Privacy Notice for California Residents

Privacy Notice for California Residents

This notice supplements the information contained in our Privacy Statement (see http://www.fnu.edu/privacy-statement/) and applies solely to visitors, users, and others who reside in the State of California (“consumers” or “you”). We adopt this notice to comply with the California Consumer Privacy Act (“CCPA”) and other California privacy laws. Any terms defined in the CCPA have the same meaning when used in this notice. This notice does not apply to our privacy obligations under the Family Educational Rights and Privacy Act (“FERPA”) or other similar laws, and the requirements of FERPA supersede those of the CCPA.

The CCPA grants California residents certain rights and imposes restrictions on businesses, as set forth below, in connection with the collection, sale and use of information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (referred to in this Notice as “Personal Information”).

FNU Does Not Sell or Share Personal Information: The University does not sell or share Personal Information. The CCPA defines “sell,” “selling,” “sale,” or “sold,” as meaning selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.  The CCPA defines “share,” “shared,” or “sharing” as sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, which means the targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally interacts.

Verifiable Requests to Delete and Requests to Know: Subject to certain exceptions, California residents have the right to make the following requests, at no charge.

• Request to Delete: California residents have the right to request that we delete any of your Personal Information that we have collected and retained, and to direct our service provider(s) to delete your Personal Information, unless the Personal Information is necessary to:

• Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by the consumer, or reasonably anticipated by the consumer within the context of a business’ ongoing business relationship with the consumer, or otherwise perform a contract between the business and the consumer.
• Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes.
• Debug to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
• Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the business’ deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if the consumer has provided informed consent.
• To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business and compatible with the context in which the consumer provided the information.
• Comply with a legal obligation.

• Request to Correct:  California residents have the right to request a business that maintains inaccurate Personal Information about them to correct that inaccurate Personal Information, taking into account the nature of the Personal Information and the purposes of the processing of the Personal Information.  A request to correct will be denied if the contested Personal Information is more likely than not accurate based on the totality of the circumstances, or if the University has a good-faith, reasonable, and documented belief that a request to correct is fraudulent or abusive.

• Request to Know: California residents have the right to request and, subject to certain exemptions, receive a copy of the specific pieces of Personal Information that we have collected about them in the prior 12 months and to have this delivered, free of charge, either (a) by mail or (b) electronically in a portable and, to the extent technically feasible, readily useable format that allows the individual to transmit this information to another entity without hindrance. California residents also have the right to request that we provide them certain information about how we have handled their Personal Information in the prior 12 months, including the:
  • Categories of and specific Personal Information collected;
  • Categories of sources from which Personal Information is collected;
  • Business and/or commercial purposes for collecting, selling, or sharing their Personal Information;
  • Categories of third parties to whom we have disclosed their Personal Information;
  • Categories of Personal Information that we have disclosed or shared with a third party; and
  • Categories of third parties to/with whom the residents’ Personal Information has been sold or shared and the specific categories of Personal Information sold to or shared with each category of third party.
  • A request to know does not extend to any educational standardized assessment or educational assessment or a consumer’s specific responses to the educational standardized assessment or educational assessment where consumer access, possession or control would jeopardize the validity and reliability of that educational standardized assessment or educational assessment.

Submitting a Verifiable Request: To exercise your access, disclosure and deletion rights, you (or your authorized agent as described in the CCPA) must submit a verifiable request to us. Verifiable requests should be submitted to records@fnu.edu or by calling (888)-504-6368. We will respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require additional time (up to 90 days), we will inform you of the reason and extension period in writing. You are permitted to make two (2) disclosure requests in any 12-month period. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

Only you or a person that you authorized via a signed, written statement to act on your behalf may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child. When making a request, please:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative. When feasible, we will match this information to Personal Information we already maintain about you, but we may request additional verification information from your or your representative.
• Describe your request with sufficient details to allow us to properly understand, evaluate and respond to it.

FNU cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account or enroll with us. We will only use Personal Information provided in a verifiable consumer request to verify the requester’s identity or authority to make the request.

Minors: Our services and electronic systems are meant for adults. We do not knowingly collect personally identifiable information from children under 13. We currently do not sell any Personal Information, and will not sell the Personal Information of consumers we actually know are less than 16 years of age unless we receive affirmative authorization (the right to opt-in) from either the consumer, who is between 13 and 16 years old, or the parent or legal guardian of a consumer less than 13 years of age.

Information We Collect: Florida National University collects Personal Information, and has collected the following categories of Personal Information from consumers within the last twelve (12) months:

FNU will retain each category of Personal Information for the longer of the duration of its relationship with any individual or the period required by applicable law or accrediting agency requirements, except as otherwise provided in FNU’s applicable records retention policy.

Personal Information does not include:

• Publicly available information from governmental records.
• De-identified or aggregated consumer information that is de-identified or aggregated in accordance with applicable law.  We maintain and use any such information in de-identified/aggregated form and not to attempt to reidentify the information.
• Information excluded from the CCPA’s scope, like:
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
  • Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA) and the Driver’s Privacy Protection Act of 1994.

We obtain the categories of Personal Information listed above from the following categories of sources:

• Directly from our applicants and students. For example, from documents that our applicants and students provide to us related to the educational services and any other services they seek from us, including when applicants provide us contact or other information for the purpose of seeking information or services from us.
• Indirectly from our applicants and students or their agents. For example, through information we collect from third parties, including the U.S. Government and other educational institutions, concerning our applicants’ and students’ educational histories.
• Directly and indirectly from activity on our website. For example, from submissions through our website portals or website usage details collected automatically.
• From publicly available sources and from third parties that interact with us in connection with the services we provide. For example, from governmental agencies which assist in funding our students’ educational costs.

Use of Personal Information: FNU uses and/or discloses the Personal Information we collect, as listed above, for one or more of the following business purposes:

• To fulfill or meet the reason for which the information is provided. For example, if you provide information in an enrollment application or a financial aid application, we will use the information to make determinations about enrollment and the award of financial aid.
• For FNU’s operational purposes as reasonably necessary and proportionate to achieve the operational purpose for which the Personal Information was collected or processed or for another operational purpose that is compatible with the context in which the Personal Information was collected.
• To provide you with information about the educational and other services that you request from us.
• To provide you with email alerts, event registrations and other notices concerning our educational services, or events or news that may be of interest to you.
• To verify your identity when you access an electronic account or portal at FNU and when you submit a request for information.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and FNU, including for billing and collections.
• To improve our website and present its contents to you.
• For testing, research, analysis and product development.
• As necessary or appropriate to protect the rights, property or safety of us, our applicants and students, or others.
• To respond to governmental or law enforcement requests and as required by applicable law, court order or governmental regulations.
• As described to you when collecting your Personal Information or as otherwise set forth in the CCPA.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer some or all of our assets whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us is among the assets transferred.
• To communicate with you on issues relating to determining your eligibility for our services, maintaining or servicing your account, providing customer service, processing or fulfilling orders and transactions, verifying your information, processing payments, providing financial aid processing, providing advertising or marketing services (subject to limitations in the CCPA on cross-context behavioral advertising), providing analytic services, providing storage, collections activity, responding to your questions or inquiries or notifying you if you won a promotion. We will also use your information to send you information about your account or about our relationship.
• To provide you with information about current or new products and services or other ads.
• To help ensure security and integrity to the extent the use of the consumer’s Personal Information is reasonably necessary and proportionate for these purposes.

Categories of Third Parties: We may disclose your Personal Information for a business purpose to the following categories of third parties:

• Entities owned in whole or in part by us or our parent company and/or its shareholders, or any acquiring party following a sale or transfer some or all of our assets.
• Government agencies, regulators, accreditors, law enforcement and other authorities entitled to such Personal Information pursuant to law or regulation.
• Authorized distributors of our products and/or services.
• A third party with a legitimate educational interest, in accordance with FERPA or similar applicable laws, or a third party where you have provided consent.
• Service providers and contractors fulfilling a business purpose for us such as, but not limited to:
  • Professional advisers including, but not limited to, auditors, bankers, insurers, legal counsel and professional subject matter experts.
  • Learning management system providers and other software or electronic platform providers we have contracted with in connection with our delivery of educational and other services.
  • Organizations we contract with for articulation (e.g., transfer of credit agreements) and affiliation purposes (e.g., internship/externship agreements).
  • Organizations we contract with for employee benefit purposes.
  • Background check providers for job candidates and/or students.

Sensitive Personal Information:  Some of the categories described in the chart above may constitute “sensitive personal information,” defined in the CCPA as (1) personal information that reveals (A) a consumer’s social security, driver’s license, state identification card, or passport number; (B) a consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (C) a consumer’s precise geolocation; (D) a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership; (E) the contents of a consumer’s mail, email and text messages, unless the business is the intended recipient of the communication; (F) a consumer’s genetic data; and (2) (A) the processing of biometric information for the purpose of uniquely identifying a consumer; (B) personal information collected and analyzed concerning a consumer’s health; or (C) personal information collected and analyzed concerning a consumer’s sex life or sexual orientation, but excluding personal information that is publicly available (as defined in the CCPA).

The University uses sensitive personal information only to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, or for other purposes permitted by the CCPA, including to provide services (e.g., maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services); to prevent, detect, and investigate security incidents or resist malicious, deceptive, fraudulent, or illegal actions; or uses that do not have the purpose of inferring characteristics about a consumer.

Discrimination and Incentives: We do not discriminate against any person who chooses to exercise any of their rights under the CCPA. The CCPA prohibits discrimination against those who exercise their rights under the CCPA and imposes requirements on any financial incentives offered to California residents related to their Personal Information. A business may offer financial incentives for the collection, sale or deletion of California residents’ personal information, provided it is not unjust, unreasonable, coercive or usurious, and is made available in compliance with applicable transparency, informed consent, and opt-out requirements. California residents have the right to be notified of any financial incentives offers and their material terms and the right to opt-out of such incentives at any time, and may not be included in such incentives without their prior informed opt-in consent.

Any California resident with questions or concerns about this notice may contact records@fnu.edu or call (888)-504-6368.

Updates to this Notice: FNU will review its CCPA notices and practices on at least an annual basis and may also make updates to this Notice at other intervals, such as in relation to new information issued by California regulators or in connection with changes to its business activities. FNU reserves the right to amend this privacy notice at its discretion and at any time. We will give notice of updates to this privacy notice by posting a revised version on this webpage, and by notifying individual consumers directly if required by the CCPA.

Last Updated: July 1, 2023