California Consumer Privacy Act Website Consumer Data Privacy Notice
This Data Privacy Notice describes how Zovio and its affiliated companies (“Zovio”) comply with the California Consumer Privacy Act of 2018 (“CCPA”), with respect to California residents (“consumers”).
The CCPA is a California law that is designed to give residents of that state additional rights in relation to the collection, processing and sharing of their personal information. The law applies to most for-profit businesses that collect and process personal information about California residents, even if the business doesn’t have its headquarters or other locations in California.
Zovio has put in place the following methods for California residents to exercise their rights under the CCPA. With respect to the right to opt-out, right to know/access, and right to request deletion, we have also included direct links in the relevant sections of this Data Privacy Notice (below) to exercise those rights.
For individuals with disabilities, and those who require language translations, please see the relevant sections of this Notice.
Personal Information Collection
The personal information that Zovio collects and processes about California residents is limited to those data elements that are relevant and proportionate for the particular purpose(s) of collection. They may include:
- Email address
- Phone number
- Mailing address
- User name and password (such as for certain restricted areas of our websites)
- Information to respond to your question(s)
- Website cookies and IP (Internet Protocol) address if your browser is set to allow cookies
- Website browsing information collected through Google Analytics if you visit our websites
- Information that you may post on our social media platforms or on other public platforms in relation to Zovio products, services or business
Please see our Website Privacy Statement at www.Zovio.com for additional information, as well as our Cookies Notice which is here.
Personal Information Uses
Zovio limits its use of personal information pertaining to California residents to the purposes for which the data is collected, such as to address your question or provide the services that are requested. We may also use the data for any surrounding legal, compliance or regulatory obligations. As also explained further in the opt-out section of this Notice, Zovio does not and will not ‘sell’ personal information of California residents (as that term is defined in the CCPA), or allow other organizations entrusted with your data (e.g., service providers) to do so.
Please see our Website Privacy Statement at www.Zovio.com for additional information.
Personal Information Sharing
We may share your personal information with (1) our affiliated companies, such as Tutorme and Ashford University; (2) other third-party ‘service providers’ assisting us with our business services; or (3) when we are required by law to make disclosures to other third-parties including, for example, government or law enforcement agencies, such as in relation to legal, compliance or regulatory obligations.
1. Cookies are small pieces of data sent from a website and stored on a user's web browser. When the user browses the same website in the future, the cookie notifies the website of the user's previous activity. Cookies do not harm your computer in any way, and some are automatically deleted after a certain period of time, such as six months. While cookies identify the IP address of the website visitor, they do not identify the visitor himself/herself. Please see Zovio’s Website Cookies Notice as well as additional information in our website privacy statement, which are accessible at www.Zovio.com.
2. Google Analytics is a web analytics service offered by Google that tracks and reports website traffic to website owners. It is used by more than one-third of all websites, so that the website operators can evaluate use of the site, make improvements, and offer content that is of interest to the visitors. The tool does not identify specific visitors but does capture IP addresses if the visitor sets their browser to permit cookies.
In terms of third-party disclosures, we may retain subcontractors (i.e. our own “Service Providers”) to assist with a variety of business activities such as our websites, data hosting, student education activities and services, IT security, and social media activities. Zovio evaluates those service providers in advance to ensure that they are capable of upholding a similar level of protection for the data and also requires them to enter into a written agreement confirming their understanding that they are expressly prohibited from using the personal information for any unrelated purposes or from selling the information.
To the extent that we entrust your personal information to our affiliated companies, those companies also fall within the scope of the CCPA for that data and are required to uphold a similar level of protection. As is the case with “Service Providers”, our affiliated companies may only use that information for authorized purposes, and are prohibited from ‘selling’ your information or sharing it with any other parties for unrelated purposes, including ‘selling’ the data.
In rare situations where Zovio may be required to entrust limited personal information of California residents to other third parties, such as regulatory or government agencies or law enforcement, we take reasonable steps to ensure that those parties recognize the confidential, non-public nature of the information and will protect it accordingly. In addition, most of those organizations are required to comply with other state and federal data privacy and security laws, which means that they also have a legal obligation to uphold appropriate protections for your information.
Please see our Website Privacy Statement at www.Zovio.com for additional information.
Use of Authorized Agents
In accordance with the CCPA, Zovio allows California residents to exercise their CCPA rights via an authorized agent. California consumers must recognize that in those situations, Zovio requires authentication/verification of the authorized agent as well as the individual about whom the data relates, and we may deny the request if we are unable to obtain appropriate authentication/verification at either level. The authentication/verification requirements adopted by Zovio vary by right, and take into consideration the potential risks to the individual of sharing their personal data with an unauthorized individual. Please see the specific rights (below), and general information about authentication/verification obligations associated with each of them.
Right to Opt-Out (Do Not Sell My Information)
As noted above, Zovio does not and will not “sell” personal information as that term is defined in the CCPA. As an added assurance, California residents may contact Zovio to request that they be added to a Do Not Sell Log, so that their data is not (inadvertently) subject to ‘sale’ on a go-forward basis. California residents can do so by emailing [email protected], or by exercising their opt-out right via one of the other options listed in the Contact Methods section of this Notice.
Zovio will confirm to the California resident (or authorized agent) as soon as feasibly possible, and no later than 15 days from the date that it received the request., that the California resident has been opted-out of the sale of his/her information held by Zovio, and added to the Do Not Sell My Information Log.
Right to Know/Access
In accordance with the CCPA requirements, California residents may contact Zovio to request information about the categories of, or specific types of, personal information that we hold about them as well as how the data was used, the categories of third parties with whom the data was shared, and the purpose(s) for the sharing of the information. They can do so by emailing [email protected] or by exercising that right via one of the other options identified in the Contact Methods section of this Notice.
In accordance with the CCPA, if Zovio is a “Service Provider” for the personal information at issue—i.e., it was entrusted with that personal information in connection with the services that it provides for educational organizations—then in accordance with the CCPA requirements for “Service Providers”, Zovio will inform the requestor that he/she must contact the organization providing the information to Zovio in order to make such a request. Zovio will fulfill such requests that are re-routed to it by the business/educational organization entrusting the personal information to it, in compliance with the CCPA, and will return the relevant response to that organization for providing to the requestor (California individual or his/her authorized agent).
In situations where Zovio is not a “Service Provider”, it will acknowledge a right to know/access within 10 days of receipt, and request appropriate verification information. California residents who exercise this right or use an authorized agent to do so are subject to comprehensive verification using a variety of authentication tools to minimize any risk to individuals of unauthorized sharing of their person information. Zovio can deny the request if it is unable to verify the requestor and/or his/her authorized agent, and if so, will inform the individual/authorized agent within 45 days of receipt of their request. Of course, Zovio can also deny the request if it does not hold any information about the individual which falls within the scope of the CCPA.
Properly verified California residents and/or their authorized agents are entitled to receive information about (or a copy of) Personal Information collected by Zovio within the last 12 months before their request was made. Zovio will endeavor to fulfill those requests within 45 days, but may require an additional period of time (up to a total of 90 days) if necessary. If so, it will inform the requestor about the delay and the reasons therefore within the 45-day period.
California residents are limited to two such requests to know/access their data in any 12-month period (whether directly or via an authorized agent).
Right to Request Deletion
With certain exceptions as described below, California residents have the right to request deletion of their personal information, and can make the request directly or via an authorized agent. They can do so by emailing [email protected] or by exercising that right via one of the other options identified in the Contact Methods section of this Notice.
In accordance with the CCPA, in situations where Zovio is a “Service Provider”, it will inform the requestor that he/she must send their request to the organization entrusting the personal information to Zovio. Zovio will honor any requests for deletion that are then re-routed by that organization, return the confirmation to that organization, and otherwise fulfill its CCPA responsibilities in relation to such a request.
Zovio is not obligated to delete the personal information if it must be retained for one of the following purposes:
- Complete a transaction for which the personal information was collected.
- Fulfill the terms of a written warranty or product recall conducted in accordance with federal law.
- Provide a good or service requested by the consumer (California resident), or reasonably anticipated within the context of a business’ ongoing business relationship with the consumer.
- Otherwise perform a contract between the business and the consumer.
- Detect security incidents.
- Protect against malicious, deceptive, fraudulent, or illegal activity or prosecute those responsible for that activity.
- Debug to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the businesses deletion of the information is likely to render impossible or seriously impair the achievement of such research, if the consumer has provided informed consent.
- Enable solely internal uses of the data that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.
- Comply with a legal obligation.
- Otherwise use the consumer’s personal information, internally, in a lawful manner that is compatible with the context in which the consumer provided the information.
In situations where Zovio is not a “Service Provider”, and receives a request for deletion from a California resident or authorized agent, it will acknowledge the request within 10 days of receipt, and will endeavor to fulfill the request within 45 days. If it becomes evident that Zovio is unable to delete all of the California resident’s data within the 45-day period, the company will inform the individual and/or the authorized agent within that period, and may take an additional 45-days to fulfill the request (i.e., a total of 90 days). Individuals who request deletion of their personal information or retain an authorized agent to do so on their behalf, will be subject to detailed verification in accordance with the CCPA requirements.
When Zovio processes a request for deletion from a California resident (which has been properly verified), it will delete the data from its systems in a secure and irreversible manner, such that the data cannot be restored. At the same time, in accordance with the CCPA, Zovio may refrain from deleting copies of information stored on back-up systems if it is unable to do so at the time that that it deletes the remaining personal information within the scope of the request. In those situations, Zovio will mark that data for future deletion when the deletion can take place. In addition, Zovio will not use that data for any unrelated purpose once it is marked for deletion.
To the extent that Zovio has entrusted any of the Personal Information of the California resident to a (downstream) service provider, it will also contact that service provider to process the deletion request and will confirm to the California resident (or his/her authorized agent, if applicable) that it has done so.
Rights of Minors
Zovio upholds the rights of California residents who are minors, including those that apply to minors who are under the age of 13 and those that apply to minors between the ages of 13 and 16. Zovio has also put in place practices to uphold the surrounding obligations to parents and legal guardians of those minors.
Parents and legal guardians who seek to exercise the CCPA rights of their children will also be subject to authentication so as to prevent the release of any information pertaining to a minor to an unauthorized individual.
Right to No Discrimination
In accordance with the CCPA, Zovio does not discriminate against individuals. Including those who choose to exercise their CCPA rights.
Rights of Individuals with Disabilities
Zovio provides certain types of assistance to individuals with disabilities to communicate effectively with us. If you require these services, please contact us at (866) 974-5700 x20050.
Questions or Concerns
California residents who have questions or who believe that Zovio has mismanaged their personal information or otherwise infringed their rights may contact us using the contact methods listed in this Notice.
For additional information about Zovio’s CCPA practices, please visit our website at www.Zovio.com or contact us via one of the options provided in the Contact Methods section of this Notice.
Updates to this Notice
Zovio will review its CCPA notices and practices on at least an annual basis, and may also make updates to this Notice at other intervals, such as in relation to new information issued by the California regulators or in connection with changes to its business activities. We encourage you to review this Notice periodically to be sure you are aware of those changes. Any changes will serve to enhance or strengthen the privacy and security protections that are in place for personal information of California residents, and not diminish them.
Issued: December 16, 2019
Copyright 2019. All rights reserved.