond to your customer service inquiries and requests for information;

To maintain, improve, and analyze our Site and Services we offer;

For our strictly necessary cookies;

To conduct marketing activities; and

To facilitate the functionality of our Site.

Legal Compliance: To comply with our legal obligations; for example:

For anti-money laundering (AML) or know-your-customer (KYC) checks;

For sanctions screening;

For fraud detection;

To maintain appropriate records for internal administrative purposes and as required by applicable law or agency regulations,

For required reporting, such as tax, accounting or financial reporting obligations;

To respond to legal process or defend ourselves in legal proceedings;

To provide important notices as required by law.

To maintain appropriate records for internal administrative purposes and as required by applicable law, and

To provide important notices required by law, if applicable.

Consent: We rely on consent when we process your Personal Information for purposes that are not necessary for providing our Services, for fulfilling our legal or regulatory obligations, or for pursuing our legitimate business interests. These include:

Sending marketing communications, including newsletters, educational content and information about events or services that may be of interest to you;

Using non-essential cookies and tracking technologies, such as for analytics, advertising, cross-site tracking, retargeting and behavioral profiling;

Collecting optional information in surveys, webinars, beta programs, or promotional events;

Enabling certain personalization features that are not required for delivering our Services;

Sharing your Personal Information with third parties for their own marketing purposes (only when you have provided express consent).

You have the right to withdraw your consent at any time without affecting the lawfulness of any processing that occurred before withdrawal.

International Transfers

Your Personal Information may be transferred to and processed in countries outside the EEA (like the United States) that may not have the same data protection laws. Where required, we use Standard Contractual Clauses (SCCs) approved by the European Commission; and additional safeguards, where necessary.

How to Exercise Your Rights Under the GDPR

If applicable, you may exercise any of your rights under the GDPR by submitting a verifiable data subject request to us by using the contact details below. You may make a request related to your Personal Information or on behalf of someone for which you have authorization. You must include your full name, email address, and attest to the fact that you are a citizen or resident of the EEA by including your country of citizenship or residence in your request. We may require you to confirm your identity and/or legal standing for the request as well as your residency in the EEA to obtain the information. We will respond to your request within 30 days or let you know if we need additional time.

Please note that we will ask you to verify your identity before responding to such requests, and we may deny your request if we are unable to verify your identity or authority to make the request.

Should you wish to raise a concern about our use of your data (and without prejudice to any other rights you may have), you have the right to do so with your local supervisory authority- a list of authorities is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en; however, we hope that we can assist with any queries or concerns you may have about our use of your Personal Information first by contacting us.

18. Your Rights Under the UK GDPR

This section applies only to individuals located in the United Kingdom at the time their Personal Information is collected or processed. It supplements, and should be read together with, the rest of this Policy.

We process Personal Information as a “controller” under the UK GDPR and the UK Data Protection Act 2018 based on the same legal bases described in the GDPR section above:

Contract

Legitimate Interests

Legal Obligation

Consent

Where UK law requires consent (particularly for marketing or non-essential cookies), we will request it separately and clearly.

Individuals in the UK have the following rights:

Right of access

Right to rectification

Right to erasure

Right to restrict processing

Right to data portability

Right to object

Right to withdraw consent

Rights relating to automated decision-making.

If we share your Personal Data within Erikson or with third parties located outside the United Kingdom, we take steps to ensure that appropriate safeguards are in place to guarantee the continued protection of your Personal Data, such as by entering into the UK International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission’s SCCs, adopted by the UK Government under section 119A of the Data Protection Act 2018, or another lawful transfer mechanism permitted under UK law.

You have the same data subject rights as those for the EU listed above, except that references to the “GDPR” should be read as references to the “UK GDPR” and complaints should be filed with the UK supervisory authority, the Information Commissioner’s Office at https://ico.org.uk/.

19. Your Canadian Privacy Rights

Canadian laws provide specific privacy rights to Canadian residents. If you are a resident of Canada, this section applies in addition to all other applicable rights and information contained in this Policy.

Where applicable, We follow applicable Canadian federal and provincial privacy laws (“Canadian Privacy Law”), including:

The Personal Information Protection and Electronic Documents Act (PIPEDA)

Alberta’s Personal Information Protection Act (Alberta PIPA)

British Columbia’s Personal Information Protection Act (BC PIPA)

Québec’s Act respecting the protection of Personal Information in the private sector (Québec Act).

Consent

In most cases, we rely on implied consent to collect, use, or disclose your Personal Information. In some circumstances, including those involving sensitive Personal Information, we obtain express consent. Where you have provided your consent to the collection, use, and transfer of your Personal Information (whether orally, in writing, or electronically), you may have the legal right to withdraw your consent under certain circumstances. In addition to the methods described above with respect to your privacy choices, you may withdraw your consent by submitting a request using the information in the Contact Us section below. Please note that if you withdraw your consent, We may not be able to provide you with a particular product or service. We will explain the impact to you at the time of your request to help you with your decision.

Use of Your Personal Information

We will not collect, use, or disclose Personal Information except for the identified purposes identified above (See When We Disclose Information section above), unless we have received additional consent or the processing is authorized without consent. Where we engage service providers who utilize the Personal Information we provide to them, those relationships are governed by a written agreement regarding the confidentiality of your information.

Marketing Communications

By opting into receiving (“CEMs”) (as defined by Canada’s Anti-Spam Legislation (“CASL”)), you confirm that you consent to receiving CEMs from us and our third-party partners. You may withdraw your consent at any time by clicking the unsubscribe link in the CEM or emailing us as follows, depending on the applicable brand:

Canadian Access and Challenge Rights

Canadian Privacy Law provides the right to receive information about the existence, use, and disclosure of your Personal Information and be provided access to that information. You may also challenge the accuracy and completeness of your Personal Information and have it amended as appropriate. Depending on the nature of the challenged information, amendment may involve correction, deletion, or addition of information.

Exercising Your Canadian Privacy Rights

If you have an account with Us, you may view and update your account information (as noted above) directly by logging into your account. To submit a request for access to information not contained within your account, or to challenge the accuracy or completeness of your Personal Information, you may also submit a written request using the information in the Contact Us section below. When submitting a request, We also may require you to confirm your identity and your residency to obtain the information. For emails, please include “Canadian Privacy Rights” as the subject line. You must include your full name, email address, and attest to the fact that you are a Canadian resident and provide your province of residence. We will begin processing your request once you have completed the verification process and will respond within the timeframe required by law.

If We cannot substantively respond to your request in a timely manner, We will notify you and state the reason for the delay. Under certain circumstances, We may not be able to fulfill your request, such as when doing so would interfere with Our regulatory or legal obligations, where We cannot verify your identity, or if your request involves disproportionate cost or effort. However, We will respond to your request within a reasonable time, as required by law, and provide an explanation.

Additional information about how to exercise your rights under Canadian Privacy Law can be found here:

Office of the Privacy Commissioner of Canada
Website
Phone: 1-800-282-1376

Office of the Information and Privacy Commissioner of Alberta
Website
Phone: 1-888-878-4044
Edmonton office: (780) 422-6860
Calgary office: (403) 297-2728

Office of the Information and Privacy Commissioner of British Columbia
Website
Vancouver: (604) 660-2421
Elsewhere in BC: (800) 663-7867

Commission d’acces a’ l’ information du Quebec
Website
Phone: 1-888-528-7741

20. Changes to This Privacy Policy

We may change this Privacy Policy at any time. We will post all changes to this Policy on this page and will indicate at the top of the page the modified policy’s effective date. We therefore encourage you to refer to this page on an ongoing basis so that you are aware of our current privacy policy. If required by the applicable law, we will notify you of the changes.

By continuing to use the Site or Services or providing us with information following such a replacement Policy being uploaded, you agree that you will be bound by the Privacy Policy as changed.

21. Contact Us

If you have any questions or suggestions regarding this Policy, please contact us as follows:

Erikson Institute
451 N. LaSalle Street
Chicago, IL 60654
Email: [email protected]
Contact number: (312) 755-2250